A company's security engineer wants to receive an email alert whenever Amazon GuardDuty, AWS Identity and Access Management Access Analyzer, or Amazon Macie generate a high- severity security…

Question

Options

• ASet up separate AWS Lambda functions for GuardDuty, IAM Access Analyzer, and Macie to call
• BCreate an Amazon EventBridge rule with a pattern that matches Security Hub findings events
• CCreate an Amazon EventBridge rule with a pattern that matches AWS Control Tower events with
• DHost an application on Amazon EC2 to call the GuardDuty. IAM Access Analyzer, and Macie

• A
  23% (6)
• B
  58% (15)
• C
  12% (3)
• D
  8% (2)

Explanation

Option B is correct because AWS Security Hub aggregates findings from GuardDuty, IAM Access Analyzer, and Macie into a single normalized event stream, so one EventBridge rule can match high-severity findings from all three services simultaneously - then route to an SNS topic for email alerts with minimal setup and zero ongoing maintenance.

Option A is wrong because maintaining three separate Lambda functions to poll or react to each service independently multiplies operational overhead and introduces more failure points.

Option C is wrong because AWS Control Tower events cover account governance actions (account creation, guardrail violations), not individual security findings from GuardDuty, Macie, or IAM Access Analyzer.

Option D is wrong because hosting an EC2 instance just to call security APIs is the highest-overhead solution - you must manage the instance, patching, uptime, and polling logic yourself.

Memory tip: Think "hub and spoke" - Security Hub is the hub that aggregates all findings, so one EventBridge rule watching Security Hub covers all integrated services at once. Whenever a question asks for least operational overhead across multiple AWS security services, Security Hub + EventBridge is almost always the answer.

No community discussion yet for this question.