A Start-up firm has implemented a number of critical application servers in Amazon VPC. Amazon GuardDuty is enabled for this firm. NACLs are configured for the VPC to provide additional security. Management is looking for an automated solution to update Amazon VPCNACLs in response to malicious activities findings by Amazon GuardDuty.
Which steps can be implemented to meet this requirement with the least effort?

Answer options:

A.Based upon GuardDuty findings, create an Amazon CloudWatch alarm that triggers an AWS Lambda function to update NACLs.
B.Based upon GuardDuty findings, create an Amazon CloudWatch events rule which triggers an AWS Lambda function to update NACLs.
C.Based upon GuardDuty findings, create an Amazon CloudWatch events rule which triggers a cron job to update NACLs.
D.Based upon GuardDuty findings, create an Amazon CloudWatch alarm that triggers a cron job to update NACLs.

Correct Answer: B
For an automated preventive action based upon Amazon GuardDuty findings, Amazon CloudWatch Events and Amazon Lambda function can be used. Amazon GuardDuty findings are sent to Amazon CloudWatch events based upon match criteria, triggers an AWS Lambda function which will modify VPC NACLs based upon Amazon GuardDuty findings.
Option A is incorrect as the CloudWatch alarm cannot be used to trigger a Lambda function directly.
Option C is incorrect as using a cron job will result in additional admin work.
Option D is incorrect as using a cron job will result in additional admin work.
For more information on Amazon GuardDuty, refer to the following URL,
https://aws.amazon.com/blogs/security/how-to-use-amazon-guardduty-and-aws-web-application-firewall-to-automatically-block-suspicious-hosts