SOA-C03 practice question: Security Hub, GuardDuty and Inspector
Security and Compliance A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A solar installer uses Amazon GuardDuty in all its accounts.
The security team wants any EC2 instance with a high-severity finding, such as cryptocurrency mining, to be isolated automatically within minutes: its security groups replaced with an isolation group that allows no traffic, so the instance stays available for forensics.
Which solution should a CloudOps engineer implement?
Choose one answer.
AA. Use an EventBridge rule on GuardDuty EC2 findings of severity 7 or higher to start a runbook that swaps security groups.
BB. Create a GuardDuty suppression rule for high-severity EC2 findings that moves them to the archive automatically.
CC. Turn on Amazon Inspector scanning for the instances so that it can quarantine any instance that has a critical vulnerability.
DD. Have the security team review GuardDuty findings each morning and stop any instance with a high-severity finding.
GuardDuty publishes every finding as an event to EventBridge, which makes automated response straightforward. A rule filtered on severity and resource type starts a runbook or function that applies an isolation security group. The instance stays running, so evidence in memory and on disk is kept for investigation.
The rule filters on severity 7 or higher, and the runbook isolates the instance by swapping its security groups, leaving it running.
Want more on Security Hub, GuardDuty and Inspector? The 5 full-length practice sets have 5 more Security Hub, GuardDuty and Inspector questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →