Exam AWS Certified Security - Specialty topic 1 question 309 discussion

B......IMO....https://aws.amazon.com/blogs/security/how-to-manage-amazon-guardduty-security-findings-across-multiple-accounts/

B is the correct answer. ACD do not say much really!

C. By adding the threat list to any company account within AWS Organizations, the security engineer can ensure that the threat list is available to all accounts that are part of the organization. This will allow the security engineer to efficiently use the threat list across all company AWS accounts without having to manually add it to each account.

Option B for me.

In multi-account environments, only users from GuardDuty administrator accounts can upload and manage trusted IP lists and threat lists. Trusted IP lists and threat lists that are uploaded by the administrator account are imposed on GuardDuty functionality in its member accounts. Customize findings within the GuardDuty network through the creation and management of suppression rules, trusted IP lists, and threat lists. Member accounts lose access to these features in a multiple-account environment.

https://aws.amazon.com/blogs/security/how-to-manage-amazon-guardduty-security-findings-across-multiple-accounts/

B. Ensure GuardDuty is in master-member configuration. Add the threat list to the master account referencing the S3 object that contains the threat list.

Answer: B https://aws.amazon.com/blogs/security/how-to-automate-import-third-party-threat-intelligence-feeds-into-amazon-guardduty/

Managing multiple accounts in Amazon GuardDuty To manage multiple accounts in Amazon GuardDuty, you must choose a single AWS account to be the administrator account for GuardDuty. You can then associate other AWS accounts with the administrator account as member accounts. There are two ways to associate accounts with a GuardDuty administrator account: either through an AWS Organizations organization that both accounts are members of, or by sending an invitation through GuardDuty. https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_accounts.html "C" is the answer