Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 101 discussion

D is not right because you need to perform a few activities to establish connection b/w Opensearch and QuickSight which is missing in choice D

This option involves using EventBridge to handle the GuardDuty findings and then routing them to two targets: Streaming the findings through Kinesis Data Firehose into an Amazon OpenSearch Service domain for visualization. Sending email alerts to the security team via SNS, with event pattern matching to filter only high severity findings. This approach leverages the flexibility of EventBridge to manage the workflow and routing of events to different services based on specific criteria.

C - it filters only High alerts.

https://github.com/aws-samples/siem-on-amazon-opensearch-service

D is correct due to Quicksight which is AWS's preferred visualization tool. The blog linked below is dated (from 2018), and while still valid not the best way to do visualization in AWS. You can still use the OS querry in Quicksight. https://docs.aws.amazon.com/quicksight/latest/user/connecting-to-os.html

According to this AWS article, it is GuardDuty -> EventBrdige -> Firehouse -> OpenSearch -> OpenSearch visualization. https://aws.amazon.com/blogs/security/visualizing-amazon-guardduty-findings/

Vote for C

QuickSight is the hint for Visualization.

Option D is the correct solution. GuardDuty can send findings to Amazon EventBridge. EventBridge can then stream to targets like Kinesis Data Streams to process and store the findings, and SNS to send email alerts. Using EventBridge event pattern matching allows filtering findings based on properties like severity. Kinesis Data Streams can feed findings into OpenSearch Service. OpenSearch Dashboards or Amazon QuickSight can visualize the findings, while OpenSearch queries can provide analysis. Option A is incorrect because GuardDuty integrates with EventBridge, not CloudWatch Alarms. Option B is incorrect because GuardDuty integrates with EventBridge, not CloudTrail. Option C is incorrect because Kinesis Data Firehose would not allow querying and analysis of findings - Kinesis Data Streams enables this with OpenSearch.

correct

https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_settingup.html#setup-sns https://aws.amazon.com/blogs/big-data/audit-aws-service-events-with-amazon-eventbridge-and-amazon-kinesis-data-firehose/ https://aws.amazon.com/blogs/big-data/ingest-streaming-data-into-amazon-elasticsearch-service-within-the-privacy-of-your-vpc-with-amazon-kinesis-data-firehose/

C gets the job done

correct