The security team wants a native AWS service to continuously assess all member accounts in an AWS Organization against the CIS AWS Foundations Benchmark. Which approach is the most operationally efficient?

The most operationally efficient approach is to designate an AWS Security Hub administrator account, enable automatic enrollment of new accounts as member accounts, and enable the CIS AWS Foundations Benchmark checks. Security Hub is designed for continuous security posture management across multiple accounts and natively supports the CIS AWS Foundations Benchmark. Automatic enrollment simplifies management by ensuring new accounts are automatically included. Incorrect options: Scripting invitations and acceptances for each account is less efficient than automatic enrollment, especially in a dynamic environment. Amazon Inspector focuses on vulnerability management for EC2 instances and container images, not continuous compliance against benchmarks for the entire AWS environment. GuardDuty is a threat detection service, not a compliance assessment tool for benchmarks like CIS.