SCS-C02 Question 416
Select 3An organization wants to centrally manage multiple AWS accounts to enforce consistent security policies, streamline billing, and simplify the deployment of common infrastructure. Which combination of services and features should the organization use to achieve this goal?
- A
AWS Organizations with Service Control Policies (SCPs)
- B
AWS Control Tower for account setup and governance
- C
AWS CloudTrail for centralized logging across accounts
- D
AWS Direct Connect for secure, high-speed network connectivity between accounts
- E
AWS Trusted Advisor for providing performance and cost recommendations across accounts
Show answer and explanation
Correct answers: A, B, C
Explanation
To centrally deploy and manage AWS accounts, you need tools that support governance, policy enforcement, and centralized monitoring. AWS Organizations, with Service Control Policies (SCPs), allows for consistent security policies across accounts. AWS Control Tower simplifies account creation and governance. AWS CloudTrail provides centralized logging for activity monitoring. AWS Direct Connect and Trusted Advisor, while useful, are not directly relevant to deploying or managing multiple accounts centrally.
- A. Correct.
Correct. AWS Organizations allows centralized management of multiple accounts, and Service Control Policies (SCPs) enable consistent enforcement of security controls across accounts.
- B. Correct.
Correct. AWS Control Tower simplifies the creation and governance of multi-account environments, ensuring that accounts are configured according to best practices.
- C. Correct.
Correct. AWS CloudTrail provides centralized logging for monitoring and auditing activities across multiple accounts, which is critical for security and compliance.
- D. Incorrect.
Incorrect. AWS Direct Connect is used for establishing private network connections to AWS, but it is not related to centrally managing AWS accounts.
- E. Incorrect.
Incorrect. AWS Trusted Advisor provides recommendations for cost optimization, security, and performance, but it is not a tool for centrally deploying and managing AWS accounts.