Amazon SOA-C02 Practice Exams
Last updated on Oct 23,2026- Exam Code: SOA-C02
- Exam Name: AWS Certified SysOps Administrator - Associate
- Certification Provider: Amazon
- Latest update: Oct 23,2026
Question #391
A SysOps administrator has enabled AWS CloudTrail in an AWS account. If CloudTrail is disabled, it must be re-enabled immediately.
What should the SysOps administrator do to meet these requirements WITHOUT writing custom code?
- A . Add the AWS account to AWS Organizations. Enable CloudTrail in the management account.
- B . Create an AWS Config rule that is invoked when CloudTrail configuration changes. Apply the AWS-ConfigureCloudTrailLogging automatic remediation action.
- C . Create an AWS Config rule that is invoked when CloudTrail configuration changes. Configure the rule to invoke an AWS Lambda function to enable CloudTrail.
- D . Create an Amazon EventBridge (Amazon CloudWatch Events) hourly rule with a schedule pattern to run an AWS Systems Manager Automation document to enable CloudTrail.
Correct Answer: B
B
Explanation:
Step-by-Step
Understand the Problem:
CloudTrail must be re-enabled immediately if it is disabled.
Analyze the Requirements:
Implement an automatic solution to monitor and re-enable CloudTrail.
Evaluate the Options:
Option A: Add the AWS account to AWS Organizations and enable CloudTrail in the management account.
This provides centralized management but does not ensure automatic re-enabling of CloudTrail.
Option B: Create an AWS Config rule with automatic remediation.
AWS Config can monitor changes and automatically remediate by re-enabling CloudTrail.
Option C: Create an AWS Config rule that invokes a Lambda function.
This requires custom code, which is not preferred.
Option D: Create an EventBridge rule with a Systems Manager Automation document.
This can re-enable CloudTrail but is more complex compared to AWS Config’s built-in remediation.
Select the Best Solution:
Option B: Using AWS Config with automatic remediation ensures CloudTrail is re-enabled without writing custom code.
Reference: AWS Config Rules
Automatic Remediation with AWS Config
Creating an AWS Config rule with automatic remediation ensures that CloudTrail is immediately re-enabled if it is disabled.
B
Explanation:
Step-by-Step
Understand the Problem:
CloudTrail must be re-enabled immediately if it is disabled.
Analyze the Requirements:
Implement an automatic solution to monitor and re-enable CloudTrail.
Evaluate the Options:
Option A: Add the AWS account to AWS Organizations and enable CloudTrail in the management account.
This provides centralized management but does not ensure automatic re-enabling of CloudTrail.
Option B: Create an AWS Config rule with automatic remediation.
AWS Config can monitor changes and automatically remediate by re-enabling CloudTrail.
Option C: Create an AWS Config rule that invokes a Lambda function.
This requires custom code, which is not preferred.
Option D: Create an EventBridge rule with a Systems Manager Automation document.
This can re-enable CloudTrail but is more complex compared to AWS Config’s built-in remediation.
Select the Best Solution:
Option B: Using AWS Config with automatic remediation ensures CloudTrail is re-enabled without writing custom code.
Reference: AWS Config Rules
Automatic Remediation with AWS Config
Creating an AWS Config rule with automatic remediation ensures that CloudTrail is immediately re-enabled if it is disabled.
Question #392
A company has deployed an application on AWS. The application runs on a fleet of Linux Amazon EC2 instances that are in an Auto Scaling group. The Auto Scaling group is configured to use launch templates. The launch templates launch Amazon Elastic Block Store (Amazon EBS) backed EC2 instances that use General Purpose SSD (gp3) EBS volumes for primary storage.
A SysOps administrator needs to implement a solution to ensure that all the EC2 instances can share the same underlying files. The solution also must ensure that the data is consistent.
Which solution will meet these requirements?
- A . Create an Amazon Elastic File System (Amazon EFS) file system. Create a new launch template version that includes user data that mounts the EFS file system. Update the Auto Scaling group to use the new launch template version to cycle in newer EC2 instances and to terminate the older EC2 instances.
- B . Enable Multi-Attach on the EBS volumes. Create a new launch template version that includes user data that mounts the EBS volume. Update the Auto Scaling group to use the new template version to cycle in newer EC2 instances and to terminate the older EC2 instances.
