DBS-C01 Database Security Practice Question
A company runs a production Amazon DynamoDB table with on-demand capacity. The security team requires that all access to the table be logged for compliance. What is the most cost-effective way to log every DynamoDB API call?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable AWS CloudTrail and create a trail that delivers logs to Amazon CloudWatch Logs.
AWS CloudTrail logs all DynamoDB API calls (e.g., GetItem, PutItem, Query) and can deliver these logs to CloudWatch Logs for monitoring and compliance. Option A is incorrect because DynamoDB Streams capture data modifications (INSERT, MODIFY, DELETE), not the API calls themselves. Option B is incorrect because CloudWatch Logs is a destination for logs, not a service that captures API calls directly; it relies on CloudTrail or other sources to send logs. Option C is incorrect because VPC Flow Logs record network traffic metadata (IP addresses, ports), not API-level calls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable DynamoDB Streams on the table and process the stream with AWS Lambda.
Why it's wrong here
DynamoDB Streams capture data modifications (INSERT, MODIFY, DELETE), not the API calls themselves.
- ✗
Enable Amazon CloudWatch Logs to capture DynamoDB API calls.
Why it's wrong here
Amazon CloudWatch Logs is a destination for logs, not a service that captures API calls directly; it relies on CloudTrail or other sources to send logs.
- ✗
Enable VPC Flow Logs and analyze them with Amazon Athena.
Why it's wrong here
VPC Flow Logs record network traffic metadata (IP addresses, ports), not API-level calls.
- ✓
Enable AWS CloudTrail and create a trail that delivers logs to Amazon CloudWatch Logs.
Why this is correct
AWS CloudTrail logs all DynamoDB API calls (e.g., GetItem, PutItem, Query) and can deliver these logs to CloudWatch Logs for monitoring and compliance.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.