How can a DevOps engineer meet these requirements?

By:
In: DOP-C01
Tagged:
With: 1 Comment
A company has a single AWS account where active development occurs.The company’s security team has implemented Amazon GuardDuty, AWS Config, and AWS CloudTrail within the account.The security team wants to receive notifications in near real time for only high-severity findings from GuardDuty.The security team uses an Amazon Simple Notification Service (Amazon SNS) topic for notifications from other security tools in the account.

How can a DevOps engineer meet these requirements?

Configure an Amazon EventBridge (Amazon CloudWatch Events) rule that detects GuardDuty findings. Use an input transformer to detect high-severity event patterns. Configure the rule to publish a message to the SNS topic.

Configure an Amazon EventBridge (Amazon CloudWatch Events) rule that detects noncompliance with the guardduty-non-archived-findings AWS Config managed rule for high-severity GuardDuty findings. Configure the EventBridge (CloudWatch Events) rule to publish a message to the SNS topic.

Configure an Amazon EventBridge (Amazon CloudWatch Events) rule with an event pattern that matches GuardDuty ListFindings API calls with a high severity level. Configure the rule to publish a message to the SNS topic.

Configure an Amazon EventBridge (Amazon CloudWatch Events) rule with an event pattern that matches GuardOuty findings that have a high severity level within the event. Configure the rule to publish a message to the SNS topic.

2025-10-01

1 Comment

  1. Vincent
    Author

    In my opinion, the answer is:
    Configure an Amazon EventBridge (Amazon CloudWatch Events) rule with an event pattern that matches GuardOuty findings that have a high severity level within the event. Configure the rule to publish a message to the SNS topic.

Leave a Reply

Your email address will not be published. Required fields are marked *

3 × 5 =