SCS-C03 · Question #125
A company has the following security policy for its Amazon Aurora MySQL databases for a single AWS account: - Database storage must be encrypted at rest. - Deletion protection must be enabled…
The correct answer is B. Enable AWS Config. Implement AWS Config managed rules that monitor all Aurora MySQL. AWS Config is a fully managed service that provides continuous monitoring and evaluation of AWS resource configurations against desired configuration baselines. According to the AWS Certified Security - Specialty Official Study Guide, AWS Config is the primary service used to…
Question
A company has the following security policy for its Amazon Aurora MySQL databases for a single AWS account:
- Database storage must be encrypted at rest.
- Deletion protection must be enabled.
- Databases must not be publicly accessible.
- Database audit logs must be published to Amazon CloudWatch Logs.
A security engineer must implement a solution that continuously monitors all Aurora MySQL resources for compliance with this policy. The solution must be able to display a database's compliance state for each part of the policy at any time. Which solution will meet these requirements?
Options
- AEnable AWS Audit Manager. Configure Audit Manager to use a custom framework that matches
- BEnable AWS Config. Implement AWS Config managed rules that monitor all Aurora MySQL
- CEnable AWS Security Hub. Create a configuration policy that includes the security requirements.
- DCreate an Amazon EventBridge rule that runs when an Aurora MySQL resource is created or
How the community answered
(15 responses)- B80% (12)
- C13% (2)
- D7% (1)
Explanation
AWS Config is a fully managed service that provides continuous monitoring and evaluation of AWS resource configurations against desired configuration baselines. According to the AWS Certified Security - Specialty Official Study Guide, AWS Config is the primary service used to track configuration changes, evaluate compliance in near real time, and display compliance states for individual AWS resources. AWS Config provides managed rules that directly map to the listed Aurora MySQL security requirements, including encryption at rest, public accessibility, deletion protection, and log exports to CloudWatch Logs. These managed rules continuously evaluate resources and mark them as compliant or noncompliant whenever a configuration change occurs. The AWS Config dashboard enables security engineers to view per-resource and per-rule compliance states at any point in time, satisfying the requirement to display compliance status for each part of the policy.
Topics
Community Discussion
No community discussion yet for this question.