AWS Certified DevOps Engineer - Professional DOP-C02 — Topic 1 Question 137

Question

A company manages a multi-tenant environment in its VPC and has configured Amazon GuardDuty for the corresponding AWS account. The company sends all GuardDuty findings to AWS Security Hub. Traffic from suspicious sources is generating a large number of findings. A DevOps engineer needs to implement a solution to automatically deny traffic across the entire VPC when GuardDuty discovers a new suspicious source. Which solution will meet these requirements?

Accepted Answer

Correct answer: C. The correct answer is C. Option C: Configure a firewall in AWS Network Firewall. Create an AWS Lambda function that will create a Drop action rule in the firewall policy. Configure the Lambda function to run in response to new Security Hub findings tha... AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon GuardDuty continuously monitors for threats and malicious activity. AWS Security Hub centralizes security findings and compliance checks.

AWS Certified DevOps Engineer - Professional DOP-C02 — Question 137