Examkin

Tüm alıştırma soruları

27 soru

Tüm türler1,964Çoktan seçmeli1,006Çoklu seçim931Sıralama27
Soru 1Soru →

An enterprise is designing a secure governance framework for its AWS Organizations structure, which consists of multiple organizational units (OUs) and a dedicated centralized Logging account. To comply with regulatory standards, a solutions architect must establish an organizational CloudTrail that logs all API activity across all member accounts. The architecture must adhere to the principle of least privilege by avoiding the use of the Management account for daily auditing tasks, and it must prevent any modifications or deletions of logging resources by member accounts.

What is the correct sequence of steps to configure this centralized, secure auditing solution?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

Register the Security Audit account as the delegated administrator for CloudTrail from the Organizations management account, configure the S3 bucket and KMS key resource policies in the Logging account, create the organizational trail from the Security Audit account, and then apply the Service Control Policy from the management account to the organization root.
The correct order begins with registering the Security Audit account as the delegated administrator for AWS CloudTrail from the management account. Next, the target resources (Amazon S3 bucket and KMS customer managed key) must be created and their resource policies configured in the central Logging account. This is mandatory before trail creation because CloudTrail validates the destination policies upon setup. The organizational trail is then created from the newly registered delegated administrator account. Finally, a Service Control Policy is attached to the organization root from the management account to prevent any member accounts from disabling or modifying the trail.

Adım Adım Çözüm

1
Enable CloudTrail trusted access and register the Security Audit account as the delegated administrator from the Organizations management account.
The Security Audit account is authorized to create and manage organizational trails.
Security principles dictate delegating operations away from the management account, but only the management account holds the authority to perform this registration.
2
Create the Amazon S3 bucket and KMS customer managed key in the centralized Logging account, and update their policies to allow CloudTrail service principal access.
A secure, centralized storage location is prepared to receive and encrypt organization-wide logs.
CloudTrail validates destination S3 bucket permissions and KMS key accessibility at the time of trail creation. If these are not configured first, the trail setup will fail.
3
Create the organization-wide CloudTrail from the Security Audit account, linking it to the destination S3 bucket and KMS key.
The organizational trail starts collecting and delivering logs from all accounts to the central S3 bucket.
This establishes the active auditing mechanism across the entire Organization using the delegated administrator permissions.
4
Attach a Service Control Policy (SCP) at the Organization root from the management account.
Member accounts are blocked from disabling, modifying, or deleting the organizational trail.
This finalizes the governance structure by ensuring the audit baseline cannot be compromised by member account administrators.

Anahtar Kavram

Delegated Administration and Centralized Resource Control in AWS Organizations
Soru 2Soru →

An enterprise is planning to establish a governed, multi-account AWS environment. The security team requires that all workload accounts inherit custom security baseline policies immediately upon creation or enrollment. The solutions architect decided to implement AWS Control Tower to manage this environment. The architect needs to initialize the landing zone, prepare the account hierarchy, configure custom guardrails, and onboard an existing standalone AWS account into the environment. Arrange the following steps in the correct chronological sequence to implement this architecture while ensuring no account is left temporarily un-governed.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: first, initialize AWS Control Tower in the management account to set up the baseline landing zone; second, create or register a custom Organizational Unit (OU) for workloads; third, apply custom Service Control Policies (SCPs) to the custom OU to establish the security boundaries; and fourth, enroll the existing standalone account into the pre-configured custom OU.
Initializing AWS Control Tower first is necessary to establish the landing zone. Next, the custom OU must be created to hold the workload accounts. Attaching the custom SCPs to this OU before enrolling accounts is a critical security best practice, ensuring that the target environment is already secure. Finally, enrolling the account ensures it immediately inherits all landing zone baselines and custom SCPs without any governance gaps.

Adım Adım Çözüm

1
Initialize the AWS Control Tower landing zone in the AWS Organizations management account.
Creates the core infrastructure, including the Security OU, Log Archive account, and Audit account, and enables Account Factory.
You cannot enroll accounts or manage OUs under AWS Control Tower governance until the landing zone is initialized.
2
Create or register a custom Organizational Unit (OU).
Establishes a container for workload accounts under AWS Control Tower governance.
Workload accounts require a separate OU container to segregate them from the core security and management accounts.
3
Attach custom Service Control Policies (SCPs) to the custom OU.
Establishes preventive guardrails on the OU before any member accounts are added.
Applying policies to the OU before enrolling accounts prevents a security gap where an account is active in the organization but not yet subject to the custom restrictions.
4
Enroll the existing standalone AWS account into the custom OU.
The existing account is brought under AWS Control Tower governance and immediately inherits the custom SCPs.
Enrolling the account is the final step, ensuring it is securely governed from the exact moment it joins the OU.

Anahtar Kavram

Chronological onboarding and policy application sequence in AWS Control Tower multi-account governance.
Soru 3Soru →

An enterprise is establishing a secure, automated multi-account landing zone using AWS Organizations and AWS Control Tower. The solutions architect needs to design a governance structure that automatically deploys custom Service Control Policies (SCPs) and baseline resources to all new accounts, while securing federated access for developers.

