ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Creating a CloudWatch Logs subscription that invokes an AWS Lambda function lets the team inspect each log event as it is streamed out of the log group. The function can compare the source IP in each authentication-failure message against a maintained list of the scanner's published address ranges. If the IP is on the allowlist, the function simply discards the event; if it is not, the function formats the remaining events as AWS Security Finding Format (ASFF) data and pushes them to Security Hub by calling BatchImportFindings. This approach suppresses only the known benign noise while continuing to surface previously unseen attack sources.

Ignoring all FAILED_AUTH events at the metric-filter level (choice A) or disabling SSH logging entirely (choice C) would eliminate visibility into any new brute-force attempts. Using GuardDuty suppression rules (choice B) would hide findings generated by GuardDuty, not the CloudWatch-derived findings already burdening analysts, and would require shifting detection logic to a different service. Therefore, forwarding only non-allow-listed events through a Lambda-based subscription filter is the most effective and precise way to reduce noise without losing important security intelligence.