A database administrator at a company using a cloud-hosted relational database has begun running unusual bulk SELECT queries against customer tables late at night. Which control is designed to detect and alert on this activity independently of the administrator's own privileges?

Database activity monitoring captures and analyzes database activity, including queries by privileged users, and compares it against policies and behavioral baselines. It can alert on unusual patterns such as bulk reads of sensitive tables at unusual hours. Effective DAM is deployed so that the monitored administrators cannot disable it or alter its records, typically by collecting activity through an agent or network sensor and sending it to a separate system such as a SIEM that a different team controls. That separation of duties is what allows detection independently of the administrator's privileges. Transparent data encryption protects data on storage media and backups from someone who obtains the files, but the database decrypts data for any authorized session, so an administrator querying through the database sees plaintext and nothing is detected. A web application firewall inspects HTTP traffic to the application; an administrator connecting directly to the database bypasses the application tier entirely. Network security group rules restrict which addresses can connect, but the administrator is an authorized user connecting from a permitted location, and filtering does not inspect or log query content. Exam caveat: DAM is named in objective 4.6 alongside WAF, XML firewalls and API gateways. Operational check: confirm DAM covers privileged accounts, that alerts route to a team independent of database administration, and that the bulk-read policy fires in a test.