A new AWS Control Tower landing zone has been created inside an AWS Organization. The landing zone must demonstrate compliance with the CIS AWS Foundations benchmarks, and the security team should view aggregated Security Hub findings across all accounts (only the security team can view aggregated findings). Specific users must be able to view findings for their own accounts. All accounts must be automatically enrolled in Security Hub when created. Which set of steps, performed mostly automatically, will achieve this? (Choose three.)

The correct options address the requirements for centralized security management, compliance, and user access. Enabling trusted access and designating a delegated administrator account for Security Hub allows for centralized aggregation of findings across the organization, which is necessary for the security team. Configuring the CIS AWS Foundations standard in this delegated account ensures compliance checks are performed. Creating an IAM Identity Center permission set and assigning it to the security team in the delegated account provides them with the necessary access to view aggregated findings. Enabling automatic enablement in Security Hub ensures that all new accounts are automatically enrolled, simplifying ongoing management. The incorrect options are less effective or incorrect. Enabling the CIS standard directly from the management account without a delegated administrator would not allow for centralized aggregation of findings for the security team. An SCP to deny access is overly restrictive and doesn't directly address the positive requirement of granting access to the security team. An EventBridge rule with a Lambda to call CreateMembers is a manual workaround for automatic enablement, which is a built-in Security Hub feature.