A security team already runs Amazon GuardDuty, Amazon Macie, and Amazon Inspector across their accounts and now wants one dashboard that ingests and normalizes findings from all three, and separately checks their environment against a security industry standard such as the CIS AWS Foundations Benchmark, prioritizing everything in a single place. Which service should they add?
- AWS Config, configured with enough custom rules to independently reproduce each of these checks
- AWS Systems Manager, to patch instances and inspect general operational configuration
- Amazon Detective, to visualize the likely root cause of one already-known security finding
- AWS Security Hub, which ingests and normalizes findings from services such as GuardDuty, Macie, and Inspector into a standard format, and separately runs its own checks against security standards such as the CIS AWS Foundations Benchmark
Why D? And why not the others?
Correct answer: D. AWS Security Hub, which ingests and normalizes findings from services such as GuardDuty, Macie, and Inspector into a standard format, and separately runs its own checks against security standards such as the CIS AWS Foundations Benchmark
AWS Security Hub is designed to collect and normalize findings from integrated services such as GuardDuty, Macie, and Inspector into a standard finding format, correlating and prioritizing them in one dashboard, while also independently running continuous checks against security industry standards, including the CIS AWS Foundations Benchmark, to produce a security score. The option describing heavy custom rule authoring is wrong because rebuilding equivalent multi-service finding aggregation and benchmark scoring from scratch is not that service's purpose and would not genuinely reproduce this capability. The option describing patching and general operational configuration inspection is wrong because that focuses on operational management tasks like patch compliance, not consolidating security findings from other detection services. The option describing root-cause visualization of a single known finding is wrong because that tool is for deep investigation of an already-identified issue, not for aggregating findings across many services and running standards-based checks.
Source: AWS Security Hub documentation: What is AWS Security Hub? (https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html)