SAP-C02 Question 2
Select 3Your organization is a multinational company with multiple business units, each requiring independent AWS accounts for cost isolation and resource management. However, the central IT team needs to enforce security policies, manage billing, and provide shared services such as DNS and logging across all accounts. Which combination of AWS services and features can best address these requirements?
- A
AWS Organizations with Service Control Policies (SCPs) to enforce security policies
- B
AWS Resource Access Manager (RAM) to share resources across accounts
- C
AWS Identity and Access Management (IAM) roles for cross-account access
- D
AWS Control Tower to establish a landing zone and govern the accounts
- E
AWS Cost Explorer to monitor and track billing for individual accounts
Show answer and explanation
Correct answers: A, B, D
Explanation
The combination of AWS Organizations with SCPs, AWS Resource Access Manager, and AWS Control Tower addresses the organization's needs by enabling centralized governance, resource sharing, and account setup. These services work together to manage security, enforce policies, and provide shared services across multiple AWS accounts, ensuring compliance and operational efficiency. IAM roles or Cost Explorer, while valuable in specific contexts, do not address the broader challenges of organizational complexity.
- A. Correct.
AWS Organizations with SCPs is a core service for managing multiple accounts. SCPs help enforce security policies across accounts, ensuring compliance with organizational requirements.
- B. Correct.
AWS Resource Access Manager (RAM) enables sharing of resources like VPC subnets, Transit Gateways, and Route 53 Resolver rules across AWS accounts, which is critical for shared services.
- C. Incorrect.
While IAM roles allow cross-account access, they do not centrally enforce security policies or manage shared services. They are more suitable for specific access use cases rather than organizational governance.
- D. Correct.
AWS Control Tower provides a comprehensive solution for setting up a well-architected multi-account environment (landing zone) with governance and security in place, aligning with the organization's needs.
- E. Incorrect.
AWS Cost Explorer is useful for cost monitoring but does not help in enforcing security policies, managing shared services, or setting up accounts. It is not a solution for organizational complexity.