DAM agents can be deployed on the database host or positioned to inspect network traffic is correct because the primary deployment constraint for Database Activity Monitoring in cloud environments is how you will obtain visibility into database activity.

When you evaluate this factor you must consider whether you can install DAM agents on the database host or whether you need to capture traffic externally with a network positioned sensor or cloud traffic mirroring. Each approach has different requirements for access, privileges, and integration with managed database services so choose the method that matches your cloud provider and service model.

DAM agents on the host provide rich, session level visibility and can see decrypted activity when they run alongside the database. Network positioned sensors inspect traffic as it traverses the network so they require the ability to mirror or route traffic and they may be affected by TLS encryption. In many cloud managed database services you cannot install host agents and you must rely on network inspection or native audit streams.

Cloud Data Loss Prevention is not the right choice because DLP is a complementary control that focuses on content discovery and exfiltration prevention. It is useful for data governance but it does not address the deployment visibility choices that determine how DAM can collect activity data.

DAM must be installed only on database clients is incorrect because DAM deployment is not limited to clients. Agents can reside on the database host or sensors can be placed on the network so restricting deployment to clients would miss common and often required architectures.

DAM can replace encryption and tokenization is incorrect because DAM monitors and detects activity it does not provide confidentiality or data minimization. Encryption and tokenization protect data at rest and in transit and they remain necessary controls even when DAM is in place.

Full AWS Practitioner Certification Question