AWS Control Tower quiz · Level 0

Question 1Todo.io wants a multi-account setup with central logging, single sign-on and guardrails, built the AWS-recommended way, with the least work. What should it use?

AWS Control Tower, which builds and governs a landing zone.Correct. Control Tower wires up Organizations, Identity Center, CloudTrail and Config for you, and keeps them from drifting.Create each account by hand and copy the settings across.Not this one. It can be done, but it is slow, easy to get wrong and drifts over time.Turn on AWS Config in the management account.Not this one. Config records and checks settings. It doesn't build accounts, sign-in or logging.Create IAM users for everyone in the management account.Not this one. That puts people and workloads in the one account SCPs can't protect.

Learn it: AWS Control Tower · Set up AWS: Day 0 with Control Tower · Landing zone

Question 2A teammate says that once Todo.io uses Control Tower, it no longer uses AWS Organizations. Which statement is true?

Control Tower sets up and governs Organizations, IAM Identity Center, CloudTrail and Config. It doesn't replace them.Correct. The organization, the OUs and the SCPs are all still there. Control Tower manages them for you.Control Tower replaces Organizations with its own account system.Not this one. Control Tower runs on top of Organizations.Control Tower is only a dashboard; it changes nothing.Not this one. It creates accounts, applies controls and sets up logging and sign-in.Control Tower runs separately inside each member account.Not this one. It runs from the management account and governs the accounts below it.

Learn it: AWS Control Tower

Question 3A teammate edits one of Control Tower's SCPs by hand in the Organizations console. What does Control Tower do?

It reports drift, so the landing zone can be repaired to match its intended setup.Correct. Control Tower notices changes made outside it. Fixing the drift puts its managed resources back as they should be.Nothing. Changes made in the Organizations console are invisible to it.Not this one. Control Tower watches the resources it manages, wherever they are changed.It deletes the account that was changed.Not this one. It never deletes accounts on its own.It blocks the edit before it happens.Not this one. The edit goes through. Control Tower reports it afterwards.

Learn it: AWS Control Tower

Question 4Todo.io had three accounts before it set up Control Tower. Can they be governed by it?

Yes. Existing accounts in the organization can be enrolled.Correct. Enrolling an account applies the landing zone's logging, guardrails and sign-in to it.No. They have to be closed and recreated with Account Factory.Not this one. Enrollment exists so that doesn't have to happen.Only by moving their workloads into the management account.Not this one. Workloads should never move into the management account.Only their root users can be governed.Not this one. Enrollment governs the whole account.

Learn it: AWS Control Tower

Question 5What does "AWS Control Tower" mean?

Sets up and governs a multi-account AWS environment (a landing zone) for you.Correct. Think of it as: A developer who builds the whole apartment complex to code, then inspects it regularly.A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.Not this one. That describes Permission set.A ready-made, well-run multi-account AWS environment that your apps can "land" in.Not this one. That describes Landing zone.One place for people to sign in and get access to many AWS accounts.Not this one. That describes IAM Identity Center.

Learn it: AWS Control Tower

Question 6Which term is this? "Sets up and governs a multi-account AWS environment (a landing zone) for you."

AWS Control TowerCorrect. Yes. Think of it as: A developer who builds the whole apartment complex to code, then inspects it regularly.Permission setNot this one. Permission set is: A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.Landing zoneNot this one. Landing zone is: A ready-made, well-run multi-account AWS environment that your apps can "land" in.IAM Identity CenterNot this one. IAM Identity Center is: One place for people to sign in and get access to many AWS accounts.

Learn it: AWS Control Tower

Question 7Which AWS term is described by this analogy? "A developer who builds the whole apartment complex to code, then inspects it regularly."

AWS Control TowerCorrect. Yes: Sets up and governs a multi-account AWS environment (a landing zone) for you.Permission setNot this one. Permission set is: A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to. Its analogy: A job description that comes with the right keys in every building.Landing zoneNot this one. Landing zone is: A ready-made, well-run multi-account AWS environment that your apps can "land" in. Its analogy: A finished business park, with roads, security gates, CCTV and empty units ready to rent.IAM Identity CenterNot this one. IAM Identity Center is: One place for people to sign in and get access to many AWS accounts. Its analogy: The front desk that hands you a temporary key card for whichever flat you're cleared for.

Learn it: AWS Control Tower

AWS Control Tower

Worth another look

Your weak spots

Services

Concepts