Monitor RDS Database Activity for Suspicious Queries
A company uses Amazon RDS for MySQL and needs to monitor database activity for suspicious queries, such as unauthorized access attempts or SQL injection. The security team wants to centralize the logs from multiple RDS instances and analyze them in near real-time. Which solution should be implemented?
Quick Answer
The correct solution is to enable database audit logs on each RDS instance, stream them to Amazon CloudWatch Logs, and use CloudWatch Logs Insights to query the logs. This works because RDS for MySQL audit logs capture detailed SQL-level activity, including login attempts, query execution, and potential SQL injection patterns, which can be streamed in near real-time to CloudWatch Logs for centralized analysis using CloudWatch Logs Insights’ query language. On the AWS Certified Security Specialty SCS-C02 exam, this question tests your ability to distinguish between logging services: a common trap is confusing Enhanced Monitoring (which provides OS metrics like CPU/memory) with database audit logs, or selecting CloudTrail (API calls) or VPC Flow Logs (network traffic) instead. Remember the memory tip: “Audit logs for SQL, Enhanced for OS, CloudTrail for API, Flow for network”—this helps you quickly match the monitoring need to the correct AWS service.
⚠ Common exam trap
Many exam-takers confuse database-level audit logs (which capture SQL queries and authentication events) with infrastructure-level logs like Enhanced Monitoring or VPC Flow Logs, leading candidates to choose options that monitor performance or network traffic instead of actual database activity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable database audit logs on each RDS instance, stream them to Amazon CloudWatch Logs, and use CloudWatch Logs Insights to query the logs.
RDS for MySQL audit logs capture detailed database-level activity, including login attempts, query execution, and SQL injection patterns. Streaming these logs to CloudWatch Logs enables near real-time analysis using CloudWatch Logs Insights, which supports querying and alerting on suspicious queries across multiple RDS instances from a centralized location.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable RDS Enhanced Monitoring and stream the metrics to Amazon CloudWatch.
Why it's wrong here
Enhanced Monitoring provides OS-level metrics, not database queries.
- ✗
Enable VPC Flow Logs for the RDS instances and analyze the logs using Amazon Athena.
Why it's wrong here
Flow Logs capture network metadata, not SQL queries.
- ✗
Enable AWS CloudTrail for RDS API calls and use Amazon GuardDuty to analyze the logs.
Why it's wrong here
CloudTrail records API calls, not database queries.
- ✓
Enable database audit logs on each RDS instance, stream them to Amazon CloudWatch Logs, and use CloudWatch Logs Insights to query the logs.
Why this is correct
Audit logs capture SQL queries; CloudWatch Logs provides centralized storage and analysis.
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Amazon RDS for MySQL and wants to monitor database activity for security analysis. Which AWS service should be used to capture detailed database activity logs such as login attempts and query execution?
easy- A.AWS CloudTrail
- B.Amazon RDS Enhanced Monitoring
- C.AWS Config
- ✓ D.Amazon RDS Database Activity Streams
Why D: Amazon RDS Database Activity Streams is the correct service because it captures a near-real-time stream of database activity, including login attempts, query execution, and other operations at the database engine level. It integrates with AWS CloudWatch and third-party monitoring tools, providing granular audit logs for security analysis that go beyond what CloudTrail or Enhanced Monitoring offer.
Variation 2. A company uses Amazon RDS for MySQL and wants to monitor database activity for suspicious queries. The security team needs to capture all SQL statements executed against the database, including SELECT queries. Which AWS service should they use?
medium- ✓ A.Amazon RDS Enhanced Monitoring with database audit logs enabled and streamed to CloudWatch Logs.
- B.AWS CloudTrail with data events enabled for RDS.
- C.AWS Config with a custom rule to log database queries.
- D.VPC Flow Logs to capture database traffic.
Why A: Amazon RDS for MySQL supports native database audit logs that can capture all SQL statements, including SELECT queries, by enabling the `audit_log` plugin. These logs can be published to Amazon CloudWatch Logs for monitoring and alerting. Enhanced Monitoring provides OS-level metrics but does not capture SQL query content; the audit logs are the key mechanism for recording executed SQL statements.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.