Q86 — AWS SAA-C03 Ch.16

Question 86 of 100 | ← Chapter 16

Q1286. A company's solutions architect is designing an AWS multi-account solution that uses AWS Organizations. The solutions architect has organized the company's accounts into organizational units(OUs).The solutions architect needs a solution that will identify any changes to the OU hierarchy. The solution also needs to notify the company's operations team of any changes.Which solution will meet these requirements with the LEAST operational overhead?

Correct Answer: B. Provision the AWS accounts by using AWS Control Tower. Use AWS Config aggregated rules to identify the changes to the OU hierarchy.

Explanation

The correct solution must detect changes to the AWS Organizations OU hierarchy and notify the operations team with minimal operational overhead. Let's evaluate each option:Correct Answer: B. Provision the AWS accounts by using AWS Control Tower. Use AWS Config aggregated rules to identify the changes to the OU hierarchy.Why Option B is Best:AWS Control Tower + AWS Config = Automated OU Change Detection:AWS Control Tower automatically sets up and enforces governance policies across AWS Organizations, including OU hierarchy management.AWS Config (with aggregated rules) can monitor OU changes across all accounts in the organization by tracking the AWS::Organizations::OrganizationalUnit resource type. AWS Config rules can trigger SNS notifications (or other remediation actions) when OU changes occur, ensuring the operations team is alerted.Least Operational Overhead:No manual scripting or custom event rules are needed (unlike CloudTrail + EventBridge setups). AWS Control Tower automates account provisioning and governance, reducing setup effort.Why Other Options Fail:A. Provision the AWS accounts by using AWS Control Tower. Use account drift notifications to identify the changes to the OU hierarchy.Incorrect Tool for OU Changes:AWS Control Tower's "account drift" notifications detect policy violations (e.g., unauthorized resources), not OU hierarchy changes.No native way to track OU modifications via drift detection. C. Use AWS Service Catalog to create accounts in Organizations. Use an AWS CloudTrail organization trail to identify the changes to the OU hierarchy.Unnecessarily Complex Setup:AWS Service Catalog is for IT service provisioning, not account creation (AWS Organizations or Control Tower is better).CloudTrail logs API calls, but requires manual EventBridge rules + SNS to detect and notify on OU changes (higher overhead than AWS Config).D. Use AWS CloudFormation templates to create accounts in Organizations. Use the drift detection operation on a stack to identify the changes to the OU hierarchy.Incorrect Use of CloudFormation Drift Detection:CloudFormation drift detection works on resources deployed by stacks, not OU hierarchy changes (which are managed outside CloudFormation).OU changes are not tracked by CloudFormation, making this approach ineffective.Key Comparison:RequirementOption BOther OptionsDetects OU hierarchy changes(AWS Config aggregated rules track AWS::Organizations::OrganizationalUnit) (A: Account drift OU changes; C: CloudTrail needs manual rules; D: CloudFormation doesn't track OUs)Notifies operations team automatically(AWS Config rules trigger SNS/remediation) (A: No OU change notifications; C: Requires manual EventBridge setup; D: No notification mechanism) Minimal operational overhead(AWS Control Tower + AWS Config = automated setup) (A: Partial solution;C: Manual EventBridge rules; D: Incorrect toolchain)Conclusion:Option B is the only solution that:Automatically detects OU hierarchy changes (via AWS Config). Notifies the operations team (via SNS or other remediation). Requires the least setup and maintenance (AWS Control Tower + AWS Config).Final Answer: B