The security team needs a continuously evaluated CIS benchmark score across accounts, with findings from GuardDuty/Inspector/Config aggregated in one place. Which service provides this?
A.AWS Config alone
Config checks resource configs — no cross-service aggregation.
B.Security Hub — standards (CIS, PCI DSS, FSBP) + cross-service finding aggregation
Correct. Standards scoring + finding aggregation.
C.GuardDuty
GuardDuty is one detection source, not the aggregator.
D.AWS Artifact
Artifact distributes compliance reports — not live scoring.
Why this answer
Security Hub is the security posture center: enables security standards (CIS AWS Foundations, PCI DSS, AWS Foundational Security Best Practices) as scored controls and normalizes findings from GuardDuty, Inspector, Macie, Config — single pane of glass. Each detector is a source; Hub aggregates.
Correct answer: B · Last reviewed 2026-11-03
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Detection & Response practice session.
Practice Detection & Response