Auto-enable Security Hub for all accounts and aggregate findings across Regions

SCS-C02 By islever Editorial Last updated

Develop a strategy to centrally deploy and manage AWS accounts. Evaluate the compliance of AWS resources.

Short answer

AC Turn on Security Hub auto-enable for all accounts and configure a finding aggregation Region to receive all-Region findings.

Question

A company has AWS accounts that are in an organization in AWS Organizations. A security engineer needs to set up AWS Security Hub in a dedicated account for security monitoring. The security engineer must ensure that Security Hub automatically manages all existing accounts and all new accounts that are added to the organization. Security Hub also must receive findings from all AWS Regions. Which combination of actions will meet these requirements with the LEAST operational overhead? (Choose two.)
  1. Configure a finding aggregation Region for Security Hub. Link the other Regions to the aggregation Region. Correct Answer
  2. Create an AWS Lambda function that routes events from other Regions to the dedicated Security Hub account. Create an Amazon EventBridge rule to invoke the Lambda function.
  3. Turn on the option to automatically enable accounts for Security Hub. Correct Answer
  4. Create an SCP that denies the securityhub:DisableSecurityHub permission. Attach the SCP to the organization’s root account.
  5. Configure services in other Regions to write events to an AWS CloudTrail organization trail. Configure Security Hub to read events from the trail.

Key Takeaways

Security Hub's auto-enable membership (delegated admin) automatically enrolls all existing and newly created organization accounts, eliminating manual onboarding. Cross-Region finding aggregation links every Region's findings to one aggregation Region in the dedicated security account, providing organization- and Region-wide visibility with minimal operational effort.

Security Hub must centrally monitor a dedicated account, automatically cover existing and new organization accounts, and receive findings from all Regions with least overhead. Turning on Security Hub's auto-enable option makes every current and future account a member automatically. Configuring a finding aggregation Region and linking the other Regions funnels all Regions' findings into the dedicated account, satisfying both requirements without per-account SCP or Lambda work.

Common mistake: Adding an SCP that denies securityhub:DisableSecurityHub (option D). That is a preventative guardrail, not a mechanism to enable or aggregate accounts/Regions, and is unnecessary for the stated requirements. Or building Lambda/EventBridge routing (option B), which duplicates native auto-enable and aggregation.

Expert Analysis

Why the Answer Is Correct

C (auto-enable) ensures Security Hub is turned on for all existing and future organization accounts from the delegated admin account, meeting the automatic account-management requirement with no per-account action. A (finding aggregation Region) links all Regions so findings from every Region roll up into the dedicated security account, meeting the all-Regions requirement. Both are native, low-overhead settings.

Why the Other Options Are Wrong

B (Lambda + EventBridge routing) is unnecessary custom work that native aggregation already provides. D (SCP denying DisableSecurityHub) is a preventive guardrail, not an enablement or aggregation mechanism, and is not required by the scenario. E (organization trail) supports auditing but does not enable Security Hub or aggregate its findings.

Community Comment Notes

Community favored A,C (75 votes), noting D is preventative and not needed for the requirement. A minority argued C,D as "simplest," but D does not enable or aggregate accounts/Regions. AC is the least-overhead native pair.

Official Reference

These links open the official vendor documentation in a new tab.

Community Votes

AC
75%
CD
25%

75% of anonymous learners picked answer AC. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. TareDHakim 👍 2
    D is a preventative method which isn't a requirement for this scenario.
  2. IPLogic 👍 1
    To meet the requirements with the least operational overhead, the best combination of actions is: A. Configure a finding aggregation Region for Security Hub. Link the other Regions to the aggregation Region. C. Turn on the option to automatically enable accounts for Security Hub. These actions will ensure that Security Hub manages all existing and new accounts automatically and receives findings from all AWS Regions with minimal manual intervention.
  3. Bad_Mat 👍 3
    Roll back, AC
  4. jdx000 👍 1
    CD is the simplest way
  5. Bad_Mat 👍 1
    I think CD

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Preserve EC2 forensic evidence by isolating first, then capturing memory before stopping the instance

S-grade

Grant the report Lambda Security Hub read-only access because findings are already in Security Hub

S-grade

Deny inbound MySQL 3306 and allow outbound TLS 443 with ephemeral return in a custom NACL

S-grade

Prepare a PHI/public-bucket audit with Macie, Audit Manager, and Security Hub FSBP

S-grade

← Back to SCS-C02 Study Guide