A security team in a dedicated account must centrally manage GuardDuty findings, Security Hub, and Config aggregator for the whole organization — without using the management account daily. What pattern applies?
A.Cross-account IAM roles assumed into every member account
Role-chasing per account doesn't scale and misses the services' native org integration.
B.Register the security account as delegated administrator for those services
Correct. Delegated admin is the designed mechanism for exactly this operating model.
C.Replicate all findings to the security account with EventBridge rules per account
Works technically but reinvents what Security Hub/GuardDuty org features do natively.
D.Make the security account a second management account
There is exactly one management account per organization.
Why this answer
Delegated administration lets a member account administer an AWS service organization-wide (GuardDuty, Security Hub, Config, etc.) — best practice is keeping the management account for billing/org structure only.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Multi-Account Architecture practice session.
Practice Multi-Account Architecture