Landing zone quiz · Level 0 · Todo.io Learns AWS

Question 1Todo.io wants a multi-account setup with central logging, single sign-on and guardrails, built the AWS-recommended way, with the least work. What should it use?

AWS Control Tower, which builds and governs a landing zone.Correct. Control Tower wires up Organizations, Identity Center, CloudTrail and Config for you, and keeps them from drifting.Create each account by hand and copy the settings across.Not this one. It can be done, but it is slow, easy to get wrong and drifts over time.Turn on AWS Config in the management account.Not this one. Config records and checks settings. It doesn't build accounts, sign-in or logging.Create IAM users for everyone in the management account.Not this one. That puts people and workloads in the one account SCPs can't protect.

Learn it: AWS Control Tower · Set up AWS: Day 0 with Control Tower · Landing zone

Question 2Why does a Control Tower landing zone keep every account's logs in a separate Log Archive account?

Someone who breaks into a workload account can't erase the evidence of what they did.Correct. Nobody runs apps in the Log Archive account, and workload accounts can't delete what is stored there.Storage is cheaper in a separate account.Not this one. The price of storage doesn't depend on which account holds it.CloudTrail can only write to another account.Not this one. CloudTrail can write to a bucket in the same account. Separating them is a security choice.Logs in workload accounts are deleted after 90 days.Not this one. Logs in S3 are kept as long as you choose, in any account.

Learn it: Landing zone · Set up AWS: Day 0 with Control Tower

Question 3What does "Landing zone" mean?

A ready-made, well-run multi-account AWS environment that your apps can "land" in.Correct. Think of it as: A finished business park, with roads, security gates, CCTV and empty units ready to rent.Sets up and governs a multi-account AWS environment (a landing zone) for you.Not this one. That describes AWS Control Tower.Control Tower's way to create new AWS accounts from a standard template.Not this one. That describes Account Factory.A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.Not this one. That describes Permission set.

Learn it: Landing zone

Question 4Which term is this? "A ready-made, well-run multi-account AWS environment for your workloads, set up for you by Control Tower."

Landing zoneCorrect. Yes. Think of it as: A finished business park, with roads, security gates, CCTV and empty units ready to rent.AWS Control TowerNot this one. AWS Control Tower is: Sets up and governs a multi-account AWS environment (a landing zone) for you.Account FactoryNot this one. Account Factory is: Control Tower's way to create new AWS accounts from a standard template.Permission setNot this one. Permission set is: A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.

Learn it: Landing zone

Question 5Which AWS term is described by this analogy? "A finished business park, with roads, security gates, CCTV and empty units ready to rent."

Landing zoneCorrect. Yes: A ready-made, well-run multi-account AWS environment that your apps can "land" in.AWS Control TowerNot this one. AWS Control Tower is: Sets up and governs a multi-account AWS environment (a landing zone) for you. Its analogy: A developer who builds the whole apartment complex to code, then inspects it regularly.Account FactoryNot this one. Account Factory is: Control Tower's way to create new AWS accounts from a standard template. Its analogy: A vending machine for pre-furnished flats.Permission setNot this one. Permission set is: A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to. Its analogy: A job description that comes with the right keys in every building.

Learn it: Landing zone

Landing zone

Worth another look

Your weak spots

Services

Concepts