How to Automate GuardDuty Incident Response Using Lambda and EventBridge
A security engineer is configuring automated response to a specific GuardDuty finding type. The engineer wants to automatically block the offending IP address in the security group when a finding is generated. Which TWO AWS services should the engineer use together to achieve this? (Choose TWO.)
Quick Answer
The correct answer is Amazon EventBridge and AWS Lambda. EventBridge captures GuardDuty findings as structured events and routes them to Lambda based on rules matching a specific finding type, such as UnauthorizedAccess:EC2/SSHBruteForce. Lambda then executes custom code to modify the security group, removing the offending IP address by revoking the relevant ingress rule. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of event-driven security automation and the integration between GuardDuty, EventBridge, and Lambda. A common trap is selecting Amazon CloudWatch Events instead of EventBridge—remember that EventBridge is the modern, recommended service for event bus patterns and offers richer filtering. Another trap is choosing AWS Config, which is for compliance and resource tracking, not real-time event response. Memory tip: think "GuardDuty finds it, EventBridge binds it, Lambda blocks it."
⚠ Common exam trap
Watch out — candidates often choose SNS because it is commonly associated with GuardDuty alerts, but they overlook that SNS cannot perform API actions like modifying security groups—only Lambda or Step Functions can execute the remediation logic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Lambda
Amazon EventBridge [CORRECT] is the right service to detect the GuardDuty finding event, because GuardDuty publishes its findings as events to the default EventBridge event bus, and an EventBridge rule can match the specific finding type (e.g., source aws.guardduty with the desired detail-type) and route it to a target for automated response. AWS Lambda [CORRECT] is the correct target to perform the remediation, since a Lambda function can call the EC2 APIs (such as AuthorizeSecurityGroupIngress/RevokeSecurityGroupIngress or ModifyNetworkInterfaceAttribute) to block the offending IP address in the security group. AWS Config is for recording resource configuration changes and evaluating compliance rules, not for event-driven remediation of GuardDuty findings. Amazon SNS can deliver notifications but cannot itself modify security groups, so it does not perform the blocking action. Amazon CloudWatch Logs stores log data but does not react to GuardDuty findings or execute remediation logic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Lambda
Why this is correct
Lambda executes custom remediation logic when GuardDuty publishes a finding to EventBridge, calling EC2 APIs to revoke the offending IP from the security group. It supplies the compute that performs the block, which the detection service alone cannot do.
- ✗
AWS Config
Why it's wrong here
AWS Config records resource configuration changes and evaluates compliance rules; it cannot itself invoke the security group modification GuardDuty findings require. It is tempting because Config can detect and remediate non-compliant security groups via automatic remediation, which would be the right choice for enforcing configuration drift, not for reacting to a threat-detection event.
- ✗
Amazon Simple Notification Service (SNS)
Why it's wrong here
SNS only fans out notifications to subscribers; it cannot call the EC2 AuthorizeSecurityGroupIngress or RevokeSecurityGroupIngress API to modify a security group. It is tempting because SNS is the standard delivery mechanism for GuardDuty findings, and would be correct if the requirement were merely to alert an on-call engineer rather than block the IP automatically.
- ✓
Amazon EventBridge
Why this is correct
EventBridge ingests the GuardDuty finding as an event and routes it by rule to a target, enabling the automated response chain. It provides the event-driven trigger that invokes the remediation logic which revokes the offending IP in the security group.
- ✗
Amazon CloudWatch Logs
Why it's wrong here
CloudWatch Logs stores and queries log data; it has no mechanism to invoke the security group API and modify ingress rules. It is tempting because GuardDuty findings can be exported to CloudWatch Logs for retention and analysis, which would suit a logging or forensic investigation requirement, not an automated blocking response.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer is setting up automated incident response for a compromised EC2 instance. The engineer wants to isolate the instance immediately upon detection of a GuardDuty finding. Which AWS service can be used to automatically trigger a Lambda function that modifies the instance's security group?
medium- A.AWS Step Functions
- B.Amazon Inspector
- ✓ C.Amazon CloudWatch Events
- D.AWS Config
Why C: Amazon CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches specific GuardDuty finding events. When a finding is detected, the rule triggers a Lambda function that can modify the EC2 instance's security group to isolate it, for example by removing all inbound rules or replacing the group with a restrictive one. This provides the automated, event-driven response required.
Variation 2. A security engineer is configuring an automated response to a GuardDuty finding that indicates a compromised EC2 instance. The engineer wants to isolate the instance by changing its security group to a 'quarantine' group. Which AWS service is BEST suited to automate this response?
easy- A.AWS Step Functions
- B.AWS Config
- ✓ C.Amazon EventBridge
- D.AWS Systems Manager Automation
Why C: Amazon EventBridge is the best choice because it can directly receive GuardDuty findings as events and trigger an automated response, such as invoking a Lambda function or Systems Manager Automation runbook to change the EC2 instance's security group to a quarantine group. EventBridge provides native integration with GuardDuty via its default event bus, enabling real-time, event-driven automation without additional orchestration overhead.
Variation 3. A security engineer is implementing automated incident response. The engineer wants to use AWS Lambda to automatically remediate GuardDuty findings. What is the recommended pattern to trigger the Lambda function?
medium- ✓ A.Configure an Amazon EventBridge rule to match GuardDuty findings and invoke the Lambda function.
- B.Subscribe the Lambda function to an SNS topic that GuardDuty publishes findings to.
- C.Use CloudWatch Logs subscription filter to trigger Lambda on GuardDuty log entries.
- D.Have the Lambda function poll the EC2 instance metadata for threat indicators.
Why A: Amazon EventBridge is the recommended pattern because it natively integrates with AWS GuardDuty to receive all finding events in near real-time. By configuring an EventBridge rule that matches GuardDuty finding types (e.g., 'UnauthorizedAccess:EC2/SSHBruteForce'), you can directly invoke a Lambda function for automated remediation without polling or intermediate services. This pattern is serverless, event-driven, and follows AWS best practices for decoupled incident response.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.