ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Database Activity Monitoring (DAM) tools sit between applications and the database (or tap the database audit stream) to capture, log, and analyze every query in real time. They can raise alerts on policy violations such as off-hours administrator access to sensitive tables, providing the detailed auditing required by regulations like PCI-DSS.

A Web Application Firewall focuses on HTTP traffic and blocks injection attacks but cannot see activity occurring inside the database once a query is accepted. An XML firewall validates and secures SOAP/XML messages and is irrelevant to a relational PCI workload. An API gateway secures REST/JSON APIs; it does not natively monitor low-level SQL traffic inside a managed database service. Therefore, DAM is the only option that fulfills the stated logging and alerting requirement without modifying the application.