Day 5 - Week 14 Comprehensive Review: The Big Picture of Security Automation Stack and Practical Scenarios

Week 14 is summarized in one sentence — "Detect (detect), Aggregate (aggregate), Assess (assess), Prove (prove), and Respond automatically (respond)." GuardDuty detects threats, Security Hub integrates all Findings into ASFF, Config assesses resource compliance, Audit Manager, Macie, Inspector, and Access Analyzer handle audit evidence, sensitive data, vulnerabilities, and external exposure, and all of these connect to automated response via EventBridge → SSM Automation/Lambda. Today we reassemble these five pieces into one picture and verify end-to-end application with 12 practical scenario questions.

The Big Picture — How Five Pieces Fit Together

                    [Data Plane Logs & Resource State]
                              │
   ┌──────────────┬──────────┼──────────────┬─────────────────┐
   ▼              ▼          ▼              ▼                 ▼
GuardDuty      Inspector   Macie      Access Analyzer       Config
(Threats/Behavior) (CVE Vulns) (Sensitive Data) (External/Unused) (Resource Compliance)
   │              │          │              │                 │
   └──────────────┴──────────┴──── ASFF ────┴─────────────────┘
                              │
                              ▼
                    ┌──────────────────┐
                    │   Security Hub   │  ← Normalization, Dedup, Priority, Std Evals
                    │ (Single Source   │     FSBP/CIS/PCI/NIST
                    │   of Truth)      │
                    └─────────┬────────┘
                              │
              ┌───────────────┼────────────────┐
              ▼               ▼                ▼
        Custom Action   Automation Rule   Findings-Imported
        (Manual HITL)   (Field Updates)    → EventBridge
                                                 │
                              ┌──────────────────┴─────────┐
                              ▼                            ▼
                      SSM Automation Runbook          Lambda
                      (Isolation/Snapshot/Remediate) (Custom Response)

  [Audit]  Audit Manager → SOC2/HIPAA/PCI Evidence Auto-Collection → Assessment Report
  [Governance] Firewall Manager (Central WAF/Shield)  │  CloudTrail Lake (7-year SQL Investigation)
  [Multi-Account] Delegated Administrator  │  [Multi-Region] Region/Config Aggregator

The core principles running through this are three-fold. First, all signals converge to Security Hub as ASFF — normalizing different tool outputs into one language is the prerequisite for automation. Second, automated response splits by risk and reversibility — safe and reversible means full automation (Imported→Lambda), destructive means human approval (Custom Action HITL). Third, multi-account is Delegated Administrator and multi-region is Aggregator — orthogonal axes for unification.

Service Role Boundaries — Organizing Confusing Pairs

💡 Related Theory: This entire stack organizes under NIST's Cybersecurity Framework (CSF) 5 functions. Identify Config, Macie, Access Analyzer / Protect Firewall Manager, Conformance Pack, KMS / Detect GuardDuty, Inspector, Security Hub / Respond EventBridge→SSM, Lambda / Recover Snapshots, backups, PITR. In scenarios, diagnosing "which CSF step is missing" quickly reveals what to add. NIST CSF, created 2014 under U.S. Executive Order (EO 13636) for critical infrastructure protection, added a sixth Govern function in 2024 CSF 2.0 — governance is the policy, role, risk-management layer spanning the five functions, handled in AWS by Organizations, Control Tower, SCP.

🔍 Deeper: Another principle running through the stack is defense in depth. Don't rely on a single control; stack detection, prevention, and response in multiple layers so one layer's breach is stopped by the next — a medieval castle's moat-wall-keep structure borrowed for infosec (NSA applies it). Week 14 tools fill different layers: Firewall Manager, Config (prevention, block misconfig), GuardDuty, Inspector (detection, catch after breach), EventBridge→SSM (response, auto-isolate), CloudTrail Lake (forensics, what happened). The Capital One incident (Day 1) showed that when one layer (WAF misconfiguration) breaks and the next layer (credential theft detection and auto-disable) is missing, damage cascades — defense-in-depth absence becomes a single point of failure.

📝 Practice Questions

Click a choice to reveal the answer and explanation.

