DBS-C01 Database Security Practice Question
A database administrator needs to audit all SQL statements executed on an Amazon RDS for Oracle DB instance. The audit logs must be stored in Amazon S3 for long-term retention and analysis with Amazon Athena. Which solution meets these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Oracle's unified auditing and stream audit logs to CloudWatch Logs, then export to S3.
Oracle's unified auditing can be configured to stream audit logs to CloudWatch Logs, which can then be exported to Amazon S3 for long-term retention and analysis with Athena. Option A is incorrect because Enhanced Monitoring provides OS-level metrics, not SQL audit logs. Option C is incorrect because AWS CloudTrail captures API calls to RDS, not SQL statements executed within the database. Option D is incorrect because detailed billing reports do not include database query logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Enhanced Monitoring on the RDS instance and publish logs to CloudWatch Logs.
Why it's wrong here
Enhanced Monitoring captures OS-level metrics such as CPU and memory usage, not the text of SQL statements, so it cannot satisfy the requirement to audit all executed SQL. It is tempting because it integrates with CloudWatch Logs for monitoring, and would be correct if the goal were to track instance performance rather than query content.
- ✓
Configure Oracle's unified auditing and stream audit logs to CloudWatch Logs, then export to S3.
Why this is correct
Oracle's unified auditing can be configured to stream audit logs to CloudWatch Logs, which can then be exported to Amazon S3 for long-term retention and analysis with Athena.
- ✗
Enable AWS CloudTrail to capture RDS API calls and store them in S3.
Why it's wrong here
AWS CloudTrail captures API calls to RDS, not SQL statements executed within the database.
- ✗
Enable detailed billing reports and configure them to include database queries.
Why it's wrong here
Detailed billing reports do not include database query logs.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.