SAP-C02 Q419 · Security

Question

A company creates an AWS Control Tower landing zone to manage and govern a multi-account AWS environment. The company's security team will deploy preventive controls and detective controls to monitor AWS services across all the accounts. The security team needs a centralized view of the security state of all the accounts. Which solution will meet these requirements?

Accepted Answer

**Option D: Enable AWS Security Hub for the organization with a delegated administrator**

Let's map each requirement to how Security Hub satisfies it:

1. **Preventive controls and detective controls**: AWS Security Hub integrates natively with AWS Control Tower's controls (formerly called guardrails). It aggregates findings from multiple AWS security services including AWS Config rules (which underpin Control Tower's detective controls), GuardDuty, Inspector, Firewall Manager, and more.

2. **Monitor AWS services across all accounts**: Security Hub can be enabled organization-wide through AWS Organizations integration. When enabled at the organization level, it automatically covers all existing and future member accounts — no manual enrollment needed.

3. **Centralized view of security s

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips