SAP-C02 Question 428
Select 2A company is designing a multi-account strategy for its organization and requires centralized security controls to ensure consistent compliance across all AWS accounts. The solution must enforce mandatory security controls such as blocking specific IAM actions and restricting resource creation in certain regions. Which AWS solutions should the company implement to meet this requirement?
- A
AWS Organizations Service Control Policies (SCPs)
- B
AWS CloudTrail
- C
AWS Identity and Access Management (IAM) Policies
- D
AWS Config Conformance Packs
- E
Amazon GuardDuty
Show answer and explanation
Correct answers: A, D
Explanation
To enforce centralized security controls across multiple accounts, AWS Organizations SCPs are used to define and enforce permissions at the organizational level. AWS Config Conformance Packs complement this by evaluating compliance against defined rules and ensuring resources meet security standards. Together, these solutions provide a robust mechanism for managing security and compliance in a multi-account AWS environment.
- A. Correct.
Correct. AWS Organizations SCPs allow centralized control over permissions for all accounts in an organization, enforcing security controls such as restricting IAM actions or resource creation.
- B. Incorrect.
Incorrect. While AWS CloudTrail provides logging and monitoring for API calls, it does not enforce security controls or manage compliance across accounts.
- C. Incorrect.
Incorrect. IAM policies are account-specific and cannot enforce restrictions across multiple accounts like SCPs can.
- D. Correct.
Correct. AWS Config Conformance Packs provide a way to evaluate resource compliance against specific rules and enforce security and compliance standards across accounts.
- E. Incorrect.
Incorrect. Amazon GuardDuty is a threat detection service, but it does not enforce security controls or compliance policies.