SAA-C03 · Question #660
A company's solutions architect wants to receive an email alert whenever Amazon GuardDuty, AWS Identity and Access Management Access Analyzer, or Amazon Macie generate a high- severity security…
The correct answer is B. Create an Amazon EventBridge rule with a pattern that matches Security Hub findings events. Security Hub already aggregates and normalizes findings from GuardDuty, IAM Access Analyzer, and Macie. You can create a single Amazon EventBridge rule that matches Security Hub findings with high severity and send them to an SNS topic. Subscribing email addresses to that SNS…
Question
A company’s solutions architect wants to receive an email alert whenever Amazon GuardDuty, AWS Identity and Access Management Access Analyzer, or Amazon Macie generate a high- severity security finding. The company uses AWS Control Tower to govern all of its accounts. The company also uses AWS Security Hub with all of the AWS service integrations turned on. Which solution will meet these requirements with the LEAST operational overhead?
Options
- ASet up separate AWS Lambda functions for GuardDuty, IAM Access Analyzer, and Macie to call
- BCreate an Amazon EventBridge rule with a pattern that matches Security Hub findings events
- CCreate an Amazon EventBridge rule with a pattern that matches AWS Control Tower events with
- DHost an application on Amazon EC2 to call the GuardDuty, IAM Access Analyzer, and Macie
How the community answered
(33 responses)- A9% (3)
- B82% (27)
- C3% (1)
- D6% (2)
Explanation
Security Hub already aggregates and normalizes findings from GuardDuty, IAM Access Analyzer, and Macie. You can create a single Amazon EventBridge rule that matches Security Hub findings with high severity and send them to an SNS topic. Subscribing email addresses to that SNS topic provides alerts with minimal setup and no custom code or scheduled jobs, giving the least operational overhead.
Community Discussion
No community discussion yet for this question.