Arrange the following steps in the correct chronological sequence to implement this governance architecture from scratch according to AWS best practices.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological sequence is: first launch AWS Control Tower to set up the landing zone; second, define the workload Organizational Units; third, deploy the Customizations for AWS Control Tower (CfCT) pipeline; fourth, provision member accounts via the Account Factory; and fifth, configure and map AWS IAM Identity Center permissions to the newly created accounts.
The correct sequence starts with launching AWS Control Tower to initialize the landing zone and establish the core logging and security accounts. Next, custom OUs must be created in AWS Organizations to house future workloads. Then, the CfCT framework is deployed so it is active and ready to handle account lifecycle events. Afterwards, accounts are provisioned or enrolled via Account Factory, automatically receiving CfCT customizations. Finally, IAM Identity Center is configured to grant users federated access to the newly active accounts.

Adım Adım Çözüm

1
Initialize AWS Control Tower
The AWS Organizations management structure is configured, and the core Log Archive and Audit accounts are created.
This establishes the control plane and foundational account structure required for all subsequent steps.
2
Create Custom Organizational Units (OUs)
A structured OU hierarchy is established to group workloads based on security and operational requirements.
Target OUs must exist before we can attach policies or enroll member accounts into them.
3
Deploy Customizations for AWS Control Tower (CfCT)
A pipeline is deployed in the management account that listens to Control Tower lifecycle events.
Deploying CfCT beforehand ensures that custom resources and guardrails are automatically deployed when new accounts are provisioned.
4
Provision/Enroll Accounts
Member accounts are successfully created under the correct OUs and automatically receive custom baselines via CfCT.
Account provisioning triggers lifecycle events, prompting the CfCT pipeline to configure the new accounts.
5
Assign Federated Access
Users can federate into the new accounts with appropriate roles and permission sets.
Access assignments require the target account IDs and OUs to be fully active and provisioned.

Anahtar Kavram

Establishing multi-account governance using AWS Organizations, AWS Control Tower, CfCT customization pipeline, and AWS IAM Identity Center.
Tahmini Süre:3m 0s
Soru 4Soru →

A solutions architect is establishing a multi-account governance structure using AWS Organizations. The security architecture requires that corporate permission guardrails are active and applied to all member accounts immediately upon their inclusion in the organization, preventing any temporary window of non-compliance. What is the correct sequence of steps to configure this organizational structure?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is to first enable AWS Organizations, design and create the Organizational Unit hierarchy, author the Service Control Policies, attach these policies to the target Organizational Units, and finally provision or move member accounts into their respective Organizational Units.
The correct order establishes the management boundary (AWS Organizations), creates the logical containment structure (OUs), authors the policy guardrails (SCPs), applies the policies to the containers (OUs), and finally populates the containers with member accounts. This workflow ensures that no account exists in an OU without the governance policy already active and inherited, eliminating any window of vulnerability.

Adım Adım Çözüm

1
Enable AWS Organizations.
The multi-account organization is initialized and the management account is established.
An organization must exist to act as the boundary for OUs, accounts, and policies.
2
Create Organizational Units (OUs).
Logical grouping containers are established within the organization.
OUs act as the logical target for policy application and account segregation.
3
Author Service Control Policies (SCPs).
SCPs are saved as policy documents in the management account.
SCPs must be defined in the organization before they can be attached to containers.
4
Attach SCPs to OUs.
Guardrails are active on the OUs.
Attaching SCPs to OUs before moving accounts ensures that security guardrails are applied immediately on account entry, avoiding any security gaps.
5
Move or provision accounts into OUs.
Accounts are active and governed by the inherited SCPs.
Member accounts inherit the policies attached to their parent OUs instantly, ensuring compliance from day one.

Anahtar Kavram

Enforcing immediate policy inheritance in AWS Organizations by attaching Service Control Policies (SCPs) to Organizational Units (OUs) prior to moving or provisioning member accounts.
Tahmini Süre:2m 0s
Soru 5Soru →

An enterprise is planning to establish a secure multi-account structure using AWS Organizations. The solutions architect needs to set up a new organizational structure with Service Control Policies (SCPs) to restrict unauthorized services before any member accounts begin deploying workloads. Arrange the steps in the correct order to implement this multi-account governance structure safely.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order to safely implement multi-account governance is: first, enable AWS Organizations from the management account; second, create the Organizational Units (OUs); third, create and attach Service Control Policies (SCPs) to the OUs; and fourth, provision or move member accounts into the secured OUs.
The correct sequence begins with initializing the AWS Organization root. Following this, the OU structure must be defined. To ensure secure-by-default behavior, SCPs are created and attached to the OUs next. Only after the OUs are secured are member accounts provisioned or moved into them, guaranteeing immediate policy enforcement.

Adım Adım Çözüm

1
Enable AWS Organizations.
The organization root is established.
This is the prerequisite step to allow any organizational configuration or member account orchestration.
2
Create Organizational Units (OUs).
A structured hierarchy of OUs is created under the root.
OUs act as the logical containers that will hold both accounts and policies.
3
Create and attach Service Control Policies (SCPs) to OUs.
Governance guardrails are applied to the containers.
Applying policies to OUs before placing accounts in them ensures that accounts are protected and restricted from the very moment they are associated with the OU.
4
Provision or move accounts into OUs.
Member accounts inherit the attached SCPs immediately.
This is the final step where the target accounts are placed within the governed structure.

