Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

A Solutions Architect needs to set up centralized security monitoring across all AWS accounts in an organization using AWS Organizations. The architect wants to delegate security administration to a dedicated Security Tooling account and implement standardized security controls across different Organizational Units (OUs) using AWS Security Hub.

Arrange the steps in the correct order to configure AWS Security Hub with delegated administration and centralized configuration management.

  1. 1Enable trusted access for AWS Security Hub in the AWS Organizations management account.
  2. 2Designate the Security Tooling account as the delegated administrator for AWS Security Hub from the management account.
  3. 3Log in to the designated Security Tooling account to enable Security Hub and associate the organization's member accounts.
  4. 4From the Security Tooling account, create configuration policies and associate them with specific Organizational Units (OUs) to enforce security standards.

Answer

The correct sequence starts by enabling trusted access for Security Hub in the organization management account, followed by designating the Security Tooling account as the delegated administrator. Next, Security Hub is enabled and member accounts are associated from the delegated administrator account, and finally, centralized configuration policies are applied to the targeted Organizational Units (OUs).
To successfully establish central security governance using AWS Security Hub, you must first enable trusted access from the Organizations management account. Once trusted access is enabled, you can designate a member account (the Security Tooling account) as the delegated administrator. Following delegation, all administrative tasks, including enabling member accounts and applying configuration policies to OUs, must be executed directly from the designated delegated administrator account, not the management account.

Step-by-Step Solution

1
Enable trusted access in the management account.
Allows AWS Organizations to integrate and share organizational structure information with AWS Security Hub.
This is a prerequisite for registering a delegated administrator in AWS Organizations.
2
Designate the Security Tooling account as the delegated administrator.
Gives the Security Tooling account permissions to manage Security Hub settings and policies for the organization.
Delegation allows management of security services to be segregated from the Organizations management account, conforming to the principle of least privilege.
3
Enable Security Hub and associate member accounts from the Security Tooling account.
Registers all current member accounts under the centralized Security Hub administration scope.
The delegated administrator must bring the accounts under management before standard configurations can be pushed to them.
4
Create and apply Security Hub configuration policies.
Applies security standards and checks consistently across target OUs.
Centralized configuration management allows targeting specific OUs with customized or standard security requirements.

Key Concept

Delegated Administration in AWS Organizations
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic