SCS-C02 Question 116
Select 3Your organization uses AWS Security Hub to monitor and improve the security posture of its AWS accounts. You are tasked with configuring Security Hub to ensure that it aggregates findings from all accounts in your AWS Organization into a single master account for centralized monitoring. Which steps must you take to achieve this?
- A
Enable Security Hub in the master account and invite member accounts to join Security Hub.
- B
Configure AWS Organizations integration with Security Hub to automatically manage member accounts.
- C
Enable Security Hub in each member account and accept the invitation from the master account.
- D
Manually aggregate findings by exporting them from each account and consolidating them in the master account.
- E
Set up a CloudWatch Event Rule in each member account to send findings to the master account.
Show answer and explanation
Correct answers: A, B, C
Explanation
To aggregate Security Hub findings across accounts, you should enable Security Hub in the master account, integrate it with AWS Organizations for account management, and ensure member accounts enable Security Hub and accept the master account's invitation. This configuration allows for centralized monitoring of security findings without requiring manual aggregation or external tools like CloudWatch Event Rules.
- A. Correct.
Correct: Enabling Security Hub in the master account and inviting member accounts establishes the foundation for centralizing findings.
- B. Correct.
Correct: Integrating AWS Organizations with Security Hub allows for automatic management of member accounts, making the process seamless and scalable.
- C. Correct.
Correct: Member accounts need to enable Security Hub and accept the invitation from the master account to participate in centralized monitoring.
- D. Incorrect.
Incorrect: Manually aggregating findings is not recommended or necessary as Security Hub provides automated mechanisms for aggregation.
- E. Incorrect.
Incorrect: CloudWatch Event Rules are not used for sending findings between Security Hub accounts; Security Hub handles aggregation natively.