DBS-C01 Database Security Practice Question
A company is using Amazon RDS for Oracle and wants to integrate with AWS CloudTrail to log database API calls. Which action is necessary?
⚠ Common exam trap
Test-takers frequently confuse AWS-level API logging (CloudTrail) with database engine-level auditing (FGA, pgAudit), leading candidates to select database-specific auditing tools instead of the correct AWS service for logging control plane API calls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable CloudTrail for the RDS instance.
AWS CloudTrail is the service that logs API calls made to AWS services, including Amazon RDS. To capture database API calls (e.g., CreateDBInstance, ModifyDBInstance) for an RDS for Oracle instance, you must enable CloudTrail for the RDS instance by creating a trail that covers the RDS service. This logs management events at the AWS control plane level, not the database engine level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable CloudTrail for the RDS instance.
Why this is correct
CloudTrail already logs RDS API calls; no special setup needed.
- ✗
Create a VPC endpoint for CloudTrail.
Why it's wrong here
Unnecessary for logging RDS API calls.
- ✗
Configure Oracle Fine-Grained Auditing (FGA).
Why it's wrong here
FGA is for SQL audit, but the question asks for API calls; CloudTrail covers that.
- ✗
Install the pgAudit extension.
Why it's wrong here
pgAudit is for PostgreSQL, not Oracle.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.