Quizzes · Service

Control Tower

Level 0 questions on Control Tower. Read about it first if it's new to you.

Works with: Organizations (4), CloudTrail (3), IAM Identity Center (2), Config (2)

15 questions, from a pool of 23
1 correct answer of 4 each
Pass line 80%

Questions and answers come in a new order every time, and every choice is explained. Your answers feed your weak spots on the exam page; they don't change your exam score.

Question 1Todo.io's auditors require that nobody in the Prod account can ever stop CloudTrail logging. Which control meets the requirement?

An SCP on the Prod OU that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.Correct. "Can ever" asks for a preventive control. An SCP Deny blocks the API call for everyone in the account, administrators and root included.An AWS Config rule that checks CloudTrail is turned on.Not this one. Config is detective: it tells you after logging was stopped. The requirement says it must never happen.A CloudWatch alarm that emails the security team when logging stops.Not this one. An alarm also fires after the fact. Being told isn't the same as preventing it.Remove cloudtrail:StopLogging from every IAM policy in the account.Not this one. Anyone who can edit IAM policies could add it back. An SCP sits outside the account, where they can't change it.

Learn it: SCP (service control policy) · Controls (guardrails) · Set up AWS: Day 0 with Control Tower

Question 2Todo.io wants a multi-account setup with central logging, single sign-on and guardrails, built the AWS-recommended way, with the least work. What should it use?

AWS Control Tower, which builds and governs a landing zone.Correct. Control Tower wires up Organizations, Identity Center, CloudTrail and Config for you, and keeps them from drifting.Create each account by hand and copy the settings across.Not this one. It can be done, but it is slow, easy to get wrong and drifts over time.Turn on AWS Config in the management account.Not this one. Config records and checks settings. It doesn't build accounts, sign-in or logging.Create IAM users for everyone in the management account.Not this one. That puts people and workloads in the one account SCPs can't protect.

Learn it: AWS Control Tower · Set up AWS: Day 0 with Control Tower · Landing zone

Question 3A teammate says that once Todo.io uses Control Tower, it no longer uses AWS Organizations. Which statement is true?

Control Tower sets up and governs Organizations, IAM Identity Center, CloudTrail and Config. It doesn't replace them.Correct. The organization, the OUs and the SCPs are all still there. Control Tower manages them for you.Control Tower replaces Organizations with its own account system.Not this one. Control Tower runs on top of Organizations.Control Tower is only a dashboard; it changes nothing.Not this one. It creates accounts, applies controls and sets up logging and sign-in.Control Tower runs separately inside each member account.Not this one. It runs from the management account and governs the accounts below it.

Learn it: AWS Control Tower

Question 4Todo.io needs a new account for its data team. It must arrive with logging on, guardrails applied and sign-in through Identity Center already set up. What creates it?

Control Tower's Account Factory.Correct. Account Factory stamps out accounts from a template, already enrolled in the landing zone.Create the account in the Organizations console and configure everything afterwards.Not this one. You would then have to set up logging, guardrails and sign-in by hand, and enroll the account.Copy the Prod account.Not this one. Accounts can't be copied.IAM Identity Center.Not this one. Identity Center gives people access to accounts. It doesn't create them.

Learn it: Account Factory

Question 5Why does a Control Tower landing zone keep every account's logs in a separate Log Archive account?

Someone who breaks into a workload account can't erase the evidence of what they did.Correct. Nobody runs apps in the Log Archive account, and workload accounts can't delete what is stored there.Storage is cheaper in a separate account.Not this one. The price of storage doesn't depend on which account holds it.CloudTrail can only write to another account.Not this one. CloudTrail can write to a bucket in the same account. Separating them is a security choice.Logs in workload accounts are deleted after 90 days.Not this one. Logs in S3 are kept as long as you choose, in any account.

Learn it: Landing zone · Set up AWS: Day 0 with Control Tower

Question 6Todo.io wants to be told whenever an S3 bucket in any account becomes public. Teams must still be able to make the change. Which kind of Control Tower control fits?

A detective control.Correct. Detective controls are AWS Config rules. They spot something after it happens and report it, without blocking it. "Be told" is the clue.A preventive control.Not this one. Preventive controls are SCPs. They would block the change, which the requirement doesn't want.A proactive control.Not this one. Proactive controls check CloudFormation templates before resources are created. Buckets changed in the console would be missed.A mandatory control.Not this one. "Mandatory" says a control is always on, not what kind it is.

Learn it: Controls (guardrails)

Question 7Todo.io deploys everything with CloudFormation. It wants each resource checked against its rules before CloudFormation creates it. Which kind of Control Tower control fits?

A proactive control.Correct. Proactive controls are CloudFormation hooks: they check a resource before it is created.A detective control.Not this one. Detective controls check after the resource exists.A preventive control.Not this one. Preventive controls are SCPs that block API calls. They don't look at what a template is about to create.An elective control.Not this one. "Elective" means optional. It doesn't say when the check happens.

