A central security team needs GuardDuty and Security Hub visibility across all org accounts WITHOUT operating from the management account. What's the mechanism?
A.Enable the services in each account manually
Manual per-account enablement doesn't scale or auto-cover new accounts.
B.Delegated administrator account — a dedicated security account manages the org-wide services
Delegated admin = managed org-wide security. Correct.
C.Cross-account IAM role assumed per account
Role assumption is per-account plumbing — not native aggregation.
D.Export findings to a shared S3 bucket
Exporting findings is reporting, not centralized management.
Why this answer
Delegated administrator = the Organizations pattern for security services: register a member account (typically a dedicated security tooling account) as admin for GuardDuty/Security Hub/Inspector/Config aggregators — keeping the management account hands-off. The standard multi-account security architecture.
Correct answer: B · Last reviewed 2026-11-05
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Multi-Account Architecture practice session.
Practice Multi-Account Architecture