Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 217 discussion

A. SELECT client_ip, client_request FROM logs WHERE client_request LIKE ‘%/admin%’ AND server_status = ‘403’ client_ip: This field identifies the IP addresses that attempted to access the restricted content. client_request: This field shows the URLs that the IP addresses attempted to access. LIKE ‘%/admin%’: This condition filters the requests to those targeting the /admin URL path. server_status = ‘403’: This condition ensures that only failed access attempts (HTTP 403 Forbidden status) are included in the results. This query will help the security engineer identify both the IP addresses and the specific URLs they attempted to access, which is crucial for analyzing unauthorized access attempts.