Examkin

Question

Difficulty: MediumSecurity Monitoring and Threat Detection

An e-learning platform operates a multi-account AWS environment managed under AWS Organizations. The security team needs a solution to centralize the monitoring of security alerts and threat detections from Amazon GuardDuty, Amazon Macie, and AWS IAM Access Analyzer across all accounts. Additionally, they must continuously assess their resource configurations against the AWS Foundational Security Best Practices standard. Which solution will meet these requirements with the least operational overhead?

  1. Enable AWS Security Hub in a designated security administrator account, integrate it with AWS Organizations to aggregate findings across all member accounts, and enable the AWS Foundational Security Best Practices standard.Answer
  2. B
    Enable AWS Shield Advanced in the centralized security account to aggregate security events, resource vulnerability reports, and IAM access logs from all member accounts into a single dashboard.
  3. C
    Configure stateless Network ACLs in the centralized transit VPC to monitor and aggregate configuration security compliance findings and API call anomalies from all member accounts.
  4. D
    Configure a centralized AWS WAF Web ACL to monitor configuration changes and automatically inspect API call payloads to block unauthorized IAM configuration changes.

Answer

Enable AWS Security Hub in a designated security administrator account, integrate it with AWS Organizations to aggregate findings across all member accounts, and enable the AWS Foundational Security Best Practices standard.
The correct solution uses AWS Security Hub, which is designed to centralize and prioritize security findings from multiple AWS services (such as GuardDuty, Macie, and IAM Access Analyzer) across all accounts in an organization. It also runs automated compliance checks against standards like AWS Foundational Security Best Practices, minimizing operational overhead.

Step-by-Step Solution

1
Identify the primary requirement of centralizing threat detection and compliance checks across multiple AWS accounts.
AWS Security Hub is identified as the native service designed for centralizing findings and conducting automated compliance checks.
It natively integrates with AWS Organizations, GuardDuty, Macie, and IAM Access Analyzer to aggregate findings into a single pane of glass.
2
Address the requirement to run security posture assessments against the AWS Foundational Security Best Practices standard.
AWS Security Hub's compliance standards feature is selected.
Security Hub continuously runs automated checks against security standards to identify configuration drifts and compliance status.
3
Determine the configuration that minimizes operational overhead across the organization.
AWS Organizations integration is configured.
Setting up a designated security administrator account allows automatic enablement of Security Hub across all existing and future member accounts.

Key Concept

Centralized security monitoring and compliance tracking using AWS Security Hub and AWS Organizations.
Rate this question

Topics

Security Monitoring and Threat Detection

More questions from this topic