Anahtar Kavram

Multi-Account Governance and Secure Lifecycle Management
Soru 6Soru →

An enterprise is designing a secure multi-account AWS environment using AWS Organizations. The solutions architect needs to establish AWS Control Tower to govern the landing zone, apply baseline compliance controls, and deploy custom CloudFormation templates across all member accounts. Arrange the following steps in the correct chronological order to implement this multi-account governance solution.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps to implement AWS Control Tower governance is: 1. Design and establish the Organizational Unit (OU) hierarchy in AWS Organizations, 2. Deploy AWS Control Tower in the management account to initialize the landing zone, 3. Configure elective guardrails on the target OUs, 4. Provision new member accounts or enroll existing accounts into the governed OUs using Account Factory, and 5. Deploy the Customizations for AWS Control Tower (CfCT) framework to distribute custom resources.
The correct implementation sequence starts with designing and establishing the Organizational Unit (OU) structure to define account boundaries. Next, AWS Control Tower is deployed to establish the landing zone control plane. Once the landing zone is active, guardrails must be configured on the OUs to define baseline security boundaries. After the guardrails are active, new or existing accounts are provisioned or enrolled via Account Factory to inherit the baseline guardrails. Finally, the Customizations for AWS Control Tower (CfCT) framework is deployed to apply additional localized configurations and custom AWS resources to the governed accounts.

Adım Adım Çözüm

1
Design and establish the OU hierarchy in AWS Organizations.
The target container structure for accounts is defined.
This provides the structure that AWS Control Tower and member accounts will utilize.
2
Deploy AWS Control Tower in the management account.
The landing zone is created along with core shared accounts (Log Archive and Audit).
This establishes the core control plane and governance framework.
3
Configure elective guardrails on the target OUs.
Service Control Policies (SCPs) and Config rules are activated for the OUs.
Applying guardrails early ensures subsequent accounts are immediately protected.
4
Provision or enroll accounts into the governed OUs using Account Factory.
Member accounts are added to the organization and inherit the OU guardrails.
Accounts must exist under governed OUs to receive configurations and baseline governance.
5
Deploy the Customizations for AWS Control Tower (CfCT) framework.
A pipeline is established to deploy custom resources and localized policies across accounts.
CfCT depends on the completed landing zone infrastructure and active member accounts to target resources.

Anahtar Kavram

AWS Control Tower multi-account landing zone establishment and governance workflow.
Soru 7Soru →

A solutions architect is planning to implement standardized multi-account governance using AWS Control Tower for a new organization. Arrange the steps in the correct chronological order to establish and extend the landing zone.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: first, designate the root management account; second, configure and launch AWS Control Tower; third, provision the core shared accounts (Log Archive and Security Audit); and finally, use the Account Factory to provision individual workload accounts.
The correct chronological process begins with establishing the management account. Next, the solutions architect launches AWS Control Tower from that account. Following that, core security accounts (Log Archive and Audit) are automatically provisioned. Lastly, standard workload accounts are spawned via the Account Factory.

Adım Adım Çözüm

1
Select a clean AWS account to act as the root management account.
The root management account is established to serve as the administrative anchor of AWS Organizations.
Centralized governance requires an authoritative parent account to host AWS Organizations and AWS Control Tower.
2
Navigate to AWS Control Tower in the management account and initiate landing zone setup.
AWS Control Tower starts orchestrating the multi-account setup from the root account.
Enabling Control Tower initiates the automated creation of the organization, organizational units (OUs), and basic guardrails.
3
Ensure the deployment of core shared accounts under the Security OU.
The Log Archive account and Security Audit account are successfully deployed.
Centralized logging and security auditing configurations must be baseline-integrated before any end-user workloads are deployed.
4
Access the AWS Control Tower Account Factory via Service Catalog.
Workload-specific AWS accounts (such as development or production accounts) are provisioned under standardized templates.
Account Factory is the mechanism to safely scale member account deployment while maintaining organizational compliance.

Anahtar Kavram

Establishing an AWS Control Tower Landing Zone requires configuring administrative management, deploying core security and logging structures, and then scaling through standardized account provisioning.
Tahmini Süre:1m 0s
Soru 8Soru →

An organization plans to establish a secure, multi-account AWS environment using AWS Control Tower. The solutions architect must prepare the account, launch the landing zone, establish centralized access, register organizational units, enroll new member accounts under governance, and deploy custom policies across the entire organization. Arrange the steps in the correct chronological order to implement this governance solution.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological sequence is to first disable any pre-existing AWS Config configuration recorders and delivery channels, second set up and launch the AWS Control Tower landing zone, third configure AWS IAM Identity Center for federated administrative access, fourth create and register custom OUs with Control Tower, fifth provision new workload accounts using Account Factory, and finally deploy the Customizations for AWS Control Tower (CfCT) framework to apply custom Service Control Policies (SCPs).
Establishing a secure multi-account environment with AWS Control Tower requires a strict ordering. First, pre-existing AWS Config configuration recorders must be disabled in the management account to avoid setup conflicts. Next, the AWS Control Tower landing zone is launched to create core accounts (logging, security) and OUs. Once the environment is initialized, AWS IAM Identity Center is configured to define federated access. Following this, custom OUs must be created and registered under AWS Control Tower governance. Member accounts can then be provisioned using the Account Factory so that they inherit these guardrails from the start. Finally, custom policies and resources are deployed using the Customizations for AWS Control Tower (CfCT) framework once the organizational structure and accounts are in place.

