SCS-C02 Question 425
Select 4An organization is adopting a multi-account strategy in AWS to improve security and operational efficiency. They want to enforce centralized security policies, manage billing efficiently, and ensure separation of workloads for compliance requirements. Which AWS services or features should they leverage as part of their multi-account strategy?
- A
AWS Organizations with Service Control Policies (SCPs)
- B
AWS Identity and Access Management (IAM) Roles for cross-account access
- C
AWS Trusted Advisor to enforce security policies across accounts
- D
AWS Control Tower for account provisioning and governance
- E
Amazon Macie for centralized billing and cost management
- F
AWS SSO (Single Sign-On) for unified user access across accounts
Show answer and explanation
Correct answers: A, B, D, F
Explanation
A multi-account strategy in AWS leverages services like AWS Organizations with SCPs for policy enforcement, IAM Roles for secure cross-account access, AWS Control Tower for streamlined account provisioning and governance, and AWS SSO for centralized user access management. These services work together to enhance security, operational efficiency, and compliance in a multi-account environment. Trusted Advisor and Amazon Macie, while useful for other purposes, are not directly relevant to enforcing governance and access in a multi-account strategy.
- A. Correct.
AWS Organizations with SCPs is a core service for managing multiple accounts. SCPs allow you to enforce security policies across all accounts in the organization, ensuring compliance and governance.
- B. Correct.
IAM Roles enable secure cross-account access by allowing users or resources in one account to access resources in another account without sharing credentials.
- C. Incorrect.
AWS Trusted Advisor provides recommendations for cost optimization, security, performance, and fault tolerance but does not enforce security policies across accounts.
- D. Correct.
AWS Control Tower simplifies the process of setting up and governing a secure and compliant multi-account AWS environment, making it critical for multi-account strategies.
- E. Incorrect.
Amazon Macie is primarily used for data discovery and classification, especially for sensitive data. It does not manage billing or cost management.
- F. Correct.
AWS SSO provides unified user access across multiple AWS accounts, simplifying user management and enhancing security in a multi-account setup.