Exams / SOA-C03 / Security Hub, GuardDuty and Inspector / Question 1
SOA-C03 practice question: Security Hub, GuardDuty and Inspector
Security and Compliance A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A solar installer uses Amazon GuardDuty in all its accounts. The security team wants any EC2 instance with a high-severity finding, such as cryptocurrency mining, to be isolated automatically within minutes: its security groups replaced with an isolation group that allows no traffic, so the instance stays available for forensics. Which solution should a CloudOps engineer implement?
Choose one answer.
- AA. Use an EventBridge rule on GuardDuty EC2 findings of severity 7 or higher to start a runbook that swaps security groups.
- BB. Create a GuardDuty suppression rule for high-severity EC2 findings that moves them to the archive automatically.
- CC. Turn on Amazon Inspector scanning for the instances so that it can quarantine any instance that has a critical vulnerability.
- DD. Have the security team review GuardDuty findings each morning and stop any instance with a high-severity finding.
Show the answer and explanation
Answer: A
Explanation
GuardDuty publishes every finding as an event to EventBridge, which makes automated response straightforward. A rule filtered on severity and resource type starts a runbook or function that applies an isolation security group. The instance stays running, so evidence in memory and on disk is kept for investigation.
Study
Keep practicing
Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.