The Security team for a finance company was notified of an internal security breach that happened 3 weeks ago. A Database Specialist must start producing audit logs out of the production Amazon Aurora

Question

Options

• AUse pg_audit to generate audit logs and send the logs to the Security team.
• BUse AWS CloudTrail to audit the DB cluster and the Security team will get data from Amazon S3.
• CSet up database activity streams and connect the data stream from Amazon Kinesis to consumer
• DTurn on verbose logging and set up a schedule for the logs to be dumped out for the Security

• A
  14% (5)
• B
  23% (8)
• C
  54% (19)
• D
  9% (3)

Explanation

Database Activity Streams for Real-Time Aurora Monitoring

Option C is correct because Amazon Aurora Database Activity Streams (DAS) natively pushes encrypted activity data directly to Amazon Kinesis Data Streams in near-real-time, allowing the Security team to consume and analyze data outside the Aurora cluster without impacting database performance - perfectly satisfying the requirements for real-time alerting, external monitoring, and encrypted file delivery.

Why the distractors are wrong:

• Option A (pg_audit): pg_audit generates audit logs within PostgreSQL, but it doesn't push encrypted data to an external system in real-time - it requires additional configuration to export logs and doesn't natively integrate with a streaming solution.
• Option B (CloudTrail): CloudTrail audits AWS API-level calls (management plane activity) to Aurora, not the actual SQL database activity or queries executed inside the cluster, making it insufficient for internal security breach investigation.
• Option D (verbose logging): Verbose logging captures general database events but is not designed for security auditing, requires manual scheduling to export, and lacks the real-time streaming capability and built-in encryption the question demands.

Memory Tip: Think "DAS = Direct Activity Streaming" - whenever a question mentions real-time, encrypted, external monitoring, and Aurora pushing data, Database Activity Streams → Kinesis is the go-to combination. The word "push" in the question is a strong signal pointing directly to streaming services.

No community discussion yet for this question.