SCS-C02 Question 28
Single answerYou are working as a security engineer for a company that uses AWS Security Hub to manage and monitor security findings across multiple AWS accounts. You notice that a compliance scanner integrated with Security Hub is generating findings in a custom format that your analytics tools cannot parse. Which feature of AWS Security Hub should you leverage to ensure all findings are standardized in a compatible format?
- A
Enable the integration with Amazon Macie to automatically reformat findings.
- B
Use the AWS Security Finding Format (ASFF) to standardize all findings.
- C
Create a custom Lambda function to convert findings to a compatible format.
- D
Enable Security Hub's auto-remediation feature to standardize findings.
Show answer and explanation
Correct answer: B
Explanation
The AWS Security Finding Format (ASFF) is explicitly designed to standardize findings across various services and integrations in AWS Security Hub. By using ASFF, all findings from integrated services, including third-party tools, are normalized into a common format, making them easier to analyze and process.
- A. Incorrect.
Amazon Macie is a data security and data privacy service. It is not used for reformatting findings or standardizing their format.
- B. Correct.
The AWS Security Finding Format (ASFF) is a standardized JSON-based format used by AWS Security Hub to ensure that all findings, regardless of source, are presented in a consistent and compatible format.
- C. Incorrect.
While creating a custom Lambda function could technically achieve the goal, it is not necessary in this case because the ASFF already standardizes findings in a compatible format.
- D. Incorrect.
Security Hub's auto-remediation feature is used to take automated actions in response to findings, but it does not handle the standardization of finding formats.