DOP-C02 practice question: Account creation and landing zones (Organizations, Control Tower) (1 of 2)
Configuration Management and IaC A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
An insurance firm manages its AWS accounts with AWS Control Tower. Business teams create new accounts through Account Factory, and each account is placed in an organizational unit that has the firm's guardrails.
Every new account must receive the same baseline at creation: an approved network stack with private subnets, a logging role for the security team and an agent configuration in AWS Systems Manager. Teams should not need to run any step after their account is enrolled.
The platform team wants the baseline to stay up to date, so a change to the approved templates should reach all accounts in the target organizational units.
Which approach meets these requirements?
Choose one answer.
AA. Ask each business team to run a CloudFormation stack from its own account after enrollment, using the template from the platform team's shared S3 bucket, and check that the stack succeeded.
BB. Create an AWS Config rule that detects accounts without the baseline resources, and use a remediation action that creates the missing resources after the account has been enrolled.
CC. Add a service control policy to the organizational units that creates the required subnets and roles whenever an account is created, so the baseline is applied before any team can use the account.
DD. Deploy Customizations for AWS Control Tower (CfCT) with the baseline templates targeted at the OUs, so its pipeline deploys them when Account Factory creates an account and again when the templates change.
Show the answer and explanation
Answer: D
A. Wrong: This relies on each team to run the step, so new accounts can be missed. It also adds work to every team and gives no way to roll a template change out across the organizational units. Learn more: What is CloudFormation? (opens in a new tab)
D. Right: Correct. CfCT is integrated with Control Tower lifecycle events, so resources attached to an OU are deployed automatically when Account Factory creates an account there. Committing a template change reruns its pipeline, which updates the accounts in the targeted OUs. Learn more: Customizations for AWS Control Tower (CfCT) overview (opens in a new tab)
Explanation
Customizations for AWS Control Tower deploys CloudFormation templates and policies to the accounts in targeted OUs, and its Control Tower lifecycle event integration applies them automatically when Account Factory creates an account. A change to the templates reruns the same pipeline for the targeted OUs. Manual stacks, reactive remediation and service control policies each miss part of this, since SCPs restrict actions but cannot create resources.
Want more on Account creation and landing zones (Organizations, Control Tower)? The 5 full-length practice sets have 6 more Account creation and landing zones (Organizations, Control Tower) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →