DBS-C01 Database Security Practice Question
A company stores financial data in an Amazon Aurora MySQL DB cluster. The security team requires that database audit logs be stored in Amazon CloudWatch Logs and encrypted at rest using a customer-managed KMS key. The database specialist enables audit log publishing to CloudWatch Logs and specifies a KMS key for log encryption. However, the audit logs are not appearing in CloudWatch Logs. What is the most likely cause?
⚠ Common exam trap
Many exam-takers assume the issue is a missing log group or a static parameter, but the exam tests the nuanced requirement that the IAM role must have explicit KMS key permissions for log encryption to work.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IAM role used for publishing logs does not have the necessary permissions to use the KMS key for CloudWatch Logs.
When publishing database audit logs to CloudWatch Logs with a customer-managed KMS key, the IAM role used by RDS must have explicit permissions for the `kms:Encrypt` and `kms:Decrypt` actions on the KMS key. Without these permissions, RDS cannot encrypt the log stream, and the logs will not appear. Option C correctly identifies this missing permission as the most likely cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The CloudWatch Logs log group does not exist and RDS cannot create it automatically.
Why it's wrong here
RDS can create the log group automatically if the IAM role has sufficient permissions.
- ✗
The DB cluster is not configured to export error logs, only audit logs.
Why it's wrong here
The issue is about audit logs not appearing, not error logs.
- ✓
The IAM role used for publishing logs does not have the necessary permissions to use the KMS key for CloudWatch Logs.
Why this is correct
The IAM role must have kms:Encrypt permission on the KMS key to allow log delivery.
- ✗
CloudWatch Logs does not support encryption with customer-managed KMS keys for audit logs.
Why it's wrong here
CloudWatch Logs does support customer-managed KMS keys.
- ✗
The audit log parameter is static and requires a DB cluster reboot after modification.
Why it's wrong here
Some audit log parameters are dynamic and do not require reboot; but the issue is not about parameter modification.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.