A holding company uses AWS Organizations with 60 member accounts and a dedicated Security OU. It must centrally manage GuardDuty, Security Hub and Macie detective findings, keep member data local, and avoid using long-term access keys for administration. Which delegation approach should the architect implement to centrally manage security services?

The correct design uses Organizations trusted access to register delegated administrators inside the Security OU for GuardDuty, Security Hub and Macie, enabling centralized policy, auto-enablement for new accounts, and aggregated detective findings while each service analyzes member data in place using service-linked roles and short-term assumed-role sessions. Centralizing directly from the management account fails the administrative separation concept because it overloads the billing and governance boundary, encounters aggregation limits, and ignores the required Security OU isolation for security operations. Centralizing with full Macie data replication fails the data locality concept because Macie is architected to inspect S3 objects locally and forward only metadata findings, so copying sensitive objects centrally breaches the residency constraint and adds cost and risk. Administering through centrally managed IAM users with rotated keys fails the credential hygiene concept because rotation does not remove long-term secret exposure, while Identity Center federation with cross-account roles issues temporary credentials that satisfy the no-static-keys mandate. For exams remember trusted access is only a prerequisite and each service still needs explicit delegated registration in every Region with auto-enablement verified. Practical check is to confirm delegated administrators in Organizations, validate findings aggregate without object movement, and audit credential reports to prove no access keys support administration.