Security Hub overview in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable AWS Security Hub in a specific region.

AWS

aws securityhub [1] --region us-east-1

Drag options to blanks, or click blank then click option'

Aenable-security-hub

Bactivate

Cstart

Denable

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'start' or 'activate' which are not valid AWS CLI commands for Security Hub.

Using 'enable' which is not the correct command syntax.

The correct command to enable Security Hub is enable-security-hub. This activates Security Hub in the specified region.

2fill in blank

medium

Complete the code to list all findings in AWS Security Hub.

AWS

aws securityhub [1] --region us-west-2

Drag options to blanks, or click blank then click option'

Adescribe-findings

Blist-findings

Cshow-findings

Dget-findings

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'list-findings' which is not a valid Security Hub command.

Using 'describe-findings' which is used in other AWS services but not Security Hub.

The correct command to retrieve findings is get-findings. It returns the security findings detected by Security Hub.

3fill in blank

hard

Fix the error in the command to disable Security Hub.

AWS

aws securityhub [1] --region eu-central-1

Drag options to blanks, or click blank then click option'

Adelete

Bdisable-security-hub

Cdisable

Dstop

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'stop' or 'disable' which are not valid commands for Security Hub.

Using 'delete' which removes resources but is not the correct command here.

The correct command to disable Security Hub is disable-security-hub. Other options are invalid commands.

4fill in blank

hard

Fill both blanks to filter Security Hub findings by severity and resource type.

AWS

aws securityhub get-findings --filters SeverityLabel={Eq=[1],ResourceType={Eq=[2] --region us-east-2

Drag options to blanks, or click blank then click option'

AHIGH

BCRITICAL

CAwsEc2Instance

DAwsS3Bucket

Attempts:

3 left

💡 Hint

Common Mistakes

Using lowercase or unquoted values causing command errors.

Mixing resource types or severity labels incorrectly.

SeverityLabel should be set to CRITICAL to filter high severity findings. ResourceType should be AwsEc2Instance to filter findings related to EC2 instances.

5fill in blank

hard

Fill all three blanks to create a custom action in Security Hub.

AWS

aws securityhub create-action-target --name [1] --description [2] --identifier [3] --region ap-southeast-1

Drag options to blanks, or click blank then click option'

A"NotifyTeam"

B"Notify the security team of critical findings"

C"NotifyTeamAction"

D"AlertOps"

Attempts:

3 left

💡 Hint

Common Mistakes

Using the same value for name and id causing confusion.

Leaving description empty or too short.

The --name is a short identifier like "NotifyTeam". The --description explains the action purpose. The --identifier is a unique string identifier like "NotifyTeamAction".

Practice

1. What is the main purpose of AWS Security Hub?

easy

A. To manage user permissions

B. To create virtual machines

C. To show all your security alerts in one place

D. To store large amounts of data

Solution

1. Step 1: Understand Security Hub's role

   AWS Security Hub collects and shows security alerts from different services.

2. Step 2: Compare options with Security Hub's function

   Only To show all your security alerts in one place describes showing security alerts in one place, which matches Security Hub's purpose.

3. Final Answer:

   To show all your security alerts in one place -> Option C

4. Quick Check:

   Security Hub = central alert view [OK]

Hint: Security Hub centralizes security alerts [OK]

Common Mistakes:

• Confusing Security Hub with storage services
• Thinking Security Hub manages users
• Assuming it creates virtual machines

2. Which command is used to enable AWS Security Hub in your account?

easy

A. aws securityhub enable-security-hub

B. aws ec2 start-instances

C. aws s3 create-bucket

D. aws iam create-user

Solution

1. Step 1: Identify the command for enabling Security Hub

   The command to enable Security Hub is specific and includes 'securityhub' and 'enable-security-hub'.

2. Step 2: Eliminate unrelated commands

   Other options relate to EC2, S3, and IAM, which are unrelated to enabling Security Hub.

3. Final Answer:

   aws securityhub enable-security-hub -> Option A

4. Quick Check:

   Enable Security Hub = aws securityhub enable-security-hub [OK]

Hint: Enable Security Hub with aws securityhub enable-security-hub [OK]

Common Mistakes:

• Using EC2 or S3 commands by mistake
• Confusing IAM user creation with enabling Security Hub
• Missing the 'securityhub' part in the command

3. After enabling Security Hub, what will you see when you open the Security Hub console?

medium

A. A list of all your security findings from multiple AWS services

B. A dashboard showing your EC2 instance statuses

C. A list of your S3 buckets and their contents

D. A user management panel

Solution

1. Step 1: Understand what Security Hub displays

   Security Hub shows security findings collected from various AWS services in one place.

2. Step 2: Match options with Security Hub's display

   Only A list of all your security findings from multiple AWS services describes a list of security findings, which is what Security Hub shows.

3. Final Answer:

   A list of all your security findings from multiple AWS services -> Option A

4. Quick Check:

   Security Hub console = security findings list [OK]

Hint: Security Hub console shows security findings [OK]

Common Mistakes:

• Confusing Security Hub with EC2 or S3 consoles
• Expecting user management features in Security Hub
• Thinking it shows bucket contents

4. You enabled Security Hub but do not see any findings. What could be the reason?

medium

A. Security Hub is disabled automatically after enabling

B. No integrated AWS services are sending security data to Security Hub

C. You need to create an S3 bucket first

D. Security Hub only works in specific AWS regions

Solution

1. Step 1: Check data sources for Security Hub

   Security Hub shows findings only if integrated services send data to it.

2. Step 2: Evaluate other options

   Security Hub does not disable itself automatically; no S3 bucket is needed; it works in many regions but not limited to one.

3. Final Answer:

   No integrated AWS services are sending security data to Security Hub -> Option B

4. Quick Check:

   No findings = no data sent [OK]

Hint: Check if services send data to Security Hub [OK]

Common Mistakes:

• Assuming Security Hub disables itself
• Thinking S3 bucket is required
• Believing Security Hub is region-limited

5. You want to improve your cloud security by automatically aggregating findings from multiple AWS accounts into one Security Hub dashboard. What should you do?

hard

A. Manually copy findings from each account to a central S3 bucket

B. Create IAM users in each account and share credentials

C. Use EC2 instances to collect and forward security data

D. Enable Security Hub in the master account and invite member accounts to send findings

Solution

1. Step 1: Understand Security Hub multi-account setup

   Security Hub supports a master-member model where a master account aggregates findings from member accounts.

2. Step 2: Evaluate other options for aggregation

   Creating IAM users or manual copying is inefficient and insecure; EC2 instances are not used for this aggregation.

3. Final Answer:

   Enable Security Hub in the master account and invite member accounts to send findings -> Option D

4. Quick Check:

   Multi-account aggregation = master invites members [OK]

Hint: Use master account to aggregate member findings [OK]

Common Mistakes:

• Trying manual copying of findings
• Using IAM users instead of Security Hub invitations
• Relying on EC2 instances for aggregation