Detecting Abnormal RDS Login Attempts with GuardDuty

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls.

Short answer

B Enable the Amazon RDS Protection feature in Amazon GuardDuty for the member accounts of the organization.

Question

An ecommerce company runs applications in AWS accounts that are part of an organization in AWS Organizations. The applications run on Amazon Aurora PostgreSQL databases across all the accounts. The company needs to prevent malicious activity and must identify abnormal failed and incomplete login attempts to the databases. Which solution will meet these requirements in the MOST operationally efficient way?
  1. Attach service control policies (SCPs) to the root of the organization to identity the failed login attempts.
  2. Enable the Amazon RDS Protection feature in Amazon GuardDuty for the member accounts of the organization. Correct Answer
  3. Publish the Aurora general logs to a log group in Amazon CloudWatch Logs. Export the log data to a central Amazon S3 bucket.
  4. Publish all the Aurora PostgreSQL database events in AWS CloudTrail to a central Amazon S3 bucket.

Key Takeaways

Amazon GuardDuty provides managed threat detection for RDS logins, whereas manual log parsing requires significantly more operational overhead.

This question addresses identifying abnormal database login attempts in an AWS Organization using Amazon GuardDuty's RDS Protection feature for operational efficiency.

Common mistake: Candidates often select CloudWatch Logs or CloudTrail because they involve data collection, but these options fail the 'operationally efficient' requirement compared to a managed security service.

Expert Analysis

Why the Answer Is Correct

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. The RDS Protection feature specifically profiles RDS and Aurora login activity, using machine learning to identify suspicious patterns such as brute force attacks or logins from unusual locations. Enabling this feature across member accounts via AWS Organizations is the most operationally efficient way to detect these threats without managing custom logic.

Why the Other Options Are Wrong

Service Control Policies (SCPs) are used to restrict permissions, not to monitor or log login attempts (Option A). Publishing Aurora general logs to CloudWatch and exporting to S3 (Option C) creates a heavy operational burden to parse logs manually for anomalies. Similarly, publishing database events to CloudTrail (Option D) captures API calls but does not inherently analyze login attempt patterns for malicious activity without additional complex processing.

Community Comment Notes

The community consensus strongly supports Option B. As user BillaRanga noted, SCPs are for permission boundaries, not monitoring. User Naveena_Devanga confirmed that GuardDuty is designed to protect against unauthorized behavior. User zinabu simply associated 'malicious activity' directly with GuardDuty, reflecting the core exam concept.

Official Reference

https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_rds.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question asks for the 'most operationally efficient' solution for security monitoring, prioritize managed services like GuardDuty over building custom logging and analysis pipelines with CloudWatch or Lambda.

Frequently Asked Questions

Why isn't CloudTrail sufficient for detecting login attempts?

CloudTrail logs API calls but does not analyze database-specific login patterns for anomalies like brute force attacks automatically.

Does GuardDuty cover Aurora PostgreSQL?

Yes, the RDS Protection feature extends to Amazon Aurora databases, monitoring both MySQL and PostgreSQL engine types.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. BillaRanga 👍 8 Answered B
    A -> SCPs are not for monitoring or logging B-> correct After you enable the RDS Protection feature, GuardDuty immediately starts monitoring RDS login activity from Aurora databases in your account. GuardDuty continuously monitors and profiles RDS login activity for suspicious activity, for example, unauthorized access to Aurora database in your account, from a previously unseen external actor.
  2. Naveena_Devanga 👍 4
    B is the correct answer. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your Amazon Web Services accounts, workloads, and data stored in Amazon S3.
  3. Scheldon 👍 2 Answered B
    AnswerB https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/CHAP_BestPractices.Security.html Amazon GuardDuty is a threat detection service that helps protect your accounts, containers, workloads, and the data within your AWS environment. Using machine learning (ML) models, and anomaly and threat detection capabilities, GuardDuty continuously monitors different log sources and runtime activity to identify and prioritize potential security risks and malicious activities in your environment. https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/guard-duty-rds-protection.html
  4. zinabu 👍 5
    malicious activity=gurd duty
  5. Andy_09 👍 4
    Option B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide