A city is standing up a new AWS Organizations OU for digital services. Security wants threat detection and a consolidated security findings view before any workload account goes live. What should be enabled in the baseline?
Select an answer to reveal the explanation.
Short Explanation
Turn on GuardDuty and Security Hub before the first workload moves in—like smoke detectors before tenants arrive. Waiting for a breach to "justify" detection is decorating after the fire.
Full Explanation
Before any digital-services workload account goes live in a new Organizations OU, security wants threat detection and a consolidated findings view. Enabling Amazon GuardDuty and AWS Security Hub with related baselines in the new OU and account structure before first launch provides detection and a standards-based findings hub from day one. Waiting until after the first production breach to enable managed detection is reactive by design. Enabling only Cost Explorer and treating billing anomalies as sufficient security monitoring misses intrusion patterns. Disabling organization CloudTrail trails to reduce log volume before launch removes forensic visibility. Exam caveat: GuardDuty and Security Hub need delegated admin, member account enablement, and response runbooks—not merely console toggles. Operational check: enable GuardDuty and Security Hub across the OU, generate a controlled finding in a sandbox, confirm it appears in the consolidated view, and verify CloudTrail organization trail delivery. In municipal cloud governance, record the owners, success metrics, and rollback or restore contacts beside this technical choice so the next incident, budget review, or audit does not rediscover the decision from scratch under time pressure.