AWS Certified Security - Specialty SCS-C03

A company has hundreds of AWS accounts in an AWS Organizations organization. The company operates in a single AWS Region and has a dedicated security tooling AWS account in the organization. The security tooling account is configured as the organization's delegated administrator for Amazon GuardDuty and AWS Security Hub. The company has configured the environment to automatically enable GuardDuty and Security Hub for existing and new AWS accounts.

The company is conducting control tests on specific GuardDuty findings to ensure that the security team can detect and respond to security events. The security team launched an Amazon EC2 instance and tried to run DNS requests against a test domain, example.com, to produce a DNS finding. However, the GuardDuty finding was never created in the Security Hub delegated administrator account.

Why was the finding not created in the Security Hub delegated administrator account?