Question 1

GuardDuty detected Backdoor:EC2/C&CActivity.B!DNS (Severity 8.7) on production EC2. Automate: ①preserve forensic evidence ②network isolation ③ops team alert, without human involvement, yet investigators must access the instance to examine what the attacker did. What's the correct auto-response sequence?

• ATerminate instance immediately to cut C2 comms, SNS to ops — maximum threat blockade first
• BEventBridge (severity≥7 + type prefix filter) → SSM Runbook: EBS snapshot (first) → swap to isolation SG → tag incident-id → SNS alert
• CLambda reboots instance to kill malware, then snapshot for evidence
• DCustom Action for operator approval before snapshot/isolation to prevent false positive damage

Question 2

Organization: 50 accounts × 3 regions. View all accounts/regions' security Findings from Audit account console. What's the correct setup?

• ADelegated Administrator only for 50 accounts (represent regions by one region)
• BRegion Aggregator only for 3 regions (connect accounts individually)
• CDelegated Administrator (50-account unification) + Cross-Region Aggregation (3-region unification)
• DManually check each account/region console, aggregate Finding counts on CloudWatch dashboard

Question 3

FSBP standard S3.1 (Block Public Access) control is FAILED on bucket. Auto-remediate to private without human intervention. What's correct?

• ASecurity Hub Automation Rule matches S3.1 FAILED, auto-fixes bucket private
• BEventBridge (Security Hub Findings - Imported, GeneratorId prefix S3.1, Compliance FAILED) → Lambda applies Block Public Access
• CCustom Action lets operator select this Finding in console and trigger private-ness
• DSuppression Rule hides S3.1 FAILED Findings to reduce noise, batch-remediate in periodic review

Question 4

Deploy PCI DSS/NIST 800-53 rule bundles org-wide (OU) with auto-remediation. What's the tool?

• AManually create PCI/NIST Config Rules per account, attach Remediation individually
• BConformance Pack (Config Rule + Remediation bundles in YAML) deployed to OU via internal StackSets
• CEnable Security Hub PCI/NIST Standards only for org-wide control evaluation
• DDeploy Audit Manager's PCI/NIST Framework for control evaluation and auto-remediation

Question 5

Auto-Remediation flaps: same resource endlessly corrects-violates, API throttles, costs explode. Root cause and safety valve?

• ANormal remediation behavior; just raise throttle limits and accept costs
• BExternal process keeps returning resource to NON_COMPLIANT + MaximumAutomaticAttempts not set — limit retries with MaxAttempts/RetrySeconds, tag justified exceptions
• CDisable auto-Remediation for that rule, batch-fix manually
• DMigrate workload to lower-API-load region to reduce throttle pressure

Question 6

ECR container push: auto-scan OS + npm/pip dependency CVEs, auto-re-evaluate on new CVE disclosure. What's correct?

• AMacie Discovery Job scans ECR image layers for dependency vulns and sensitive data together
• BInspector v2 ECR Enhanced Scanning — OS+language dependency CVE scan + continuous re-eval on new CVE, Findings→Security Hub
• CGuardDuty Malware Protection detects malware and package CVEs at runtime
• DConfig Rule evaluates ECR repo's scan settings compliance, detects unscanned images

Question 7

Large S3 data lake (hundreds TB): auto-discover card numbers/SSNs, control costs. What's the strategy?

• AFull-scan Discovery Job daily for complete card/SSN capture, no missed data
• BMacie auto-discovery (sampling-based continuous monitoring, low cost) + incremental Discovery Job for new/changed only, Luhn validation reduces false positives
• CDownload all objects to EC2, run custom regex script for manual checking
• DSkip Macie, use S3 Inventory + Athena regex query for low-cost direct detection

Question 8

Find S3/roles exposed to external accounts/public without missing cases. Shrink IAM permissions to observation-based least privilege. What's the combo?

• AGuardDuty external-access Findings + IAM Access Advisor to shrink permissions
• BAccess Analyzer External Findings (Zelkova formal reasoning, no missed cases) + Policy Generation (CloudTrail-based actual-use policies) + Unused Access
• CConfig Rules (s3-bucket-public-read-prohibited, etc.) + manual permission audit
• DMacie detects external-shared buckets' sensitive data; IAM permission reports identify over-grant

Question 9

Eliminate manual screenshot/log collection for SOC2/PCI audits. Auto-collect evidence, submit reports to auditors. What's the tool?