Adım Adım Çözüm

1
Prepare the management account by disabling existing AWS Config configuration recorders and delivery channels.
Potential landing zone initialization failures due to duplicate AWS Config recorders are avoided.
AWS Control Tower manages its own AWS Config recorders, and existing ones will cause the landing zone deployment to fail.
2
Launch the AWS Control Tower landing zone.
The core Organization structure, Security OU, Sandbox OU, Log Archive account, and Security Audit account are deployed.
This establishes the foundational multi-account framework and default guardrails.
3
Configure AWS IAM Identity Center.
Federated identity access is established and permission sets are mapped to users and groups.
Administrators must be able to log in to the newly generated core accounts before configuring additional resources.
4
Create and register custom OUs.
Custom OUs are registered under AWS Control Tower governance.
Workload segregation requires custom OUs, which must be registered with Control Tower to receive guardrails.
5
Enroll accounts via Account Factory.
New member accounts are provisioned, linked to the registered OUs, and standard VPCs are set up.
Provisioning accounts through Account Factory ensures they are automatically governed and compliant from creation.
6
Deploy the Customizations for AWS Control Tower (CfCT) framework.
Custom SCPs and CloudFormation resources are automatically deployed to the target OUs.
Customizations are applied as the final layer of governance once accounts and OUs are established.

Anahtar Kavram

AWS Control Tower Landing Zone Setup and Governance Customization Sequence
Tahmini Süre:2m 0s
Soru 9Soru →

An enterprise is designing a secure, multi-account governance strategy using AWS Organizations. The security team wants to delegate CloudTrail administration to a dedicated Security Tooling account. All member accounts must have their API activity logged to a centralized Amazon S3 bucket in the Security Tooling account, encrypted with an AWS KMS Customer Managed Key (CMK). The configuration must be enforced across the organization to prevent member accounts from modifying or bypassing the logging structure.

What is the correct sequence of steps to establish this centralized, secure organization trail using the principle of least privilege in the management account?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts by enabling trusted access for CloudTrail from the management account, followed by registering the Security Tooling account as the delegated administrator. Next, the KMS CMK and S3 bucket are created and configured with appropriate resource policies in the Security Tooling account. Then, the organization trail is created from the Security Tooling account. Finally, a Service Control Policy (SCP) is attached from the management account to the organization root to enforce the logging configuration and protect resources from tampering.
The correct sequence begins with enabling trusted access for AWS CloudTrail from the Organizations management account, followed by registering the Security Tooling account as the delegated administrator for CloudTrail. Next, the logging destination (Amazon S3 bucket) and encryption resources (KMS CMK) are created and configured with resource policies in the Security Tooling account to allow CloudTrail access. The organization trail is then created from the Security Tooling account. Finally, an SCP is attached to the organization root from the management account to enforce logging compliance across all member accounts.

Adım Adım Çözüm

1
Enable trusted access for AWS CloudTrail from the Organizations management account.
Allows AWS CloudTrail to integrate with AWS Organizations, which is a prerequisite for creating organization-level trails and delegating administration.
Delegated administration and organization-level resources cannot be managed before trusted access is explicitly enabled.
2
Register the Security Tooling account as the delegated administrator for CloudTrail from the management account.
Grants the Security Tooling account permissions to create, update, and delete organization-level trails.
This establishes the delegation of administrative duties, adhering to the security principle of least privilege by reducing the need to access the management account.
3
Create the KMS CMK and Amazon S3 bucket in the Security Tooling account, updating their resource-based policies.
Prepares the storage and encryption infrastructure. The S3 bucket policy must allow 's3:PutObject' for CloudTrail with a condition for the organization ID, and the KMS key policy must allow 'kms:GenerateDataKey*' and 'kms:DescribeKey' for the CloudTrail service principal.
The trail creation will fail if the logging destination (S3) and encryption key (KMS) are not pre-configured to accept logs from the CloudTrail service principal across all accounts.
4
Create the organization trail from the Security Tooling account.
Deploys a multi-region organization trail across all existing and future accounts, sending logs to the central S3 bucket using the KMS key.
Using the delegated administrator permissions, the security team can configure and start the trail without management account access.
5
Attach a Service Control Policy (SCP) at the root level of the organization from the management account.
Restricts member accounts from disabling CloudTrail, modifying the organization trail, or tampering with the S3 bucket and KMS key in the Security Tooling account.
SCPs must be applied to prevent root and administrator users in member accounts from bypassing security logging and auditing controls.

Anahtar Kavram

Delegated administration of AWS CloudTrail and centralizing organization-level logging under AWS Organizations governance.
Soru 10Soru →

A solutions architect is tasked with restricting member accounts from performing unauthorized actions across a newly created AWS Organization. The architect decides to use Service Control Policies (SCPs) to enforce these boundaries. To implement this governance control, in what order should the steps be performed?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is to first create the AWS Organization, enable the Service Control Policies feature within the organization settings, author the custom policy document, and then attach the policy to the target Organizational Unit.
Establishing governance using SCPs requires first setting up the AWS Organization. The Service Control Policies feature must then be enabled in the organization settings since it is disabled by default. Once enabled, the custom policy defining the governance limits must be created, and finally, the policy must be attached to the target Organizational Unit (OU) to enforce the rules on member accounts.

Adım Adım Çözüm

1
Initialize the AWS Organization.
The Organization is created, and the management account is established.
You cannot manage policies or organize accounts before the organization environment exists.
2
Enable the Service Control Policies policy type.
SCPs are activated and ready to be applied.
SCPs are disabled by default in newly created organizations.
3
Create the custom SCP document.
The SCP document with the defined policy rules is stored in the account.
A policy must exist before you can select it to attach to target nodes.
4
Attach the policy.
The policy is attached to the target OU, applying the restrictions to all member accounts inside.
Creating a policy does not enforce it; it must be explicitly attached to target OUs or accounts.

