SCS-C02 Question 100
Select 2Your organization uses AWS Security Hub to monitor security findings across multiple accounts and regions. You are tasked with automating the process of notifying the security operations team whenever a critical finding is detected. The notification must include details about the finding and be sent to an email distribution list. Which combination of AWS services should you use to achieve this?
- A
AWS Lambda, Amazon Simple Notification Service (SNS)
- B
AWS Lambda, Amazon Simple Queue Service (SQS)
- C
AWS Security Hub, Amazon Simple Notification Service (SNS)
- D
Amazon CloudWatch Alarms, Amazon Simple Notification Service (SNS)
- E
AWS Security Hub, Amazon CloudWatch Events (EventBridge), Amazon Simple Notification Service (SNS)
Show answer and explanation
Correct answers: A, E
Explanation
To automate alerting for critical findings in AWS Security Hub, you can use a combination of AWS services. Security Hub findings can be forwarded to Amazon EventBridge, which allows you to define rules that match specific conditions (e.g., critical severity). EventBridge can trigger an action, such as an SNS notification or a Lambda function. Lambda can also directly process findings and invoke SNS to send notifications. Both approaches are valid solutions for the given scenario.
- A. Correct.
Correct. AWS Lambda can process findings from AWS Security Hub and trigger Amazon SNS to send notifications to an email distribution list.
- B. Incorrect.
Incorrect. While SQS can queue messages, it is not suitable for sending email notifications directly. SNS is better suited for this purpose.
- C. Incorrect.
Incorrect. Security Hub does not natively integrate directly with SNS for sending notifications. You need an intermediary service like Lambda or EventBridge to process findings.
- D. Incorrect.
Incorrect. While CloudWatch Alarms can send notifications via SNS, they are not designed to monitor or process Security Hub findings directly.
- E. Correct.
Correct. AWS Security Hub findings can be sent to EventBridge, which can trigger SNS to notify the security team via email.