Organizations, Control Tower and delegated administrators: SCS-C03 study notes and practice questions

What to know for the exam

These questions describe a company with several accounts, an audit team that needs central logs, and a rule such as “the security team must see every account” or “new accounts must be secure from the first minute.” You choose the account structure that enforces the rule with the least manual work.

What decides the answer

• The management account owns and pays for the organization. Keep workloads and everyday users out of it. Service control policies (SCPs) and resource control policies (RCPs) do not restrict it, so protect it with its own controls.
• Organizational units (OUs) group accounts by purpose, such as Security, Infrastructure, Workloads and Sandbox. Attach a control to an OU and every account under it inherits the control, including accounts created later.
• All features must be enabled for SCPs, RCPs and Control Tower. An organization that only has consolidated billing cannot use these controls.
• Trusted access lets an AWS service, such as GuardDuty, Security Hub CSPM or AWS Config, act across the organization. Enable it from the management account before you designate an administrator for that service.
• Delegated administrators are member accounts, usually a security tooling account, that run organization-wide security services. This keeps daily security work out of the management account.
• Control Tower builds a landing zone. It creates a Security OU with a log archive account, which holds centralized logs, and an audit account, which security staff use to reach every account. It applies controls, which older material calls guardrails. Preventive controls use SCPs and other organization policies, detective controls use AWS Config rules, and proactive controls use CloudFormation hooks to check resources before they are created.
• Account Factory creates new accounts that already meet the baseline you chose, so a team cannot start from an unsecured account.

How to choose

Common traps

• Running workloads in the management account, then expecting SCPs to protect them. No SCP or RCP limits the management account, which is why it should stay small.
• Attaching controls to single accounts when an OU would cover future accounts automatically.
• Choosing a billing-only organization when the requirement needs SCPs, RCPs or Control Tower.
• Administering org-wide security from a member account’s own admin role rather than a delegated administrator that the organization manages.
• Building a landing zone by hand when the requirement asks for the least operational overhead. Control Tower is the managed answer.

Read the delegated administrators guide and the Control Tower overview before the exam. The first explains which services accept a delegated administrator, and the second explains controls, the landing zone and the accounts it creates.

Try the 1 practice question ↓