🔥 40% Off Crucial Exams Memberships — This Week Only

2 days, 12 hours remaining!
Crucial Exams

ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Your security team centralizes VPC Flow Logs, AWS CloudTrail, and Application Load Balancer access logs in CloudWatch Logs. They must be alerted when an external actor repeatedly attempts invalid credentials against a public Amazon RDS instance, but only if similar activity is observed across more than one log source to reduce false positives. Which AWS-native approach best meets this event-correlation requirement while keeping custom development effort to a minimum?

  • Enable Amazon GuardDuty so findings such as RDS brute-force attacks are generated by correlating VPC Flow Logs, CloudTrail, and DNS activity.

  • Use an AWS Config managed rule to evaluate whether an RDS instance receives multiple failed connections from the same IP within five minutes.

  • Build an AWS Step Functions workflow that runs Athena queries across each log source and sends an SNS notification when all queries exceed thresholds.

  • Create a CloudWatch Logs metric filter that counts failed RDS login messages and triggers an alarm when a threshold is exceeded.

ISC2 Systems Security Certified Practitioner (SSCP)
Risk Identification, Monitoring and Analysis
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot