SCS-C02 Threat Detection and Incident Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use AWS Security Hub with cross-account aggregation and Amazon EventBridge to trigger AWS Systems Manager Automation runbooks.

  Why this is correct

  Security Hub's cross-account aggregation consolidates findings from all member accounts into a single delegated administrator account, enabling a central view of threats. You can then create EventBridge rules that match specific finding types and trigger Systems Manager Automation runbooks, which can execute remediation actions directly in the affected member account. This provides centralized, event-driven response without manually managing each account individually.

• ✗

  Enable Amazon GuardDuty in all accounts and use its built-in remediation actions.

  Why it's wrong here

  Amazon GuardDuty's built-in remediation actions are largely per-account and operate only within a single account's environment; they do not aggregate findings or orchestrate actions across multiple accounts. While GuardDuty can generate findings and some rules can trigger Lambda or S3 actions, it lacks a central management plane for coordinated incident response across all accounts in an organization. Therefore, relying solely on GuardDuty's built-in actions would require configuring and managing each account separately, which is not a centralized solution.

• ✗

  Configure AWS CloudFormation StackSets to deploy incident response stacks in all accounts.

  Why it's wrong here

  CloudFormation StackSets are designed to deploy infrastructure as code across multiple accounts and regions, such as creating security templates, IAM roles, or baseline resources. However, they are not event-driven and do not react to live findings; deploying an 'incident response stack' does not automatically execute a response when a security finding occurs. You would still need an event mechanism, such as EventBridge, to invoke actions, making StackSets an infrastructure provisioning tool rather than an actual response orchestration solution.

• ✗

  Deploy an AWS Lambda function in each member account to respond to findings.

  Why it's wrong here

  Deploying an individual Lambda function in each member account to respond to findings would require per-account deployment, configuration, and permission management, creating significant operational overhead. It also fragments visibility, since there is no central aggregator or coordinated trigger to ensure consistent and timely responses across the organization. This approach lacks the centralized aggregation and orchestration that Security Hub plus EventBridge provides, making it less effective and harder to govern.

Go deeper

Related to this question