SCS-C02 Threat Detection and Incident Response Practice Question

A company wants to automate the response to a specific GuardDuty finding. When GuardDuty detects a finding of type `UnauthorizedAccess:EC2/SSHBruteForce`, they want to automatically block the offending IP address using a network ACL. Which AWS service can they use to orchestrate this response?

⚠ Common exam trap

Watch out — candidates often assume AWS Lambda is the only option for custom automation, but the exam specifically tests knowledge of SSM Automation as a managed orchestration service that can perform remediation actions without writing code, especially when the question uses the word 'orchestrate'.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS Systems Manager Automation

AWS Systems Manager Automation is the correct service because it provides a runbook-based automation framework that can be triggered by Amazon EventBridge events from GuardDuty. When GuardDuty generates a finding of type `UnauthorizedAccess:EC2/SSHBruteForce`, an EventBridge rule can invoke an SSM Automation document that modifies the network ACL to block the offending IP address. This orchestration is natively supported by SSM Automation without requiring custom code, making it the ideal choice for automated incident response workflows.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
AWS Lambda
Why it's wrong here
Lambda is a serverless compute service, ideal for executing the custom code required to modify a Network ACL and block the offending IP address. However, it does not directly orchestrate the response by subscribing to GuardDuty findings itself. It requires an event-driven service, such as Amazon EventBridge, to detect the GuardDuty event and then invoke the Lambda function. Therefore, while crucial for performing the action, it is not the service that orchestrates the overall automated response from the GuardDuty finding.
✓
AWS Systems Manager Automation
Why this is correct
Systems Manager Automation is the correct service because it runs SSM runbooks in response to events via Amazon EventBridge. A GuardDuty finding event can invoke a public or custom runbook, which then performs steps such as updating a VPC Network ACL with a deny rule for the offending IP address. This service provides built-in approval gates, rollback controls, and parameterized execution, making it the native orchestration layer for GuardDuty-driven incident response rather than a mere compute or provisioning tool.
✗
AWS Config
Why it's wrong here
AWS Config records resource configurations and evaluates them against config rules, but it does not directly subscribe to GuardDuty findings or execute remediation actions. Its 'auto remediation' feature can trigger external actions such as SSM Automation runbooks or Lambda functions, which demonstrates that Config is only a compliance/assessment layer. For a live GuardDuty finding, no Config rule or event model allows Config to modify a NACL itself, so it cannot be the service orchestrating the automated response.
✗
AWS CloudFormation
Why it's wrong here
CloudFormation is an infrastructure-as-code service used to provision and update stacks at deploy time, not to react to runtime security events. While a template could define NACL entries or include a custom resource backed by Lambda, applying that template is a manual or CI/CD-driven action, not an event-triggered response to a specific GuardDuty finding. Relying on CloudFormation would require updating the entire stack, making it unsuitable for the low-latency, targeted remediation needed to quickly block an attacker's IP address.

Visual reference

Go deeper

SCS-C02 Threat Detection and Incident Response Practice Question

Why each option matters

Option-by-option breakdown

Related to this question