DBS-C01 Management and Operations Practice Question
A database administrator is responsible for managing an Amazon RDS for Oracle DB instance. The DBA needs to ensure that all changes to the DB instance's security group rules are logged for audit purposes. Which TWO services can be used together to achieve this? (Select TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail logs API calls made to the AWS account, including changes to security group rules (e.g., AuthorizeSecurityGroupIngress). By sending CloudTrail logs to Amazon CloudWatch Logs, you can create metrics filters and alarms to monitor and alert on specific API calls, enabling audit logging of security group rule changes. AWS Config tracks configuration changes but does not provide real-time log streaming to CloudWatch Logs for API calls. VPC Flow Logs capture network traffic, not API calls. Amazon Inspector is a vulnerability assessment service, not for logging API calls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon Inspector
Why it's wrong here
Inspector is for vulnerability assessment.
- ✗
AWS Config
Why it's wrong here
Config evaluates configuration rules but does not stream logs.
- ✓
AWS CloudTrail
Why this is correct
CloudTrail records API calls that modify security group rules.
- ✓
Amazon CloudWatch Logs
Why this is correct
CloudTrail logs can be streamed to CloudWatch Logs for monitoring.
- ✗
Amazon VPC Flow Logs
Why it's wrong here
Amazon VPC Flow Logs capture metadata about IP traffic to and from network interfaces, not the API-level changes to security group rules. The requirement is for auditing modifications to the security group configuration itself, which VPC Flow Logs cannot record because they operate at the network traffic layer, not the control plane. This option is tempting because VPC Flow Logs are commonly used for network auditing and monitoring, and in a scenario requiring visibility into actual traffic patterns or connectivity troubleshooting, they would be the correct choice.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.