DBS-C01 Database Security Practice Question
A company is using Amazon DynamoDB to store financial transactions. The security team requires that all access to the table be logged for auditing, and that any unauthorized access attempts trigger an immediate alert. The company has enabled AWS CloudTrail to log all DynamoDB API calls. However, the security team is concerned that CloudTrail logs may not capture all access patterns, such as queries that return no results. Which additional step should the company take to ensure comprehensive auditing and alerting?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a CloudWatch Logs metric filter on the CloudTrail log group to detect unauthorized access attempts and set up a CloudWatch alarm.
CloudWatch Logs can be used to monitor CloudTrail logs and trigger alerts on specific patterns like unauthorized access. CloudTrail logs all DynamoDB API calls, including queries that return no results. By creating a metric filter on the CloudTrail log group for unauthorized access patterns (e.g., AccessDenied exceptions) and setting a CloudWatch alarm, the company can get immediate alerts. Option A (Amazon Inspector) is for vulnerability assessment, not access logging. Option B (DAX) is a caching layer and does not log all read requests; it only caches and can be configured for logging, but it does not replace CloudTrail for auditing. Option D (VPC Flow Logs) captures network traffic, not API call details.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Amazon Inspector to assess the DynamoDB table for vulnerabilities.
Why it's wrong here
Amazon Inspector is for vulnerability assessment, not real-time access monitoring.
- ✗
Enable DynamoDB Accelerator (DAX) and configure it to log all read requests.
Why it's wrong here
DAX is a caching layer, not an auditing tool.
- ✓
Create a CloudWatch Logs metric filter on the CloudTrail log group to detect unauthorized access attempts and set up a CloudWatch alarm.
Why this is correct
CloudWatch Logs can analyze CloudTrail logs and trigger alarms based on patterns.
- ✗
Enable VPC Flow Logs on the subnet where DynamoDB endpoints are deployed.
Why it's wrong here
VPC Flow Logs capture IP traffic metadata, not DynamoDB API calls.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.