Exam AWS Certified Solutions Architect - Professional topic 1 question 686 discussion

B it looks AWS Control Tower automates the setup of a new landing zone using best-practices blueprints for identity, federated access, and account structure. The account factory automates provisioning of new accounts in your organization. As a configurable account template, it helps you standardize the provisioning of new accounts with pre-approved account configurations. You can configure your account factory with pre-approved network configuration and region selections. https://aws.amazon.com/controltower/features/

B. Deploy an AWS Control Tower landing zone. Create an AD Connector linked to the on-premises Active Directory. Change the identity source in AWS Single Sign-On to use Active Directory. Allow department administrators to use Account Factory to create new member accounts and networking. Grant the departments AWS power user permissions on the created accounts.

B is perfect

B Control Tower + AD Connector + Account Factory

It's B

BBB --- Key: "Each department should be allowed to create AWS accounts with preconfigured networking"

I'll go with B

it's B https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.html

The answer is B https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.html

Although option #A points out the key factor SCP, however, it does not emphasize its major functionality which is the service boundary in this case. All the options here are more about how to govern the accounts. According to the introduction (https://aws.amazon.com/controltower/?nc2=h_ql_prod_mg_ct), there are two highlights to make option #B is much more ideal than #A. 1) Blueprints are available to provide identity management, federate access to accounts, centralize logging, establish cross-account security audits, define workflows for provisioning accounts, and implement account baselines with network configurations. 2) Control Tower provides mandatory and strongly recommended high-level rules, called guardrails, that help enforce your policies using service control policies (SCPs), or detect policy violations using AWS Config rules.

Seems to be B ------------ AWS Control Tower seems to maintain the control of AWS Organizations, AWS Service Catalog and AWS Config ------ https://d1.awsstatic.com/whitepapers/aws-overview.pdf (46)

Is service catalog not more in line with "access to only a specific list of approved services"? maybe C.

I go for A, keyword "access to only a specific list of approved services. " it means SCP

Should be A https://aws.amazon.com/blogs/security/aws-federated-authentication-with-active-directory-federation-services-ad-fs/

I think A