Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 166 discussion

acd are correct answer

My answer is A. Create an AWS Config custom rule to detect configuration changes to AWS resources. Create an AWS Lambda function to remediate the AWS resources in the delegated administrator AWS account. My answer is D. Create an Amazon EventBridge event rule to Invoke an AWS Lambda function that will take action on AWS resources. My answer is E. Create an Amazon EventBridge event rule to invoke an AWS Lambda function that will evaluate AWS resource configuration for a set of API requests and create a finding for noncompllant AWS resources.

Option A: Creating an AWS Config custom rule and a Lambda function for remediation is a good choice for detecting and responding to configuration changes. Option D: Using an EventBridge event rule to invoke a Lambda function is also a good choice for taking action on AWS resources based on events. Option E: While creating an EventBridge event rule to evaluate AWS resource configuration and create findings for non-compliant resources is useful, it does not directly address the need for near-real-time remediation. It focuses more on evaluation and logging rather than immediate action. By including Option C (Security Hub custom action), you ensure that Security Hub findings can trigger EventBridge rules, which then invoke Lambda functions for remediation. This creates a more integrated and automated response system, aligning with the requirement for near-real-time response and remediatio

(A) for config rule creation which is the main detection of config change, this will generate a SecurityHub finding as mentioned in the question to be already enabled. (C) Security hub can invoke event bridge. (D) eventbridge can invoke lambda at which point we can do anything

I will go for ACD

ADE is most correct answer

CDE are correct answers