CCSP Cloud Security Operations Practice Question
A security operations team is using AWS Security Hub to aggregate findings from multiple AWS accounts. They want to automatically create a ticket in their IT service management (ITSM) system for any new critical finding. The ITSM system exposes a REST API. Which AWS service should they use to invoke the ITSM API when a critical finding is generated?
⚠ Common exam trap
The trap here is assuming that SNS or CloudTrail can directly invoke an external REST API based on Security Hub findings, when EventBridge is the native integration point.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon EventBridge
Security Hub integrates with EventBridge by sending findings as events. EventBridge rules can filter for critical findings and route them to targets like Lambda or API destinations. API destinations allow EventBridge to invoke external REST APIs directly, enabling automatic ticket creation in the ITSM system without custom code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudTrail
Why it's wrong here
CloudTrail logs API activity in your AWS account but does not process findings or trigger actions based on them. It cannot invoke external APIs. While it can log Security Hub API calls, it is not an event-driven service for responding to findings. Using CloudTrail would not automate ticket creation.
- ✓
Amazon EventBridge
Why this is correct
Security Hub publishes findings to EventBridge as events. You can create an EventBridge rule that matches critical findings and targets an AWS Lambda function or directly an API destination. EventBridge supports API destinations, allowing you to invoke external REST APIs. This enables automatic ticket creation in the ITSM system when a critical finding occurs.
- ✗
AWS Config
Why it's wrong here
AWS Config evaluates resource configurations against rules and can trigger remediation, but it does not process Security Hub findings. It is not designed to integrate with external ITSM systems directly. Config rules are for configuration compliance, not for security finding response. Therefore, it cannot invoke the ITSM API based on Security Hub findings.
- ✗
Amazon Simple Notification Service (SNS)
Why it's wrong here
SNS can send notifications, but it cannot directly invoke a REST API. You could use SNS to trigger a Lambda function that calls the API, but SNS alone does not have the capability to make HTTP requests to external endpoints. Additionally, Security Hub does not natively publish findings to SNS; it publishes to EventBridge. So SNS would require additional integration.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.