SCS-C02 Question 49
Single answerYour company uses multiple AWS accounts for different teams, and each account uses AWS Security Hub to monitor security findings. As the central security team, you need to centralize all security findings from these accounts into a single location for analysis and reporting. Which strategy should you implement to achieve this?
- A
Enable Security Hub in the central account and configure member accounts to send findings to the central account.
- B
Use AWS Config in each account to export compliance findings to an Amazon S3 bucket in the central account.
- C
Set up an Amazon EventBridge rule in each account to forward findings to the central account via an Amazon SQS queue.
- D
Deploy a custom Lambda function in the central account to periodically pull findings from member accounts.
Show answer and explanation
Correct answer: A
Explanation
The recommended approach for centralizing security findings in AWS Security Hub is to enable Security Hub in a central account and configure member accounts to send their findings to the central account. This native integration simplifies management and ensures consolidated visibility without requiring custom solutions or additional services like EventBridge or Lambda.
- A. Correct.
This is the correct answer. AWS Security Hub allows you to configure a central account as the administrator and link member accounts. Findings from member accounts are automatically aggregated into the central account for centralized visibility and management.
- B. Incorrect.
This option is incorrect because AWS Config is primarily used for resource compliance checks, not aggregating security findings from AWS Security Hub.
- C. Incorrect.
This option is incorrect because while EventBridge can forward events, it is not the recommended method for centralizing Security Hub findings across multiple accounts.
- D. Incorrect.
This option is incorrect because using a custom Lambda function is unnecessary and inefficient when AWS Security Hub provides native support for centralizing findings.