SCS-C02 Question 108
Single answerYour organization uses AWS Security Hub to monitor and consolidate security findings across multiple AWS accounts and regions. You notice that no findings have been generated for a critical EC2 instance that is intentionally configured with an open SSH port. Upon investigation, you confirm that GuardDuty is enabled in the account. What could be the most likely reason for the missing findings?
- A
The Security Hub administrator account has not been connected to the member account.
- B
GuardDuty findings are not automatically forwarded to Security Hub unless explicitly enabled.
- C
The AWS Config rule for monitoring open SSH ports is not enabled.
- D
The EC2 instance is running in a region where GuardDuty is not enabled.
Show answer and explanation
Correct answer: D
Explanation
GuardDuty findings are generated regionally, and Security Hub aggregates findings across regions. If GuardDuty is not enabled in the region where the EC2 instance resides, no findings will be generated for resources in that region. The other options either do not affect GuardDuty’s ability to generate findings or are unrelated to the specific scenario.
- A. Incorrect.
If the Security Hub administrator account is not connected to the member account, findings may not aggregate correctly across accounts. However, in this scenario, the focus is on the lack of findings for a specific EC2 instance in the same account, which is unrelated to the administrator-member account connection.
- B. Incorrect.
GuardDuty findings are automatically forwarded to Security Hub once both services are enabled. There is no manual forwarding step required.
- C. Incorrect.
AWS Config rules are unrelated to GuardDuty findings. AWS Config monitors compliance, while GuardDuty detects security threats.
- D. Correct.
GuardDuty must be enabled in the specific region where the EC2 instance resides. If it is not enabled in that region, no findings will be generated for resources in that region.