DBS-C01 Database Security Practice Question
A company is using Amazon RDS for SQL Server with Multi-AZ deployment. The security team requires that all database activity be monitored for suspicious queries. The database specialist enabled RDS Database Activity Streams and configured AWS Lambda to process the stream. However, the Lambda function fails to process some events when the database fails over to the standby instance. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Lambda function does not re-establish the stream session after a failover event.
When a failover occurs, the RDS Database Activity Stream session is tied to the original primary instance. The Lambda function must re-establish the stream session to the new primary instance to continue processing events. If it does not, events during failover are lost. Option A is incorrect because the security group controls network access to the RDS endpoint, which remains the same after failover; connectivity is not the issue. Option C is incorrect because parameter group settings apply to both primary and standby instances; the activity stream setting is not parameter group-dependent. Option D is incorrect because the KMS key used for encryption is available in the same region; region unavailability is not a factor in Multi-AZ deployments within a single region.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group does not allow the Lambda function to connect to the new primary instance.
Why it's wrong here
The security group applies to the RDS endpoint, which remains the same after failover. Connectivity is not the issue.
- ✓
The Lambda function does not re-establish the stream session after a failover event.
Why this is correct
The Lambda function must re-establish the stream session after a failover. If it does not, events are lost.
- ✗
The parameter group for the standby instance does not have the activity stream enabled.
Why it's wrong here
The parameter group is applied to both instances; the activity stream setting is not a parameter group concern.
- ✗
The KMS key used to encrypt the activity stream is not available in the standby instance's Region.
Why it's wrong here
The KMS key is available in the same region; this is not a cause for event loss after failover.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.