SCS-C02 Question 97
Select 3An organization has set up an AWS Security Hub to monitor their cloud environment for security issues. They want to ensure that any critical findings are automatically sent to their incident response team via email and a ticket is logged in their ITSM (IT Service Management) tool. Which combination of AWS services can be used to automate this workflow?
- A
AWS Lambda to process Security Hub findings and forward them to Amazon SNS
- B
Amazon SNS to send email notifications to the incident response team
- C
Amazon S3 to store Security Hub findings and trigger alerts
- D
AWS CloudTrail to monitor and send notifications for Security Hub findings
- E
Amazon EventBridge to route Security Hub findings to an ITSM tool
Show answer and explanation
Correct answers: A, B, E
Explanation
The correct combination of AWS services, AWS Lambda, Amazon SNS, and Amazon EventBridge, allows for an automated workflow where critical findings from Security Hub are processed, emailed to the incident response team via SNS, and routed to an ITSM tool via EventBridge. This ensures that the findings are handled swiftly and efficiently.
- A. Correct.
AWS Lambda can be used to process findings from Security Hub and perform custom logic, such as forwarding findings to Amazon SNS or other destinations. This is a correct option as it enables automation of the workflow.
- B. Correct.
Amazon SNS is a messaging service that can send email notifications to the incident response team. This is a correct option because it ensures team members are alerted immediately.
- C. Incorrect.
Amazon S3 is a storage service and does not natively trigger alerts for Security Hub findings. While Security Hub findings could be stored here for archival purposes, it doesn't facilitate the desired alerting workflow.
- D. Incorrect.
AWS CloudTrail tracks API activity and changes in the AWS environment but is not used to monitor Security Hub findings or send notifications. This is not relevant to the given scenario.
- E. Correct.
Amazon EventBridge (formerly CloudWatch Events) can route Security Hub findings to various destinations, such as an ITSM tool, enabling automation of ticket logging. This is a correct option for integrating with the ITSM tool.