SAP-C02 Question 397
Single answerAn organization uses multiple AWS accounts for its workloads and has recently discovered unauthorized access attempts to sensitive resources in one of its accounts. As a Solutions Architect, you are tasked with improving the overall security posture across all accounts while ensuring centralized management and monitoring of security policies. Which solution provides the most secure and scalable approach?
- A
Enable AWS CloudTrail in each account and manually inspect logs for unauthorized access attempts.
- B
Use AWS Organizations to enable Service Control Policies (SCPs) to restrict access to specific sensitive resources across all accounts.
- C
Configure AWS Config in each account to monitor resource configurations and enable AWS Config Rules for compliance checks.
- D
Set up AWS Control Tower to centralize governance, implement guardrails, and enable centralized logging and monitoring.
Show answer and explanation
Correct answer: D
Explanation
AWS Control Tower is designed specifically for multi-account environments and offers a comprehensive solution for improving security. It allows organizations to implement guardrails to enforce security best practices, centralizes logging and monitoring, and simplifies governance across all accounts. This makes it the most scalable and effective approach for addressing security concerns in a multi-account setup while ensuring centralized management and compliance.
- A. Incorrect.
While enabling CloudTrail is essential for logging and tracking API activity, manually inspecting logs is not scalable and does not provide a preventative security measure.
- B. Incorrect.
Service Control Policies (SCPs) are effective for restricting resource access, but they are not a complete solution for centralized security management and monitoring across multiple accounts.
- C. Incorrect.
AWS Config is a useful tool for compliance monitoring, but it does not provide centralized governance or preventative security measures across multiple accounts.
- D. Correct.
AWS Control Tower is the most secure and scalable solution as it provides centralized governance using guardrails, centralizes logging and monitoring, and simplifies multi-account management.