A fintech with 60 accounts must spot credential theft and anomalous access to S3 buckets holding transaction exports, identify which exports hold sensitive data, centralize findings for analysts with long-term normalized retention for cross-account SQL analytics, and trigger alerts with visual trends. Which detection, aggregation, and dashboard design provides organization-wide anomaly visibility?
Select an answer to reveal the explanation.
Short Explanation
You’re connecting the dots across dozens of accounts. Centralized findings and lake analytics give you sharp correlation without drowning in raw logs.
Full Explanation
The design combining GuardDuty and Macie with Security Hub, Security Lake, EventBridge, and QuickSight matches the requirements at organization scale. GuardDuty detects credential theft and anomalous API and S3 access across the 60 accounts; Macie discovers sensitive transaction exports in S3; Security Hub centralizes and prioritizes findings for analysts; Security Lake provides durable, normalized storage for cross-account analytics; EventBridge automates alert routing; and QuickSight shows visual trends. The design using CloudTrail Insights instead of Macie strengthens API anomaly detection but cannot classify sensitive S3 data or assess bucket exposure, leaving the sensitive-export requirement unmet. The design that centralizes findings only in Security Hub supports triage and correlation but lacks Security Lake’s durable retention and analytics capabilities. The design using Athena queries and CloudWatch Logs insights supports expert investigation, but does not provide the requested automated EventBridge alerts and persistent QuickSight trend dashboards. For exams, remember that broad log collection is not sensitive-data discovery, and finding triage is not a substitute for lake retention when both are required. In practice, confirm delegated administrators in Organizations, validate Security Lake subscribers and QuickSight refresh, and test a simulated finding through to alert delivery.