Anahtar Kavram

Enabling and applying Service Control Policies (SCPs) within AWS Organizations governance workflows.
Tahmini Süre:45s
Soru 11Soru →

An enterprise is establishing a multi-account governance framework using AWS Organizations. To comply with regulatory requirements, the solutions architect must enforce a Service Control Policy (SCP) that restricts resource provisioning to a subset of approved AWS Regions without disrupting essential global services or production workloads. Arrange the following steps in the correct order to design, test, and implement this governance control.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order begins with identifying global services to exempt, followed by creating the Service Control Policy (SCP) in the management account, attaching it to a sandbox OU, validating the policy's behavior with test resources, and finally attaching the SCP to the production OUs.
The correct order follows standard safe deployment practices and AWS best practices for managing SCPs. You must first identify which global services to exempt to prevent locking administrative actions. Next, you author the SCP with the appropriate conditions. To ensure safety, you must test the policy inside a sandbox/test OU first, validate the expected behavior (allowing permitted regions and blocking unpermitted ones), and only then promote the policy to production OUs.

Adım Adım Çözüm

1
Identify global services that require exemption from region restrictions.
A list of global AWS services such as IAM, Billing, and Route 53.
Excluding global services is critical because they operate out of global endpoints and would otherwise fail if restricted to specific regions.
2
Create the SCP in the management account.
An SCP containing the region restriction logic and the global service exemptions.
Designing the policy rules is necessary before any testing or deployment can take place.
3
Attach the SCP to a Sandbox or Test OU.
The policy rules are active only for accounts inside the test OU.
Applying guardrails to sandbox environments first prevents accidental disruption of production workloads during the validation phase.
4
Verify and validate policy constraints by launching resources in approved and unapproved regions within the test accounts.
Confirmation that workloads operate correctly in approved regions and are successfully denied in unapproved regions.
Testing validates that the policy conditions are working as intended and do not have unintended side effects.
5
Apply the validated SCP to the Production OUs.
The compliance control is enforced across all production workloads.
Once validated in sandbox, the control can be safely promoted to production OUs to satisfy governance requirements.

Anahtar Kavram

Enforcing multi-account regional governance using Service Control Policies (SCPs) requires identifying global service exemptions and applying policy changes sequentially through sandbox environments to prevent operational disruption.
Soru 12Soru →

A solutions architect is designing a multi-account environment using AWS Organizations and AWS Control Tower for a large enterprise. The architecture must enforce custom guardrails, structure accounts into business-specific Organizational Units (OUs), and automatically deploy custom local network resources (such as VPCs and security groups) during account onboarding. The solutions architect decided to use AWS Control Tower Lifecycle Events linked to an Amazon EventBridge rule that triggers an AWS Lambda function for post-enrollment customization.

Arrange the steps in the correct chronological order to establish this governed environment and ensure all target accounts are automatically customized upon enrollment.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

To establish this environment and ensure all accounts are automated upon enrollment, the solutions architect must first launch the landing zone, create the custom OUs, apply guardrails, configure the EventBridge rules for lifecycle events, and finally enroll the member accounts via Account Factory.
The correct sequence starts with launching the landing zone and creating the custom OUs. Guardrails must be applied next to ensure immediate compliance. Crucially, the EventBridge rule for Lifecycle Events must be created before enrolling accounts to ensure that the orchestration workflow is active when the accounts are provisioned, allowing for automatic deployment of VPCs and security groups. Enrolling accounts is the final step that triggers this sequence.

Adım Adım Çözüm

1
Initialize AWS Organizations and launch the AWS Control Tower landing zone from the management account.
Deploys core AWS Control Tower architecture including Security and Sandbox OUs, and Log Archive and Audit accounts.
This establishes the foundation required for any multi-account governance setup.
2
Create custom OUs in AWS Control Tower.
Creates workload-specific OUs in the organizational directory.
OUs must exist to act as containers for member accounts and policy attachments.
3
Apply guardrails (SCPs and Config rules) to the custom OUs.
Enforces guardrail compliance policies on the selected OUs.
Enforces governance guardrails before accounts are placed in the OUs, avoiding any temporary compliance gaps.
4
Create the Amazon EventBridge rule that detects AWS Control Tower Lifecycle Events and targets AWS Lambda.
Prepares the event listener for the CreateManagedAccount event.
Ensures that the event-driven customization workflow is active before the accounts are created; otherwise, the creation events will not trigger the Lambda function.
5
Enroll member accounts using AWS Control Tower Account Factory into the target OUs.
Accounts are created, placed in OUs under the applied guardrails, and trigger the EventBridge rule to complete local setup.
This initiates the creation sequence, relying on pre-existing guardrails and event rules to secure and customize the accounts automatically.

Anahtar Kavram

AWS Control Tower Lifecycle Events and multi-account governance setup flow
Soru 13Soru →

An enterprise is establishing a multi-region landing zone using AWS Organizations and AWS Control Tower to govern a rapidly growing portfolio of application accounts. The solutions architect must establish a secure multi-account structure, centralize security operations, apply service control policies (SCPs), and configure automated account provisioning. In what sequence should the solutions architect perform these setup steps to establish the environment while maintaining operational security and ensuring all new accounts are compliant upon creation?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with provisioning the landing zone using AWS Control Tower, followed by enabling AWS IAM Identity Center for administrative access, delegating security administration to the Audit account, attaching custom Service Control Policies (SCPs) to organizational units, and finally configuring the Account Factory Customizer for automated account provisioning.
Establishing the AWS landing zone must follow a strict dependencies-first approach. First, the management account must initialize AWS Control Tower to spin up the Security OU along with the Log Archive and Audit accounts. Second, federated access via AWS IAM Identity Center is configured to secure cross-account administration. Third, security and compliance administration is delegated to the Audit account. Fourth, custom SCPs are attached to the OUs to define strict guardrails. Finally, the Account Factory Customizer is configured to automate compliant workload provisioning.

Adım Adım Çözüm

1
Provision the landing zone via AWS Control Tower.
Creates the Log Archive account, Audit account, and Security OU.
Establishes the multi-account structure and core AWS accounts required by all subsequent setup steps.
2
Enable and configure AWS IAM Identity Center.
Establishes federated user access and administrative roles mapped to identity groups.
Allows secure administrative access to core security and member accounts without utilizing root credentials or local IAM users.
3
Delegate administration of security services to the Audit account.
Centralizes compliance monitoring, security findings, and AWS Config aggregation in the Audit account.
Adheres to the principle of least privilege by separating security monitoring duties from management account operations.
4
Author and attach Service Control Policies (SCPs) to parent OUs.
Applies top-down guardrails restricting AWS regions and preventing security service disabling.
Establishes a hardened governance boundary that applies automatically to existing and future member accounts.
5
Configure AWS Control Tower Account Factory Customizer.
Enables automated deployment of baseline networking (VPCs) and local configurations.
Ensures that newly provisioned workload accounts are compliant from day one by deploying them under established guardrails.

Anahtar Kavram

AWS multi-account governance setup lifecycle using AWS Control Tower, IAM Identity Center, delegated administration, Service Control Policies, and Account Factory automation.
Soru 14Soru →

An enterprise is planning to establish a secure multi-account landing zone. The solutions architect needs to migrate several legacy standalone AWS accounts into a new AWS Organizations structure and implement centralized governance. The goals are to enforce strict preventive guardrails, enable centralized security monitoring, and provide federated access. Arrange the following implementation steps in the correct logical sequence to achieve these goals with the minimum window of security vulnerability.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of implementation is first creating the organization and OUs, onboarding the legacy accounts into the organization, delegating security administration to establish monitoring, applying Service Control Policies to enforce guardrails, and finally provisioning federated access using AWS IAM Identity Center.
The correct order follows the principle of secure landing zone setup. First, the organization structure is built. Second, the accounts are enrolled as members. Third, delegated admin and organization-wide security monitoring are turned on to ensure auditing is ready. Fourth, preventive SCPs are attached to OUs to secure the environment. Finally, federated access is provisioned so that users operate under a fully audited and locked-down environment from their very first login.

Adım Adım Çözüm

1
Establish AWS Organizations and create OUs
The organizational hierarchy is ready to receive accounts.
A root management account must initiate the organization before any members or structures can exist.
2
Invite and join standalone accounts to the organization
Member accounts are enrolled and grouped into OUs.
Accounts must be organizational members to inherit policies and participate in delegated administration.
3
Configure delegated administration for security monitoring
Centralized auditing is active across all member accounts.
Ensuring visibility and security logging is established before any developer or operator access is allowed.
4
Apply preventive SCPs to OUs
Guardrails are active, preventing unauthorized API calls.
Attaching SCPs before users gain access eliminates the risk of security violations during the initial access window.
5
Provision federated access via AWS IAM Identity Center
Users can log in with permissions regulated by both IAM and SCPs.
Federation is enabled last to ensure all operations are fully governed and monitored from day one.

Anahtar Kavram

Multi-Account Governance Bootstrapping Sequence
Soru 15Soru →

A company is implementing a multi-account governance framework using AWS Organizations and AWS Control Tower. The solutions architect needs to onboard an existing standalone AWS account that hosts a legacy production workload into the organization. The landing zone must apply the standard enterprise security baselines and detective guardrails without disrupting the legacy workload.

What is the correct sequence of steps to successfully onboard and govern this existing account using AWS Control Tower?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order to onboard the existing standalone account is: first, send the organization invitation from the management account; second, accept the invitation from the standalone account; third, move the joined account to a registered organizational unit (OU); and fourth, enroll the account in AWS Control Tower.
The correct sequence begins with initiating the invite from the management account, followed by accepting it in the member account. Next, the member account must be moved to an Organizational Unit that is registered with AWS Control Tower, and finally, the account is enrolled to apply the standard baselines and policies.

Adım Adım Çözüm

1
Invite the standalone account to the Organization.
The invitation is pending and visible in the standalone account.
Before managing the account, it must become a member of the AWS Organization.
2
Accept the invitation in the standalone account.
The standalone account becomes a member account under the Root OU.
The owner of the standalone account must approve the join request to delegate billing and management.
3
Move the account to an OU registered with AWS Control Tower.
The account is positioned within the governance scope of AWS Control Tower.
AWS Control Tower manages accounts that reside in registered OUs.
4
Enroll the account in AWS Control Tower.
Baseline guardrails, Service Control Policies, and StackSets are deployed to the account.
This step applies the security posture and governance baseline without recreating the account.

