DOP-C02 Question 105
Select 3Your organization uses AWS Organizations to manage multiple AWS accounts across several Regions. You have been tasked with implementing a solution to automate the creation of new AWS accounts, ensure their onboarding to a central security baseline, and apply specific guardrails for compliance purposes. Which of the following steps should be included in your solution to meet these requirements?
- A
Use AWS Control Tower to set up a landing zone and automate account creation with pre-configured guardrails.
- B
Use AWS CloudFormation StackSets to deploy security baseline templates across all accounts and Regions.
- C
Set up an AWS Lambda function to manually add new accounts to the Organization and apply Service Control Policies (SCPs).
- D
Leverage AWS Service Catalog to allow team members to create accounts using approved templates with pre-configured settings.
- E
Configure AWS Security Hub to automatically remediate security issues in newly created accounts.
Show answer and explanation
Correct answers: A, B, D
Explanation
To automate the creation, onboarding, and securing of AWS accounts in a multi-account and multi-Region setup, AWS Control Tower is a key service that provides a managed landing zone with pre-configured guardrails. AWS CloudFormation StackSets further ensures that security baselines are applied across all accounts and Regions. Additionally, AWS Service Catalog enables team members to create new accounts using approved templates with pre-configured compliance settings. This combination of services ensures automation, governance, and security in a scalable and reliable manner.
- A. Correct.
Correct: AWS Control Tower provides a managed service to set up a landing zone, automate account creation, and enforce governance through guardrails.
- B. Correct.
Correct: AWS CloudFormation StackSets can be used to apply a security baseline template to multiple accounts and Regions, ensuring consistent compliance.
- C. Incorrect.
Incorrect: Manually adding accounts with an AWS Lambda function is not a scalable or secure approach, and automation is a key requirement in the scenario.
- D. Correct.
Correct: AWS Service Catalog allows you to standardize the account creation process by providing approved templates with pre-configured settings, ensuring compliance and consistency.
- E. Incorrect.
Incorrect: AWS Security Hub is a security monitoring service and not specifically designed to automate account creation or onboarding. While it can identify and remediate issues, it is not sufficient for the task described.