SAP-C02

Deep Dive

Back to guides
All guides
Practice now
D3 · Continuous Improvement for Existing Solutions

Security and compliance at scale: GuardDuty, Security Hub and Config

SAP-C02's D3 domain (25%) tests continuous improvement, and organization-scale security is its core. You need to differentiate between security tools, their use cases, and how they work together in a detection-and-response pipeline.

Contents

Icon-Architecture/48/Arch_AWS-Shield_48

Security framework: preventive vs detective controls

Preventive Controls — block before it happens

  • SCPs (Service Control Policies) — org-level account boundaries
  • IAM Policies — least-privilege permissions
  • Security Groups and NACLs — network firewall
  • — layer 7 attack protection
  • — DDoS protection
  • S3 Block Public Access — prevents accidental S3 exposure
  • AWS Organizations: block unauthorized regions
  • CloudFormation Stack Policies — protects resources within stacks

Detective Controls — identify after it happens

  • AWS CloudTrail — audit of every API call
  • AWS Config — configuration changes and compliance
  • — ML-based threat detection
  • — centralized findings view
  • — detects sensitive data in S3
  • — vulnerabilities in EC2/ECS/Lambda
  • — security incident investigation
  • VPC Flow Logs — network traffic for forensic analysis
Icon-Architecture/48/Arch_Amazon-GuardDuty_48

Amazon GuardDuty — intelligent threat detection

GuardDuty is a threat detection service that uses Machine Learning to analyze AWS data sources and detect malicious or anomalous behavior. It requires no agents or complex configuration.

Data sources analyzed

  • CloudTrail Event Logs — suspicious API calls
  • VPC Flow Logs — network traffic (communication with malicious IPs)
  • DNS Logs — queries to malicious domains (C2 servers)
  • EKS Audit Logs — suspicious activity in Kubernetes clusters
  • RDS Login Events — suspicious login activity on RDS
  • S3 Data Events — unusual access to S3 buckets
  • Lambda Network Activity — Lambda functions with anomalous behavior
  • ECS Runtime Activity — suspicious container activity

Finding types

Backdoor:EC2 communicating with known botnet IPs
Cryptocurrency:EC2 mining cryptocurrency without authorization
Recon:Port scanning or API enumeration
Trojan:Malware or droppers detected in behavior
UnauthorizedAccess:IAM credentials used from unusual IPs or TOR
Policy:Configuration that violates best practices (active root user)

GuardDuty across multi-account Organizations

Enable GuardDuty org-wide from a Delegated Administrator account (typically the Security Tooling Account). Findings from all member accounts are aggregated at the delegated admin. New accounts are onboarded automatically.

Icon-Architecture/48/Arch_AWS-Security-Hub_48

AWS Security Hub — centralized security posture

Security Hub aggregates findings from multiple AWS and third-party security services into a single pane of glass. It scores your security posture against standards like CIS AWS Foundations Benchmark, PCI DSS, and AWS Foundational Security Best Practices.

Finding sources (native integrations)

  • • GuardDuty
  • • Inspector
  • • Macie
  • • IAM Access Analyzer
  • • AWS Config
  • • Firewall Manager
  • • Systems Manager Patch Manager
  • • AWS Health

Key capabilities

  • • Security Score: overall security posture score (0-100)
  • • Security Standards: CIS, PCI-DSS, FSBP, NIST 800-53
  • • Automated Response: EventBridge + Lambda to remediate findings
  • • Cross-account aggregation via Organizations
  • • Standard format: ASFF (Amazon Security Finding Format)
  • • Integration with third-party SIEM (Splunk, IBM QRadar)
Icon-Architecture/48/Arch_AWS-Config_48

— configuration compliance and governance

AWS Config records the configuration history of every AWS resource and evaluates its compliance against defined rules. It answers: how was this resource configured 3 months ago? What changed and who changed it?

Config Rules

AWS Managed Rules150+ pre-built rules. E.g.: "s3-bucket-public-read-prohibited", "ec2-instances-in-vpc".
Custom RulesA Lambda function that evaluates a resource’s configuration and returns COMPLIANT/NON_COMPLIANT.
Conformance PacksA packaged collection of rules and remediation actions. E.g.: "AWS Control Tower Detective Controls".
RemediationSSM Automation Documents to automatically remediate non-compliance (e.g., enable encryption on an S3 bucket).

