DOP-C02 practice question: Account creation and landing zones (Organizations, Control Tower) (2 of 2)
Configuration Management and IaC A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A university has enrolled its research accounts in AWS Control Tower. The university's data-use policy requires that research workloads run only in the two US Regions where its data agreements apply, and that no one can turn this off in an individual account.
Account administrators in the research organizational unit should keep full access to the services they use in those two Regions, and the university does not want to build its own policy engine.
The compliance office wants the control's status for the research OU and its accounts visible in the Control Tower console.
Which control should the university enable on the research organizational unit?
Choose one answer.
AA. Enable a detective guardrail that reports resources created in Regions outside the approved list, and send its alerts to the compliance team for follow-up.
BB. Enable the Control Tower Region deny control on the research OU, with the two approved Regions as its parameter.
CC. Write a custom service control policy in the Organizations console that denies every action in other Regions, and attach it to the research organizational unit with no Control Tower involvement.
DD. Create an AWS Config rule in each research account that marks any resource outside the approved Regions as noncompliant, and remediate the resource by deleting it.
Show the answer and explanation
Answer: B
A. Wrong: A detective guardrail reports violations after resources exist, so workloads could run outside the approved Regions for a time. The requirement is to prevent that use, not only to report it. Learn more: Guardrails in AWS Control Tower (opens in a new tab)
B. Right: Correct. The OU-level Region deny control is a preventive control implemented as a service control policy, so it blocks requests in other Regions and accounts in the OU cannot turn it off. Its status appears with the OU's controls in the Control Tower console. Learn more: Configure the Region deny control (opens in a new tab)
C. Wrong: This prevents the use, but the university would write and maintain the policy itself, and Control Tower would not show the compliance status. The requirement asked for a managed control that the university does not build. Learn more: Service control policies (SCPs) (opens in a new tab)
Control Tower's OU-level Region deny control is preventive: it is implemented as a service control policy that denies requests in Regions outside the approved list. Accounts in the OU cannot disable it, and the console shows its status for compliance review. Detective controls, hand-written SCPs and per-account Config rules each miss part of the requirement.
Want more on Account creation and landing zones (Organizations, Control Tower)? The 5 full-length practice sets have 6 more Account creation and landing zones (Organizations, Control Tower) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →