Security Hub, GuardDuty and defense in depth: DOP-C02 study notes and practice questions
What to know about Security Hub, GuardDuty and defense in depth for the DOP-C02 exam, from the Security and Compliance domain (17% of the exam guide), then 3 free questions to test it. Part of the DOP-C02 study guide.
These questions ask how to detect and respond to threats and misconfigurations across many accounts with little manual effort.
Detection
Service
Does
GuardDuty
Threat detection from CloudTrail, VPC Flow Logs, DNS logs and optional protections (S3, EKS, runtime, malware, RDS, Lambda); extended threat detection links multi-stage attacks
Security Hub CSPM
Runs security standards (AWS Foundational Security Best Practices, CIS, PCI DSS) as controls and aggregates findings in ASFF format
Security Hub
Correlates and prioritizes findings across AWS security services
Inspector
Vulnerability scanning for EC2, ECR images and Lambda
Macie
Sensitive data in S3
Detective
Investigates the history behind findings
Running them at scale
Use a delegated administrator for each service and auto-enable new accounts.
Security Hub CSPM central configuration applies standards and controls to every account and Region; cross-Region aggregation gives one view.
Automated response
Findings flow to EventBridge, so rules can start Lambda, Step Functions or SSM Automation to, for example, disable a compromised access key, isolate an instance with a quarantine security group, or notify on-call.
Security Hub automation rules update or suppress findings automatically.
Network protection
AWS WAF on CloudFront, ALB and API Gateway with managed rule groups and rate limits.
Shield Advanced for DDoS response and cost protection.
Network Firewall in a central inspection VPC reached through Transit Gateway, with stateful domain filtering and logging.
Firewall Manager applies WAF, security group, Network Firewall and DNS Firewall policies across accounts.
Common traps
Weekly manual reviews of findings that EventBridge can act on instantly.
Enabling services account by account instead of through a delegated administrator.
Security groups for domain-based egress filtering. Use Network Firewall.
A university has 35 AWS accounts and operates in four Regions. The security office wants one place to see security findings from every account and Region, and it wants the standard security checks switched on everywhere.
The security office works in one account, and the other departments should not need to administer the security service themselves. The security office also wants the results to stay visible when a department changes its own account settings, and it reviews the same view every month.
Which approach meets these requirements?
Choose one answer.
AA. Enable Amazon Inspector in each account, and have each department review its own findings in the Inspector console on a monthly schedule.
BB. Enable AWS Config in each account and Region, and send each account's compliance changes to a shared mailbox so that the security office can review them.
CC. Designate the security account as the Security Hub CSPM delegated administrator, use central configuration to enable the standards everywhere, and aggregate findings from all Regions.
DD. Enable AWS Security Hub CSPM separately in each account and Region, and have each department turn on the standards it needs in its own account.
Show the answer and explanation
Answer: C
A. Wrong: Inspector scans for vulnerabilities in some resources, but it does not provide the standard security checks across all services. Monthly reviews by each department also leave no single view for the security office. Learn more: What is Amazon Inspector? (opens in a new tab)
B. Wrong: Config records configuration and compliance, but the requirement is a single view of security findings. A shared mailbox is not an aggregated view and needs manual handling. Learn more: What is AWS Config? (opens in a new tab)
Security Hub CSPM with a delegated administrator and central configuration enables the standards in every account and Region, and cross-Region aggregation gives the security office one view of findings. Departments do not run the service themselves. Separate setups, Inspector alone and Config mail each miss the single view or the standards.
A video streaming service runs about 30 VPCs in one Region. Its services in those VPCs call a fixed list of third-party domains for licensing and analytics, and security wants all outbound internet traffic filtered by domain name and inspected centrally.
Some teams need to reach other domains for testing, and the security team wants those requests logged and blocked by default. The inspection must work for the whole estate from one place, with managed rule groups where possible.
Which approach meets these requirements?
Choose one answer.
AA. Tighten the security groups of every instance so that they only allow outbound traffic on ports 80 and 443, and rely on the security groups to restrict the destination domains.
BB. Add a network ACL to each subnet that denies traffic to any destination that is not on the list of approved IP addresses, and update the list when the third parties change addresses.
CC. Route outbound traffic through a transit gateway to an inspection VPC that runs AWS Network Firewall, with stateful domain rules that allow approved domains and drop the rest.
DD. Deploy AWS WAF in front of every service, and use a web ACL with a rule that blocks requests to domains that are not on the approved list.
Show the answer and explanation
Answer: C
A. Wrong: Security groups filter by IP address and port, not by domain name, and they cannot inspect the traffic. The requirement is domain-level filtering, which they do not provide. Learn more: Security group rules (opens in a new tab)
C. Right: Correct. Network Firewall in a central inspection VPC filters traffic by domain name using stateful rules, logs every decision, and can use managed rule groups. The transit gateway sends each VPC's outbound traffic to it. Learn more: What is AWS Network Firewall? (opens in a new tab)
AWS Network Firewall can sit in a central inspection VPC, reached from the other VPCs through a transit gateway, and its stateful rules can allow or drop traffic by domain name while logging each decision. Security groups and network ACLs work on addresses and ports, and WAF protects inbound web requests rather than outbound calls.
A SaaS startup has enabled Amazon GuardDuty in all of its accounts and sends the findings to AWS Security Hub CSPM. Last week a GuardDuty finding reported that an IAM access key used by a build role was calling AWS APIs from an unfamiliar network.
The on-call engineer found the finding eight hours after it was raised, because the security team reviews Security Hub CSPM only during business hours. The startup wants a high-severity finding of this kind to disable the access key and notify the on-call channel within a few minutes, with no manual step in the response.
Which approach meets these requirements?
Choose one answer.
AA. Create an EventBridge rule for high-severity GuardDuty key findings that starts a Systems Manager runbook, which deactivates the key and notifies on-call.
BB. Set up a weekly review of GuardDuty findings in each account, and have the security team disable any access key that appears in a finding during the review.
CC. Add a Config rule that flags access keys older than 90 days, so that old keys are disabled before they can be misused by attackers.
DD. Enable Amazon Macie in all accounts so that it reports any access key that appears in S3 objects, and have the security team delete those objects when they are found.
B. Wrong: A weekly review is far slower than the few-minute target, and it relies on people to act. The compromised key would remain active until the review.
D. Wrong: Macie looks for sensitive data in S3 objects, not for activity from compromised access keys. The response would not disable the key used by the build role. Learn more: What is Amazon Macie? (opens in a new tab)
Explanation
GuardDuty findings can be routed through EventBridge as they are created, so an automation can disable a compromised access key and notify the on-call channel without waiting for a person. A weekly review, key-age rules and Macie do not detect or stop the activity described in the finding.
A high-severity GuardDuty finding matches the rule, and the runbook deactivates the key and alerts on-call within minutes.
Want more on Security Hub, GuardDuty and defense in depth? The 5 full-length practice sets have 13 more Security Hub, GuardDuty and defense in depth questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Security Hub, GuardDuty and defense in depth