SCS-C02 Question 98
Select 3Your organization uses AWS Security Hub to monitor security findings across multiple AWS accounts. You want to set up an automated system that triggers an alert whenever Security Hub detects a high-severity finding. The alert should send an email notification to your security team. Which combination of services and configurations will accomplish this?
- A
Configure a CloudWatch Event Rule to capture high-severity findings from Security Hub and trigger an AWS Lambda function.
- B
Use AWS Lambda to process the findings and publish a notification to an Amazon SNS topic.
- C
Directly configure AWS Security Hub to send email notifications for high-severity findings.
- D
Subscribe the security team's email address to the Amazon SNS topic.
- E
Enable AWS Config rules to monitor high-severity findings and send email notifications through Amazon SNS.
Show answer and explanation
Correct answers: A, B, D
Explanation
To automate alerting for high-severity findings in AWS Security Hub, you need to use a combination of AWS services. First, configure a CloudWatch Event Rule to detect high-severity findings and trigger an AWS Lambda function. The Lambda function processes the findings and publishes them to an Amazon SNS topic. Finally, subscribe the security team's email address to the SNS topic to ensure email notifications are delivered. This approach uses AWS services effectively to create an automated and scalable alerting system.
- A. Correct.
Correct: CloudWatch Event Rules can be used to capture specific events or findings from AWS Security Hub. In this scenario, it can filter high-severity findings and trigger Lambda functions for further processing.
- B. Correct.
Correct: AWS Lambda can process the findings and send notifications to an Amazon SNS topic, which can then deliver alerts to the subscribed email addresses.
- C. Incorrect.
Incorrect: AWS Security Hub does not have a direct feature to send email notifications. It integrates with other AWS services like CloudWatch Events and SNS for alerting purposes.
- D. Correct.
Correct: Subscribing an email address to an Amazon SNS topic ensures that alerts are delivered to the security team via email.
- E. Incorrect.
Incorrect: AWS Config rules are used for compliance checks and do not directly monitor Security Hub findings or send notifications via SNS.