AWS Certified Cloud Practitioner (CLF-C02)Security and ComplianceHard
A security engineer wants a single dashboard that aggregates and prioritizes findings from GuardDuty, Inspector, and AWS Config, and evaluates the account against industry standards like the CIS AWS Foundations Benchmark. Which service should the engineer use?
- AAmazon Macie
- BAWS Systems Manager
- CAWS Security Hub
- DAWS Trusted Advisor
Show answer & explanationAnswer & explanation
Correct answer: C. AWS Security Hub
AWS Security Hub aggregates, organizes, and prioritizes security findings from multiple AWS services (like GuardDuty, Inspector, and Config) and third-party tools, and it also runs automated checks against standards such as the CIS AWS Foundations Benchmark.
Why the other options are wrong
- A. Macie focuses on discovering and protecting sensitive data in S3, not aggregating cross-service security findings.
- B. Systems Manager provides operational management tools, not a centralized security findings dashboard.
- D. Trusted Advisor offers general best-practice checks across cost, performance, and security, but does not aggregate findings from other security services.
AWS Security Hub
A service that provides a comprehensive view of security alerts and compliance status by aggregating findings from multiple AWS security services and standards.
- Aggregates findings from GuardDuty, Inspector, Macie, and Config
- Runs automated compliance checks (e.g., CIS AWS Foundations Benchmark, PCI DSS)
- Provides a unified security score and prioritized findings dashboard
Memory trick: Security Hub is mission control gathering all the security alarms.