SAP-C02 Question 105
Single answerAn organization has multiple AWS accounts under a single AWS Organization. The company wants to implement a standardized security baseline and enforce policies across all accounts while allowing specific teams to customize their environments within defined guardrails. Which solution should you implement to meet this requirement?
- A
Use AWS Control Tower to set up a landing zone and define guardrails for governance while allowing account-level customizations.
- B
Manually create Service Control Policies (SCPs) in AWS Organizations to enforce security standards across all accounts and allow customization.
- C
Use AWS Config to define security rules and enforce them across accounts in the organization.
- D
Use AWS Security Hub to aggregate security findings and enforce policies across all accounts.
Show answer and explanation
Correct answer: A
Explanation
AWS Control Tower is the best solution for organizations looking to implement governance and enforce policies across multiple accounts while allowing some flexibility for teams. It automates the setup of a secure multi-account AWS environment, applies governance guardrails, and integrates with AWS Organizations for unified management. Other options like SCPs, AWS Config, and AWS Security Hub address specific aspects of security and compliance but do not provide the centralized governance framework that AWS Control Tower offers.
- A. Correct.
This is the correct answer. AWS Control Tower is purpose-built to set up a landing zone with governance guardrails, which allows for central management of policies while still enabling account-level customizations within the guardrails.
- B. Incorrect.
While SCPs in AWS Organizations can enforce policies, they do not provide the comprehensive governance framework, automation, and account setup capabilities that AWS Control Tower offers.
- C. Incorrect.
AWS Config is useful for monitoring compliance and detecting configuration changes but does not provide the governance or policy enforcement capabilities of AWS Control Tower.
- D. Incorrect.
AWS Security Hub is designed for aggregating security findings and improving visibility but does not enforce policies or manage account governance like AWS Control Tower.