A retailer runs 140 AWS accounts in one AWS Organizations organization. Each business unit owns its accounts, and the platform team creates new accounts every week.
The security team wants Amazon GuardDuty turned on in every account, including accounts created later, with all findings visible in one security tooling account. The security team must not run daily work from the management account, and no account owner should have to take a manual step.
Which TWO actions should the security team take? (Choose two.)
Choose two answers.
AA. Turn on GuardDuty in the management account, then send an email invitation from it to each member account when that account is created.
BB. From the management account, designate the security tooling account as the GuardDuty delegated administrator for the organization.
CC. Add a service control policy that denies guardduty:DeleteDetector, and ask each account owner to enable GuardDuty in their own account.
DD. In the delegated administrator account, set auto-enable to cover all member accounts, so that GuardDuty is turned on in existing accounts and in accounts that join later.
EE. Give the security team IAM users in the management account with GuardDuty administrator permissions, and review findings there each morning.
Show the answer and explanation
Answers: B, D
A. Wrong: Invitations need an acceptance step in each account, which is a manual step for the owner. Running detectors from the management account also breaks the rule that daily security work stays out of it.
B. Right: Correct. Designating a delegated administrator from the management account moves GuardDuty administration to the security tooling account, so daily work stays out of the management account. The delegated administrator can then see findings from every member account. Learn more: Managing multiple accounts in Amazon GuardDuty (opens in a new tab)
C. Wrong: A service control policy protects a detector from deletion, but it does not turn GuardDuty on. Each owner would have to enable it by hand, and the security team would still have no single place to see findings.
D. Right: Correct. Auto-enable for all member accounts turns on GuardDuty in the existing accounts and in each new account, without an invitation or a manual step by the owner. Together with the delegated administrator, it covers the accounts the platform team creates each week. Learn more: Managing multiple accounts in Amazon GuardDuty (opens in a new tab)
E. Wrong: This lets the team view findings, but it puts daily security work in the management account, which the team must avoid. It also gives many people broad access to the account that governs the whole organization.
Explanation
Turning on GuardDuty across an organization takes two parts: a delegated administrator account, designated from the management account, and auto-enable so that new accounts join without manual steps. The delegated administrator then collects findings from every member account in one place. Invitations and daily work in the management account both fail the stated requirements.
Want more on Threat detection and findings (GuardDuty, Macie, Security Hub)? The 5 full-length practice sets have 7 more Threat detection and findings (GuardDuty, Macie, Security Hub) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →