SAP-C02 Question 3
Select 4An enterprise company is undergoing a multi-account strategy transformation to align with AWS best practices. They aim to centralize governance, maintain security and compliance, and enable individual business units to operate independently. The organization also wants to implement cost controls and share common resources, such as networking infrastructure and logging solutions. Which combination of AWS services and features should be used to achieve these objectives?
- A
AWS Organizations with Service Control Policies (SCPs)
- B
AWS Control Tower for account provisioning and governance
- C
AWS Lambda functions for automating cost allocation tags
- D
AWS Resource Access Manager (RAM) for sharing resources across accounts
- E
Amazon CloudFront for distributing content securely across accounts
- F
AWS Config for compliance monitoring across accounts
Show answer and explanation
Correct answers: A, B, D, F
Explanation
To design a robust multi-account architecture for a large enterprise, AWS Organizations with SCPs is essential for centralized governance and compliance enforcement. AWS Control Tower provides an easy way to set up and manage a secure multi-account environment, ensuring alignment with best practices. Resource sharing is facilitated by AWS RAM, allowing common resources to be used efficiently across accounts. Finally, AWS Config plays a crucial role in monitoring compliance and security posture across all accounts. These services collectively address governance, security, resource sharing, and compliance requirements in a multi-account strategy.
- A. Correct.
Correct. AWS Organizations with SCPs is a critical part of centralizing governance and enforcing compliance across multiple AWS accounts.
- B. Correct.
Correct. AWS Control Tower simplifies the setup and management of a secure multi-account environment, aligning with the organization’s governance and compliance needs.
- C. Incorrect.
Incorrect. While AWS Lambda can be used for automation, it is not a direct solution for centralizing governance, security, or resource sharing in a multi-account setup.
- D. Correct.
Correct. AWS Resource Access Manager (RAM) enables sharing common resources like networking and logging solutions across accounts.
- E. Incorrect.
Incorrect. Amazon CloudFront is a CDN service and is not directly related to centralizing governance, security, or resource sharing in a multi-account strategy.
- F. Correct.
Correct. AWS Config provides compliance monitoring and auditing capabilities, which are essential for maintaining security and compliance across multiple accounts.