Learn it: Controls (guardrails)

Question 8A teammate edits one of Control Tower's SCPs by hand in the Organizations console. What does Control Tower do?

It reports drift, so the landing zone can be repaired to match its intended setup.Correct. Control Tower notices changes made outside it. Fixing the drift puts its managed resources back as they should be.Nothing. Changes made in the Organizations console are invisible to it.Not this one. Control Tower watches the resources it manages, wherever they are changed.It deletes the account that was changed.Not this one. It never deletes accounts on its own.It blocks the edit before it happens.Not this one. The edit goes through. Control Tower reports it afterwards.

Learn it: AWS Control Tower

Question 9Todo.io had three accounts before it set up Control Tower. Can they be governed by it?

Yes. Existing accounts in the organization can be enrolled.Correct. Enrolling an account applies the landing zone's logging, guardrails and sign-in to it.No. They have to be closed and recreated with Account Factory.Not this one. Enrollment exists so that doesn't have to happen.Only by moving their workloads into the management account.Not this one. Workloads should never move into the management account.Only their root users can be governed.Not this one. Enrollment governs the whole account.

Learn it: AWS Control Tower

Question 10Which statement about Control Tower's controls is true?

Some are mandatory and always on. Others are strongly recommended or elective, and you choose where to turn them on.Correct. Mandatory controls protect the landing zone itself, such as its logging. The rest you enable per OU.Every control is a preventive SCP.Not this one. Controls are preventive (SCPs), detective (Config rules) or proactive (CloudFormation hooks).Every control is optional.Not this one. Mandatory controls can't be turned off.Controls only apply to the management account.Not this one. Controls are applied to OUs, so they reach the accounts in them.

Learn it: Controls (guardrails)

Question 11What are Control Tower's detective controls built from?

AWS Config rules.Correct. They spot problems after they happen and report them.Service control policies.Not this one. SCPs are the preventive controls.CloudFormation hooks.Not this one. Hooks are the proactive controls.IAM policies in each account.Not this one. Controls are applied across OUs, not written into each account's IAM.

Learn it: AWS Config · Controls (guardrails)

Question 12What does "AWS Control Tower" mean?

Sets up and governs a multi-account AWS environment (a landing zone) for you.Correct. Think of it as: A developer who builds the whole apartment complex to code, then inspects it regularly.A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.Not this one. That describes Permission set.A ready-made, well-run multi-account AWS environment that your apps can "land" in.Not this one. That describes Landing zone.One place for people to sign in and get access to many AWS accounts.Not this one. That describes IAM Identity Center.

Learn it: AWS Control Tower

Question 13Which term is this? "Sets up and governs a multi-account AWS environment (a landing zone) for you."

AWS Control TowerCorrect. Yes. Think of it as: A developer who builds the whole apartment complex to code, then inspects it regularly.Permission setNot this one. Permission set is: A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.Landing zoneNot this one. Landing zone is: A ready-made, well-run multi-account AWS environment that your apps can "land" in.IAM Identity CenterNot this one. IAM Identity Center is: One place for people to sign in and get access to many AWS accounts.

Learn it: AWS Control Tower

Question 14Which AWS term is described by this analogy? "A developer who builds the whole apartment complex to code, then inspects it regularly."

AWS Control TowerCorrect. Yes: Sets up and governs a multi-account AWS environment (a landing zone) for you.Permission setNot this one. Permission set is: A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to. Its analogy: A job description that comes with the right keys in every building.Landing zoneNot this one. Landing zone is: A ready-made, well-run multi-account AWS environment that your apps can "land" in. Its analogy: A finished business park, with roads, security gates, CCTV and empty units ready to rent.IAM Identity CenterNot this one. IAM Identity Center is: One place for people to sign in and get access to many AWS accounts. Its analogy: The front desk that hands you a temporary key card for whichever flat you're cleared for.

Learn it: AWS Control Tower

Question 15What does "Landing zone" mean?

A ready-made, well-run multi-account AWS environment that your apps can "land" in.Correct. Think of it as: A finished business park, with roads, security gates, CCTV and empty units ready to rent.Sets up and governs a multi-account AWS environment (a landing zone) for you.Not this one. That describes AWS Control Tower.Control Tower's way to create new AWS accounts from a standard template.Not this one. That describes Account Factory.A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.Not this one. That describes Permission set.

Learn it: Landing zone

Question 16Which term is this? "A ready-made, well-run multi-account AWS environment for your workloads, set up for you by Control Tower."

Landing zoneCorrect. Yes. Think of it as: A finished business park, with roads, security gates, CCTV and empty units ready to rent.AWS Control TowerNot this one. AWS Control Tower is: Sets up and governs a multi-account AWS environment (a landing zone) for you.Account FactoryNot this one. Account Factory is: Control Tower's way to create new AWS accounts from a standard template.Permission setNot this one. Permission set is: A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.

