CLF-C02 Practice Question 94: Security Findings Hub
AWS Certified Cloud Practitioner (CLF-C02) · Test 10 · question 4 of 10
A security team uses Amazon GuardDuty, Amazon Inspector and Amazon Macie across 20 AWS accounts, and their findings are spread across three separate consoles. The team wants one place that collects and prioritizes findings from these services, and that also runs continuous automated checks of the accounts against the AWS Foundational Security Best Practices standard. Which service should the team use?
Show answer and explanation
Answer:
AWS Security Hub (its documentation now calls this capability AWS Security Hub CSPM, for cloud security posture management) gives a comprehensive view of your security state across accounts. It receives findings from Amazon GuardDuty, Amazon Inspector, Amazon Macie and supported third-party products, normalizes and prioritizes them, and gives you "a single pane of glass". It also runs continuous security checks against standards such as the AWS Foundational Security Best Practices, CIS and PCI DSS, and produces a security score.
Option A, Amazon Detective, is for *investigating* the root cause of a specific finding with behavior graphs. It doesn't aggregate findings from all of these services or run best-practice checks. Option C, AWS Config, records resource configurations and evaluates them against rules. Security Hub uses Config behind the scenes for many of its checks, but Config doesn't collect GuardDuty, Inspector and Macie findings into one place. Option D, AWS Trusted Advisor, makes best-practice recommendations about cost, performance, security and quotas, but it doesn't aggregate findings from these security services.
Reference: Introduction to AWS Security Hub CSPM