Q72 — AWS SAA-C03 Ch.10

Question 72 of 100 | ← Chapter 10

Q672. An ecommerce company runs applications in AWS accounts that are part of an organization in AWS Organizations. The applications run on Amazon Aurora PostgreSQL databases across all the accounts.The company needs to prevent malicious activity and must identify abnormal failed and incomplete login attempts to the databases.Which solution will meet these requirements in the MOST operationally efficient way?

Correct Answer: B. Enable the Amazon RDS Protection feature in Amazon GuardDuty for the member accounts of the organization

Explanation

The solution that meets the requirements in the most operationally efficient way is: **B. Enable the Amazon RDS Protection feature in Amazon GuardDuty for the member accounts of the organization.** Here's why: * **Amazon GuardDuty is specifically designed for threat detection and security monitoring.** It continuously monitors your AWS environment for malicious activity, including abnormal login attempts to your databases.* **RDS Protection is a feature within GuardDuty that focuses on Amazon RDS instances.** It analyzes logs and events from your RDS instances to identify suspicious activity.* **Enabling RDS Protection for all member accounts in your organization provides a centralized and automated way to monitor your Aurora PostgreSQL databases.** This eliminates the need for manual log analysis and reduces operational overhead. **Why other options are less efficient:** * **A. Attach service control policies (SCPs) to the root of the organization to identify the failed login attempts.** SCPs are for controlling permissions and access, not for real-time threat detection.* **C. Publish the Aurora general logs to a log group in Amazon CloudWatch Logs. Export the log data to a central Amazon S3 bucket.** This approach requires manual log analysis and configuration, which is less efficient than using a dedicated security service like GuardDuty.* **D. Publish all the Aurora PostgreSQL database events in AWS CloudTrail to a central Amazon S3 bucket.** CloudTrail is primarily for auditing and compliance purposes. While it can capture database events, it's not as efficient for real-time threat detection as GuardDuty. **In summary:** Enabling RDS Protection in Amazon GuardDuty is the most operationally efficient way to identify abnormal failed and incomplete login attempts to your Aurora PostgreSQL databases across your AWS organization. It provides a centralized, automated, and proactive approach to security monitoring.