Compliance team has mandated strict adherence to PCI DSS standards and Center for Internet Security (CIS) AWS Foundations Benchmark best practices. To ensure compliance, it is decided that any deviations from the standards and best practices should be highlighted along with the recommended resolution steps.
Which of the AWS offerings can help automate continuous, account/resource level security-related checks and configurations using standards and best practices?

Answer options:

A.Amazon Macie
B.AWS Security Hub
C.Amazon GuardDuty
D.AWS Firewall Manager

Answer: B
Option A is INCORRECT. Amazon Macie is a fully managed service from AWS that provides data security and privacy by utilizing Amazon’s machine learning and pattern matching capabilities.
Option B is CORRECT. AWS Security Hub provides a view of across-account security status and gives security alerts. Security hub identifies deviations from the standards and best practices and suggests recommended resolution steps.
Option C is INCORRECT. Amazon GuardDuty performs continuous monitoring to protect AWS accounts, S3 data and workloads from any malicious, unauthorized activities.
Option D is INCORRECT. AWS Firewall Manager enables management and configuration of firewalls across AWS accounts and applications centrally.
Reference:
https://aws.amazon.com/macie/
https://aws.amazon.com/security-hub/features/
https://aws.amazon.com/guardduty/
https://aws.amazon.com/firewall-manager/