Security Hub, GuardDuty and Inspector: SOA-C03 study notes and practice questions
What to know about Security Hub, GuardDuty and Inspector for the SOA-C03 exam, from the Security and Compliance domain (16% of the exam guide), then 1 free question to test it. Part of the SOA-C03 study guide.
Security findings questions ask which service detects a problem and how to respond automatically.
The services
Service
Finds
Notes
Amazon GuardDuty
Threats: compromised instances, credential misuse, cryptomining, unusual API calls
Analyzes CloudTrail, VPC Flow Logs and DNS logs without agents; optional protection plans for S3, EKS, RDS, Lambda, malware and runtime monitoring
Amazon Inspector
Software vulnerabilities and network exposure
Continuous scanning of EC2 (with the SSM Agent), ECR images and Lambda functions
Amazon Macie
Sensitive data in S3
AWS Security Hub
Your overall posture
Aggregates findings from these services and partners, and runs security standards checks (the posture checks are now called Security Hub CSPM)
Amazon Detective
Root causes
Investigates findings with graphs built from logs
IAM Access Analyzer
Unintended external access
AWS Config
Non-compliant configurations
Organization-wide setup
Use a delegated administrator (often a security account) to turn services on for all accounts and auto-enable new accounts. Aggregate Security Hub findings across Regions into one aggregation Region.
Automated response
The service publishes each finding to EventBridge.
A rule matches the finding type or severity.
A target acts: Lambda, Systems Manager Automation (isolate an instance by swapping its security group, snapshot it for forensics), SNS to notify, or Step Functions for a workflow.
Security Hub also supports automation rules to update or suppress findings, and custom actions to send selected findings to EventBridge.
Common traps
GuardDuty vs Inspector. Activity threats vs software vulnerabilities.
Expecting GuardDuty to block. It detects; you build the response.
Turning services on account by account. Use a delegated administrator with auto-enable.
A solar installer uses Amazon GuardDuty in all its accounts.
The security team wants any EC2 instance with a high-severity finding, such as cryptocurrency mining, to be isolated automatically within minutes: its security groups replaced with an isolation group that allows no traffic, so the instance stays available for forensics.
Which solution should a CloudOps engineer implement?
Choose one answer.
AA. Use an EventBridge rule on GuardDuty EC2 findings of severity 7 or higher to start a runbook that swaps security groups.
BB. Create a GuardDuty suppression rule for high-severity EC2 findings that moves them to the archive automatically.
CC. Turn on Amazon Inspector scanning for the instances so that it can quarantine any instance that has a critical vulnerability.
DD. Have the security team review GuardDuty findings each morning and stop any instance with a high-severity finding.
GuardDuty publishes every finding as an event to EventBridge, which makes automated response straightforward. A rule filtered on severity and resource type starts a runbook or function that applies an isolation security group. The instance stays running, so evidence in memory and on disk is kept for investigation.
The rule filters on severity 7 or higher, and the runbook isolates the instance by swapping its security groups, leaving it running.
Want more on Security Hub, GuardDuty and Inspector? The 5 full-length practice sets have 5 more Security Hub, GuardDuty and Inspector questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →