SCS-C02 Question 115
Select 3Your organization uses AWS Security Hub to monitor and manage security findings across multiple AWS accounts. Recently, you noticed that findings from Amazon GuardDuty are not appearing in Security Hub. As a security engineer, what steps should you take to ensure that GuardDuty findings are integrated with Security Hub?
- A
Enable the Security Hub service in each AWS account where GuardDuty is enabled.
- B
Configure GuardDuty to send findings to Security Hub by enabling the 'Findings Publishing to Security Hub' option in the GuardDuty settings.
- C
Ensure that Amazon GuardDuty is enabled and properly configured in all AWS accounts being monitored.
- D
Manually upload GuardDuty findings to Security Hub using the AWS Management Console.
- E
Verify that the IAM role used by Security Hub has the necessary permissions to read GuardDuty findings.
Show answer and explanation
Correct answers: A, B, C
Explanation
To ensure GuardDuty findings are integrated with AWS Security Hub, you must enable Security Hub in each AWS account, configure GuardDuty to publish findings to Security Hub, and ensure GuardDuty is enabled and properly configured in all monitored accounts. Manual upload of findings is not required, and the necessary IAM permissions for Security Hub to access GuardDuty findings are automatically handled during the integration process.
- A. Correct.
Correct. Security Hub needs to be enabled in each account to aggregate and display findings from integrated AWS services like GuardDuty.
- B. Correct.
Correct. GuardDuty findings are not automatically sent to Security Hub by default. You must enable the specific option in the GuardDuty settings.
- C. Correct.
Correct. GuardDuty must be enabled and properly configured in all monitored accounts for findings to be generated and sent to Security Hub.
- D. Incorrect.
Incorrect. Findings are automatically forwarded from GuardDuty to Security Hub once the integration is configured; manual uploads are not required.
- E. Incorrect.
Incorrect. While IAM role permissions are important, Security Hub automatically assumes the necessary permissions to read findings from supported services like GuardDuty when the integration is correctly configured.