A retailer with 40 accounts needs identical VPC baselines, guardrails, and encryption defaults deployed from a security admin account, with drift detection and versioned rollbacks. Local console changes have caused outages. Which deployment strategy should the architect choose to deliver consistent secure infrastructure across accounts?

CloudFormation StackSets with a delegated administrator enables centrally managed stack instances across accounts and Regions using version-controlled templates, automatic deployments to new accounts, drift detection, and stack operations for rollback, which enforces consistency and prevents local variance. Per-account nested stacks fail by concept because they require separate deployments without central orchestration or automatic multi-account rollout. Service Catalog portfolios fail by concept because they govern approved product provisioning rather than automatically enforcing baseline stacks and drift remediation across accounts. Systems Manager Run Command fails by concept because imperative scripts lack declarative state, drift detection, and safe rollback for network baselines. Exam caveat is to link StackSets to Organizations integration and delegated admin versus StackSets with self-managed permissions, and practical check is to enable drift detection and confirm stack instance status is in sync after deployment.