SCS-C03 practice question: Organizations, Control Tower and delegated administrators
Security Foundations and Governance A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A healthcare company is building its AWS organization from scratch. The security team wants the log archive and audit accounts to exist before any workload account, and wants threat detection turned on automatically in each new account, managed from the audit account.
Each workload account must join its production OU only after its baseline logging and detection are confirmed. When a project ends, its account moves to a Suspended OU that blocks new resources.
Put these steps in the order the team should do them, first step first.
Put these 5 steps in order.
AA. Create each new workload account in an onboarding OU, and confirm that the organization trail and the GuardDuty detector are active in it.
BB. Enable all features in AWS Organizations, and then create a Security OU that holds the log archive and audit accounts.
CC. Move the account of each ended project into a Suspended OU whose SCP denies the creation of new resources.
DD. Designate the audit account as the delegated administrator for GuardDuty and Security Hub CSPM, with auto-enable turned on for new accounts.
EE. Move each workload account from the onboarding OU into its production OU once its baseline logging and detection are confirmed.
Show the answer and explanation
Correct order: B, D, A, E, C
B. Enable all features in AWS Organizations, and then create a Security OU that holds the log archive and audit accounts. First: all features must be enabled before SCPs and delegated administrators can be used, and the audit account must exist before anything can be delegated to it. The log archive account also exists before any workload.
D. Designate the audit account as the delegated administrator for GuardDuty and Security Hub CSPM, with auto-enable turned on for new accounts. Second: delegation needs all features and the audit account from the first step. Auto-enable must be on before workload accounts are created, so that detection starts in each of them without a manual step.
A. Create each new workload account in an onboarding OU, and confirm that the organization trail and the GuardDuty detector are active in it. Third: the account is created only after delegated administration and auto-enable are in place, so detection starts in it automatically. The onboarding OU holds it until the baseline is confirmed.
E. Move each workload account from the onboarding OU into its production OU once its baseline logging and detection are confirmed. Fourth: a workload joins its production OU only after its baseline is confirmed in the onboarding OU. Moving it earlier would put an unverified account into production.
C. Move the account of each ended project into a Suspended OU whose SCP denies the creation of new resources. Fifth: an account moves to the Suspended OU only when its project ends, after it has served as a workload. The SCP keeps the account in the organization without letting it run anything new.
Explanation
The organization needs all features and the security accounts first, then delegated administration with auto-enable so that detection starts in each new account. Workload accounts are created and checked in an onboarding OU, moved to production once the baseline is confirmed, and moved to a Suspended OU when their project ends. Each step depends on the one before it.
Want more on Organizations, Control Tower and delegated administrators? The 5 full-length practice sets have 5 more Organizations, Control Tower and delegated administrators questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →