DBS-C01 pgAudit extension Practice Question
A database administrator needs to audit all SQL queries executed on an Amazon RDS for PostgreSQL instance, including SELECT statements. Which two most efficient ways to achieve this?
⚠ Common exam trap
Some candidates may think CloudTrail logs SQL queries, but it only records API actions. Others may overlook that exporting logs to CloudWatch alone does not capture query content unless statement logging is enabled in the parameter group.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Install the pgAudit extension and configure it to log all statements.
The pgAudit extension for PostgreSQL can be installed on RDS and configured to log all SQL statements, including SELECT queries. Option C is also correct because configuring the DB instance to export logs to Amazon CloudWatch Logs, when combined with enabling statement logging via the RDS parameter group (e.g., setting log_statement = 'all'), allows centralized log management and analysis, effectively auditing all queries. Option A is wrong because AWS CloudTrail does not capture SQL query content; it logs API actions on the RDS instance itself. Option D is wrong because Enhanced Monitoring provides OS-level metrics, not SQL query logs. Therefore, both B and C are correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable AWS CloudTrail for the RDS instance.
Why it's wrong here
Wrong. AWS CloudTrail logs API actions on the RDS instance (e.g., CreateDBInstance), not the SQL queries executed within the database.
- ✓
Install the pgAudit extension and configure it to log all statements.
Why this is correct
Correct. The pgAudit extension is the native way to log all SQL statements, including SELECTs, on PostgreSQL. It provides granular auditing.
- ✓
Configure the DB instance to export logs to Amazon CloudWatch Logs.
Why this is correct
Correct. While exporting logs to CloudWatch alone does not enable auditing, it is part of an efficient solution when combined with database statement logging configuration (e.g., setting log_statement='all' in the parameter group). This allows centralized log management and analysis.
- ✗
Enable Enhanced Monitoring for the DB instance.
Why it's wrong here
Wrong. Enhanced Monitoring provides OS-level performance metrics such as CPU and memory usage, not database query logs.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.