SCS-C02 Question 99
Select 3Your organization uses AWS Security Hub to monitor security findings across multiple accounts. You want to automate the process of alerting your security team whenever a high-severity finding is detected. The alert should include the finding details and should be sent via email. Which combination of services and configurations should you use to achieve this?
- A
Configure an EventBridge rule to detect high-severity findings from Security Hub and trigger an AWS Lambda function.
- B
Use the Lambda function to extract details from the finding and publish an alert to an Amazon SNS topic.
- C
Set up Amazon SNS subscriptions to send the alert to email recipients.
- D
Directly set up an EventBridge rule to send high-severity findings to email addresses without additional services.
- E
Enable AWS Config to automatically send compliance reports for high-severity findings to an Amazon SNS topic.
Show answer and explanation
Correct answers: A, B, C
Explanation
To automate alerting for high-severity findings in Security Hub, you can use EventBridge to detect the findings, trigger a Lambda function to process the alert, and use SNS to send the alert to email recipients. This combination provides a robust and automated notification system that ensures your security team is promptly informed.
- A. Correct.
Correct. Amazon EventBridge can be configured to detect specific patterns in Security Hub findings, such as high-severity alerts, and trigger actions like invoking a Lambda function.
- B. Correct.
Correct. AWS Lambda is ideal for processing and customizing Security Hub findings (e.g., extracting details) before sending them as alerts to other services like Amazon SNS.
- C. Correct.
Correct. Amazon SNS allows you to send notifications to multiple subscribers, such as email recipients, ensuring the security team receives the alert.
- D. Incorrect.
Incorrect. EventBridge cannot directly send alerts to email addresses. It requires integration with other services, such as Lambda and SNS, for this use case.
- E. Incorrect.
Incorrect. AWS Config tracks resource compliance but does not natively send Security Hub findings or alerts through SNS.