SCS-C02 Question 26
Single answerAn organization uses AWS Security Hub to monitor and manage security findings across multiple AWS accounts. A security engineer wants to create a Lambda function that processes the findings in near real-time. The function must extract details such as the severity, resource type, and compliance status of each finding. Which format should the Lambda function expect the findings to be in?
- A
JSON format following the AWS Security Finding Format (ASFF) schema
- B
XML format as defined by the AWS Security Hub API
- C
CSV file containing summarized findings
- D
Plain text logs retrieved from AWS Config
Show answer and explanation
Correct answer: A
Explanation
AWS Security Hub findings are standardized into the AWS Security Finding Format (ASFF), a JSON-based schema that includes all necessary details like severity, resource type, and compliance status. This format is designed to enable consistent integration with security tools and custom processing, such as the Lambda function in this scenario.
- A. Correct.
Correct. AWS Security Hub findings are provided in the JSON format following the AWS Security Finding Format (ASFF) schema. This format ensures a consistent and detailed structure for processing security data.
- B. Incorrect.
Incorrect. AWS Security Hub does not use XML to structure findings; it uses ASFF in JSON format.
- C. Incorrect.
Incorrect. Findings from AWS Security Hub are not exported as CSV files by default; they are in JSON format using ASFF.
- D. Incorrect.
Incorrect. AWS Security Hub does not use plain text logs from AWS Config. Instead, it provides structured findings in JSON format based on ASFF.