Examkin

Question

Difficulty: Very hardMulti-Account Governance and Organizational Structure

An enterprise manages its multi-account environment using AWS Organizations. The security team must establish a secure governance framework that centralizes the administration of Amazon GuardDuty and AWS Security Hub in a dedicated Security account. The framework must ensure that member accounts cannot disassociate themselves from the organization, disable these security services, or modify their centralized configurations, even if users in the member accounts have administrative or root privileges. Which TWO actions must the solutions architect take to implement this architecture? (Select TWO.)

  1. From the AWS Organizations management account, designate the Security account as the delegated administrator for Amazon GuardDuty and AWS Security Hub. From the Security account, enable both services for all organization member accounts and configure them to auto-enable for any new accounts.Answer
  2. Create a Service Control Policy (SCP) in the management account that denies organizations:LeaveOrganization, guardduty:DeleteDetector, guardduty:DisassociateFromMasterAccount, and securityhub:DisableSecurityHub. Attach this SCP to the Organizational Units (OUs) containing the member accounts.Answer
  3. C
    Create an SCP that denies organizations:LeaveOrganization, guardduty:DeleteDetector, and securityhub:DisableSecurityHub, and attach it directly to the organization's management account to enforce these constraints globally, including on the management account itself.
  4. D
    From the Security account, configure AWS-managed KMS keys (e.g., aws/guardduty and aws/securityhub) to encrypt and share findings across the organization, delegating key administration permissions directly to member account root users.
  5. E
    Configure all member accounts to write their audit logs directly to a centralized S3 bucket in the Security account by updating each member account's local IAM policies to grant write permissions to the bucket, without modifying the Security account's S3 bucket policy.

Answer

To secure the multi-account architecture, the solutions architect must designate the Security account as the delegated administrator for GuardDuty and Security Hub, and create an SCP in the management account restricting member accounts from disabling these services or leaving the organization, attaching it to the member Organizational Units.
To establish the required governance, the solutions architect must designate the Security account as the delegated administrator for GuardDuty and Security Hub, enabling central control. Additionally, an SCP must be created to block actions such as disabling the detectors, disassociating from the master, and leaving the organization. This SCP must be attached to the member OUs because SCPs apply only to member accounts, not the management account. Together, these actions ensure centralized operations and strict guardrails that cannot be bypassed by member account administrators.

Step-by-Step Solution

1
Enable trusted access for GuardDuty and Security Hub in the AWS Organizations management account, and delegate administration to the Security account.
The Security account becomes the delegated administrator, allowing it to manage findings, members, and configurations centrally.
This isolates organizational management activities from security administration, conforming to the principle of least privilege.
2
Configure GuardDuty and Security Hub within the Security account to enable both services for all existing and new member accounts automatically.
All member accounts are enrolled under the delegated administrator.
This guarantees that security monitoring is consistently active across all workloads without requiring manual intervention.
3
Create an SCP that denies organizations:LeaveOrganization, guardduty:DeleteDetector, guardduty:DisassociateFromMasterAccount, and securityhub:DisableSecurityHub.
A policy definition is created that blocks these critical operations.
This establishes a hard guardrail that prevents local account administrators or root users from disabling security monitoring or detaching from the organization's governance.
4
Attach the created SCP to the Organizational Units (OUs) that contain the member accounts, avoiding the management account.
The guardrail takes effect on all member accounts, while leaving the management account unrestricted.
SCPs do not apply to the management account, so they must be applied at the OU level or the organization root to affect member accounts.

Key Concept

Multi-account security governance using AWS Organizations delegated administration and Service Control Policies (SCPs).
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic