A university system with 40 AWS accounts in Organizations struggles with inconsistent WAF rules, open security groups, and divergent firewall policies. Central security must enforce baseline protections automatically, including remediation of drift. Which centralized control best deploys and enforces network protections?

Firewall Manager with a delegated administrator is purpose-built for this scenario because it centrally deploys and continuously enforces baseline WAF web ACL associations, VPC security group rules, and Network Firewall policies across accounts and OUs, automatically remediating drift when resources fall out of compliance, which directly solves inconsistent rules and divergent policies at scale. By contrast, service control policies at the organization root provide strong centralized preventive guardrails by denying noncompliant API actions, but they cannot deploy required WAF associations or revert already-existing open security groups, so they fail the automatic remediation and deployment requirement. Centralized AWS Network Firewall with Transit Gateway inspection is a sound, commonly used architecture for scalable L3 and L4 filtering, yet it addresses only network-layer traffic and does not create or enforce WAF protections or security group baselines, so it fails the stated scope requirement. A central AWS Config aggregator with Systems Manager automation is excellent for cross-account detection of drift and event-driven remediation, but it is fundamentally detective with add-on response rather than policy-based enforcement that provisions and maintains protections, so it fails the centralized deployment requirement and scales poorly for 40 accounts. For exams, remember the caveat that preventive, detective, and enforcement controls sound similar under Organizations, so focus on verbs like deploy, enforce, and auto-remediate to select Firewall Manager when remediation of existing noncompliance is required. As a practical check, confirm the Firewall Manager administrator account, enable automatic remediation on each security policy, and verify scope includes the target OUs and resource types before auditing compliance in the console.