ExpertMedium1 markMultiple Choice
AWS SAP-C02 · Question 54 · Domain 1.2: Security Controls
An enterprise has 100 AWS accounts. They want to ensure that Amazon GuardDuty is enabled in every account and region, and that all findings are aggregated into a central 'Security Tooling' account. What is the MOST operationally efficient way to achieve this?
An enterprise has 100 AWS accounts. They want to ensure that Amazon GuardDuty is enabled in every account and region, and that all findings are aggregated into a central 'Security Tooling' account. What is the MOST operationally efficient way to achieve this?
Answer options:
A.
Write a CloudFormation StackSet to deploy GuardDuty in all accounts.
B.
Designate the Security Tooling account as the GuardDuty delegated administrator in AWS Organizations, and enable GuardDuty for all accounts via the delegated admin.
C.
Use AWS Config rules to remediate accounts where GuardDuty is disabled.
D.
Manually invite each account from the Security Tooling account.
How to approach this question
Leverage AWS Organizations delegated administration.
Full Answer
B.Designate the Security Tooling account as the GuardDuty delegated administrator in AWS Organizations, and enable GuardDuty for all accounts via the delegated admin.✓ Correct
Many AWS security services (GuardDuty, Security Hub, Macie) support Delegated Administration via AWS Organizations. This allows a central security account to manage and aggregate findings for the entire organization automatically.
Common mistakes
Using manual invitations or custom scripts instead of native Org integration.
Practice the full AWS Solutions Architect Professional SAP-C02 Practice Exam 2
75 questions · hints · full answers · grading
More questions from this exam
Q01A company is setting up a multi-account AWS environment using AWS Organizations. They need to ens...EasyQ02An enterprise needs to connect its on-premises data center to AWS. They require a dedicated, priv...EasyQ03A company wants to share a single AWS Transit Gateway across multiple AWS accounts within their A...EasyQ04An architect needs to design a highly available database architecture that spans multiple AWS Reg...EasyQ05A global financial institution is migrating its core banking application to AWS. The application ...Medium