- C . Create a cron job that synchronizes the data between the EBS volumes for all the EC2 instances in the Auto Scaling group. Create a lifecycle hook during instance launch to configure the cron job on all the EC2 instances. Rotate out the older EC2 instances.
- D . Create a new launch template version that creates an Amazon Elastic File System (Amazon EFS) file system. Update the Auto Scaling group to use the new template version to cycle in newer EC2 instances and to terminate the older EC2 instances.
Correct Answer: A
A
Explanation:
The requirement to share the same underlying files among EC2 instances with data consistency is best met by using Amazon Elastic File System (EFS), which supports concurrent access from multiple EC2 instances. A new launch template version should include user data scripts that mount the EFS file system on each instance launched by the Auto Scaling group. Older instances can be cycled out to ensure all instances use the new configuration. Option A is correct and provides the necessary solution while ensuring data consistency and availability. For implementation guidance, refer to the AWS documentation on integrating EFS with EC2 Amazon EFS Integration with EC2.
A
Explanation:
The requirement to share the same underlying files among EC2 instances with data consistency is best met by using Amazon Elastic File System (EFS), which supports concurrent access from multiple EC2 instances. A new launch template version should include user data scripts that mount the EFS file system on each instance launched by the Auto Scaling group. Older instances can be cycled out to ensure all instances use the new configuration. Option A is correct and provides the necessary solution while ensuring data consistency and availability. For implementation guidance, refer to the AWS documentation on integrating EFS with EC2 Amazon EFS Integration with EC2.
Question #393
A company has an application that uses Amazon DynamoDB tables The tables are spread across AWS accounts and AWS Regions. The company uses AWS CloudFormation to deploy AWS resources.
A new team at the company is deleting unused AWS resources. The team accidentally deletes several
production DynamoDB tables by running an AWS Lambda function that makes a DynamoDB DeleteTable API call. The table deletions cause an application outage A SysOps administrator must implement a solution that minimizes the chance of accidental deletions of tables. The solution also must minimize data loss that results from accidental deletions.
Which combination of steps will meet these requirements? (Select TWO.)
- A . Enable termination protection for the CloudFormation stacks that deploy the DynamoDB tables.
- B . Enable deletion protection for the DynamoDB tables
- C . Enable point-in-time recovery for (he DynamoDB tables. Restore the tables if they are accidentally deleted.
- D . Schedule daily backups of the DynamoDB tables. Restore the tables if they are accidentally deleted.
- E . Export the DynamoDB tables to Amazon S3 every day. Use Import from Amazon S3 to restore data for tables that are accidentally deleted
Correct Answer: BC
BC
Explanation:
Enable deletion protection for the DynamoDB tables:
Deletion protection is a feature that prevents accidental deletion of DynamoDB tables. When enabled, it requires an additional step to disable this protection before the table can be deleted.
Steps:
Go to the AWS Management Console.
Navigate to DynamoDB.
Select the table you want to protect.
Choose the "Overview" tab.
Under "Deletion protection," click "Enable deletion protection."
Reference: AWS DynamoDB Deletion Protection
Enable point-in-time recovery (PITR) for the DynamoDB tables:
PITR provides continuous backups of your DynamoDB tables. You can restore the table to any point in time within the last 35 days.
Steps:
Go to the AWS Management Console.
Navigate to DynamoDB.
Select the table you want to enable PITR for.
Choose the "Backups" tab.
Click on "Enable Point-in-Time Recovery."
If a table is accidentally deleted, you can restore it using PITR.
Go to the DynamoDB console.
Select "Backups" from the navigation pane.
Find the table backup and choose "Restore."
Reference: AWS DynamoDB Point-In-Time Recovery
BC
Explanation:
Enable deletion protection for the DynamoDB tables:
Deletion protection is a feature that prevents accidental deletion of DynamoDB tables. When enabled, it requires an additional step to disable this protection before the table can be deleted.
Steps:
Go to the AWS Management Console.
Navigate to DynamoDB.
Select the table you want to protect.
Choose the "Overview" tab.
Under "Deletion protection," click "Enable deletion protection."
Reference: AWS DynamoDB Deletion Protection
Enable point-in-time recovery (PITR) for the DynamoDB tables:
PITR provides continuous backups of your DynamoDB tables. You can restore the table to any point in time within the last 35 days.
Steps:
Go to the AWS Management Console.
Navigate to DynamoDB.
Select the table you want to enable PITR for.
Choose the "Backups" tab.
Click on "Enable Point-in-Time Recovery."
