DBS-C01 Database Security Practice Question
A company is using an RDS for MySQL DB instance encrypted at rest with AWS KMS. The security team requires that all access to the database be logged, including queries that fail due to authentication errors. Which configuration meets this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the RDS audit log by setting the 'audit_log_enabled' parameter to 1 in the DB parameter group and export logs to CloudWatch Logs.
RDS for MySQL supports audit logs that can capture authentication failures and queries. By setting the 'audit_log_enabled' parameter to 1 in the DB parameter group and exporting logs to CloudWatch Logs, you meet the requirement to log all access including failed authentication attempts. Option B is incorrect because Enhanced Monitoring provides OS-level metrics, not query logs. Option C is incorrect because AWS CloudTrail logs control plane API calls for RDS, not data plane activities like database queries. Option D is incorrect because S3 server access logs capture requests made to S3 buckets, not database connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable the RDS audit log by setting the 'audit_log_enabled' parameter to 1 in the DB parameter group and export logs to CloudWatch Logs.
Why this is correct
Audit logs capture authentication failures and queries; exporting to CloudWatch allows monitoring.
- ✗
Enable RDS Enhanced Monitoring and publish metrics to CloudWatch.
Why it's wrong here
Enhanced Monitoring provides OS-level metrics, not query logs.
- ✗
Enable AWS CloudTrail for the RDS instance and store logs in S3.
Why it's wrong here
CloudTrail logs API calls, not database queries.
- ✗
Use S3 server access logs to capture database connection attempts.
Why it's wrong here
S3 access logs only log requests to S3 buckets, not RDS connections.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a multi-AZ RDS for PostgreSQL DB instance. The security team wants to ensure that database audit logs are stored in CloudWatch Logs for real-time monitoring. The team enabled the 'pgaudit.log' parameter and set 'log_destination' to 'csvlog'. However, logs are not appearing in CloudWatch. What is the most likely cause?
hard- A.The DB instance is multi-AZ, which prevents log delivery to CloudWatch.
- B.AWS CloudTrail is not enabled for the RDS instance.
- C.The DB parameter group is not associated with the DB instance.
- ✓ D.The 'rds.logs_to_cloudwatch' parameter is not set to 1.
Why D: RDS publishes logs to CloudWatch only if the 'rds.logs_to_cloudwatch' parameter is set to 1. Option A is wrong because multi-AZ does not prevent log delivery. Option B is wrong because CloudTrail is not involved in log delivery to CloudWatch; it's about API activity logging. Option C is wrong because the DB parameter group is associated; the issue is that the specific parameter 'rds.logs_to_cloudwatch' is not set.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.