SAA-C03 Q661 · Multi-Account

Question

A company requires centralized auditing for all AWS accounts and compliance monitoring against AWS Foundational Security Best Practices (FSBP) with minimal operational overhead. Which solution will meet these requirements?

Accepted Answer

Let's break down each requirement and see how Answer A satisfies them:

**Requirement 1: Centralized auditing for ALL AWS accounts**
- **AWS Control Tower** provides a landing zone that sets up a multi-account environment with centralized governance. It automatically creates a **Log Archive account** that aggregates AWS CloudTrail logs and AWS Config data from all enrolled accounts — this is your centralized auditing.
- **Account Factory** allows standardized creation of new accounts that are automatically enrolled under Control Tower's governance, ensuring every new account is audited from day one.

**Requirement 2: Compliance monitoring against FSBP**
- **AWS Security Hub** natively supports the **AWS Foundational Security Best Practices (FSBP)** standard. When enabled, it automatically

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips