AWS Control Tower and Security Hub for Centralized Audit

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

A Deploy an AWS Control Tower environment in the Organizations management account with AWS Security Hub enabled.

Question

A company has an organization in AWS Organizations that has all features enabled. The company requires that all API calls and logins in any existing or new AWS account must be audited. The company needs a managed solution to prevent additional work and to minimize costs. The company also needs to know when any AWS account is not compliant with the AWS Foundational Security Best Practices (FSBP) standard. Which solution will meet these requirements with the LEAST operational overhead?
  1. Deploy an AWS Control Tower environment in the Organizations management account. Enable AWS Security Hub and AWS Control Tower Account Factory in the environment. Correct Answer
  2. Deploy an AWS Control Tower environment in a dedicated Organizations member account. Enable AWS Security Hub and AWS Control Tower Account Factory in the environment.
  3. Use AWS Managed Services (AMS) Accelerate to build a multi-account landing zone (MALZ). Submit an RFC to self-service provision Amazon GuardDuty in the MALZ.
  4. Use AWS Managed Services (AMS) Accelerate to build a multi-account landing zone (MALZ). Submit an RFC to self-service provision AWS Security Hub in the MALZ.

Key Takeaways

The core concept is leveraging AWS Control Tower's Landing Zone capabilities in the management account to enforce guardrails and integrate Security Hub for automated FSBP compliance checks, minimizing operational overhead.

This question evaluates the use of AWS Control Tower combined with AWS Security Hub to achieve centralized auditing and compliance monitoring across an AWS Organization.

Common mistake: Candidates often select Option B, mistakenly deploying Control Tower in a member account instead of the management account, or Option D, which lacks the centralized governance features of Control Tower.

Expert Analysis

Why the Answer Is Correct

Option A is correct because AWS Control Tower is designed to be deployed in the AWS Organizations management account to create a secure, multi-account environment (Landing Zone). By enabling AWS Security Hub within this environment, the company can automatically aggregate security findings and check compliance against the AWS Foundational Security Best Practices (FSBP) standard across all accounts. This setup provides centralized logging, monitoring, and account creation (via Account Factory) with minimal manual effort, satisfying the 'least operational overhead' requirement.

Why the Other Options Are Wrong

Option B is incorrect because AWS Control Tower must be deployed in the management account, not a dedicated member account, to effectively govern the entire organization. Option C and D involve AWS Managed Services (AMS), which is a managed service provider offering, not a native self-service AWS feature that minimizes internal operational overhead as requested; additionally, AMS Accelerate is typically used for migration, not ongoing governance automation like Control Tower.

Community Comment Notes

Community consensus strongly favors Option A. As user LeonSauveterre noted, "Control Tower enforces centralized logging, monitoring, and account management," while correctly identifying that B deviates from best practices by using a member account. User Kezuko also provided a direct link to AWS documentation confirming the integration between Control Tower and Security Hub controls.

Official Reference

https://docs.aws.amazon.com/controltower/latest/userguide/security-hub-controls.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always identify the deployment target for foundational services like AWS Control Tower; it must reside in the management account. Look for keywords like 'least operational overhead' and 'compliance' which point towards integrated, managed solutions like Control Tower + Security Hub rather than custom scripts or third-party services.

Frequently Asked Questions

Why not deploy Control Tower in a member account?

Control Tower requires the management account to act as the root of trust for the organization. Deploying it in a member account breaks the hierarchical governance structure.

Does Security Hub replace GuardDuty?

No, they serve different purposes. GuardDuty detects threats, while Security Hub aggregates findings and checks compliance against standards like FSBP. They work together.

More SAA-C03 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. Kezuko 👍 4 Answered A
    https://docs.aws.amazon.com/controltower/latest/userguide/security-hub-controls.html
  2. FlyingHawk 👍 2 Answered A
    This question was in my today's exam.
  3. LeonSauveterre 👍 1 Answered A
    A - Control Tower enforces centralized logging, monitoring, and account management. Security Hub monitors compliance with AWS Foundational Security Best Practices (FSBP). Account Factory simplifies the creation of new accounts with preconfigured settings. B - Control Tower is intended to be deployed in the management account, not a member account, which deviates from AWS-recommended practices. C - GuardDuty focuses on security threats rather than compliance monitoring for FSBP. D - AMS Accelerate is more suitable for enterprises with highly complex requirements. Also, more operational overheads and cost more, but the question wants "to prevent additional work and to minimize costs".
  4. kempes 👍 4 Answered A
    Option A
  5. asdfcdsxdfc 👍 2 Answered A
    A is correct
Show 2 more comments
  1. LuongTo 👍 1
    Why not B?
  2. Ipergorta 👍 1
    Option D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide