SAP-C03 practice question: Landing zones, OUs, SCPs and RCPs (2 of 2)
Security, Compliance, and Governance A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A retailer's platform team creates about 25 new AWS accounts a year, one for each new store system. Each account must start with the company's baseline: central logging, approved Regions, a standard VPC and the security guardrails.
Account requests come from a web form, and the business wants a new account ready within an hour. The platform team does not want to script every step from scratch, and accounts that are created must stay compliant afterwards.
Which solution meets these requirements?
Choose one answer.
AA. Enroll the OU in AWS Control Tower, and provision new accounts through Account Factory, using Account Factory customization blueprints to deploy the standard VPC and baseline stacks.
BB. Have an administrator create each account by hand in the Organizations console, then copy the baseline settings from a template account, following a written runbook.
CC. Write a Lambda function that calls the Organizations CreateAccount API when a form is submitted, and move the new account into the correct OU.
DD. Create one shared account for all store systems, and separate the stores with IAM roles, resource tags and dedicated subnets instead of creating a new account for each store system that is requested.
Show the answer and explanation
Answer: A
A. Right: Correct. Account Factory creates accounts with the landing zone's guardrails and logging already in place, and its customizations apply the team's VPC and baseline stacks. Guardrails keep the accounts compliant after creation.
B. Wrong: Manual creation takes far longer than an hour and is prone to missed steps. The accounts would also lack the guardrails and logging that the landing zone enforces.
C. Wrong: The function creates the account, but nothing applies the logging, the Region limits or the VPC. The team would have to build and maintain the entire baseline itself.
D. Wrong: A shared account removes the account boundaries the company wants for each store system, so one system's compromise can reach the others. The design does not give each system its own baseline.
Explanation
Control Tower Account Factory gives the one-hour provisioning, with the landing zone's logging and guardrails already in place and customizations for the VPC and stacks. Manual setup, a bare CreateAccount function and a shared account each miss the baseline or the isolation.
Want more on Landing zones, OUs, SCPs and RCPs? The 5 full-length practice sets have 8 more Landing zones, OUs, SCPs and RCPs questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →