A multinational company uses an organization in AWS Organizations to manage over 200 member accounts across multiple AWS Regions. The company must ensure that all AWS resources meet specific…

Question

Options

• ACreate AWS Config rules with remediation actions in each account to detect policy violations.
• BEnable AWS Security Hub across the organization. Create custom security standards to enforce
• CUse AWS Control Tower for account governance. Configure Region deny controls. Use Service
• DConfigure AWS Firewall Manager with security policies to meet the security requirements. Use an

• A
  9% (2)
• B
  23% (5)
• C
  59% (13)
• D
  9% (2)

Explanation

Explanation

Option C is correct because AWS Control Tower provides centralized governance across all AWS Organizations accounts using Service Control Policies (SCPs) and guardrails that automatically apply to existing and future accounts - Region deny controls can block EC2 deployments in ap-southeast-2, SCPs can completely restrict root user actions, and resource protection policies can prevent CloudTrail log deletion, satisfying all requirements with a single, scalable solution.

Option A (AWS Config rules) is incorrect because Config rules detect violations after the fact and require manual setup per account - they don't prevent actions proactively or apply automatically to new accounts at scale.

Option B (Security Hub) is incorrect because Security Hub is a monitoring and aggregation tool for security findings; it cannot enforce preventive controls or block actions like root usage or resource deletion.

Option D (Firewall Manager) is incorrect because Firewall Manager is designed to manage network security policies (WAF, Shield, Security Groups) - it is not built to enforce IAM restrictions, block root actions, or protect CloudTrail logs.

Memory Tip: Think "Control Tower = Central Control" - when you see requirements for preventive, organization-wide governance applied to all current and future accounts automatically, Control Tower + SCPs is almost always the answer on the exam.

No community discussion yet for this question.