A company uses AWS Organizations and runs production workloads in multiple AWS accounts. A security engineer must implement a solution that proactively detects suspicious activity across all production accounts, automatically remediates incidents, sends a notification to an Amazon Simple Notification Service (Amazon SNS) topic for critical findings, and centralizes all security incident logs in a dedicated account. Which solution meets these requirements?

The correct solution involves enabling Amazon GuardDuty in each production account, as it is a threat detection service that proactively monitors for suspicious activity. Aggregating GuardDuty findings in a dedicated logging account centralizes security incident logs. Using Amazon EventBridge to invoke a custom AWS Lambda function from GuardDuty findings allows for automated remediation and the ability to publish notifications to an Amazon SNS topic for critical findings. Incorrect options: Directly invoking a Lambda function from GuardDuty is not a native GuardDuty feature; EventBridge is the standard way to trigger actions based on GuardDuty findings. While AWS Security Hub aggregates findings, GuardDuty is specifically designed for proactive threat detection. AWS Config and AWS Systems Manager can perform remediation, but the prompt specifically asks for detection of suspicious activity, which GuardDuty excels at. Enabling Security Hub is good for aggregating findings, but GuardDuty is the primary service for proactive detection of suspicious activity as requested.