DBS-C01 Database Security Practice Question
A company has a multi-AZ RDS for PostgreSQL DB instance. The security team wants to ensure that database audit logs are stored in CloudWatch Logs for real-time monitoring. The team enabled the 'pgaudit.log' parameter and set 'log_destination' to 'csvlog'. However, logs are not appearing in CloudWatch. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'rds.logs_to_cloudwatch' parameter is not set to 1.
RDS publishes logs to CloudWatch only if the 'rds.logs_to_cloudwatch' parameter is set to 1. Option A is wrong because multi-AZ does not prevent log delivery. Option B is wrong because CloudTrail is not involved in log delivery to CloudWatch; it's about API activity logging. Option C is wrong because the DB parameter group is associated; the issue is that the specific parameter 'rds.logs_to_cloudwatch' is not set.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DB instance is multi-AZ, which prevents log delivery to CloudWatch.
Why it's wrong here
Multi-AZ does not block log delivery.
- ✗
AWS CloudTrail is not enabled for the RDS instance.
Why it's wrong here
CloudTrail is not required for log delivery.
- ✗
The DB parameter group is not associated with the DB instance.
Why it's wrong here
If not associated, other parameters would not work; likely associated.
- ✓
The 'rds.logs_to_cloudwatch' parameter is not set to 1.
Why this is correct
This parameter must be enabled for logs to be published to CloudWatch.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using an RDS for MySQL DB instance encrypted at rest with AWS KMS. The security team requires that all access to the database be logged, including queries that fail due to authentication errors. Which configuration meets this requirement?
hard- ✓ A.Enable the RDS audit log by setting the 'audit_log_enabled' parameter to 1 in the DB parameter group and export logs to CloudWatch Logs.
- B.Enable RDS Enhanced Monitoring and publish metrics to CloudWatch.
- C.Enable AWS CloudTrail for the RDS instance and store logs in S3.
- D.Use S3 server access logs to capture database connection attempts.
Why A: RDS for MySQL supports audit logs that can capture authentication failures and queries. By setting the 'audit_log_enabled' parameter to 1 in the DB parameter group and exporting logs to CloudWatch Logs, you meet the requirement to log all access including failed authentication attempts. Option B is incorrect because Enhanced Monitoring provides OS-level metrics, not query logs. Option C is incorrect because AWS CloudTrail logs control plane API calls for RDS, not data plane activities like database queries. Option D is incorrect because S3 server access logs capture requests made to S3 buckets, not database connections.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.