• AConfig Aggregator unifies multi-account compliance view for audit submission
• BAudit Manager — SOC2/PCI Frameworks auto-map evidence (CloudTrail/Config/Security Hub) to regulatory controls, generate Assessment Reports
• CSecurity Hub Insights group Findings by control for compliance reporting
• DCloudTrail Lake SQL query audit-period activity, extract evidence for auditor submission

Question 10

Reduce false positives but keep investigative records in case that IP/pattern later compromises. GuardDuty: what's correct?

• AAdd IP to Trusted IP List — block that IP's Findings, reduce noise
• BSuppression Rule — generate Findings but hide from console/alerts, preserve data for post-investigation
• CDisable that detection type because it falsely triggers
• DAdd to Threat IP List for explicit tracking, separate Finding management

Question 11

Operator manually triggers response in console for specific Finding (destructive production work needs human judgment). What's the mechanism?

• AAutomation Rule auto-triggers Findings - Imported flow when condition matches, SSM/Lambda auto-runs
• BCustom Action: operator selects Finding in console, manually triggers → Security Hub Findings - Custom Action event → EventBridge → SSM/Lambda
• CConformance Pack Remediation connects to that Finding type, batch-auto-fixes
• DInsight groups Findings, auto-runs workflow at threshold

Question 12

Fintech org: ①multi-account threat detection auto-enabled ②all Findings unified ③S3 PII discovery ④container CVE scanning ⑤external exposure detection ⑥7-year breach SQL investigation ⑦multi-account WAF central policy. Map each requirement to correct service.

• A①GuardDuty Org Delegated Admin+auto-enable ②Security Hub(ASFF) ③Macie ④Inspector v2 ⑤Access Analyzer ⑥CloudTrail Lake ⑦Firewall Manager
• BAll handled by GuardDuty
• CAll handled by Security Hub
• D①Config ②Macie ③GuardDuty ④Audit Manager ⑤Inspector ⑥Config ⑦Inspector

📌 Week 14 Final Checkpoint — Pre-Exam Verification

1. Detect: GuardDuty (agent-less, data plane logs, signature+anomaly, Severity=severity×confidence) / Inspector v2 (CVE·CVSS·NVD, EC2·container·Lambda, continuous re-eval)
2. Aggregate: Security Hub (ASFF normalization·Normalized 0~100, FSBP/CIS/PCI/NIST standards, Config-dependent) — multi-account=Delegated Admin, multi-region=Region Aggregator
3. Evaluate & Remediate: Config (closed-loop control, CI=state snapshot, 3-Rule types Managed/Lambda/Guard DSL, Conformance Pack=StackSets, Remediation=SSM Automation, flapping blocked by MaxAttempts)
4. Evidence/Data/Permissions: Audit Manager (evidence auto-collection & proof) / Macie (PII classification, Luhn validation, cost control) / Access Analyzer (Zelkova formal-verify external exposure, observation-based least privilege)
5. 3 Response Paths: Custom Action (manual HITL) / Automation Rule (field updates only) / Imported→Lambda·SSM (actual resource remediation)
6. Governance: Firewall Manager (central WAF/Shield) / CloudTrail Lake (7-year SQL) / NIST CSF 5 functions diagnostics

💪 Week 14 Complete! Core: "Precisely distinguish role boundaries; choose automation depth by risk and reversibility."

🎯 Scenario (Holistic Diagnosis Practice): A SaaS firm says "security tools all enabled, incident happened." Investigation: GuardDuty, Security Hub, Config all active; Findings pile up; no automated response connected. CSF diagnosis: Detect sufficient, Respond missing. Fix: ① Automation Rule suppresses low-risk Findings (reduce alarm fatigue, base-rate error) ② Critical+specific-type EventBridge→SSM for full auto-isolation ③ Destructive work Custom Action HITL ④ Macie identifies which bucket has PII (Identify step) to prioritize. "Turning on tools" ≠ "tying detection to response" — without the latter, detection is just noise.

🔜 Week 15 Preview

Comprehensive Scenario — Enterprise Case: Weeks 1~14 CI/CD, IaC, monitoring, security into one enterprise case for end-to-end application verification.