Learn it: Landing zone

Question 17Which AWS term is described by this analogy? "A finished business park, with roads, security gates, CCTV and empty units ready to rent."

Landing zoneCorrect. Yes: A ready-made, well-run multi-account AWS environment that your apps can "land" in.AWS Control TowerNot this one. AWS Control Tower is: Sets up and governs a multi-account AWS environment (a landing zone) for you. Its analogy: A developer who builds the whole apartment complex to code, then inspects it regularly.Account FactoryNot this one. Account Factory is: Control Tower's way to create new AWS accounts from a standard template. Its analogy: A vending machine for pre-furnished flats.Permission setNot this one. Permission set is: A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to. Its analogy: A job description that comes with the right keys in every building.

Learn it: Landing zone

Question 18What does "Account Factory" mean?

Control Tower's way to create new AWS accounts from a standard template.Correct. Think of it as: A vending machine for pre-furnished flats.A ready-made, well-run multi-account AWS environment that your apps can "land" in.Not this one. That describes Landing zone.Control Tower's rules for every account in an OU. Some block, some report, some check before deploying.Not this one. That describes Controls (guardrails).Sets up and governs a multi-account AWS environment (a landing zone) for you.Not this one. That describes AWS Control Tower.

Learn it: Account Factory

Question 19Which term is this? "Control Tower's way to create new AWS accounts from a standard template."

Account FactoryCorrect. Yes. Think of it as: A vending machine for pre-furnished flats.Landing zoneNot this one. Landing zone is: A ready-made, well-run multi-account AWS environment that your apps can "land" in.Controls (guardrails)Not this one. Controls (guardrails) is: Control Tower's rules for every account in an OU. Some block, some report, some check before deploying.AWS Control TowerNot this one. AWS Control Tower is: Sets up and governs a multi-account AWS environment (a landing zone) for you.

Learn it: Account Factory

Question 20Which AWS term is described by this analogy? "A vending machine for pre-furnished flats."

Account FactoryCorrect. Yes: Control Tower's way to create new AWS accounts from a standard template.Landing zoneNot this one. Landing zone is: A ready-made, well-run multi-account AWS environment that your apps can "land" in. Its analogy: A finished business park, with roads, security gates, CCTV and empty units ready to rent.Controls (guardrails)Not this one. Controls (guardrails) is: Control Tower's rules for every account in an OU. Some block, some report, some check before deploying. Its analogy: Locked doors, CCTV, and a plan check before building work starts.AWS Control TowerNot this one. AWS Control Tower is: Sets up and governs a multi-account AWS environment (a landing zone) for you. Its analogy: A developer who builds the whole apartment complex to code, then inspects it regularly.

Learn it: Account Factory

Question 21What does "Controls (guardrails)" mean?

Control Tower's rules for every account in an OU. Some block, some report, some check before deploying.Correct. Think of it as: Locked doors, CCTV, and a plan check before building work starts.Control Tower's way to create new AWS accounts from a standard template.Not this one. That describes Account Factory.A ready-made, well-run multi-account AWS environment that your apps can "land" in.Not this one. That describes Landing zone.Sets up and governs a multi-account AWS environment (a landing zone) for you.Not this one. That describes AWS Control Tower.

Learn it: Controls (guardrails)

Question 22Which term is this? "Control Tower's rules for every account in an OU. Some block, some report, some check before deploying."

Controls (guardrails)Correct. Yes. Think of it as: Locked doors, CCTV, and a plan check before building work starts.Account FactoryNot this one. Account Factory is: Control Tower's way to create new AWS accounts from a standard template.Landing zoneNot this one. Landing zone is: A ready-made, well-run multi-account AWS environment that your apps can "land" in.AWS Control TowerNot this one. AWS Control Tower is: Sets up and governs a multi-account AWS environment (a landing zone) for you.

Learn it: Controls (guardrails)

Question 23Which AWS term is described by this analogy? "Locked doors, CCTV, and a plan check before building work starts."

Controls (guardrails)Correct. Yes: Control Tower's rules for every account in an OU. Some block, some report, some check before deploying.Account FactoryNot this one. Account Factory is: Control Tower's way to create new AWS accounts from a standard template. Its analogy: A vending machine for pre-furnished flats.Landing zoneNot this one. Landing zone is: A ready-made, well-run multi-account AWS environment that your apps can "land" in. Its analogy: A finished business park, with roads, security gates, CCTV and empty units ready to rent.AWS Control TowerNot this one. AWS Control Tower is: Sets up and governs a multi-account AWS environment (a landing zone) for you. Its analogy: A developer who builds the whole apartment complex to code, then inspects it regularly.

Learn it: Controls (guardrails)

Control Tower

Worth another look

Your weak spots

Services

Concepts