SCS-C02 Question 102
Select 2Your company has recently adopted AWS GuardDuty to monitor for malicious or unauthorized activity in your AWS environment. The security team wants to ensure that all detected findings are reviewed and appropriately handled. Additionally, they want to automate certain responses, such as isolating compromised instances when GuardDuty detects a high-severity finding. Which combination of AWS tools can you use to meet this requirement?
- A
AWS GuardDuty and Amazon SNS to send email notifications about findings
- B
AWS GuardDuty, AWS Lambda, and AWS Systems Manager Automation to isolate compromised instances
- C
AWS GuardDuty and AWS Config to monitor compliance with security baselines
- D
AWS GuardDuty and AWS Security Hub to aggregate and prioritize findings across accounts
- E
AWS GuardDuty and AWS CloudTrail to automatically remediate high-severity findings
Show answer and explanation
Correct answers: B, D
Explanation
To meet the requirements of monitoring GuardDuty findings and automating responses, a combination of AWS GuardDuty, AWS Lambda, and AWS Systems Manager Automation is ideal for isolating compromised instances. Additionally, AWS Security Hub can be used to aggregate and prioritize findings across accounts, providing a centralized view of security alerts. Other options, like SNS or CloudTrail, do not fulfill the requirement for automated response or aggregation in this scenario.
- A. Incorrect.
AWS GuardDuty and Amazon SNS can send notifications about findings, but this combination alone does not provide an automated mechanism to isolate compromised instances.
- B. Correct.
This is correct. AWS GuardDuty detects findings, AWS Lambda can trigger custom response scripts, and AWS Systems Manager Automation can perform actions like isolating an EC2 instance by modifying its security group.
- C. Incorrect.
AWS Config helps monitor compliance with security baselines, but it is not directly involved in automating responses to GuardDuty findings.
- D. Correct.
This is correct. AWS GuardDuty provides threat intelligence, and AWS Security Hub can aggregate GuardDuty findings across accounts and prioritize them for action.
- E. Incorrect.
AWS CloudTrail provides event history and logging but does not provide automated remediation for GuardDuty findings.