A company has security requirements for Amazon Aurora MySQL databases regarding encryption, deletion protection, public access, and audit logging. The company needs continuous monitoring and…

Question

Options

• AUse AWS Audit Manager with a custom framework.
• BEnable AWS Config and use managed rules to monitor Aurora MySQL compliance.
• CUse AWS Security Hub configuration policies.
• DUse EventBridge and Lambda with custom metrics.

• A
  7% (4)
• B
  80% (47)
• C
  10% (6)
• D
  3% (2)

Explanation

AWS Config is the AWS service designed to continuously evaluate resource configurations against defined rules. According to the AWS Certified Security - Specialty Study Guide, AWS Config managed rules exist specifically to check database encryption, public accessibility, deletion protection, and log exports for Amazon RDS and Aurora. AWS Config provides a real-time compliance timeline and displays the compliance state of each resource against each rule at any point in time. This granular visibility is required to assess ongoing compliance with security policies. Audit Manager generates reports but does not provide continuous compliance monitoring. Security Hub aggregates findings but does not track configuration drift. EventBridge and Lambda introduce unnecessary complexity.

No community discussion yet for this question.