DBS-C01 Database Security Practice Question
A database administrator needs to audit all SQL statements executed on an Amazon Aurora MySQL DB cluster, including SELECT queries. Which AWS service should be used to capture and store these logs?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon RDS Database Activity Streams
Amazon RDS Database Activity Streams (Option A) is the correct service to capture and store audit logs of SQL statements, including SELECT queries, on an Aurora MySQL DB cluster. It streams database activity to Amazon CloudWatch Logs and Amazon Kinesis Data Streams for further analysis and storage. Option B (Amazon RDS Enhanced Monitoring) provides OS-level metrics, not SQL statements. Option C (Amazon CloudWatch Logs) can store logs but does not capture SQL statements directly; it requires a source like Database Activity Streams. Option D (Amazon RDS Performance Insights) monitors database performance, not SQL audit logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Amazon RDS Database Activity Streams
Why this is correct
Database Activity Streams captures database activity including SQL statements and sends to CloudWatch and Kinesis.
- ✗
Amazon RDS Enhanced Monitoring
Why it's wrong here
Enhanced Monitoring provides metrics on OS processes, not SQL queries.
- ✗
Amazon CloudWatch Logs
Why it's wrong here
CloudWatch Logs stores logs but does not capture database activity without a source like Activity Streams.
- ✗
Amazon RDS Performance Insights
Why it's wrong here
Performance Insights focuses on database performance, not auditing.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A database administrator needs to audit all SQL statements executed on an Amazon RDS for Oracle DB instance. The audit logs must be stored in Amazon S3 for long-term retention and analysis with Amazon Athena. Which solution meets these requirements?
medium- A.Enable Enhanced Monitoring on the RDS instance and publish logs to CloudWatch Logs.
- ✓ B.Configure Oracle's unified auditing and stream audit logs to CloudWatch Logs, then export to S3.
- C.Enable AWS CloudTrail to capture RDS API calls and store them in S3.
- D.Enable detailed billing reports and configure them to include database queries.
Why B: Oracle's unified auditing can be configured to stream audit logs to CloudWatch Logs, which can then be exported to Amazon S3 for long-term retention and analysis with Athena. Option A is incorrect because Enhanced Monitoring provides OS-level metrics, not SQL audit logs. Option C is incorrect because AWS CloudTrail captures API calls to RDS, not SQL statements executed within the database. Option D is incorrect because detailed billing reports do not include database query logs.
Variation 2. A database administrator needs to audit all SQL statements executed on an Amazon RDS for PostgreSQL DB instance. Which service should be used to capture and log the SQL statements?
easy- A.AWS CloudTrail
- B.AWS Config
- C.Amazon Inspector
- ✓ D.Amazon RDS for PostgreSQL database activity streams
Why D: Amazon RDS for PostgreSQL supports database activity streams, which can be integrated with services like Amazon CloudWatch and AWS CloudTrail to provide a near real-time stream of database activities. The other options do not capture SQL statements: CloudTrail records API calls to RDS, Config records resource configuration changes, and Inspector is for vulnerability assessment.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.