A security administrator enabled AWS Security Hub for all accounts in an AWS Organizations organization. The security team requires near-real-time response and remediation for AWS resources that do not meet security standards, with centralized audit logging. The organization has already reached the quotas for the number of SCPs attached to the OU and SCP document size and wants to avoid any SCP changes. The solution must maximize scalability and cost-effectiveness. Which combination of actions should the administrator take? (Choose three.)

The solution requires near-real-time response and remediation. AWS Config custom rules (1) can detect configuration changes and trigger remediation via Lambda functions, addressing the "near-real-time" and "remediation" requirements. Security Hub custom actions (2) allow for defining specific responses to findings, and when referenced in an EventBridge rule, can trigger automated workflows. An EventBridge rule invoking a Lambda function (3) directly provides a flexible and scalable way to automate remediation actions based on Security Hub findings or other events, fulfilling the need for automated response. Systems Manager Change Manager is for tracking and approving changes, not for automated remediation. The other incorrect options describe evaluation or assessment methods rather than direct remediation actions.