Security Hub overview in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding AWS Security Hub Findings

What does an AWS Security Hub finding represent?

A A backup snapshot of security configurations in AWS.

B A detailed billing report for AWS security services usage.

C A list of all users with administrative access in an AWS account.

D A summary of security alerts and compliance status from multiple AWS services and partner tools.

💡 Hint

Think about what Security Hub collects and shows about your cloud environment.

A Security Hub finding is a security alert or compliance status summary aggregated from AWS services and partner tools to help you identify security issues.

❓ Architecture

intermediate

Integrating AWS Security Hub with Other Services

Which AWS service integration allows Security Hub to automatically receive findings from Amazon GuardDuty?

A Enabling GuardDuty as a data source in Security Hub settings.

B Manually exporting GuardDuty logs to Security Hub via S3.

C Configuring CloudTrail to send events to Security Hub.

D Setting up a Lambda function to poll GuardDuty findings and push to Security Hub.

💡 Hint

Consider how Security Hub natively connects with AWS security services.

Security Hub can be configured to automatically ingest findings from GuardDuty by enabling GuardDuty as a data source within Security Hub.

❓ security

advanced

Security Hub Finding Severity Levels

What severity label does Security Hub assign to a finding with a normalized severity score of 70?

A Low

B Critical

C High

D Medium

💡 Hint

Check how Security Hub maps normalized severity scores to severity labels.

Security Hub uses these ranges: 0-39 Low, 40-69 Medium, 70-89 High, 90-100 Critical. A score of 70 falls into High.

❓ service_behavior

advanced

Behavior of Security Hub Automated Response

What happens when you enable Security Hub's automated response and remediation feature with a custom Lambda function?

A Security Hub disables all findings until the Lambda function is manually run.

B The Lambda function runs automatically when a matching finding is detected to remediate the issue.

C The Lambda function must be manually triggered from the Security Hub console for each finding.

D The Lambda function only logs findings but does not perform any remediation.

💡 Hint

Think about how automation helps fix security issues quickly.

When automated response is enabled, Security Hub triggers the Lambda function automatically for matching findings to remediate issues.

✅ Best Practice

expert

Best Practice for Managing Security Hub in Multi-Account AWS Environments

In a multi-account AWS setup, what is the recommended way to centralize Security Hub findings for all accounts?

A Designate one account as the Security Hub administrator account and invite member accounts to send findings there.

B Enable Security Hub independently in each account without centralization.

C Use AWS Config rules to copy findings manually between accounts.

D Export findings from each account to S3 and aggregate externally.

💡 Hint

Consider AWS best practices for centralized security management.

A Security Hub administrator account can manage and view findings from all member accounts centrally, simplifying security oversight.