Anahtar Kavram

Onboarding existing accounts into AWS Control Tower requires first making them part of the AWS Organization, placing them in a registered OU, and then executing the enrollment process.
Soru 16Soru →

An enterprise is integrating a newly acquired, standalone AWS account into its AWS Organizations structure managed by AWS Control Tower. The solutions architect must prepare the account for enrollment while preventing errors due to pre-existing resources and ensuring the environment conforms to the landing zone's centralized policies. Arrange the following steps in the correct chronological sequence to successfully onboard and baseline this account in AWS Control Tower.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with inviting the standalone account to join the organization, followed by creating the cross-account administrative role, removing any active AWS Config recorders and delivery channels, moving the account to a registered organizational unit, and finally triggering the AWS Control Tower enrollment.
The correct onboarding sequence ensures that the target account is first brought into the organization boundary, after which the administrative trust role (AWSControlTowerExecution) is established. Before invoking enrollment, any conflicting local AWS Config resources must be deleted to prevent StackSet failures. The account is then moved into the registered OU, and the enrollment process is triggered to apply Control Tower's baselines and guardrails.

Adım Adım Çözüm

1
Invite and accept the standalone account into the organization.
The standalone account is successfully added to the AWS Organization as a member account.
This establishes the organizational boundary and trust required for subsequent configuration.
2
Create the AWSControlTowerExecution IAM role in the member account.
An IAM role named AWSControlTowerExecution with AdministratorAccess is established, trusting the management account.
AWS Control Tower must have delegated administrative access to configure resources and establish baselines in the member account.
3
Delete existing AWS Config recorders and delivery channels.
All existing local AWS Config configuration recorders and delivery channels are removed in the target regions.
This prevents configuration duplication errors that automatically fail the AWS Control Tower stack execution during enrollment.
4
Move the member account into a governed Organizational Unit.
The account is relocated to an OU registered under AWS Control Tower control.
This step ensures that once enrollment is initiated, the correct SCPs and default configurations are inherited by the account.
5
Initiate enrollment from the AWS Control Tower console.
The enrollment process executes, setting up baselines and guardrails.
This triggers the final orchestration steps to officially enroll the account under Control Tower management.

Anahtar Kavram

AWS Control Tower Account Onboarding Workflow
Tahmini Süre:3m 0s
Soru 17Soru →

An enterprise is establishing a centralized logging architecture across its multi-account environment managed by AWS Organizations. The security team requires that all API activity across all current and future member accounts be logged to a central, read-only Amazon S3 bucket, and that member accounts be prevented from disabling or altering these logging configurations. Arrange the steps in the correct sequence to implement this centralized logging solution in accordance with AWS best practices.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with creating the Log Archive account, followed by creating the central S3 bucket with the appropriate bucket policy, then creating the organization-level CloudTrail trail, and finally applying a Service Control Policy to prevent member accounts from tampering with the CloudTrail configuration.
The correct sequence ensures that resource dependencies are satisfied chronologically. The Log Archive account must exist first to host the destination S3 bucket. The S3 bucket must then be created with a policy that allows the CloudTrail service principal to write logs from the organization; without this policy, creating the organization trail will fail. After the bucket is ready, the organization trail is created to deliver logs from all accounts. Finally, an SCP is applied to prevent member accounts from altering the trail, securing the auditing setup.

Adım Adım Çözüm

1
Provision the Log Archive account.
A dedicated, isolated account exists under the Security OU for storing audit logs.
The destination account must be created first to own the central S3 logging bucket.
2
Create the S3 bucket and attach a CloudTrail-compliant bucket policy.
An S3 bucket is configured in the Log Archive account, granting write permissions to the CloudTrail service principal.
AWS CloudTrail validates the bucket's existence and permissions when the organization trail is created. If the bucket or correct policy is missing, trail creation will fail.
3
Create the organization trail in the management account.
A multi-region organization trail is deployed to all current and future member accounts.
This establishes centralized logging for all API activity across the entire organization.
4
Deploy a Service Control Policy restricting CloudTrail modifications.
Member accounts are blocked from disabling CloudTrail, deleting the trail, or changing S3 settings.
This enforces governance and prevents local administrators from tampering with the audit logs.

Anahtar Kavram

Centralized multi-account logging and guardrails using AWS Organizations and CloudTrail
Tahmini Süre:2m 0s
Soru 18Soru →

An enterprise is planning to establish a governed, multi-account AWS environment using AWS Organizations and AWS Control Tower. The strategy requires centralized logging, centralized security operations, environment segregation, and service control guardrails before workloads are deployed. Arrange the following steps in the correct chronological sequence to implement this multi-account governance strategy according to AWS best practices.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order is: Initialize AWS Organizations, deploy AWS Control Tower, designate the Security Tooling account as the delegated administrator, establish custom OUs, and attach custom Service Control Policies (SCPs).
The correct sequence begins with initializing the AWS Organization to build the administrative root. Next, deploying AWS Control Tower provisions the Security OU along with the Log Archive and Security Tooling accounts. Once these core accounts are active, the Security Tooling account is designated as the delegated administrator for security services. Custom OUs are then created to group future workload accounts, and finally, custom SCPs are attached to these OUs to enforce boundaries before the member accounts are provisioned.

Adım Adım Çözüm

1
Initialize AWS Organizations
The administrative root is created, enabling multi-account management features.
This establishes the organizational structure and API capabilities required by orchestration tools.
2
Deploy AWS Control Tower
A multi-account landing zone is created with dedicated Security OUs containing Log Archive and Security Tooling accounts.
Control Tower sets up the foundational security baseline and logs account before custom workloads or configurations can be applied.
3
Designate Delegated Administrator
Security services are centralized in the Security Tooling account rather than the Management account.
Best practices dictate delegating administration to security-specific accounts rather than performing daily security operations in the management account.
4
Establish Custom OUs
New OUs (e.g., Workloads, Sandbox) are added to the hierarchy.
OUs must exist in the hierarchy before you can assign accounts or attach policies to them.
5
Attach Service Control Policies (SCPs)
Custom guardrails are applied to target OUs.
Enforcing policies at the OU level before accounts are provisioned guarantees that new accounts are immediately governed by the guardrails.

