SAP-C02 Question 96
Select 3An organization is planning to set up a multi-account AWS environment to manage its diverse business units, ensure security, and optimize costs. The organization wants to implement centralized governance, enforce security policies across accounts, and facilitate cross-account billing. Which combination of AWS services and features is best suited for designing this environment?
- A
AWS Organizations with Service Control Policies (SCPs)
- B
AWS Control Tower for account setup and governance
- C
AWS Billing and Cost Management with Consolidated Billing
- D
AWS Transit Gateway for managing network traffic between accounts
- E
Amazon S3 Cross-Region Replication for data synchronization between accounts
- F
AWS Identity and Access Management (IAM) for cross-account user authentication
Show answer and explanation
Correct answers: A, B, C
Explanation
To design a robust multi-account AWS environment, AWS Organizations with SCPs provides centralized governance, AWS Control Tower simplifies account setup and governance workflows, and AWS Billing and Cost Management with Consolidated Billing ensures centralized billing and cost optimization. These services collectively address the organization's requirements for governance, security, and cost efficiency. Other options, like Transit Gateway and S3 Cross-Region Replication, do not directly contribute to these needs.
- A. Correct.
AWS Organizations with SCPs is essential to centrally manage policies and enforce security controls across multiple accounts.
- B. Correct.
AWS Control Tower simplifies the setup of a multi-account environment by automating account provisioning and governance.
- C. Correct.
AWS Billing and Cost Management with Consolidated Billing is critical for centralizing billing and optimizing costs across all AWS accounts.
- D. Incorrect.
AWS Transit Gateway is used for managing network traffic between VPCs and accounts, but it is not directly related to governance or cost optimization in a multi-account setup.
- E. Incorrect.
Amazon S3 Cross-Region Replication is for data synchronization and does not address centralized governance or cost management in a multi-account environment.
- F. Incorrect.
AWS IAM is used for managing permissions and access control, but cross-account authentication is better managed through AWS Organizations with IAM role delegation.