Management and governance

Correct Answer: AWS Organizations with Service Control Policies (SCPs) to define permissions guardrails for IAM users in member accounts

AWS Organizations with Service Control Policies (SCPs) is the most suitable service for centrally managing access permissions for IAM users across multiple AWS accounts. SCPs allow you to define permissions guardrails that apply to all IAM users in the member accounts of an organization. This ensures that IAM users have the necessary permissions to perform their job functions while maintaining strict security controls. AWS Systems Manager is primarily used for operational tasks such as patching, configuration management, and automation, but it does not provide centralized IAM permission management across multiple accounts. Amazon Inspector is a security assessment service that helps identify vulnerabilities and deviations from best practices in AWS resources, but it does not manage IAM permissions across accounts. AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources, including IAM. However, it focuses on compliance monitoring and reporting rather than centralized permission management across multiple accounts.

Correct Answer: AWS CloudTrail

AWS CloudTrail is the correct service to use for recording and evaluating API activity across multiple accounts and services for governance, risk, and compliance purposes. It enables you to log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. AWS Config is used for continuously monitoring and recording AWS resource configurations, but it doesn't specifically focus on API activity logging for compliance purposes. Amazon CloudWatch collects metrics, logs, and events, but it is primarily used for monitoring application performance and resource utilization rather than auditing API activity. AWS Systems Manager provides a unified interface to view operational data and automate tasks, but it is not the primary service for logging and evaluating API activity for compliance and governance.

Correct Answer: Amazon GuardDuty

Amazon GuardDuty is the correct answer because it is an AWS service specifically designed to automatically detect, investigate, and respond to potential security issues across AWS accounts. It uses machine learning, anomaly detection, and integrated threat intelligence to identify and prioritize potential security threats. AWS Systems Manager focuses more on operational tasks like patch management and configuration compliance, rather than dedicated security monitoring. AWS Config is used for tracking configuration changes and compliance, but not for active security monitoring and response. AWS CloudTrail logs API activity for auditing purposes, but does not provide the automated threat detection and response capabilities of GuardDuty.