Q57 — AWS SAA-C03 Ch.15

Question 57 of 100 | ← Chapter 15

Q1157. A company uses AWS Organizations to manage multiple AWS accounts. Each department in the company has its own AWS account.A security team needs to implement centralized governance and control to enforce security best practices across all accounts. The team wants to have control over which AWS services each account can use. The team needs to restrict access to sensitive resources based on IP addresses or geographic regions. The root user must be protected with multi-factor authentication (MFA) across all accounts.Which solution will meet these requirements?

• A. Use AWS Identity and Access Management(IAM) to manage IAM users and IAM roles in each account.Implement MFA for the root user in each account. Enforce service restrictions by using AWS managed prefix lists.
• B. Use AWS Control Tower to establish a multi-account environment. Use service control policies (SCPs) to enforce service restrictions in AWS Organizations. Configure MFA for the root user across all accounts. ✓
• C. Use AWS Systems Manager to enforce service restrictions across multiple accounts. Use IAM policies to enforce MFA for the root user across all accounts.
• D. Use AWS IAM Identity Center to manage user access and to enforce service restrictions by using permissions boundaries in each account.i

Correct Answer: B. Use AWS Control Tower to establish a multi-account environment. Use service control policies (SCPs) to enforce service restrictions in AWS Organizations. Configure MFA for the root user across all accounts.

Explanation

To meet the requirements of centralized governance, security best practices, service restrictions, IP/ geographic-based access control, and MFA for root users across multiple AWS accounts managed by AWS Organizations, the best solution is:Key Requirements:Centralized governance and control across all AWS accounts. Restrict which AWS services can be used (service control). Restrict access to sensitive resources based on IP addresses or geographic regions.Enforce MFA for the root user across all accounts.Option Analysis:A. Use AWS IAM to manage IAM users and IAM roles in each account. Implement MFA for the root user in each account. Enforce service restrictions by using AWS managed prefix lists. IAM is for user/role management but does not provide centralized governance across accounts. AWS managed prefix lists are for IP-based routing, not for service restrictions or geographic access control.Does not meet the centralized governance requirement.B. Use AWS Control Tower to establish a multi-account environment. Use service control policies (SCPs) to enforce service restrictions in AWS Organizations. Configure MFA for the root user across all accounts. AWS Control Tower provides a centralized governance framework for multi-account environments. Service Control Policies (SCPs) in AWS Organizations allow restricting which AWS services can be used across accounts.MFA for root users can be enforced across all accounts (though root user access should generally be minimized, SCPs can help restrict it).IP/geographic-based access control can be implemented via IAM policies (e.g., Condition blocks in policies) or AWS WAF (for geographic restrictions).Best fit for the requirements.C. Use AWS Systems Manager to enforce service restrictions across multiple accounts. Use IAM policies to enforce MFA for the root user across all accounts.AWS Systems Manager is for operational management (e.g., patching, inventory) and does not enforce service restrictions or centralized governance.IAM policies alone cannot enforce MFA for root users (root user access is not managed by IAM policies). Does not meet the centralized governance or service restriction requirements. D. Use AWS IAM Identity Center to manage user access and to enforce service restrictions by using permissions boundaries in each account.AWS IAM Identity Center (formerly AWS SSO) is for centralized identity management but does not enforce service restrictions (SCPs are needed for that).Permissions boundaries limit IAM users/roles but do not restrict AWS services at the account level (SCPs are required).Does not fully meet the centralized governance or service restriction requirements.Correct Answer:B. Use AWS Control Tower to establish a multi-account environment. Use service control policies (SCPs) to enforce service restrictions in AWS Organizations. Configure MFA for the root user across all accounts.This solution provides:Centralized governance (AWS Control Tower).Service restrictions (SCPs).MFA for root users (though best practice is to disable root user access and use IAM roles instead). IP/geographic-based access control can be implemented via IAM policies or AWS WAF (though not explicitly mentioned in this option, it is achievable in AWS).Final Answer:B. Use AWS Control Tower to establish a multi-account environment. Use service control policies (SCPs) to enforce service restrictions in AWS Organizations. Configure MFA for the root user across all accounts.The solution that best meets the requirements for centralized governance and control across multiple AWS accounts is:B. Use AWS Control Tower to establish a multi-account environment. Use service control policies (SCPs) to enforce service restrictions in AWS Organizations. Configure MFA for the root user across all accounts.AWS Control Tower: This service helps set up and govern a secure, multi-account AWS environment based on AWS best practices, making it ideal for centralized management. Service Control Policies (SCPs): SCPs allow you to control which AWS services can be used in each account, enabling centralized enforcement of security best practices. MFA for Root Users: Control Tower facilitates the enforcement of MFA for root users across all accounts, enhancing security.This solution provides the necessary governance, control over services, and security measures required by the security team.