A company has a multi-account strategy that uses an organization in AWS Organizations with all features enabled. The company has enabled trusted access for AWS Account Management. New accounts are pro

Question

Options

• AEnable Security Hub in the organization's management account. Create an AWS Step Functions
• BEnable Security Hub in the organization's management account. Wait for all new accounts to
• CEnable Security Hub in the organization's management account. Create an AWS Lambda
• DUse the organization's management account to designate a Security Hub delegated administrator

• A
  15% (8)
• B
  4% (2)
• C
  8% (4)
• D
  73% (38)

Explanation

Designating a Security Hub delegated administrator (option D) is the native AWS Organizations solution for this exact use case. When you assign a delegated administrator and enable the auto-enable setting, Security Hub automatically enrolls every new account added to the organization as a member - no custom code or workflows required. This integration is built directly into the AWS Organizations + Security Hub service layer.

Why the distractors fall short:

• A (Step Functions) and C (Lambda) both require you to write and maintain custom automation code, which is development effort the question explicitly asks you to minimize.
• B (waiting for new accounts) implies either a manual process or a polling/scheduled solution - neither of which is as reliable or low-effort as a native service integration.

Memory tip: Whenever an AWS exam question asks for automatic enrollment of new org accounts into a security service (Security Hub, GuardDuty, Macie, etc.) with least effort, the answer pattern is almost always delegated administrator + auto-enable - it's the "set it and forget it" approach baked into AWS Organizations.

No community discussion yet for this question.