A retail enterprise runs 60 accounts across three Regions, security analysts miss threats scattered in GuardDuty, WAF, and CloudTrail, and leadership wants one prioritized view with automated enrichment. Which aggregation design should the architect implement to centralize security findings and monitoring events?
Select an answer to reveal the explanation.
Short Explanation
You can give your analysts one prioritized view instead of making them hunt across 60 accounts. Security Hub aggregation brings findings together across Regions, while centralized CloudTrail delivery gives you monitoring events in one archive. That combination helps your team focus on threats and investigate them centrally.
Full Explanation
Delegating Security Hub administration gives you scalable governance across the 60 accounts, and cross-Region aggregation consolidates GuardDuty and WAF findings into a prioritized view with automated enrichment. Streaming the Organization CloudTrail to a central log archive also centralizes monitoring events across accounts. A design that aggregates Security Hub findings but does not stream CloudTrail centrally leaves those events fragmented, so analysts lack a unified place to review them alongside prioritized findings. Retaining CloudTrail trails in each member account likewise leaves API history distributed, making centralized protection, analytics, and retention controls harder to manage, even though findings are aggregated. Sending Organization CloudTrail to central S3 and using CloudWatch cross-account observability still requires manual triage of log events; it does not provide Security Hub’s finding prioritization, normalization, and correlation. Exam caveat: centralized logging and centralized findings management are different capabilities; a central S3 archive alone does not prioritize threats. Practical check: confirm the delegated Security Hub administrator has all three Regions linked for aggregation, required standards and GuardDuty and WAF integrations enabled, and an Organization trail logging across all accounts with delivery to the central archive.