SAP-C02 Question 108
Select 3An organization is planning to use AWS Control Tower to set up and govern a multi-account AWS environment. The organization already uses AWS Organizations to centrally manage its accounts. One of the requirements is to ensure that all member accounts comply with mandatory security controls and that new accounts are automatically provisioned with pre-defined configurations. What steps should the Solutions Architect take to meet this requirement?
- A
Enable AWS Control Tower in the management account and set up guardrails for governance.
- B
Integrate AWS Control Tower with AWS Organizations to use the existing organizational structure and accounts.
- C
Manually enable security services like AWS Config and AWS CloudTrail in each account managed by AWS Organizations.
- D
Use AWS Control Tower Account Factory to automate the provisioning of new accounts with pre-defined configurations.
- E
Disable AWS Organizations while using AWS Control Tower since they cannot work together.
Show answer and explanation
Correct answers: A, B, D
Explanation
AWS Control Tower is designed to simplify the setup and governance of a multi-account AWS environment, and it integrates directly with AWS Organizations. The management account must enable Control Tower to apply governance guardrails, and Account Factory is used to automate new account provisioning with pre-defined configurations. Security services like AWS Config and AWS CloudTrail are automatically enabled for managed accounts, so manual setup is unnecessary.
- A. Correct.
Correct. AWS Control Tower requires you to enable it in the management account to apply governance and security guardrails across the organization.
- B. Correct.
Correct. AWS Control Tower integrates seamlessly with AWS Organizations and uses its organizational units (OUs) and account structure.
- C. Incorrect.
Incorrect. AWS Control Tower automatically enables and configures services like AWS Config and AWS CloudTrail for all accounts under its management.
- D. Correct.
Correct. AWS Control Tower's Account Factory allows you to provision new accounts with pre-defined configurations, ensuring compliance and consistency.
- E. Incorrect.
Incorrect. AWS Control Tower is designed to work with AWS Organizations, and disabling AWS Organizations would make it impossible to manage accounts centrally.