Anahtar Kavram

Foundational multi-account setup sequence and delegation of administrative control under AWS Organizations.

Alternatif Yöntem

An alternative approach is using Infrastructure as Code (IaC) with AWS Control Tower Account Factory for Terraform (AFT) to automate this pipeline, where the organization bootstrap, landing zone deployment, and customized OU policies are defined declaratively.
Tahmini Süre:3m 0s
Soru 19Soru →

An enterprise is establishing a new multi-account governance strategy using AWS Organizations. The security team requires that all API activity across all accounts is centrally logged to a secure Amazon S3 bucket in a dedicated Log Archive account, encrypted with a customer-managed KMS key, and protected against deletion or modification by any account administrator. What is the correct sequence of steps to configure this centralized logging and governance structure?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

To establish centralized and protected logging, first create the AWS Organization and OUs. Second, provision the dedicated Log Archive account under the Security OU. Third, set up the secure S3 bucket and KMS key within the Log Archive account. Fourth, enable trusted access for CloudTrail and deploy the organization trail. Finally, enforce security by attaching an SCP at the organization Root or OU level to prevent modification of these logging resources.
The correct order establishes a logical progression of dependencies: defining the organizational structure first, provisioning the dedicated account, setting up the destination S3 bucket and KMS keys inside that account, deploying the organization-wide CloudTrail to stream data to that bucket, and finally securing the setup using Service Control Policies (SCPs) to prevent tampering.

Adım Adım Çözüm

1
Create the AWS Organization and define the OU hierarchy.
An AWS Organization is initialized with management control, and logical OUs (such as Security and Workloads) are available for grouping accounts.
You cannot deploy accounts or apply policies structurally without first establishing the Organization and its OUs.
2
Provision the Log Archive account under the Security OU.
A clean, isolated member account is created specifically for storing logs and audit records.
The destination account must exist in the organization before configuring localized destination resources.
3
Configure the S3 bucket and customer-managed KMS key inside the Log Archive account.
An S3 bucket is configured with bucket policies allowing the CloudTrail service to write logs, and a KMS key is configured to allow encryption of those logs.
The trail deployment in the next step will fail if the specified target S3 bucket or KMS key does not exist or lacks correct permission policies.
4
Enable trusted access for AWS CloudTrail in the Organizations management account and deploy the organization trail.
A single organization-wide trail automatically starts delivering encrypted API activity logs from all member accounts to the centralized S3 bucket.
This establishes the logging mechanism across the entire Organization.
5
Attach an SCP to the Root of the organization to prevent modification of the logging resources.
Root and administrator users in all member accounts are blocked from disabling the trail, deleting the S3 bucket, or modifying the KMS key policies.
Applying the SCP secures the logging configuration against tampering, fulfilling the compliance and governance requirements.

Anahtar Kavram

Establishing multi-account governance involves a precise sequence of setting up the AWS Organization structure, isolating resources in dedicated accounts (such as a Log Archive account), configuring destination storage and encryption keys, deploying organization-wide services via trusted access, and securing the configuration using Service Control Policies (SCPs).
Soru 20Soru →

An enterprise is setting up a new multi-account environment using AWS Organizations to support multiple development teams. The security team requires central auditing, compliance guardrails, and centralized network administration. Arrange the steps in the correct logical sequence to establish this governed multi-account structure.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps to establish the governed multi-account structure is: first, create the Organizational Units (OUs); second, configure the delegated administrator for central logging; third, apply Service Control Policies (SCPs) to the OUs; and fourth, share VPC subnets using AWS Resource Access Manager (RAM).
Establishing the OUs first provides the structural hierarchy. Next, configuring delegated administration for CloudTrail guarantees all actions are audited from the start. Then, applying SCPs ensures security guardrails are active. Finally, sharing network resources via AWS RAM allows workloads to deploy safely within these predefined boundaries.

Adım Adım Çözüm

1
Set up the OU hierarchy in the management account.
Establishes the container structure (OUs) representing Security, Infrastructure, and Workloads.
OUs must exist first because all policy attachments, account assignments, and RAM shares target either OUs or the accounts inside them.
2
Configure delegated administration for AWS CloudTrail to the Security account.
Enables the Security account to manage the organizational trail, writing logs to a centralized S3 bucket.
Centralized auditing must be established before provisioning infrastructure resources or deploying applications to maintain compliance and capture all audit events from the beginning.
3
Draft and attach Service Control Policies (SCPs) to the Workloads OU.
Establishes top-level compliance guardrails that apply to all member accounts in that OU.
SCPs must be active before resources are provisioned or shared to ensure no user in the member accounts can perform restricted actions during setup.
4
Use AWS Resource Access Manager (RAM) in the Infrastructure account to share VPC subnets with the Workloads OU.
Enables member accounts in the Workloads OU to deploy resources in the shared subnets.
Sharing network resources is the final deployment step that allows application teams to deploy workloads inside a secure, monitored, and governed environment.

Anahtar Kavram

Establishment of a governed multi-account landing zone using AWS Organizations OUs, delegated administration, SCPs, and RAM sharing.
Tahmini Süre:2m 0s
Sayfa 1 / 2Sonraki
Tüm alıştırma soruları — AWS Certified Solutions Architect - Professional | Examkin