Question 110
While designing a multi-Region AWS solution, the decisive constraint is: Backup policies must protect resources in many accounts but recovery access should remain isolated. Which technical choice resolves the stated issue?
Explanation
Correct Answer
Use delegated AWS Backup administration and dedicated secured backup vaults. Organization-aware backup governance can separate operational ownership from recovery safeguards.
Incorrect Answers
For the separate situation A security account must receive selected GuardDuty and Security Hub events from member accounts, Route matching findings through EventBridge to a central event bus with explicit resource permissions could be useful. Cross-account event buses deliver security signals without granting full account access.
Use CloudWatch cross-account observability and tightly scoped monitoring roles solves the related scenario Teams in different accounts need standardized metrics and log views with governed read access; cross-account observability enables centralized investigation while retaining workload-account ownership.
Although Configure an organization trail and destination bucket policy with required write permissions can be valid when An organization must deliver its member accounts CloudTrail events to a security-owned bucket, it targets a different technical condition. A centrally managed trail enables common event collection across organization accounts.