How to Automate GuardDuty Incident Response Using Lambda and EventBridge
A security engineer is configuring automated response to a specific GuardDuty finding type. The engineer wants to automatically block the offending IP address in the security group when a finding is generated. Which TWO AWS services should the engineer use together to achieve this? (Choose TWO.)
Quick Answer
The correct answer is Amazon EventBridge and AWS Lambda. EventBridge captures GuardDuty findings as structured events and routes them to Lambda based on rules matching a specific finding type, such as UnauthorizedAccess:EC2/SSHBruteForce. Lambda then executes custom code to modify the security group, removing the offending IP address by revoking the relevant ingress rule. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of event-driven security automation and the integration between GuardDuty, EventBridge, and Lambda. A common trap is selecting Amazon CloudWatch Events instead of EventBridge—remember that EventBridge is the modern, recommended service for event bus patterns and offers richer filtering. Another trap is choosing AWS Config, which is for compliance and resource tracking, not real-time event response. Memory tip: think "GuardDuty finds it, EventBridge binds it, Lambda blocks it."
⚠ Common exam trap
Watch out — candidates often choose SNS because it is commonly associated with GuardDuty alerts, but they overlook that SNS cannot perform API actions like modifying security groups—only Lambda or Step Functions can execute the remediation logic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Lambda
AWS Lambda is correct because it can execute custom code to modify security group rules, such as removing an offending IP address. Amazon EventBridge is correct because it can capture GuardDuty findings as events and trigger the Lambda function in response to a specific finding type. Together, they enable automated, event-driven remediation without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Lambda
Why this is correct
Lambda can run code to modify security groups based on the finding details.
- ✗
AWS Config
Why it's wrong here
Config is used for compliance and configuration tracking, not for real-time automated response.
- ✗
Amazon Simple Notification Service (SNS)
Why it's wrong here
SNS can send notifications but cannot directly execute actions on security groups.
- ✓
Amazon EventBridge
Why this is correct
EventBridge can receive GuardDuty findings and invoke a Lambda function.
- ✗
Amazon CloudWatch Logs
Why it's wrong here
CloudWatch Logs is for storing logs, not for triggering automated responses.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer is setting up automated incident response for a compromised EC2 instance. The engineer wants to isolate the instance immediately upon detection of a GuardDuty finding. Which AWS service can be used to automatically trigger a Lambda function that modifies the instance's security group?
medium- A.AWS Step Functions
- B.Amazon Inspector
- ✓ C.Amazon CloudWatch Events
- D.AWS Config
Why C: Amazon CloudWatch Events (now part of Amazon EventBridge) can be configured with a rule that matches specific GuardDuty finding events. When a finding is detected, the rule triggers a Lambda function that can modify the EC2 instance's security group to isolate it, for example by removing all inbound rules or replacing the group with a restrictive one. This provides the automated, event-driven response required.
Variation 2. A security engineer is configuring an automated response to a GuardDuty finding that indicates a compromised EC2 instance. The engineer wants to isolate the instance by changing its security group to a 'quarantine' group. Which AWS service is BEST suited to automate this response?
easy- A.AWS Step Functions
- B.AWS Config
- ✓ C.Amazon EventBridge
- D.AWS Systems Manager Automation
Why C: Amazon EventBridge is the best choice because it can directly receive GuardDuty findings as events and trigger an automated response, such as invoking a Lambda function or Systems Manager Automation runbook to change the EC2 instance's security group to a quarantine group. EventBridge provides native integration with GuardDuty via its default event bus, enabling real-time, event-driven automation without additional orchestration overhead.
Variation 3. A security engineer is implementing automated incident response. The engineer wants to use AWS Lambda to automatically remediate GuardDuty findings. What is the recommended pattern to trigger the Lambda function?
medium- ✓ A.Configure an Amazon EventBridge rule to match GuardDuty findings and invoke the Lambda function.
- B.Subscribe the Lambda function to an SNS topic that GuardDuty publishes findings to.
- C.Use CloudWatch Logs subscription filter to trigger Lambda on GuardDuty log entries.
- D.Have the Lambda function poll the EC2 instance metadata for threat indicators.
Why A: Amazon EventBridge is the recommended pattern because it natively integrates with AWS GuardDuty to receive all finding events in near real-time. By configuring an EventBridge rule that matches GuardDuty finding types (e.g., 'UnauthorizedAccess:EC2/SSHBruteForce'), you can directly invoke a Lambda function for automated remediation without polling or intermediate services. This pattern is serverless, event-driven, and follows AWS best practices for decoupled incident response.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.