If a table is accidentally deleted, you can restore it using PITR.
Go to the DynamoDB console.
Select "Backups" from the navigation pane.
Find the table backup and choose "Restore."
Reference: AWS DynamoDB Point-In-Time Recovery
Question #394
A company migrated an I/O intensive application to an Amazon EC2 general purpose instance. The EC2 instance has a single General Purpose SSD Amazon Elastic Block Store (Amazon EBS) volume attached.
Application users report that certain actions that require intensive reading and writing to the disk are taking much longer than normal or are failing completely. After reviewing the performance metrics of the EBS volume, a SysOps administrator notices that the VolumeQueueLength metric is consistently high during the same times in which the users are reporting issues. The SysOps administrator needs to resolve this problem to restore full performance to the application.
Which action will meet these requirements?
- A . Modify the instance type to be storage optimized.
- B . Modify the volume properties by deselecting Auto-Enable Volume 10.
- C . Modify the volume properties to increase the IOPS.
- D . Modify the instance to enable enhanced networking.
Correct Answer: C
C
Explanation:
Step-by-Step
Understand the Problem:
An I/O intensive application on an Amazon EC2 general purpose instance is experiencing performance issues.
Users report delays or failures during intensive read/write operations. The VolumeQueueLength metric is consistently high during these periods. Analyze the Requirements:
Address the high VolumeQueueLength, which indicates that the EBS volume is unable to handle the I/O requests efficiently.
Improve the disk I/O performance to restore full application performance.
Evaluate the Options:
Option A: Modify the instance type to be storage optimized.
Storage optimized instances are designed for workloads that require high, sequential read and write access to large data sets on local storage.
This could help, but if the issue is primarily with EBS volume performance, increasing IOPS would be a more direct solution.
Option B: Modify the volume properties by deselecting Auto-Enable Volume I/O.
Auto-Enable Volume I/O is a setting that automatically enables I/O for the EBS volume after an event such as a snapshot restore.
Deselecting this option will not address the issue of high I/O demand.
Option C: Modify the volume properties to increase the IOPS.
Increasing the IOPS (Input/Output Operations Per Second) will directly address the high VolumeQueueLength by allowing the volume to handle more I/O operations concurrently.
This is the most effective and direct solution to improve the performance of I/O intensive tasks.
Option D: Modify the instance to enable enhanced networking.
Enhanced networking provides higher bandwidth, higher packet per second (PPS) performance, and consistently lower inter-instance latencies.
While beneficial for network performance, this does not directly impact the EBS volume’s I/O performance.
Select the Best Solution:
Option C: Modifying the volume properties to increase the IOPS directly addresses the high VolumeQueueLength and improves the EBS volume’s ability to handle intensive read/write operations.
Reference: Amazon EBS Volume Types
Amazon EBS Volume Performance
Optimizing EBS Performance
Increasing the IOPS of the EBS volume ensures that the application can handle the required intensive read/write operations more efficiently, directly addressing the high VolumeQueueLength and restoring full performance.
C
Explanation:
Step-by-Step
Understand the Problem:
An I/O intensive application on an Amazon EC2 general purpose instance is experiencing performance issues.
Users report delays or failures during intensive read/write operations. The VolumeQueueLength metric is consistently high during these periods. Analyze the Requirements:
Address the high VolumeQueueLength, which indicates that the EBS volume is unable to handle the I/O requests efficiently.
Improve the disk I/O performance to restore full application performance.
Evaluate the Options:
Option A: Modify the instance type to be storage optimized.
Storage optimized instances are designed for workloads that require high, sequential read and write access to large data sets on local storage.
This could help, but if the issue is primarily with EBS volume performance, increasing IOPS would be a more direct solution.
Option B: Modify the volume properties by deselecting Auto-Enable Volume I/O.
Auto-Enable Volume I/O is a setting that automatically enables I/O for the EBS volume after an event such as a snapshot restore.
Deselecting this option will not address the issue of high I/O demand.
Option C: Modify the volume properties to increase the IOPS.
Increasing the IOPS (Input/Output Operations Per Second) will directly address the high VolumeQueueLength by allowing the volume to handle more I/O operations concurrently.
This is the most effective and direct solution to improve the performance of I/O intensive tasks.
Option D: Modify the instance to enable enhanced networking.
Enhanced networking provides higher bandwidth, higher packet per second (PPS) performance, and consistently lower inter-instance latencies.
