SCS-C02 Question 426
Select 3You are a Security Engineer at a company that has adopted a multi-account strategy using AWS Organizations. The company wants to minimize the blast radius of potential security incidents while ensuring central visibility and management of accounts. Which of the following approaches should you implement to meet these requirements?
- A
Use Service Control Policies (SCPs) to enforce security best practices across all accounts.
- B
Enable AWS CloudTrail in all accounts and configure centralized logging to an S3 bucket in a dedicated logging account.
- C
Directly manage all IAM users and roles within each individual account to ensure isolation.
- D
Set up a dedicated security account for monitoring and incident response activities.
- E
Disable cross-account access to all resources to ensure strict isolation between accounts.
Show answer and explanation
Correct answers: A, B, D
Explanation
In a multi-account strategy, minimizing the blast radius of incidents involves enforcing strict security controls (via SCPs), centralizing logs for visibility (via a logging account), and setting up dedicated accounts for security operations (such as monitoring and incident response). These measures collectively enhance security while maintaining centralized governance and management.
- A. Correct.
Service Control Policies (SCPs) are a key feature of AWS Organizations that allow you to enforce security best practices and restrict certain actions across all accounts, reducing the risk of misconfigurations.
- B. Correct.
Enabling AWS CloudTrail in all accounts and centralizing logs in a dedicated logging account ensures you have visibility into account activities, which is critical for auditing and incident response.
- C. Incorrect.
Managing IAM users and roles directly in each account is not recommended in a multi-account strategy because it adds complexity and reduces central control. Using AWS SSO or centralized access management is a better approach.
- D. Correct.
A dedicated security account is a best practice for monitoring, auditing, and responding to security incidents in a multi-account setup.
- E. Incorrect.
Disabling cross-account access entirely can hinder necessary workflows, such as centralized logging or security monitoring, and is not a recommended practice in a multi-account strategy.