SOA-C02 Question 196
Single answerYour organization uses multiple AWS accounts to isolate workloads for different teams. They want to implement a secure multi-account management strategy to enforce baseline security controls, manage permissions centrally, and ensure compliance across all accounts. Which solution should you implement to achieve these requirements?
- A
Use AWS Control Tower to set up and govern a secure multi-account environment with guardrails.
- B
Manually create a root user in each account and configure security settings individually.
- C
Use AWS Organizations with Service Control Policies (SCPs) to enforce security and compliance rules across accounts.
- D
Rely on IAM roles in each account and use cross-account access to manage permissions.
Show answer and explanation
Correct answer: A
Explanation
AWS Control Tower is the best solution for organizations looking to secure and manage a multi-account environment. It automates the setup of AWS Organizations, applies baseline security and compliance rules using guardrails, and ensures a scalable governance model. While other options provide some level of control, they lack the comprehensive features and automation offered by AWS Control Tower.
- A. Correct.
This is the correct answer because AWS Control Tower provides an automated way to set up and manage a secure multi-account environment with built-in guardrails, ensuring compliance and central governance.
- B. Incorrect.
This option is incorrect because manually creating and configuring root users for each account is not scalable, error-prone, and lacks centralized governance.
- C. Incorrect.
While AWS Organizations with SCPs is a powerful tool for controlling permissions and compliance, it does not provide the automated setup, governance, and baseline security enforcement that AWS Control Tower offers.
- D. Incorrect.
This option is incorrect because relying solely on IAM roles and cross-account access does not provide centralized management or enforce compliance across multiple accounts.