Security Hub and ASFF Format Quiz

5 questions Pass: 70% +25 pts (50 with Pro)

Quiz covering Threat Detection Services

What you'll be asked

  1. What is the primary purpose of the AWS Security Finding Format (ASFF)?
  2. Which field in the ASFF schema is used to indicate the current state of a security finding?
  3. You need to automate a response when a high-severity finding is detected in Security Hub. Which ASFF field should your event-driven rule primarily filter on?
  4. When creating a custom integration for Security Hub, what is the mandatory requirement for importing findings?
  5. If you are developing a custom security tool and need to associate a finding with a specific AWS resource, which top-level ASFF object must be populated to ensure proper visual mapping in the Security Hub console?

Answers and explanations come after you submit.