Examkin

Question

Difficulty: HardAWS Management, Governance, and Developer Tools

An enterprise is establishing a multi-account AWS environment. The cloud operations team must satisfy the following governance goals:

1. Automatically set up a secure, governed multi-account AWS environment (landing zone) based on AWS best practices.
2. Centrally enforce security guidelines by applying policy controls that restrict allowed AWS services and API actions across all member accounts.

Which AWS services should the enterprise implement to meet these requirements? (Select TWO).

  1. AWS Control TowerAnswer
  2. AWS OrganizationsAnswer
  3. C
    AWS Config
  4. D
    AWS Systems Manager
  5. E
    AWS CloudFormation

Answer

AWS Control Tower and AWS Organizations
AWS Control Tower automates the creation of a multi-account environment (landing zone) using best-practice blueprints. AWS Organizations acts as the underlying service to manage these accounts centrally and apply Service Control Policies (SCPs) to enforce permission boundaries and restrict API calls.

Step-by-Step Solution

1
Analyze the requirement for establishing a secure, governed multi-account landing zone.
AWS Control Tower is the specific service designed to automate landing zone setup under AWS best practices.
This directly matches the first goal of setting up a governed multi-account environment.
2
Analyze the requirement for centrally restricting AWS services and API actions across all member accounts.
AWS Organizations provides Service Control Policies (SCPs) which act as guardrails to centrally restrict member account permissions.
This directly matches the second goal of enforcing central security guidelines.

Key Concept

Multi-account governance using landing zones and central policy boundaries
Rate this question

Topics

AWS Management, Governance, and Developer Tools

More questions from this topic