AWS Certified Solutions Architect Professional SAP-C02 Practice Question

Running enable-organization-admin-account from the organization management account designates the security-tooling account as the Security Hub delegated administrator in the current Region; repeating the call (or using central-configuration) in every active Region ensures that the same account is admin everywhere. In the delegated administrator account, update-organization-configuration with AutoEnable=true (and the default standards setting) automatically adds every existing and future member account as a Security Hub member in every Region, so findings flow to the delegated administrator without additional setup. Finally, an SCP applied at the root that explicitly denies securityhub:EnableOrganizationAdminAccount (except for the management account) blocks any other account from changing the delegated administrator. This combination satisfies all three requirements with a single point of administration and no per-account maintenance. The other options either rely on manual EventBridge forwarding, require per-account StackSet deployments, or depend on Control Tower guardrails that neither auto-enable Security Hub in every Region nor prevent other accounts from changing the administrator.