SOA-C02 Question 194
Select 3Your organization has multiple AWS accounts and wants to implement a secure multi-account strategy. As a SysOps Administrator, you are tasked with ensuring centralized governance, streamlined account provisioning, and unified security controls. Which combination of services and features would best achieve this objective?
- A
Use AWS Control Tower to set up a landing zone for centralized account management.
- B
Enable AWS Organizations to consolidate accounts and apply Service Control Policies (SCPs).
- C
Manually set up IAM roles and policies in each account for security compliance.
- D
Use AWS Single Sign-On (SSO) to manage user access across multiple accounts.
- E
Deploy AWS Config in each account individually for compliance monitoring.
Show answer and explanation
Correct answers: A, B, D
Explanation
To implement a secure multi-account strategy, it is best to utilize AWS Control Tower for centralized governance and account provisioning, AWS Organizations for account consolidation and policy enforcement, and AWS Single Sign-On for unified user access management. These services are designed to streamline and secure multi-account environments. Manually managing IAM roles and deploying AWS Config per account lack scalability and efficiency in multi-account setups.
- A. Correct.
Correct: AWS Control Tower helps create a secure and compliant multi-account environment by setting up a landing zone with guardrails and automated account provisioning.
- B. Correct.
Correct: AWS Organizations allows you to consolidate accounts under a single management umbrella and enforce policies using Service Control Policies (SCPs).
- C. Incorrect.
Incorrect: Manually setting up IAM roles and policies is error-prone and does not scale well for multi-account strategies.
- D. Correct.
Correct: AWS SSO simplifies user access management to multiple accounts by providing centralized authentication and authorization.
- E. Incorrect.
Incorrect: While AWS Config is useful for compliance monitoring, deploying it individually in each account is not an efficient or centralized approach for multi-account governance.