A logistics firm runs 180 AWS accounts in six Regions. Its security operations center wants all Security Hub CSPM findings visible in one Region, so that analysts work from one console.
A sandbox organizational unit produces many low-risk findings that clutter the queue. Analysts want those findings hidden from the main queue but kept for audit, and they want the change to be reversible. The security checks in the sandbox accounts must keep running.
Which solution meets these requirements?
Choose one answer.
AA. Disable the Security Hub CSPM controls in the sandbox accounts, so that no findings are created there in the first place.
BB. Turn on Security Hub CSPM cross-Region aggregation into one Region, then add an automation rule for the sandbox accounts that sets the workflow status to SUPPRESSED.
CC. Keep Security Hub separate in each Region, and have analysts open the six consoles in turn, filtering each one by sandbox account ID.
DD. Create an Amazon EventBridge rule in each Region that drops the sandbox findings from the Security Hub CSPM event stream before analysts see them in the console.
Show the answer and explanation
Answer: B
A. Wrong: Disabling the controls stops the checks, so the sandbox accounts would produce no findings at all. The requirement says the checks must keep running, and the audit trail would be incomplete.
B. Right: Correct. Cross-Region aggregation brings findings from all six Regions into one console. A suppression automation rule hides the matching findings from the default queue while keeping them for audit, and disabling the rule reverses the change. Learn more: Automation rules in AWS Security Hub (opens in a new tab)
C. Wrong: Separate Regions give no single view, which the operations center needs. Analysts would still see the sandbox noise in each console, so the filter would have to be repeated six times.
D. Wrong: Dropping events from the EventBridge stream does not remove the findings from Security Hub, so the console still shows them. The approach is also hard to reverse and gives no single console.
Explanation
Cross-Region aggregation gives the operations center one view of findings from every Region. An automation rule that sets the workflow status to suppressed hides the noisy sandbox findings without deleting them, and it can be reversed. Disabling controls, dropping events and separate consoles each break a stated requirement.
Want more on Threat detection and findings (GuardDuty, Macie, Security Hub)? The 5 full-length practice sets have 7 more Threat detection and findings (GuardDuty, Macie, Security Hub) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →