SCS-C02 Question 50
Select 2You are a Security Engineer working for a large organization with multiple AWS accounts. Your team wants to centralize security findings from all accounts into a single location for better visibility and monitoring. Which combination of actions will help you achieve this using AWS services?
- A
Enable AWS Security Hub in all accounts and designate a delegated administrator account for centralized findings.
- B
Use AWS Config to aggregate compliance findings across accounts and regions.
- C
Set up Amazon GuardDuty in all accounts and configure a master account to receive shared findings.
- D
Integrate AWS Security Hub findings with Amazon CloudWatch Logs for centralized logging.
- E
Use AWS Control Tower to automatically aggregate security findings from all accounts.
Show answer and explanation
Correct answers: A, C
Explanation
To centralize security findings, AWS Security Hub allows aggregation of findings across multiple accounts by designating a delegated administrator account. Additionally, Amazon GuardDuty can centralize its findings by configuring a master account. These two services are designed to handle multi-account environments and allow for a unified view of security insights.
- A. Correct.
Enabling AWS Security Hub in all accounts and designating a delegated administrator account allows for centralized security findings by aggregating them into a single account.
- B. Incorrect.
While AWS Config can aggregate compliance data, it does not directly centralize security findings from services like GuardDuty or Security Hub.
- C. Correct.
Amazon GuardDuty findings can be centralized by configuring a master account to receive shared findings from member accounts.
- D. Incorrect.
Integrating Security Hub findings with CloudWatch Logs can provide additional logging capabilities, but it does not inherently centralize findings across accounts.
- E. Incorrect.
AWS Control Tower helps with account setup and governance but does not directly aggregate security findings from services like Security Hub or GuardDuty.