Q54 — AWS SAA-C03 Ch.12

Question 54 of 100 | ← Chapter 12

Q854. A financial services company that runs on AWS has designed its security controls to meet industry standards. The industry standards include the National Institute of Standards and Technology (NIST) and the Payment Card Industry Data Security Standard (PCI DSS).The company's third-party auditors need proof that the designed controls have been implemented and are functioning correctly. The company has hundreds of AWS accounts in a single organization in AWS Organizations. The company needs to monitor the current state of the controls across accounts.Which solution will meet these requirements?

• A. Designate one account as the Amazon Inspector delegated administrator account from the Organizations management account. Integrate Inspector with Organizations to discover and scan resources across all AWS accounts. Enable Inspector industry standards for NIST and PCI DSS.
• B. Designate one account as the Amazon GuardDuty delegated administrator account from the Organizations management account. In the designated GuardDuty administrator account, enable GuardDuty to protect all member accounts. Enable GuardDuty industry standards for NIST and PCI DSS.
• C. Configure an AWS CloudTrail organization trail in the Organizations management account. Designate one account as the compliance account. Enable CloudTrail security standards for NIST and PCI DSS in the compliance account.
• D. Designate one account as the AWS Security Hub delegated administrator account from the Organizations management account. In the designated Security Hub administrator account, enable Security Hub for all member accounts. Enable Security Hub standards for NIST and PCI DSS. ✓

Correct Answer: D. Designate one account as the AWS Security Hub delegated administrator account from the Organizations management account. In the designated Security Hub administrator account, enable Security Hub for all member accounts. Enable Security Hub standards for NIST and PCI DSS.

Explanation

To meet the requirement of monitoring the current state of security controls across multiple AWS accounts in a single organization, the recommended solution is:D. Designate one account as the AWS Security Hub delegated administrator account from the Organizations management account. In the designated Security Hub administrator account, enable Security Hub for all member accounts. Enable Security Hub standards for NIST and PCI DSS.Here's why:Option D suggests designating one account as the AWS Security Hub delegated administrator account and enabling Security Hub for all member accounts in the organization.AWS Security Hub is a comprehensive security service that provides a centralized view of security findings and compliance status across multiple AWS accounts. By designating a specific account as the Security Hub administrator account, you can enable Security Hub for all member accounts in the organization.Enabling Security Hub standards for NIST and PCI DSS allows you to monitor the compliance of your AWS accounts against these industry standards. Security Hub automatically aggregates and analyzes findings from various AWS services and third-party tools, providing you with a unified dashboard to monitor the security posture of your organization.Option A suggests using Amazon Inspector integrated with AWS Organizations to discover and scan resources across all AWS accounts. While Inspector can provide vulnerability assessment and compliance scanning, it does not offer the same level of centralized visibility and compliance monitoring as Security Hub.Option B suggests designating an account as the Amazon GuardDuty delegated administrator account and enabling GuardDuty to protect all member accounts. While GuardDuty is a valuable threat detection service, it focuses on detecting malicious activity and threats rather than providing comprehensive compliance monitoring.Option C suggests configuring an AWS CloudTrail organization trail and designating an account as the compliance account. While CloudTrail can provide detailed audit logs, it does not offer the same level of compliance monitoring and central visibility as Security Hub.In summary, the recommended solution is to designate one account as the AWS Security Hub delegated administrator account and enable Security Hub for all member accounts. This allows for centralized, comprehensive security findings and compliance monitoring across the organization, including adherence to industry standards such as NIST and PCI DSS.