A security team uses GuardDuty, Inspector, and third-party tools — each producing findings in different formats. They want one normalized store where findings can be correlated and routed to response. What's the aggregation point?
A.AWS Security Hub — findings normalized into ASFF
Correct. ASFF normalization is Security Hub's core job.
B.CloudWatch Logs for each tool
Logs hold text — no normalization or correlation.
C.An S3 bucket with JSON files
A bucket stores data but provides no security-finding semantics.
D.Amazon EventBridge without a finding format
EventBridge routes events but doesn't normalize or aggregate findings.
Why this answer
Security Hub ingests findings from AWS services and partner tools, normalizing everything into the AWS Security Finding Format (ASFF) — enabling cross-tool correlation, standards scoring, and EventBridge-driven response.
Correct answer: A · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Detection & Response practice session.
Practice Detection & Response