Examkin

Question

Difficulty: HardMulti-Account Governance and Organizational Structure

An enterprise is designing a secure multi-account governance strategy using AWS Organizations. The security team wants to establish a secure, managed landing zone with automated account provisioning, centralized logging, and strict service control policies (SCPs) to prevent member accounts from disabling security monitoring. Arrange the following steps in the correct sequence to configure and secure this multi-account environment, ensuring that guardrails are active before member accounts begin deploying workloads.

  1. 1Deploy AWS Control Tower in the management account to establish the foundational landing zone, creating the Core OUs, Log Archive account, and Audit account.
  2. 2Register the Audit account as the delegated administrator for Amazon GuardDuty and AWS Security Hub from the Organizations management account.
  3. 3From the Audit account, enable and configure Amazon GuardDuty and AWS Security Hub for all current and future accounts in the organization.
  4. 4From the management account, attach a Service Control Policy (SCP) to member OUs to prevent member accounts from disabling GuardDuty and Security Hub.
  5. 5Provision new member accounts for application workloads through the AWS Control Tower Account Factory.

Answer

The correct sequence is: Deploy AWS Control Tower in the management account, register the Audit account as the delegated administrator, enable security services from the Audit account, attach the protective SCP from the management account, and finally provision member accounts.
The correct sequence begins with deploying AWS Control Tower to establish the landing zone, which creates the foundational OUs and core accounts (including the Audit account). Once the Audit account exists, delegated administration is configured from the management account, allowing the Audit account to manage security services organization-wide. The Audit account then enables GuardDuty and Security Hub. Next, the management account applies SCPs to member OUs to prevent disabling these monitoring tools, establishing the necessary guardrails. Finally, workload accounts are provisioned via Account Factory, ensuring they are governed by the established security baselines and SCPs from the moment of creation.

Step-by-Step Solution

1
Deploy AWS Control Tower in the management account.
Establishes the foundational landing zone, OUs, and core accounts (Log Archive and Audit).
Creates the target accounts and OUs needed for delegation and policy attachment.
2
Designate the Audit account as the delegated administrator for GuardDuty and Security Hub from the management account.
Grants the Audit account organization-wide management permissions for the security services.
The Audit account cannot enable or configure services across other accounts without this delegation.
3
Enable and configure GuardDuty and Security Hub for all accounts from the Audit account.
Security monitoring is active across the organization.
Ensures that all member accounts are baseline-monitored before restricting changes or adding workloads.
4
Attach a protective SCP to member OUs from the management account.
Member accounts are restricted from disabling or modifying GuardDuty and Security Hub.
Establishes policy-based guardrails to maintain security posture.
5
Provision member accounts using AWS Control Tower Account Factory.
New member accounts are created with full guardrails and monitoring enabled from day one.
Ensures no unmonitored window of time exists for new workloads.

Key Concept

Multi-Account Security Governance and Control Delegation
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic