GuardDuty is producing many findings from suspicious sources. How can you automatically block traffic across the VPC whenever GuardDuty identifies a new suspicious source?

AWS Network Firewall is designed for centralized network traffic filtering across VPCs. When GuardDuty detects a suspicious IP, it sends a finding to Security Hub. A Lambda function, triggered by this Security Hub finding, can then programmatically update the AWS Network Firewall policy to add a "Drop" rule for the identified malicious IP address. This effectively blocks traffic from that source across all VPCs protected by the firewall. Incorrect options: GuardDuty threat lists are for identifying threats, not blocking them. While you could update a threat list, it wouldn't directly block traffic. AWS WAF operates at the application layer (Layer 7) and protects web applications. It cannot block traffic across an entire VPC at the network layer (Layer 3/4). GuardDuty suppression rules prevent specific findings from being generated again, but they do not block traffic.