Examkin

Soru

Zorluk: ZorAWS Management, Governance, and Developer Tools

An enterprise is establishing a multi-account AWS environment. The cloud operations team must satisfy the following governance goals:

1. Automatically set up a secure, governed multi-account AWS environment (landing zone) based on AWS best practices.
2. Centrally enforce security guidelines by applying policy controls that restrict allowed AWS services and API actions across all member accounts.

Which AWS services should the enterprise implement to meet these requirements? (Select TWO).

  1. AWS Control TowerCevap
  2. AWS OrganizationsCevap
  3. C
    AWS Config
  4. D
    AWS Systems Manager
  5. E
    AWS CloudFormation

Cevap

AWS Control Tower and AWS Organizations
AWS Control Tower automates the creation of a multi-account environment (landing zone) using best-practice blueprints. AWS Organizations acts as the underlying service to manage these accounts centrally and apply Service Control Policies (SCPs) to enforce permission boundaries and restrict API calls.

Adım Adım Çözüm

1
Analyze the requirement for establishing a secure, governed multi-account landing zone.
AWS Control Tower is the specific service designed to automate landing zone setup under AWS best practices.
This directly matches the first goal of setting up a governed multi-account environment.
2
Analyze the requirement for centrally restricting AWS services and API actions across all member accounts.
AWS Organizations provides Service Control Policies (SCPs) which act as guardrails to centrally restrict member account permissions.
This directly matches the second goal of enforcing central security guidelines.

Anahtar Kavram

Multi-account governance using landing zones and central policy boundaries
Bu soruyu puanla

Konular

AWS Management, Governance, and Developer Tools

Bu konudan daha fazla soru