SCS-C03 Detection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create a Security Hub Custom Action and an EventBridge rule that triggers the Lambda function based on the Action ID.

  Why this is correct

  Custom Actions provide a way to integrate human-led decisions into automated workflows. By defining a custom action in Security Hub, you create a target for findings. When triggered, the finding is sent to EventBridge, which then invokes the Lambda function to perform the isolation.

• ✗

  Use the Security Hub 'Auto-Remediate' feature to link a finding type directly to a Lambda function.

  Why it's wrong here

  Security Hub does not have a native 'Auto-Remediate' button that links directly to Lambda. Remediation is always handled through EventBridge. The engineer must explicitly set up the custom action and the corresponding EventBridge rule to facilitate the link between Security Hub and the Lambda function.

• ✗

  Configure a CloudWatch Alarm to monitor Security Hub findings and trigger an SNS topic for remediation.

  Why it's wrong here

  CloudWatch Alarms are not the correct mechanism for manual, finding-specific remediation in Security Hub. Alarms are based on metrics (counts of events) rather than individual finding details. Custom Actions in Security Hub provide the necessary context to remediate specific instances or resources identified in a finding.

• ✗

  Enable the 'Remediation' standard in Security Hub and select the 'Isolate EC2' managed rule.

  Why it's wrong here

  Security Hub standards (like CIS or AWS Foundational Security Best Practices) provide checks for compliance, but they do not include pre-built 'managed rules' for active remediation like isolating instances. Remediation logic must be custom-built or deployed using the AWS Security Hub Automated Response and Remediation solution.