Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 270 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional SAP-C02

Question #: 270
Topic #: 1

[All AWS Certified Solutions Architect - Professional SAP-C02 Questions]

A company is expanding. The company plans to separate its resources into hundreds of different AWS accounts in multiple AWS Regions. A solutions architect must recommend a solution that denies access to any operations outside of specifically designated Regions.

Which solution will meet these requirements?

A. Create IAM roles for each account. Create IAM policies with conditional allow permissions that include only approved Regions for the accounts.
B. Create an organization in AWS Organizations. Create IAM users for each account. Attach a policy to each user to block access to Regions where an account cannot deploy infrastructure.
C. Launch an AWS Control Tower landing zone. Create OUs and attach SCPs that deny access to run services outside of the approved Regions.
D. Enable AWS Security Hub in each account. Create controls to specify the Regions where an account can deploy infrastructure.

Show Suggested Answer

Suggested Answer: C 🗳️

by psyx21 at June 21, 2023, 11:26 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

Al8282

1 month ago

Selected Answer: C

For those of you stuck on the fact that you need Orgs enabled to use SCPs or ControlTower and there is no orgs yet, enabling ControlTower creates an org if one doesn't exist.

upvoted 1 times

...