A fintech with 60 AWS accounts must detect anomalous S3 access, Malware findings, and PII exposure in logs through centralized dashboards and alerts without deploying agents. Which monitoring architecture should the detection engineer implement for agentless anomaly visibility?

The correct architecture works because GuardDuty provides agentless detection of anomalous S3 API activity and malware findings for S3 objects without sensors, while Macie applies managed machine learning to discover PII exposure at scale, and Security Hub with an organization delegated administrator aggregates findings from all 60 accounts into centralized dashboards with alerting for unified triage. The centralized CloudTrail in S3 with Athena dashboards approach is valid for audit analytics and custom SQL hunting but fails on automated PII classification because raw events and queries cannot natively identify sensitive-data patterns requiring Macie content inspection. The centralized Macie plus CloudTrail Insights approach correctly addresses PII exposure and unusual API rates but fails on comprehensive threat coverage because Insights focuses on management-event anomalies and lacks GuardDuty threat intelligence for credential compromise and malware verdicts. The per-account GuardDuty plus Macie with local CloudWatch approach delivers the right agentless detection types but fails centralization because isolated dashboards prevent cross-account correlation, increase overhead, and violate single-pane visibility. As an exam caveat, distinguish detective controls by data source: Config evaluates compliance, CloudTrail records API history, and only GuardDuty-Macie together covers anomaly plus malware plus sensitive-data exposure. As a practical check, confirm Organizations integration, designate delegated administrators, enable auto-enrollment for new accounts, and validate findings flow to the aggregation Region with tuned filters and thresholds.