Q12 — AWS SAA-C03 Ch.13

Question 12 of 100 | ← Chapter 13

Q912. A company wants to isolate its workloads by creating an AWS account for each workload. The company needs a solution that centrally manages networking components for the workloads. The solution also must create accounts with automatic security controls (guardrails).Which solution will meet these requirements with the LEAST operational overhead?

Correct Answer: B. Use AWS Organizations to deploy accounts. Create a networking account that has a VPC with private subnets and public subnets. Use AWS Resource Access Manager (AWS RAM) to share the subnets with the workload accounts.

Explanation

To meet the requirements of centrally managing networking components for workloads and automatically applying security controls (guardrails) with the least operational overhead, the most suitable solution is:B. Use AWS Organizations to deploy accounts. Create a networking account that has a VPC with private subnets and public subnets. Use AWS Resource Access Manager (AWS RAM) to share the subnets with the workload accounts.AWS Organizations is a service that allows central management of multiple AWS accounts. It provides a hierarchical structure for organizing accounts and enables the application of policies across the organization.By using AWS Organizations, the company can create separate AWS accounts for each workload and a central networking account. The networking account can have a VPC with private and public subnets, providing a centralized networking infrastructure for the workloads.AWS Resource Access Manager (AWS RAM) can be used to share the subnets created in the networking account with the workload accounts. This allows the workloads to utilize the shared networking resources without the need to recreate or manage them individually.Option A suggests using AWS Control Tower to deploy accounts and share subnets with AWS RAM. While AWS Control Tower provides centralized management capabilities, it introduces additional complexity compared to using AWS Organizations directly.Options C and D propose deploying a VPC in each workload account and configuring them to route through an inspection VPC using transit gateway attachment. This approach would require manual configuration for each workload account and would result in higher operational overhead.In summary, option B using AWS Organizations to deploy accounts, creating a networking account with shared subnets using AWS RAM, provides the most efficient and least operationally intensive solution for centrally managing networking components and applying security controls to the company's workloads.