High-severity GuardDuty findings on an instance should trigger automatic isolation — quarantine SG swap, EBS snapshots — within minutes, day or night. What's the response architecture?
A.On-call engineer checks Security Hub each morning
Hours of exposure window — too slow.
B.EventBridge on high-severity GuardDuty findings → Lambda/SSM runbook performing quarantine + evidence capture
Correct. Event-driven containment in minutes.
C.Daily Config evaluation
Config checks config, not threat findings.
D.CloudWatch dashboard review
Dashboards observe — they don't act.
Why this answer
GuardDuty emits findings as EventBridge events — matching high-severity rules to a Lambda/SSM runbook enables consistent, immediate, documented response (quarantine SG, snapshot for forensics, notify). Human review follows the automated containment.
Correct answer: B · Last reviewed 2026-11-04
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Incident Response practice session.
Practice Incident Response