While beneficial for network performance, this does not directly impact the EBS volume’s I/O performance.
Select the Best Solution:
Option C: Modifying the volume properties to increase the IOPS directly addresses the high VolumeQueueLength and improves the EBS volume’s ability to handle intensive read/write operations.
Reference: Amazon EBS Volume Types
Amazon EBS Volume Performance
Optimizing EBS Performance
Increasing the IOPS of the EBS volume ensures that the application can handle the required intensive read/write operations more efficiently, directly addressing the high VolumeQueueLength and restoring full performance.
Question #395
The SysOps administrator needs to deploy auditing software on all existing and new EC2 instances across multiple Regions, using AWS Systems Manager.
- A . Create a Systems Manager Distributor package that includes the auditing software. Store the package in an Amazon S3 bucket. Create a Systems Manager State Manager association in each Region to install the software package on all managed instances in the company’s AWS account.
- B . Load the installer for the auditing software into an Amazon S3 bucket. Connect to every instance by using Systems Manager Fleet Manager Remote Desktop. Download the installer by using the AWS CLI. Run the installer manually.
- C . Create an AWS Lambda function that calls the software installer. Merge the auditing software into the Lambda function by using Lambda layers. Run the Lambda function from each instance by using a scheduled Amazon EventBridge rule.
- D . Create an Amazon EventBridge rule to react to Amazon EC2 RunInstances events. Configure the rule to modify the events to include a step that runs the software installer. Reboot all the instances.
Correct Answer: A
A
Explanation:
Using AWS Systems Manager Distributor and State Manager is an automated and scalable solution for managing software installation across EC2 instances.
Systems Manager Distributor: Allows packaging and distributing the auditing software across multiple Regions.
State Manager Association: Automates software installation on both existing and new instances, ensuring consistent deployment across all managed instances.
Manually connecting to instances or using Lambda is not scalable or efficient for this type of ongoing software management.
A
Explanation:
Using AWS Systems Manager Distributor and State Manager is an automated and scalable solution for managing software installation across EC2 instances.
Systems Manager Distributor: Allows packaging and distributing the auditing software across multiple Regions.
State Manager Association: Automates software installation on both existing and new instances, ensuring consistent deployment across all managed instances.
Manually connecting to instances or using Lambda is not scalable or efficient for this type of ongoing software management.
Question #395
The SysOps administrator needs to deploy auditing software on all existing and new EC2 instances across multiple Regions, using AWS Systems Manager.
- A . Create a Systems Manager Distributor package that includes the auditing software. Store the package in an Amazon S3 bucket. Create a Systems Manager State Manager association in each Region to install the software package on all managed instances in the company’s AWS account.
- B . Load the installer for the auditing software into an Amazon S3 bucket. Connect to every instance by using Systems Manager Fleet Manager Remote Desktop. Download the installer by using the AWS CLI. Run the installer manually.
- C . Create an AWS Lambda function that calls the software installer. Merge the auditing software into the Lambda function by using Lambda layers. Run the Lambda function from each instance by using a scheduled Amazon EventBridge rule.
- D . Create an Amazon EventBridge rule to react to Amazon EC2 RunInstances events. Configure the rule to modify the events to include a step that runs the software installer. Reboot all the instances.
Correct Answer: A
A
Explanation:
Using AWS Systems Manager Distributor and State Manager is an automated and scalable solution for managing software installation across EC2 instances.
Systems Manager Distributor: Allows packaging and distributing the auditing software across multiple Regions.
State Manager Association: Automates software installation on both existing and new instances, ensuring consistent deployment across all managed instances.
Manually connecting to instances or using Lambda is not scalable or efficient for this type of ongoing software management.
A
Explanation:
Using AWS Systems Manager Distributor and State Manager is an automated and scalable solution for managing software installation across EC2 instances.
Systems Manager Distributor: Allows packaging and distributing the auditing software across multiple Regions.
State Manager Association: Automates software installation on both existing and new instances, ensuring consistent deployment across all managed instances.
Manually connecting to instances or using Lambda is not scalable or efficient for this type of ongoing software management.
Question #397
A company is running production workloads that use a Multi-AZ deployment of an Amazon RDS for MySQL db.m6g.xlarge (general purpose) standard DB instance. Users report that they are frequently encountering a "too many connections" error. A SysOps administrator observes that the number of connections on the database is high.
The SysOps administrator needs to resolve this issue while keeping code changes to a minimum.
