SAP-C02 Question 69
Single answerAn organization has recently migrated its workloads to AWS and wants to ensure compliance with industry standards and regulations. They need a solution that provides a centralized view of their AWS environment's security posture, performs automated security checks against AWS best practices and compliance frameworks, and integrates with other AWS security services. Which AWS service should they use?
- A
AWS CloudTrail
- B
AWS Identity and Access Management (IAM) Access Analyzer
- C
AWS Security Hub
- D
Amazon Inspector
Show answer and explanation
Correct answer: C
Explanation
AWS Security Hub is the correct choice because it provides a centralized view of your AWS environment's security posture, performs automated security checks against compliance standards, and integrates with other AWS security services such as AWS Config and Amazon GuardDuty. While other services like CloudTrail, IAM Access Analyzer, and Amazon Inspector are valuable for specific security tasks, they do not provide the comprehensive, centralized compliance and security management capabilities that Security Hub offers.
- A. Incorrect.
AWS CloudTrail provides a record of actions taken by a user, role, or AWS service in your account. While it improves auditability and helps in tracking changes, it does not provide centralized security posture management or compliance checks.
- B. Incorrect.
AWS IAM Access Analyzer helps identify resources in your account that are shared with an external entity by analyzing IAM policies. While it improves security, it does not provide a comprehensive view of your security posture or compliance checks.
- C. Correct.
AWS Security Hub provides a centralized view of your security posture across your AWS accounts. It performs automated security checks against AWS best practices and compliance frameworks and integrates with other AWS security services, making it the correct choice for this scenario.
- D. Incorrect.
Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. While it is useful for specific assessments (e.g., finding vulnerabilities in EC2 instances or container images), it does not provide a centralized view of overall security posture or compliance.