GuardDuty reports cryptocurrency mining activity on a county EC2 instance. Leadership wants an architecture that can automatically start containment when that finding type appears. Which design best supports detection-to-response automation?
Select an answer to reveal the explanation.
Short Explanation
When GuardDuty yells “miner on that box,” you want a tripwire that already knows what to do—EventBridge catches the finding and kicks off isolate-and-notify. Waiting on invoices or binders lets the miner keep digging.
Full Explanation
Secure detection and response designs pair GuardDuty findings with EventBridge rules that trigger containment workflows—security group isolation, forensic snapshots, and notifications. That is Associate-level architecture of the response path, not deep Security Specialty playbook authorship. Disabling detection or delaying all action undermines containment.