Security findings raised in member accounts must trigger automated response runbooks that run only in the central security account. Which event architecture supports that pattern?
Select an answer to reveal the explanation.
Short Explanation
Findings are like smoke alarms in every building that need to ring the firehouse, not just the hallway. Cross-account EventBridge carries the signal into the security account where the response automation lives.
Full Explanation
Multi-account security architectures commonly route Security Hub, GuardDuty, or custom findings via EventBridge rules with cross-account targets so remediation and orchestration stay centralized. That separates detection in members from privileged response tooling in the security account. Manual email, spreadsheet cadence, and root-key Lambdas in every account are neither scalable nor least privilege.