A company has an organization in AWS Organizations that has all features enabled. The company requires that all API calls and logins in any existing or new AWS account must be audited. The company needs a managed solution to prevent additional work and to minimize costs. The company also needs to know when any AWS account is not compliant with the AWS Foundational Security Best Practices $($FSBP$)$ standard.

Which solution will meet these requirements with the LEAST operational overhead?

A$.$ Deploy an AWS Control Tower environment in the Organizations management account. Enable AWS Security Hub and AWS Control Tower Account Factory in the environment.

B$.$ Deploy an AWS Control Tower environment in a dedicated Organizations member account. Enable AWS Security Hub and AWS Control Tower Account Factory in the environment.

C$.$ Use AWS Managed Services $($AMS$)$ Accelerate to build a multi$-$account landing zone $($MALZ$).$ Submit an RFC to self$-$service provision Amazon GuardDuty in the MALZ.

D$.$ Use AWS Managed Services $($AMS$)$ Accelerate to build a multi$-$account landing zone $($MALZ$).$ Submit an RFC to self$-$service provision AWS Security Hub in the MALZ.