SCS-C02 Question 65
Select 3Your organization has multiple teams working on separate cloud projects. To ensure compliance and security, you need to isolate the resources used by each team while allowing each team to manage their own resources independently. Which of the following mechanisms would help achieve this requirement?
- A
Use AWS Organizations to create separate accounts for each team and apply Service Control Policies (SCPs).
- B
Use IAM roles with strict permissions to manage access to shared resources in a single account.
- C
Create separate VPCs for each team within a single AWS account to achieve network-level isolation.
- D
Leverage resource tagging and tag-based IAM policies to restrict access to resources by team.
- E
Implement AWS Control Tower to establish guardrails and enforce resource isolation across multiple accounts.
Show answer and explanation
Correct answers: A, C, E
Explanation
The best way to ensure resource isolation is by using mechanisms that separate resources at the account or network level. AWS Organizations and AWS Control Tower allow for account-level isolation, while separate VPCs can be used for network isolation within a single account. IAM roles and resource tagging do not provide true isolation but can complement these strategies by controlling access and visibility.
- A. Correct.
Correct. AWS Organizations allows you to create separate accounts for each team, ensuring resource isolation at the account level. Service Control Policies (SCPs) can further restrict what actions can be performed across accounts.
- B. Incorrect.
Incorrect. While IAM roles can manage access to shared resources, they do not provide full resource isolation, as all resources remain within a single account.
- C. Correct.
Correct. Creating separate VPCs within a single account can provide network-level isolation, ensuring that teams' resources are not accessible to others by default.
- D. Incorrect.
Incorrect. Resource tagging and tag-based IAM policies help with resource identification and access control, but they do not provide true resource isolation.
- E. Correct.
Correct. AWS Control Tower simplifies the setup of multi-account environments and enforces guardrails to maintain resource isolation and compliance.