A company has a single AWS account and uses an Amazon EC2 instance to test application code. The company recently discovered that the instance was…

This solution establishes a complete, automated workflow for threat detection and notification. First, Amazon GuardDuty is enabled to provide continuous, intelligent threat detection. It analyzes various data sources to identify malicious activities, such as the EC2 instance compromise described. Second, an Amazon SNS topic is created, and the security team's email is subscribed to it, establishing the required notification channel. Finally, an Amazon EventBridge rule acts as the automation engine. This rule is configured to listen for findings from GuardDuty, filter specifically for those marked as "high severity," and then automatically publish a message to the SNS topic, which in turn sends an email to the security team. This combination directly meets all requirements efficiently.

A. Enable AWS Security Hub in the AWS account.

Security Hub aggregates findings but does not generate them. GuardDuty is the service that would generate the finding for a compromised EC2 instance, making it the more direct and fundamental choice.

D. Create an Amazon Simple Queue Service (Amazon SQS) queue. Subscribe the security team's email distribution list to the queue.

Amazon SQS is a message queuing service for decoupling applications; you cannot subscribe an email address directly to an SQS queue for notifications. Amazon SNS is the correct service for this purpose.

F. Create an Amazon EventBridge rule for Security Hub findings of high severity. Configure the rule to publish a message to the queue.

This option is incorrect for two reasons: it uses an SQS queue for notification, which is not appropriate for email, and it relies on Security Hub, which is less direct than using the finding's source (GuardDuty).

1. Amazon GuardDuty User Guide: "Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, and data stored in Amazon S3." This supports enabling GuardDuty (Option B) for detecting compromises.

Source: AWS Documentation, Amazon GuardDuty User Guide, "What is Amazon GuardDuty?", p. 1.

2. Amazon GuardDuty User Guide: "When GuardDuty generates a finding, it sends a finding event to Amazon EventBridge... You can create a rule in EventBridge that uses a custom event pattern to filter findings... and route them to a target, such as an Amazon SNS topic." This directly validates the workflow of using EventBridge to filter GuardDuty findings (Option E) and send them to an SNS topic (Option C).

Source: AWS Documentation, Amazon GuardDuty User Guide, "Tutorial: Setting up a custom response to GuardDuty findings with Amazon EventBridge".

3. Amazon Simple Notification Service Developer Guide: "Amazon Simple Notification Service (Amazon SNS) is a web service that coordinates and manages the delivery or sending of messages to subscribing endpoints or clients... You can also use Amazon SNS to send notifications to end users, using mobile push, SMS, and email." This confirms SNS (Option C) is the correct service for email notifications.

Source: AWS Documentation, Amazon SNS Developer Guide, "What is Amazon SNS?".

4. Amazon EventBridge User Guide: "An event pattern defines the structure and the fields that an event must contain for the rule to match... For example, you can create a rule that matches events from a specific AWS service, such as Amazon GuardDuty, and filters based on the 'severity' field in the event detail." This supports using EventBridge to filter for high-severity findings (Option E).

Source: AWS Documentation, Amazon EventBridge User Guide, "Event patterns in EventBridge".