SOA-C03 practice question 9 of 10

A multinational company uses an organization in AWS Organizations to manage over 200 member accounts across multiple AWS Regions. The company must…

Domain Security and Compliance

A multinational company uses an organization in AWS Organizations to manage over 200 member accounts across multiple AWS Regions. The company must ensure that all AWS resources meet specific security requirements. The company must not deploy any EC2 instances in the ap-southeast-2 Region. The company must completely block root user actions in all member accounts. The company must prevent any user from deleting AWS CloudTrail logs, including administrators. The company requires a centrally managed solution that the company can automatically apply to all existing and future accounts. Which solution will meet these requirements?

Answer options

A: Create AWS Config rules with remediation actions in each account to detect policy violations. Implement IAM permissions boundaries for the account root users.

B: Enable AWS Security Hub across the organization. Create custom security standards to enforce the security requirements. Use AWS CloudFormation StackSets to deploy the standards to all the accounts in the organization. Set up Security Hub automated remediation actions.

C: Use AWS Control Tower for account governance. Configure Region deny controls. Use Service Control Policies (SCPs) to restrict root user access. Correct answer

D: Configure AWS Firewall Manager with security policies to meet the security requirements. Use an AWS Config aggregator with organization-wide conformance packs to detect security policy violations.

Correct Answer:

C. Use AWS Control Tower for account governance. Configure Region deny controls. Use Service Control Policies (SCPs) to restrict root user access.

Explanation

AWS Control Tower is a service designed to establish and govern a secure, multi-account AWS environment. It uses preventive guardrails, which are implemented as Service Control Policies (SCPs), to enforce policies across all accounts in an organization. The "Region deny control" is a specific Control Tower feature that uses an SCP to restrict access to specified AWS Regions, meeting the requirement to block EC2 deployments in ap-southeast-2. SCPs are the only mechanism that can restrict permissions for the account root user, thereby meeting the requirement to block root user actions. An SCP can also be configured to deny actions like cloudtrail:DeleteTrail for all principals, including administrators, thus protecting the logs. This solution is centrally managed and automatically applied to new accounts created via the Control Tower account factory.

Why Incorrect

A. AWS Config is a detective, not a preventive, control. You cannot attach IAM permissions boundaries to the account root user to restrict its permissions.
B. AWS Security Hub is a security posture management service that aggregates findings; it is primarily a detective tool and does not prevent actions from occurring.
D. AWS Firewall Manager is used for centrally managing firewall rules (e.g., WAF, Security Groups), not for restricting EC2 deployments by region or limiting root user actions.

References

1. AWS Control Tower Documentation, "Region deny control": This document explains the Region deny control feature. It states, "The Region deny control... helps you restrict access to AWS Regions... This control is implemented using a service control policy (SCP)."

2. AWS Organizations User Guide, "Service control policies (SCPs)": This guide clarifies how SCPs work. It states, "SCPs are a type of organization policy that you can use to manage permissions in your organization... SCPs affect all IAM entities (users and roles), including the root user, in a member account."

3. AWS Organizations User Guide, "SCP examples": This section provides examples of SCPs. The example "Prevent member accounts from leaving the organization" demonstrates denying an action (organizations:LeaveOrganization) for all principals, a principle that can be applied to deny cloudtrail:DeleteTrail or all actions for the root user.

4. AWS Control Tower User Guide, "How AWS Control Tower works": This guide describes the overall function. It explains, "When you create a new account with Account Factory, the account is enrolled automatically in AWS Control Tower, and the guardrails are applied to the account." This confirms the solution applies to existing and future accounts.

Question breakdown

Tests: Apply preventive multi-account guardrails with Control Tower and SCPs
Difficulty: Medium

Key idea: SCPs, applied directly or through Control Tower controls, are preventive guardrails that restrict every principal in member accounts, including the root user and administrators.

How to reach the answer

Each requirement uses preventive wording: must not deploy, completely block, prevent deletion.
Detective services (Config, Security Hub) only report or remediate after the fact.
Only SCPs can limit the member account root user and deny actions to administrators.
Control Tower applies SCP-based controls, including Region deny, centrally and to new accounts enrolled through Account Factory.
Firewall Manager handles network and WAF policies, not Region or root restrictions.

Each option

AIncorrect. Config is detective, and permissions boundaries cannot be applied to the root user.
BIncorrect. Security Hub aggregates and evaluates findings; it cannot block actions before they happen.
CCorrect. Control Tower with Region deny controls and SCPs gives central, preventive enforcement on existing and future accounts, including root.
DIncorrect. Firewall Manager manages firewall-type policies, and Config conformance packs only detect violations.

Common trap: Config or Security Hub with automated remediation sounds like enforcement, but it reacts after a violation instead of preventing it.

In practice: Landing zones commonly use SCPs to deny unused Regions, restrict the root user, and protect CloudTrail from tampering across every account.

Remember: When the requirement is to prevent actions organization-wide, even for root or admins, use SCPs, usually through Control Tower.

Official documentation: Service control policies (SCPs) · What is AWS Control Tower?

Reviewed by David Mercer.

Keep practicing

Take the free SOA-C03 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test