DBS-C01 Database Security Practice Question
A company uses Amazon DynamoDB and wants to audit access to a table. Which TWO services can be used together to log and monitor data plane operations? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon CloudWatch Logs
AWS CloudTrail (option C) can be configured to log data plane operations for DynamoDB, such as GetItem, PutItem, or Query. Amazon CloudWatch Logs (option A) can then be used to store, monitor, and alarm on these logs. Together they provide auditing of data plane access. Options B, D, and E are incorrect: S3 access logs only apply to S3, VPC Flow Logs capture network traffic, and AWS Config records configuration changes, not data operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Amazon CloudWatch Logs
Why this is correct
CloudWatch Logs can store and monitor CloudTrail logs.
- ✗
S3 access logs
Why it's wrong here
S3 access logs are for S3 buckets.
- ✓
AWS CloudTrail
Why this is correct
CloudTrail logs DynamoDB data events.
- ✗
VPC Flow Logs
Why it's wrong here
VPC Flow Logs capture network traffic, not API calls.
- ✗
AWS Config
Why it's wrong here
AWS Config tracks configuration changes, not API calls.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company needs to audit access to an Amazon DynamoDB table. The audit should capture which IAM user or role performed each action. Which AWS service should be used?
medium- A.VPC Flow Logs
- ✓ B.AWS CloudTrail
- C.Amazon GuardDuty
- D.AWS Config
Why B: AWS CloudTrail is the correct service because it records API calls made to DynamoDB and captures the IAM user or role that performed each action. VPC Flow Logs (Option A) capture network traffic metadata, not API calls. Amazon GuardDuty (Option C) is a threat detection service that monitors for malicious activity, not API auditing. AWS Config (Option D) tracks resource configuration changes, not API call details.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.