Which solution will meet these requirements MOST cost-effectively?
- A . Modify the RDS for MySQL DB instance to a larger instance size.
- B . Migrate the RDS for MySQL DB instance to Amazon DynamoDB.
- C . Configure RDS Proxy. Modify the application configuration file to use the RDS Proxy endpoint.
- D . Modify the RDS for MySQL DB instance to a memory optimized DB instance.
Correct Answer: C
C
Explanation:
For the issue of "too many connections" on a MySQL database, using RDS Proxy offers a streamlined solution:
RDS Proxy Setup: RDS Proxy sits between your application and the database. It pools and efficiently manages database connections, which reduces the number of direct connections to the database.
Connection Management: By handling connection pooling, RDS Proxy can help mitigate issues related to connection overhead and limits, such as the "too many connections" error, by allowing the database to serve more requests from a smaller and more stable number of connections.
Minimal Code Changes: Integrating RDS Proxy requires changes only to the database connection settings in the application’s configuration files to point to the RDS Proxy endpoint instead of directly to the database. This minimizes the amount of code change needed and leverages RDS Proxy to handle connection scaling and management more efficiently.
This approach enhances database performance and scalability by efficiently managing connections without the need for significant application changes or database resizing.
C
Explanation:
For the issue of "too many connections" on a MySQL database, using RDS Proxy offers a streamlined solution:
RDS Proxy Setup: RDS Proxy sits between your application and the database. It pools and efficiently manages database connections, which reduces the number of direct connections to the database.
Connection Management: By handling connection pooling, RDS Proxy can help mitigate issues related to connection overhead and limits, such as the "too many connections" error, by allowing the database to serve more requests from a smaller and more stable number of connections.
Minimal Code Changes: Integrating RDS Proxy requires changes only to the database connection settings in the application’s configuration files to point to the RDS Proxy endpoint instead of directly to the database. This minimizes the amount of code change needed and leverages RDS Proxy to handle connection scaling and management more efficiently.
This approach enhances database performance and scalability by efficiently managing connections without the need for significant application changes or database resizing.
Question #398
A company is using Amazon Elastic File System (Amazon EFS) to share a file system among several Amazon EC2 instances. As usage increases, users report that file retrieval from the EFS file system is slower than normal.
Which action should a SysOps administrator take to improve the performance of the file system?
- A . Configure the file system for Provisioned Throughput.
- B . Enable encryption in transit on the file system.
- C . Identify any unused files in the file system, and remove the unused files.
- D . Resize the Amazon Elastic Block Store (Amazon EBS) volume of each of the EC2 instances.
Correct Answer: A
A
Explanation:
Step-by-Step
Understand the Problem:
Users report that file retrieval from the Amazon EFS file system is slower than normal.
Analyze the Requirements:
Improve the performance of the EFS file system to handle increased usage and file retrieval speed.
Evaluate the Options:
Option A: Configure the file system for Provisioned Throughput.
Provisioned Throughput mode allows you to specify the throughput of your file system independent of the amount of data stored.
This option is suitable for applications with high throughput-to-storage ratio requirements and ensures consistent performance.
Option B: Enable encryption in transit on the file system.
While this enhances security, it does not directly improve performance.
Option C: Identify any unused files in the file system, and remove the unused files.
This may free up some resources but does not address the root cause of slow performance.
Option D: Resize the Amazon EBS volume of each of the EC2 instances.
EFS performance issues are not directly related to the size of EBS volumes attached to EC2 instances.
Select the Best Solution:
Option A: Configuring the file system for Provisioned Throughput ensures consistent performance by allowing you to set the required throughput regardless of the amount of data stored.
Reference: Amazon EFS Performance
Provisioned Throughput Mode
Configuring Provisioned Throughput for Amazon EFS provides a consistent and higher performance level, which is suitable for high throughput requirements.
A
Explanation:
Step-by-Step
Understand the Problem:
Users report that file retrieval from the Amazon EFS file system is slower than normal.
Analyze the Requirements:
Improve the performance of the EFS file system to handle increased usage and file retrieval speed.
Evaluate the Options:
Option A: Configure the file system for Provisioned Throughput.
Provisioned Throughput mode allows you to specify the throughput of your file system independent of the amount of data stored.
This option is suitable for applications with high throughput-to-storage ratio requirements and ensures consistent performance.
Option B: Enable encryption in transit on the file system.
While this enhances security, it does not directly improve performance.
