Exams / DOP-C02 / Study guide / Account creation and landing zones (Organizations, Control Tower)
Account creation and landing zones (Organizations, Control Tower): DOP-C02 study notes and practice questions
What to know about Account creation and landing zones (Organizations, Control Tower) for the DOP-C02 exam, from the Configuration Management and IaC domain (17% of the exam guide), then 2 free questions to test it. Part of the DOP-C02 study guide.
These questions ask how to create new accounts quickly with security baselines already in place.
AWS Organizations
Management account plus member accounts grouped in OUs.
SCPs and RCPs (resource control policies) set maximum permissions; tag policies, backup policies and AI opt-out policies set standards.
Delegated administrators run services (Security Hub, GuardDuty, Config, StackSets, Backup) from a member account.
Consolidated billing.
AWS Control Tower
Sets up a landing zone: a log archive account, an audit account, organization CloudTrail, Config and IAM Identity Center.
Account Factory vends new accounts into OUs with a standard baseline.
Controls (guardrails):
Type
Implemented by
Does
Preventive
SCPs (and RCPs)
Blocks actions, such as denying Regions outside an approved list
Detective
AWS Config rules
Reports non-compliance
Proactive
CloudFormation hooks
Blocks non-compliant resources before they’re created
Accounts in the OU can’t disable preventive controls.
Customizing accounts
Customizations for AWS Control Tower (CfCT) deploys CloudFormation templates and SCPs to accounts in target OUs, triggered by Control Tower lifecycle events when Account Factory creates an account.
Account Factory for Terraform (AFT) does the same in Terraform with a GitOps flow.
Account Factory Customization (AFC) applies blueprints from Service Catalog at creation.
Lifecycle events go to EventBridge (such as CreateManagedAccount) for your own automation.
Common traps
Creating accounts by hand and running scripts afterward.
Detective controls when the ask is to prevent an action.
Local IAM policies to enforce a Region rule that admins could remove. Use an SCP.
Running workloads in the management account, where SCPs do not apply.
An insurance firm manages its AWS accounts with AWS Control Tower. Business teams create new accounts through Account Factory, and each account is placed in an organizational unit that has the firm's guardrails.
Every new account must receive the same baseline at creation: an approved network stack with private subnets, a logging role for the security team and an agent configuration in AWS Systems Manager. Teams should not need to run any step after their account is enrolled.
The platform team wants the baseline to stay up to date, so a change to the approved templates should reach all accounts in the target organizational units.
Which approach meets these requirements?
Choose one answer.
AA. Ask each business team to run a CloudFormation stack from its own account after enrollment, using the template from the platform team's shared S3 bucket, and check that the stack succeeded.
BB. Create an AWS Config rule that detects accounts without the baseline resources, and use a remediation action that creates the missing resources after the account has been enrolled.
CC. Add a service control policy to the organizational units that creates the required subnets and roles whenever an account is created, so the baseline is applied before any team can use the account.
DD. Deploy Customizations for AWS Control Tower (CfCT) with the baseline templates targeted at the OUs, so its pipeline deploys them when Account Factory creates an account and again when the templates change.
Show the answer and explanation
Answer: D
A. Wrong: This relies on each team to run the step, so new accounts can be missed. It also adds work to every team and gives no way to roll a template change out across the organizational units. Learn more: What is CloudFormation? (opens in a new tab)
D. Right: Correct. CfCT is integrated with Control Tower lifecycle events, so resources attached to an OU are deployed automatically when Account Factory creates an account there. Committing a template change reruns its pipeline, which updates the accounts in the targeted OUs. Learn more: Customizations for AWS Control Tower (CfCT) overview (opens in a new tab)
Explanation
Customizations for AWS Control Tower deploys CloudFormation templates and policies to the accounts in targeted OUs, and its Control Tower lifecycle event integration applies them automatically when Account Factory creates an account. A change to the templates reruns the same pipeline for the targeted OUs. Manual stacks, reactive remediation and service control policies each miss part of this, since SCPs restrict actions but cannot create resources.
A university has enrolled its research accounts in AWS Control Tower. The university's data-use policy requires that research workloads run only in the two US Regions where its data agreements apply, and that no one can turn this off in an individual account.
Account administrators in the research organizational unit should keep full access to the services they use in those two Regions, and the university does not want to build its own policy engine.
The compliance office wants the control's status for the research OU and its accounts visible in the Control Tower console.
Which control should the university enable on the research organizational unit?
Choose one answer.
AA. Enable a detective guardrail that reports resources created in Regions outside the approved list, and send its alerts to the compliance team for follow-up.
BB. Enable the Control Tower Region deny control on the research OU, with the two approved Regions as its parameter.
CC. Write a custom service control policy in the Organizations console that denies every action in other Regions, and attach it to the research organizational unit with no Control Tower involvement.
DD. Create an AWS Config rule in each research account that marks any resource outside the approved Regions as noncompliant, and remediate the resource by deleting it.
Show the answer and explanation
Answer: B
A. Wrong: A detective guardrail reports violations after resources exist, so workloads could run outside the approved Regions for a time. The requirement is to prevent that use, not only to report it. Learn more: Guardrails in AWS Control Tower (opens in a new tab)
B. Right: Correct. The OU-level Region deny control is a preventive control implemented as a service control policy, so it blocks requests in other Regions and accounts in the OU cannot turn it off. Its status appears with the OU's controls in the Control Tower console. Learn more: Configure the Region deny control (opens in a new tab)
C. Wrong: This prevents the use, but the university would write and maintain the policy itself, and Control Tower would not show the compliance status. The requirement asked for a managed control that the university does not build. Learn more: Service control policies (SCPs) (opens in a new tab)
Control Tower's OU-level Region deny control is preventive: it is implemented as a service control policy that denies requests in Regions outside the approved list. Accounts in the OU cannot disable it, and the console shows its status for compliance review. Detective controls, hand-written SCPs and per-account Config rules each miss part of the requirement.
Want more on Account creation and landing zones (Organizations, Control Tower)? The 5 full-length practice sets have 6 more Account creation and landing zones (Organizations, Control Tower) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Account creation and landing zones (Organizations, Control Tower)