DBS-C01 Database Security Practice Question
A company is using an Amazon RDS for MySQL database and needs to audit all database login events. The audit logs must be stored in Amazon S3 for long-term retention. Which steps should be taken to accomplish this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the 'audit_log' plugin, publish logs to CloudWatch Logs, and create an export task to S3.
Amazon RDS for MySQL supports the audit_log plugin, which captures login events. These logs can be published to CloudWatch Logs, and then an export task can be created to move them to Amazon S3 for long-term retention. Option A is incorrect because RDS does not allow direct log file copying to S3 via manual methods. Option B is incorrect because CloudTrail data events for RDS capture API calls, not database-level login events. Option C is incorrect because RDS does not natively publish audit logs directly to an S3 bucket; they must go through CloudWatch Logs first.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable the 'general_log' parameter and set 'log_output' to 'FILE', then copy the log file to S3 manually.
Why it's wrong here
General log is not an audit log; manual copy is not scalable or automated.
- ✗
Enable CloudTrail data events for RDS to capture login events and store in S3.
Why it's wrong here
CloudTrail captures API calls, not database login events.
- ✗
Enable the 'audit_log' plugin and configure RDS to publish logs to an S3 bucket.
Why it's wrong here
RDS cannot publish logs directly to S3; logs must go through CloudWatch Logs.
- ✓
Enable the 'audit_log' plugin, publish logs to CloudWatch Logs, and create an export task to S3.
Why this is correct
This is the standard method to get audit logs into S3.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using Amazon RDS for MySQL. They want to audit all database logins and failed login attempts. Which option should they enable?
easy- A.Set the parameter log_queries_not_using_indexes = 'ON' in the DB parameter group.
- ✓ B.Set the parameter audit_log = 'ON' in the DB parameter group.
- C.Set the parameter general_log = 'ON' in the DB parameter group.
- D.Set the parameter slow_query_log = 'ON' in the DB parameter group.
Why B: Setting the parameter audit_log = 'ON' enables audit logging for MySQL, which logs connections and disconnections, including failed login attempts. Option A is wrong because log_queries_not_using_indexes logs queries that do not use indexes, not login attempts. Option C is wrong because general_log logs all queries, not just logins. Option D is wrong because slow_query_log logs only slow queries.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.