AWS Security Hub for Multi-Account Compliance Monitoring

SAA-C03 By islever Editorial Last updated

Design secure workloads and applications.

Short answer

D Designate an AWS Security Hub delegated administrator to enable and monitor NIST and PCI DSS standards across all member accounts.

Question

A financial services company that runs on AWS has designed its security controls to meet industry standards. The industry standards include the National Institute of Standards and Technology (NIST) and the Payment Card Industry Data Security Standard (PCI DSS). The company's third-party auditors need proof that the designed controls have been implemented and are functioning correctly. The company has hundreds of AWS accounts in a single organization in AWS Organizations. The company needs to monitor the current state of the controls across accounts. Which solution will meet these requirements?
  1. Designate one account as the Amazon Inspector delegated administrator account from the Organizations management account. Integrate Inspector with Organizations to discover and scan resources across all AWS accounts. Enable Inspector industry standards for NIST and PCI DSS.
  2. Designate one account as the Amazon GuardDuty delegated administrator account from the Organizations management account. In the designated GuardDuty administrator account, enable GuardDuty to protect all member accounts. Enable GuardDuty industry standards for NIST and PCI DSS.
  3. Configure an AWS CloudTrail organization trail in the Organizations management account. Designate one account as the compliance account. Enable CloudTrail security standards for NIST and PCI DSS in the compliance account.
  4. Designate one account as the AWS Security Hub delegated administrator account from the Organizations management account. In the designated Security Hub administrator account, enable Security Hub for all member accounts. Enable Security Hub standards for NIST and PCI DSS. Correct Answer

Key Takeaways

The exam tests the distinction between threat detection services (GuardDuty, Inspector) and centralized compliance aggregation (Security Hub). The trap is confusing automated remediation or scanning tools with the service that provides proof of control implementation against industry standards.

This question addresses how to centrally monitor compliance with NIST and PCI DSS standards across hundreds of AWS accounts using AWS Organizations. The correct solution leverages AWS Security Hub as the delegated administrator to aggregate security findings.

Common mistake: Candidates often select Amazon GuardDuty (B) because it is a popular security service, but GuardDuty focuses on threat detection rather than compliance posture assessment against frameworks like PCI DSS. Others might choose CloudTrail (C), which records API activity but does not evaluate controls against specific standards.

Expert Analysis

Why the Answer Is Correct

AWS Security Hub is the centralized security dashboard designed to assess your AWS environment against security industry standards and best practices. By designating one account as the Security Hub delegated administrator within AWS Organizations, you can enable Security Hub for all member accounts. This setup allows Security Hub to automatically collect and aggregate security findings, including compliance checks against standards like NIST and PCI DSS, providing the necessary proof to auditors.

Why the Other Options Are Wrong

Option A (Amazon Inspector) focuses on vulnerability management and OS-level patching, not comprehensive compliance standards like PCI DSS. Option B (Amazon GuardDuty) is a threat detection service that identifies malicious activity and unauthorized behavior, but it does not provide compliance reports for NIST or PCI DSS. Option C (CloudTrail) records API calls for auditing purposes but does not evaluate the configuration or state of resources against security standards; it logs actions, not compliance status.

Community Comment Notes

Community consensus strongly supports option D. As user 'sandordini' noted, "Security Hub: assess your AWS environment against security industry standards and best practices." Another commenter, 'Kaula', referenced the official documentation confirming Security Hub's role in compliance. User 'mk168898' succinctly linked "security industry standards" directly to "security hub," highlighting the key keyword association for this exam topic.

Official Reference

https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always associate 'compliance standards' (NIST, PCI DSS, CIS) with AWS Security Hub. Reserve GuardDuty for 'threats' and 'malicious activity', and Inspector for 'vulnerabilities' and 'patches'. When asked about multi-account aggregation of security posture, look for Security Hub with Organizations delegation.

Frequently Asked Questions

Why not use CloudTrail for PCI DSS proof?

CloudTrail logs API activity but does not evaluate resource configurations against compliance frameworks. It proves who did what, not if the system meets NIST/PCI DSS rules.

Can Security Hub replace GuardDuty?

No. Security Hub aggregates findings from multiple services including GuardDuty, Inspector, and Macie. It is a dashboard/aggregator, not a standalone detector.

More SAA-C03 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. sandordini 👍 7 Answered D
    Security Hub: assess your AWS environment against security industry standards and best practices.
  2. Kaula 👍 4 Answered D
    https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html
  3. Johnoppong101 👍 2 Answered D
    NIST, PCI DSS Compliance + AWS accounts -> Security Hub
  4. mk168898 👍 2 Answered D
    security industry standards => security hub

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide