A holding company with 80 member accounts must enforce GuardDuty, Security Hub, and Macie findings centrally while letting each subsidiary view only its own findings and preventing members from disabling the services. Which delegated administration design achieves central control with scoped visibility?

Designating a security tooling delegated administrator for GuardDuty, Security Hub, and Macie is the right design: organization auto-enable enrolls current and future member accounts, findings can be managed centrally while each subsidiary has scoped visibility, and SCPs prevent members from disabling the services. Designating a delegated administrator for GuardDuty, Security Hub, and Detective fails the service-coverage requirement because Detective does not provide Macie’s sensitive-data discovery, leaving the requested Macie protection unmet. Aggregating findings in the management account may centralize visibility, but it does not establish the clean delegated-administration boundary intended for operational security tooling; the management account has a distinct billing and organization role and cannot be governed by SCPs in the same way as member accounts. Allowing members to pause detectors for tuning fails the enforcement requirement: local suspension makes mandatory protection optional and can leave findings undetected. Exam caveat: distinguish a delegated administrator from simply aggregating findings in the management account, and do not treat Detective as a substitute for Macie. Practical check: verify the three delegated administrator registrations and organization auto-enable settings, confirm a subsidiary role sees only its own findings, and test that an SCP denies a member’s attempt to disable a service.