A company subscribes to a third-party cloud security scanner that integrates with AWS Security Hub. The security engineer must automatically remediate findings generated by this integration. Which solution meets this requirement?

This solution is correct because Security Hub findings are published to Amazon EventBridge (formerly CloudWatch Events) as events. An EventBridge rule can be configured to filter these events based on specific criteria (e.g., finding type, severity, or provider from the third-party scanner). When a matching event occurs, the rule can trigger an AWS Lambda function. This Lambda function can then execute the necessary remediation steps, such as modifying AWS resources or calling other AWS services. This provides an automated, event-driven remediation workflow. The other options are less suitable: Defining a custom action in Security Hub requires manual invocation by a user, not automatic remediation. AWS Config rules primarily evaluate resource compliance and trigger actions based on configuration changes, not directly on Security Hub findings from third-party integrations. While Config can trigger remediation, it's not the most direct or efficient way to respond to Security Hub findings.