DBS-C01 Database Security Practice Question
A company is using Amazon DynamoDB with a TTL attribute to automatically delete expired items. The security team is concerned that deleted items might still be recoverable from backups. They need to ensure that once an item is deleted by TTL, it is not included in future on-demand backups. Additionally, they want to ensure that the TTL deletion itself is logged for audit purposes. What should they do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable DynamoDB Streams on the table and use a Lambda function to log TTL deletion events to CloudWatch Logs.
DynamoDB Streams can capture TTL deletions as 'REMOVE' events. By processing these events with a Lambda function and logging them to CloudWatch Logs, the security team can audit TTL deletions. On-demand backups reflect the current table state, so items deleted by TTL before the backup is taken will not be included. Option A is incorrect because disabling TTL and implementing a custom deletion process adds complexity and may not be as efficient. Option C is incorrect because CloudTrail logs the UpdateTimeToLive API call (control plane), not the actual TTL deletions (data plane). Option D is incorrect because CloudTrail data events for DynamoDB capture GetItem, PutItem, etc., but not TTL deletions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable TTL and implement a custom deletion process that logs deletions before removing items.
Why it's wrong here
This adds complexity; TTL is still needed.
- ✓
Enable DynamoDB Streams on the table and use a Lambda function to log TTL deletion events to CloudWatch Logs.
Why this is correct
Streams capture TTL deletions as REMOVE events.
- ✗
Use AWS CloudTrail to log the UpdateTimeToLive API call.
Why it's wrong here
That logs when TTL is configured, not when items are deleted.
- ✗
Enable AWS CloudTrail data events for DynamoDB to capture TTL deletions.
Why it's wrong here
CloudTrail data events do not capture TTL deletions.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.