What's changed: In-scope coverage (fix): added AWS WAF (L7 web protection; SQLi/XSS/rate-limit via IaC) to the Network Firewall block (closes an Axis-B textbook gap)
6.2Threat Detection and Compliance Automation
Understand continuous security governance—GuardDuty, Security Hub, AWS Config, Inspector, Macie, and auto-remediation. Run detect/evaluate/remediate automatically.
Security must be continuously automated: detect threats, evaluate configuration compliance, and auto-remediate drift.
6.2.1Detect, evaluate, remediate
- GuardDuty: ML analysis of logs to detect threats/anomalies.
- AWS Config: continuously evaluate configuration against rules, detecting drift (with remediation).
- Inspector / Macie: Inspector = vulnerability scanning (EC2/ECR), Macie = sensitive-data discovery in S3.
- Security Hub: aggregate and score findings across services/accounts.
Common on DOP-C02: threat detection = GuardDuty, config compliance/drift = Config, vulnerability scanning = Inspector, S3 sensitive-data discovery = Macie, central finding aggregation = Security Hub, plus detect → EventBridge → auto-remediate. Don’t mix up the roles (detect/evaluate/scan/aggregate).
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.