CCSP Cloud Security Operations Practice Question
A cloud security operations team is configuring AWS Security Hub to automatically send all findings to a third-party ticketing system. They need a solution that requires minimal custom code and supports filtering by severity. Which AWS service should they use to route the findings?
⚠ Common exam trap
The trap here is assuming that SNS can filter messages by content without additional processing, but SNS only supports attribute-based filtering which requires the publisher to set attributes, not automatically derived from finding severity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon EventBridge
EventBridge natively integrates with Security Hub, allowing findings to be matched against event patterns and routed to targets. This enables severity-based filtering and delivery to external systems with minimal custom code, making it the ideal choice for automated ticketing integration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudTrail
Why it's wrong here
CloudTrail records API activity across the AWS account, but it does not process Security Hub findings or route them to external systems. While CloudTrail logs could be analyzed, it would require building a custom solution to parse and forward events, which does not meet the minimal custom code requirement.
- ✗
Amazon SNS
Why it's wrong here
Amazon SNS can deliver notifications, but it lacks built-in filtering for Security Hub finding attributes like severity. To filter by severity, you would need to implement custom logic, which contradicts the minimal custom code requirement. SNS alone cannot route findings based on severity without additional processing.
- ✗
AWS Config
Why it's wrong here
AWS Config evaluates resource configurations against rules and can send compliance notifications, but it does not natively forward Security Hub findings to ticketing systems. Using Config would require additional automation and does not provide the event-driven filtering needed for severity-based routing.
- ✓
Amazon EventBridge
Why this is correct
Amazon EventBridge can receive Security Hub findings as events, filter them based on severity or other attributes, and route them to targets such as AWS Lambda or directly to a ticketing system's API endpoint. This requires minimal custom code because EventBridge rules can match patterns and invoke targets without writing complex polling logic.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.