Q57 — AWS SAA-C03 Ch.10

Question 57 of 100 | ← Chapter 10

Q657. A company has an organization in AWS Organizations that has all features enabled. The company requires that all API calls and logins in any existing or new AWS account must be audited. The company needs a managed solution to prevent additional work and to minimize costs. The company also needs to know when any AWS account is not compliant with the AWS Foundational Security Best Practices (FSBP) standard.Which solution will meet these requirements with the LEAST operational overhead?

Correct Answer: A. Deploy an AWS Control Tower environment in the Organizations management account. Enable AWS Security Hub and AWS Control Tower Account Factory in the environment

Explanation

To meet the requirements with the LEAST operational overhead, the most suitable solution is:A. Deploy an AWS Control Tower environment in the Organizations management account. Enable AWS Security Hub and AWS Control Tower Account Factory in the environment.Explanation:AWS Control Tower is a managed service that provides pre-configured guardrails, landing zones, and automated account provisioning that help customers quickly set up and govern their multi-account AWS environments. By deploying AWS Control Tower in the Organizations management account, the company can ensure that all new and existing accounts are automatically set up with the necessary security and governance configurations, including enabling AWS Security Hub for centralized security monitoring and compliance checks.AWS Security Hub is a fully managed service that enables you to centrally view and manage your security alerts and findings across multiple AWS accounts. By enabling AWS Security Hub within the AWS Control Tower environment, the company can automatically collect, aggregate, organize, and prioritize security alerts and findings from various AWS services and third-party security tools. This helps in identifying and addressing security issues across all AWS accounts.AWS Control Tower Account Factory simplifies the process of creating and managing multiple AWS accounts by automating the account creation process and applying guardrails, such as enabling AWS Config, AWS GuardDuty, and other AWS security services. By enabling AWS Control Tower Account Factory, the company can ensure that all new accounts are automatically set up with the necessary security configurations, reducing the operational overhead.Option B is not ideal as deploying AWS Control Tower in a dedicated member account would not provide the same level of centralized governance and automation as deploying it in the management account.Option C and D involve using AWS Managed Services (AMS) Accelerate to build a multi-account landing zone (MALZ), which is a more customizable solution but also requires more operational overhead compared to AWS Control Tower. Moreover, the RFC (Request for Change) process for self-service provisioning of Amazon GuardDuty or AWS Security Hub in the MALZ adds additional complexity and operational overhead.Therefore, option A provides the least operational overhead by leveraging AWS Control Tower's automated account provisioning, guardrails, and integration with AWS Security Hub.