SCS-C02 Question 105
Select 3A company has set up an Amazon GuardDuty detector in its AWS account to monitor for unauthorized and malicious activities. Recently, several GuardDuty findings were generated, but no one in the security team received any notifications. Upon investigation, you find that the team configured Amazon Simple Notification Service (SNS) to send alerts but is still missing notifications. What should you check to troubleshoot this issue?
- A
Verify that the SNS topic has the correct subscriptions configured to send notifications to the security team.
- B
Check if the IAM role associated with GuardDuty has permissions to publish messages to the SNS topic.
- C
Ensure that the GuardDuty detector is configured in the same region as the SNS topic.
- D
Confirm that GuardDuty findings are assigned the appropriate severity levels to trigger the SNS notifications.
- E
Verify that the security team's email provider is not blocking the messages from SNS.
Show answer and explanation
Correct answers: A, B, E
Explanation
To troubleshoot GuardDuty notification issues, you must ensure that the SNS topic is properly configured with subscriptions (e.g., email, Lambda, etc.), GuardDuty has the necessary IAM permissions to publish messages to the SNS topic, and the email provider is not blocking messages. These are the critical components for ensuring notifications are received. The region of the GuardDuty detector and severity levels of findings do not affect the ability to send notifications.
- A. Correct.
Correct: If the SNS topic does not have subscriptions configured properly (e.g., email addresses or endpoints), notifications will not reach the intended recipients.
- B. Correct.
Correct: GuardDuty needs appropriate IAM permissions to publish findings to the SNS topic. Without these permissions, no alerts will be sent.
- C. Incorrect.
Incorrect: GuardDuty findings and SNS topics do not need to be in the same region to function properly. This is not a requirement.
- D. Incorrect.
Incorrect: GuardDuty findings generate notifications regardless of their severity level. Notification delivery depends on SNS configuration and permissions, not severity levels.
- E. Correct.
Correct: If the security team's email provider blocks messages from SNS, notifications may fail to be delivered. This should be checked to ensure smooth alert delivery.