SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a multi-account AWS environment with a central security account for AWS GuardDuty, AWS Security Hub, and AWS IAM Access Analyzer. The security team wants to aggregate findings from all member accounts into the security account. Which THREE steps should be taken?
⚠ Common exam trap
It's easy for candidates to confuse AWS Config aggregator (which aggregates configuration data) with security finding aggregation, or think that simply enabling a service in the security account automatically pulls findings from member accounts without explicitly designating the administrator account or adding members.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable AWS Security Hub in the security account and designate it as the administrator account for the organization.
AWS Security Hub supports multi-account management by designating a central administrator account (the security account) that aggregates findings from all member accounts across the organization. This is done through AWS Organizations integration, enabling automatic enrollment of all accounts and regions without manual setup.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Config aggregator in the security account to collect configuration items from all accounts.
Why it's wrong here
Config aggregator does not aggregate security findings.
- ✓
Enable AWS Security Hub in the security account and designate it as the administrator account for the organization.
Why this is correct
Security Hub administrator account aggregates findings.
- ✓
Enable Amazon GuardDuty in the security account and add member accounts via the GuardDuty API.
Why this is correct
GuardDuty administrator account can manage member accounts.
- ✓
Enable AWS IAM Access Analyzer in the security account with the organization as the zone of trust.
Why this is correct
Access Analyzer can analyze the entire organization.
- ✗
Configure GuardDuty in the security account to monitor all regions by using a single detector.
Why it's wrong here
GuardDuty detectors are per-region.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.