Config across multiple accounts

  • Aggregator: consolidates Config data from multiple accounts/regions into a centralized view
  • Organizations Integration: automatic enablement in new accounts
  • Org-level Conformance Pack: a rule is deployed to every account at once
  • Config Recorder: records every configuration change to S3 and SNS for auditing
Icon-Architecture/48/Arch_Amazon-Macie_48

Macie, Inspector and Detective — specialized services

Amazon Macie

Discovers and protects sensitive data in S3 using ML. Identifies PII (card numbers, SSNs, medical data), credentials, and confidential data. Generates findings when sensitive data is found in public or shared buckets.

  • • GDPR/HIPAA compliance audits
  • • Discovering PII stored in S3
  • • Alerting when sensitive data is accidentally exposed

Amazon Inspector

Continuously scans EC2 instances, container images in ECR, and Lambda functions for software vulnerabilities (CVEs) and network reachability deviations from best practices.

  • • Detecting CVEs in OS packages or libraries
  • • Network reachability: whether port 22 is open to the internet
  • • Patch management compliance

Amazon Detective

A security incident investigation service. It automatically analyzes CloudTrail, VPC Flow Logs, and GuardDuty to build a behavior graph that speeds up forensic investigation.

  • • Investigating the scope of a security incident
  • • Correlating events from multiple sources
  • • Visualizing the timeline of an attack or breach
Icon-Architecture/48/Arch_AWS-Key-Management-Service_48

Encryption at scale: KMS, and Secrets Manager

ServiceKey controlFIPS 140-2Best for
AWS KMS (AWS Managed Keys)AWS manages rotation and key materialLevel 2Encrypting AWS resources with no operational overhead
AWS KMS (Customer Managed Keys)You control the policy and rotationLevel 2Compliance requiring you to own key control
AWS KMS (Customer-Provided Keys)You import your own key materialLevel 2Compliance requiring externally sourced key material
CloudHSMYou have exclusive access to the HSMLevel 3Strict compliance (PCI, FIPS L3), SSL/TLS offload
Secrets ManagerSecrets management + automatic rotationUses KMSDB credentials, API keys with automatic rotation
SSM Parameter StoreSecrets and configuration (not just secrets)Uses KMSApp configuration + simple secrets, lower cost
Icon-Architecture/48/Arch_Amazon-GuardDuty_48

Common exam pitfalls

Pitfall: "GuardDuty analyzes the content of the data stored in S3"

Reality: FALSE. GuardDuty analyzes metadata and logs (CloudTrail, VPC Flow, DNS) — not file content. To analyze data content in S3 (PII) use Amazon Macie.

Pitfall: "AWS Config can block non-compliant configuration changes"

Reality: FALSE. Config is detective, not preventive. It records and evaluates changes but doesn’t block them. To block changes use SCPs, IAM Policies, or Service Catalog.

Pitfall: "Security Hub replaces GuardDuty, Inspector, and Macie"

Reality: FALSE. Security Hub aggregates and centralizes findings from these services — it doesn’t replace them. You still need to enable GuardDuty, Inspector, etc. separately.

Pitfall: "CloudHSM and KMS are equivalent"

Reality: They’re different. KMS is AWS-managed (shared but with cryptographic isolation). CloudHSM gives you a dedicated HSM where you hold the only copy of the keys. CloudHSM meets FIPS 140-2 Level 3 (KMS only Level 2).

Did you get this topic?

Test what you just learned

A security team needs to: (1) automatically detect if an EC2 instance in any account of the organization is communicating with known malicious IPs, (2) view all security findings from all accounts in a centralized dashboard, and (3) receive an alert when an S3 bucket in production is configured as public. Which combination of services satisfies all three requirements?

Ready to test "Security and Compliance at Scale: GuardDuty, Security Hub and Config"?

Put what you learned to the test with original SAP-C02 exam questions.

Start SAP-C02 mock exam

Unlimited mock exams with the Pro plan

Log in to track your progress.

PreviousAdvanced Networking: CloudFront, VPC Endpoints and Enhanced NetworkingDesign for New SolutionsNextAdvanced Observability: CloudWatch, X-Ray and Container InsightsContinuous Improvement for Existing Solutions