A company is using Amazon RDS for PostgreSQL. The Security team wants all database connection requests to be logged and retained for 180 days. The RDS for PostgreSQL DB instance is currently using…

Question

Options

• AUpdate the log_connections parameter in the default parameter group
• BCreate a custom parameter group, update the log_connections parameter, and associate the
• CEnable publishing of database engine logs to Amazon CloudWatch Logs and set the event
• DEnable publishing of database engine logs to an Amazon S3 bucket and set the lifecycle policy to
• EConnect to the RDS PostgreSQL host and update the log_connections parameter in the

• A
  4% (1)
• B
  74% (20)
• D
  15% (4)
• E
  7% (2)

Explanation

Explanation

Why B and C are correct: RDS default parameter groups cannot be modified - you must create a custom parameter group, update log_connections = 1 within it, and then associate it with the DB instance (Option B). To meet the 180-day retention requirement, publishing logs to Amazon CloudWatch Logs is the appropriate mechanism, where you can set a log retention policy to exactly 180 days (Option C).

Why the distractors are wrong:

• Option A is incorrect because AWS does not allow modification of default parameter groups - changes require a custom group.
• Option D is incorrect because RDS does not natively publish engine logs directly to S3; CloudWatch Logs is the supported integration for RDS log publishing.
• Option E is incorrect because RDS is a managed service - you do not have operating system or host-level access to directly edit configuration files.

Memory Tip

Think "Customize, then CloudWatch" - on RDS, you always need a custom parameter group to change settings, and CloudWatch Logs is your go-to for log retention with configurable expiry periods. Any answer suggesting direct host access or default group modification should be an immediate red flag on the exam.

No community discussion yet for this question.