DOP-C02 practice question: Security Hub, GuardDuty and defense in depth (1 of 3)
Security and Compliance A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A university has 35 AWS accounts and operates in four Regions. The security office wants one place to see security findings from every account and Region, and it wants the standard security checks switched on everywhere.
The security office works in one account, and the other departments should not need to administer the security service themselves. The security office also wants the results to stay visible when a department changes its own account settings, and it reviews the same view every month.
Which approach meets these requirements?
Choose one answer.
AA. Enable Amazon Inspector in each account, and have each department review its own findings in the Inspector console on a monthly schedule.
BB. Enable AWS Config in each account and Region, and send each account's compliance changes to a shared mailbox so that the security office can review them.
CC. Designate the security account as the Security Hub CSPM delegated administrator, use central configuration to enable the standards everywhere, and aggregate findings from all Regions.
DD. Enable AWS Security Hub CSPM separately in each account and Region, and have each department turn on the standards it needs in its own account.
Show the answer and explanation
Answer: C
A. Wrong: Inspector scans for vulnerabilities in some resources, but it does not provide the standard security checks across all services. Monthly reviews by each department also leave no single view for the security office. Learn more: What is Amazon Inspector? (opens in a new tab)
B. Wrong: Config records configuration and compliance, but the requirement is a single view of security findings. A shared mailbox is not an aggregated view and needs manual handling. Learn more: What is AWS Config? (opens in a new tab)
Security Hub CSPM with a delegated administrator and central configuration enables the standards in every account and Region, and cross-Region aggregation gives the security office one view of findings. Departments do not run the service themselves. Separate setups, Inspector alone and Config mail each miss the single view or the standards.
Want more on Security Hub, GuardDuty and defense in depth? The 5 full-length practice sets have 13 more Security Hub, GuardDuty and defense in depth questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →