A company manages a set of accounts on AWS by using AWS Organizations. The company's security team wants to use a native AWS service to regularly scan all AWS accounts against the Center for…

Question

Options

• ADesignate a central security account as the AWS Security Hub administrator account. Create a
• BRun the CIS AWS Foundations Benchmark across all accounts by using Amazon Inspector.
• CDesignate a central security account as the Amazon GuardDuty administrator account. Create a
• DDesignate an AWS Security Hub administrator account. Configure new accounts in the

• A
  6% (4)
• B
  16% (10)
• C
  3% (2)
• D
  75% (47)

Explanation

AWS Security Hub is the purpose-built service for this job - it natively supports the CIS AWS Foundations Benchmark as a built-in security standard and integrates directly with AWS Organizations. Option D is correct because configuring a Security Hub administrator account to automatically enable Security Hub and the CIS standard for new member accounts means compliance scanning is applied immediately as accounts join the organization, with zero manual effort per account - the definition of operational efficiency.

Why the distractors fail:

• A is likely wrong because it describes an incomplete or manual configuration (e.g., requiring individual account enablement), making it less efficient than auto-enrollment.
• B is wrong because Amazon Inspector focuses on vulnerability scanning of EC2 instances, container images, and Lambda functions - it does not evaluate against the CIS AWS Foundations Benchmark.
• C is wrong because Amazon GuardDuty is a threat detection service (anomaly/behavior-based), not a compliance or benchmark assessment tool.

Memory tip: Think of Security Hub as your compliance dashboard - it aggregates findings and runs standards checks (CIS, PCI DSS, NIST). GuardDuty detects threats, Inspector scans software vulnerabilities. When the question says "benchmark" or "compliance standard," Security Hub is almost always the answer.

No community discussion yet for this question.