DBS-C01 Database Security Practice Question
A company uses Amazon DynamoDB with AWS KMS-managed encryption at rest. The security team requires that all access to a particular DynamoDB table be logged for audit purposes. Which solution meets this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable CloudTrail data events for the DynamoDB table.
AWS CloudTrail logs all DynamoDB API calls, including data plane operations, when data events are enabled. Option A is wrong because VPC Flow Logs capture network traffic, not API calls. Option B is wrong because AWS Config records resource configuration changes, not API calls. Option D is wrong because Amazon GuardDuty is a threat detection service, not a logging service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable VPC Flow Logs for the VPC where the DynamoDB endpoint is accessed.
Why it's wrong here
VPC Flow Logs capture IP traffic, not API calls.
- ✗
Enable AWS Config rules for DynamoDB.
Why it's wrong here
AWS Config evaluates resource compliance, not API logging.
- ✓
Enable CloudTrail data events for the DynamoDB table.
Why this is correct
CloudTrail data events log DynamoDB data plane operations.
- ✗
Enable Amazon GuardDuty with DynamoDB protection.
Why it's wrong here
GuardDuty detects threats but does not log all API calls for auditing.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using Amazon DynamoDB with server-side encryption enabled. They need to ensure that all access to the table is audited. Which service should be used to capture data-plane API calls?
hard- A.VPC Flow Logs
- B.AWS Config
- C.Amazon CloudWatch Logs
- ✓ D.AWS CloudTrail
Why D: AWS CloudTrail, when configured to capture data events, can record DynamoDB data-plane API calls such as GetItem and PutItem. Option A (VPC Flow Logs) captures network traffic, not API calls. Option B (AWS Config) records configuration changes, not data-plane actions. Option C (Amazon CloudWatch Logs) can store logs but does not directly capture API calls; it would require another service to send logs to it.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.