Option C: Identify any unused files in the file system, and remove the unused files.
This may free up some resources but does not address the root cause of slow performance.
Option D: Resize the Amazon EBS volume of each of the EC2 instances.
EFS performance issues are not directly related to the size of EBS volumes attached to EC2 instances.
Select the Best Solution:
Option A: Configuring the file system for Provisioned Throughput ensures consistent performance by allowing you to set the required throughput regardless of the amount of data stored.
Reference: Amazon EFS Performance
Provisioned Throughput Mode
Configuring Provisioned Throughput for Amazon EFS provides a consistent and higher performance level, which is suitable for high throughput requirements.
Question #399
A company is using Amazon Elastic File System (Amazon EFS) to share a file system among several Amazon EC2 instances. As usage increases, users report that file retrieval from the EFS file system is slower than normal.
Which action should a SysOps administrator take to improve the performance of the file system?
- A . Configure the file system for Provisioned Throughput.
- B . Enable encryption in transit on the file system.
- C . Identify any unused files in the file system, and remove the unused files.
- D . Resize the Amazon Elastic Block Store (Amazon EBS) volume of each of the EC2 instances.
Correct Answer: A
A
Explanation:
When experiencing slow file retrieval from an EFS file system as usage increases, configuring the file system for Provisioned Throughput can improve performance.
Provisioned Throughput:
Amazon EFS offers two throughput modes: Bursting Throughput and Provisioned Throughput.
With Provisioned Throughput, you can set a fixed throughput limit for your file system independent of the amount of data stored.
Configuring Provisioned Throughput:
Go to the EFS console and select your file system.
Click on "Manage File System" and then "Edit."
Choose the "Provisioned Throughput" option and set the desired throughput limit.
Benefits:
Provisioned Throughput ensures consistent performance and is beneficial for applications with high throughput requirements.
It helps in cases where the default Bursting Throughput mode might not provide sufficient throughput during peak times.
Reference: Amazon EFS Performance
Managing Amazon EFS File Systems
A
Explanation:
When experiencing slow file retrieval from an EFS file system as usage increases, configuring the file system for Provisioned Throughput can improve performance.
Provisioned Throughput:
Amazon EFS offers two throughput modes: Bursting Throughput and Provisioned Throughput.
With Provisioned Throughput, you can set a fixed throughput limit for your file system independent of the amount of data stored.
Configuring Provisioned Throughput:
Go to the EFS console and select your file system.
Click on "Manage File System" and then "Edit."
Choose the "Provisioned Throughput" option and set the desired throughput limit.
Benefits:
Provisioned Throughput ensures consistent performance and is beneficial for applications with high throughput requirements.
It helps in cases where the default Bursting Throughput mode might not provide sufficient throughput during peak times.
Reference: Amazon EFS Performance
Managing Amazon EFS File Systems
Question #400
To configure central configuration for Security Hub in an AWS Organization, the SysOps administrator must ensure it’s set up centrally.
- A . Enable Security Hub in the organization’s management account. Configure Security Hub central configuration.
- B . Enable Security Hub in the organization’s management account. Configure and integrate AWS Trusted Advisor. Configure Security Hub from an opt-in Region.
- C . Delegate an AWS account that is not the organization’s management account as the Security Hub administrator. Configure Security Hub central configuration.
- D . Delegate an AWS account that is not the organization’s management account as the Security Hub administrator. Configure and integrate AWS Trusted Advisor. Configure Security Hub from an opt-in Region.
Correct Answer: C
C
Explanation:
To centrally manage Security Hub across an organization, AWS allows you to delegate a member account as the Security Hub administrator. This enables centralized configuration and security insights without directly using the management account, which is a best practice.
Delegating a Non-Management Account: AWS recommends using a designated Security Hub administrator account (different from the management account) for central security configurations.
Security Hub Central Configuration: Configuring Security Hub in this manner ensures that security findings from all member accounts are consolidated and manageable from the designated administrator account.
C
Explanation:
To centrally manage Security Hub across an organization, AWS allows you to delegate a member account as the Security Hub administrator. This enables centralized configuration and security insights without directly using the management account, which is a best practice.
Delegating a Non-Management Account: AWS recommends using a designated Security Hub administrator account (different from the management account) for central security configurations.
Security Hub Central Configuration: Configuring Security Hub in this manner ensures that security findings from all member accounts are consolidated and manageable from the designated administrator account.