AWS Certified DevOps Engineer - Professional DOP-C02 — Topic 1 Question 101

Question

A company recently created a new AWS Control Tower landing zone in a new organization in AWS Organizations. The landing zone must be able to demonstrate compliance with the Center for Internet Security (CIS) Benchmarks for AWS Foundations. The company’s security team wants to use AWS Security Hub to view compliance across all accounts. Only the security team can be allowed to view aggregated Security Hub findings. In addition, specific users must be able to view findings from their own accounts within the organization. All accounts must be enrolled in Security Hub after the accounts are created. Which combination of steps will meet these requirements in the MOST automated way? (Choose three.)

Accepted Answer

Correct answer: A, C, E. The correct answer is A, C, E. Option A: Turn on trusted access for Security Hub in the organization’s management account. Create a new security account by using AWS Control Tower. Configure the new security account as the delegated administrator account for... Option C: Create an AWS IAM Identity Center (AWS Single Sign-On) permission set that includes the required permissions. Use the CreateAccountAssignment API operation to associate the security team users with the permission set... Option E: In Security Hub, turn on automatic enablement. Amazon RDS is a managed relational database that handles patching, backups and failover. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS Security Hub centralizes security findings and compliance checks.

AWS Certified DevOps Engineer - Professional DOP-C02 — Question 101