Question 590
A professional architect is reviewing two independent workstreams. Requirement A: Security analysts need one cross-account aggregation view of prioritized findings without requesting console access in every workload account. Requirement B: Customer-uploaded S3 objects must appear in a second Region for durability and region-isolation objectives. Choose TWO remedies that meet A and B respectively.
Explanation
Correct Answers
This action meets the independently stated requirement A: Security analysts need one cross-account aggregation view of prioritized findings without requesting console access in every workload account. Security Hub delegated administration centralizes findings while each source account retains its own resources. A direct acceptance check is: The delegated account receives findings from participating member accounts and permitted Regions.
This action meets the independently stated requirement B: Customer-uploaded S3 objects must appear in a second Region for durability and region-isolation objectives. Cross-Region Replication asynchronously copies eligible objects between configured buckets. A direct acceptance check is: Newly created and eligible changed objects arrive in the destination bucket with expected encryption.
Incorrect Answers
This action targets a different technical need: Critical backups must be scheduled consistently across many application accounts and retained by policy. It does not replace either required solution in A or B. Organization backup policies support common baseline definitions but still require functioning target configuration; verify the two stated requirements independently rather than accepting an unrelated change.
This action targets a different technical need: A service needs to replay historical event notifications after a downstream subscriber defect is corrected. It does not replace either required solution in A or B. EventBridge archives support bounded replay of previously captured events; verify the two stated requirements independently rather than accepting an unrelated change.
This action targets a different technical need: Compliance requires protected organization-wide API activity logs to flow into a centralized security account with controlled deletion. It does not replace either required solution in A or B. AWS Organizations trails centralize multi-account CloudTrail logging when storage access is secured; verify the two stated requirements independently rather than accepting an unrelated change.