SCS-C02 Question 113
Select 3You are a security engineer managing your organization's AWS accounts. You have enabled AWS Security Hub across multiple accounts using AWS Organizations. The security team needs to monitor findings from Security Hub and ensure compliance with CIS AWS Foundations Benchmark in real-time. What steps should you take to configure monitoring and ensure compliance effectively?
- A
Enable Security Hub in the master account and all member accounts, then enable the CIS AWS Foundations Benchmark standard.
- B
Configure a CloudWatch Events rule to forward Security Hub findings to an SNS topic for notifications.
- C
Manually check Security Hub findings daily across all accounts to ensure compliance.
- D
Enable automatic archiving of findings in Security Hub to reduce the noise from low-priority findings.
- E
Enable AWS Config and configure rules to align with CIS AWS Foundations Benchmark requirements.
Show answer and explanation
Correct answers: A, B, E
Explanation
To effectively monitor Security Hub findings and ensure compliance with the CIS AWS Foundations Benchmark, it is important to enable Security Hub and the relevant standard in all accounts, forward findings using CloudWatch Events for real-time notifications, and complement this with AWS Config to continuously monitor resource configurations. Manual monitoring is inefficient and archiving findings does not solve compliance challenges.
- A. Correct.
Enabling Security Hub in the master and member accounts, as well as enabling the CIS AWS Foundations Benchmark standard, is essential for centralized monitoring and compliance checks.
- B. Correct.
Configuring a CloudWatch Events rule to forward findings to an SNS topic ensures that findings are acted upon promptly by notifying the relevant stakeholders.
- C. Incorrect.
Manually checking Security Hub findings daily is not scalable or efficient, particularly for environments with multiple accounts and high activity.
- D. Incorrect.
Enabling automatic archiving of findings in Security Hub does not address compliance or monitoring requirements; it only reduces the visibility of low-priority findings.
- E. Correct.
AWS Config is a critical service for compliance as it allows you to monitor the configuration of AWS resources against required compliance standards, such as CIS AWS Foundations Benchmark.