SAP-C02 - Design Solutions for Organizational Complexity (26% of the exam) - Section 1.2

Design centralised security auditing, event notification and encryption strategy using AWS CloudTrail, AWS Security Hub, AWS KMS and AWS Certificate Manager.

Design a centralised security posture using AWS CloudTrail for audit logging, AWS Security Hub for aggregating findings, AWS KMS for envelope encryption, and AWS Certificate Manager for certificate lifecycle management. Recognise which service each addresses and how findings flow from member accounts to a security audit account.

AWS CloudTrailAWS Security HubAWS KMSAWS Certificate Manager

Practice question for this objective

Free sampleDesign Solutions for Organizational Complexityhard

A media organisation with 90 accounts in AWS Organizations wants one account, rather than the management account, to operate its security tooling and view findings from every member account. The security team needs Amazon GuardDuty and AWS Security Hub findings aggregated organisation-wide, automatic enrolment of new accounts, and a design that keeps the management account out of day-to-day security operations to limit its blast radius. Which approach BEST achieves centralised security operations across the organisation?

AOperate GuardDuty and Security Hub from the management account directly, inviting each member account individually and re-running the invitation process by hand whenever a new account is created anywhere in the organisation.
BConfigure an AWS Config organisation aggregator in the security account and rely on its conformance pack compliance status to surface the threat findings the security team needs from every member account.
CDesignate the dedicated security account as the delegated administrator for GuardDuty and Security Hub in AWS Organizations, then enable automatic enablement so new member accounts are onboarded as they join. Correct
DReplicate each member account's GuardDuty and Security Hub findings into a central S3 bucket with EventBridge rules and have the security team query the consolidated objects with Amazon Athena.

Use organisation delegated administration with automatic enablement to centralise security findings in a dedicated account away from the management account. AWS Organizations lets a member account be the delegated administrator for services such as GuardDuty and Security Hub, so security operations run from a dedicated account rather than the high-privilege management account. With automatic enablement, every existing and newly joined member account is onboarded and its findings aggregate centrally, which manual invitations, a Config aggregator or custom S3 export pipelines cannot match for coverage and low overhead.

Why A is wrong: Running security tooling from the management account widens its blast radius, and manual per-account invitations do not auto-enrol new accounts, so coverage drifts as the organisation grows.

Why B is wrong: A Config aggregator centralises configuration and rule compliance, but it does not collect GuardDuty threat detections or Security Hub findings, so the security team would lack the threat data the requirement names.

Why C is correct: Delegated administration moves GuardDuty and Security Hub operations into the dedicated security account and away from the management account, and turning on automatic enablement onboards every current and future member account so findings aggregate organisation-wide.

Why D is wrong: Per-account EventBridge export to S3 can collect findings, but it is custom plumbing that each account must keep configured and gives no native aggregated console, duplicating capability the delegated administrator already provides.

See more SAP-C02 practice questions, answers explained.

Exam traps in Design Solutions for Organizational Complexity

Answers that look right on this material and are not. Each one is a distractor from a different question in the SAP-C02 bank for this domain.

Build an EventBridge rule in every account and Region that forwards Security Hub findings to an EventBridge bus in the central account, then write a Lambda function there to de-duplicate and normalise the events before storing them in DynamoDB.
Why it is wrong: Hand-built EventBridge forwarding plus a de-duplication function can move findings centrally, but it recreates capability Security Hub aggregation already provides and adds a custom pipeline to maintain in every account and Region.
Keep a separate CloudTrail trail in each account but reconfigure every one to deliver to a single shared S3 bucket, and add new trails by hand whenever an account joins the organisation.
Why it is wrong: Pointing per-account trails at one bucket centralises storage, but each trail is still owned locally and can be stopped by that account, and adding a trail manually for every new account does not scale or guarantee coverage.
Stand up a second, independent IAM Identity Center instance inside the dedicated security account, migrate the permission sets and assignments into it, and disable the original instance so identity operations are run entirely from the security account.
Why it is wrong: Identity Center is an organisation-wide service and is not designed to run two parallel instances for the same organisation, so this fragments identity management and breaks existing assignments rather than relocating administration cleanly.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.