DOP-C02 practice question: Security Hub, GuardDuty and defense in depth (3 of 3)
Security and Compliance A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A SaaS startup has enabled Amazon GuardDuty in all of its accounts and sends the findings to AWS Security Hub CSPM. Last week a GuardDuty finding reported that an IAM access key used by a build role was calling AWS APIs from an unfamiliar network.
The on-call engineer found the finding eight hours after it was raised, because the security team reviews Security Hub CSPM only during business hours. The startup wants a high-severity finding of this kind to disable the access key and notify the on-call channel within a few minutes, with no manual step in the response.
Which approach meets these requirements?
Choose one answer.
AA. Create an EventBridge rule for high-severity GuardDuty key findings that starts a Systems Manager runbook, which deactivates the key and notifies on-call.
BB. Set up a weekly review of GuardDuty findings in each account, and have the security team disable any access key that appears in a finding during the review.
CC. Add a Config rule that flags access keys older than 90 days, so that old keys are disabled before they can be misused by attackers.
DD. Enable Amazon Macie in all accounts so that it reports any access key that appears in S3 objects, and have the security team delete those objects when they are found.
B. Wrong: A weekly review is far slower than the few-minute target, and it relies on people to act. The compromised key would remain active until the review.
D. Wrong: Macie looks for sensitive data in S3 objects, not for activity from compromised access keys. The response would not disable the key used by the build role. Learn more: What is Amazon Macie? (opens in a new tab)
Explanation
GuardDuty findings can be routed through EventBridge as they are created, so an automation can disable a compromised access key and notify the on-call channel without waiting for a person. A weekly review, key-age rules and Macie do not detect or stop the activity described in the finding.
A high-severity GuardDuty finding matches the rule, and the runbook deactivates the key and alerts on-call within minutes.
Want more on Security Hub, GuardDuty and defense in depth? The 5 full-length practice sets have 13 more Security Hub, GuardDuty and defense in depth questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →