A gaming company with 40 accounts and three Regions needs one security dashboard, long-term log retention, and automated response to GuardDuty and Config findings. Which architecture best aggregates security and monitoring events centrally?
Select an answer to reveal the explanation.
Short Explanation
You've got 40 accounts buzzing, so you'll love having one mission-control screen instead of tab-hopping all day. Security Hub gathers your GuardDuty and Config findings centrally while logs land in your archive, and EventBridge fires off automatic fixes.
Full Explanation
The correct design aligns each requirement with centralized control: Organizations organization trail sends logs from all accounts to log archive S3 with Glacier lifecycle for durable low-cost long-term retention, Security Hub delegated admin with cross-Region aggregation normalizes GuardDuty plus Config findings into one dashboard, and EventBridge provides event-driven automated response. The manual-triage centralized logging design is operationally sound for retention and visibility but fails automation because without EventBridge GuardDuty and Config findings need human handling. The distributed-retention with centralized findings design is common for autonomy but fails central governance because member-local CloudTrail breaks immutable archiving, uniform lifecycle, and audit assurance. The primary-Region-only centralized design is valid for single-Region estates but fails coverage because without cross-Region aggregation findings in other Regions never reach the single dashboard. Exam caveat: do not confuse Security Hub dashboard aggregation with Detective investigation graphs or CloudTrail Lake querying, and watch for single-Region versus aggregator wording. Practical check: verify organization trail multi-Region and all accounts, bucket Object Lock plus lifecycle, Security Hub aggregation linkage, and EventBridge test triggers for GuardDuty and Config.