AWS Certified Security – Specialty — Question 435

A company is using an organization in AWS Organizations that contains 100 accounts. The company has configured trusted access for Amazon GuardDuty to AWS Organizations within the management account. The company has designated a member account to be the GuardDuty administrator for the organization.

GuardDuty is working properly and reports findings for the organization in the GaurdDuty console. The company wants a SecOps team to receive real-time email alerts from any GuardDuty finding within the organization that is high severity according the GuardDuty severity levels.

Which solution will meet these requirements?

Answer options

• A. In the management account, create a rule in Amazon EventBridge that will react to a GuardDuty finding that has a high severity level. Configure the rule to notify an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the SecOps team's email addresses to the SNS topic.
• B. Configure trusted access for AWS Config within the organization. Create a rule in AWS Config to monitor for any non-archived findings in GuardDuty. Create a rule in Amazon EventBridge that will react if AWS Config detects a compliance change for the AWS Config rule. Configure the EventBridge rule to target an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the SecOps team's email addresses to the SNS topic.
• C. In the GuardDuty delegated administrator account, configure a rule in Amazon EventBridge that will react to a GuardDuty finding that has a high severity level. Configure the rule to notify an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the SecOps team's email addresses to the SNS topic.
• D. Configure AWS CloudTrail for the organization in the management account. Create a rule in Amazon EventBridge that will run on a ListFindings API call. Configure the rule to notify an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the SecOps team's email addresses to the SNS topic.

Correct answer: C

Explanation

When Amazon GuardDuty is configured with a delegated administrator account in AWS Organizations, all security findings from the member accounts are automatically aggregated into that administrator account. Consequently, the Amazon EventBridge rule designed to detect high-severity findings must be deployed in this delegated administrator account to capture all organizational alerts. Deploying the rule in the management account or relying on CloudTrail API polling for ListFindings would fail to capture these real-time aggregated events correctly.