AWS Organizations quiz · Level 0

Question 1Why does Todo.io keep its apps out of the management account of its organization?

SCPs never apply to the management account, so the organization's guardrails can't protect anything running there.Correct. The management account sits above every SCP. Keeping it empty, apart from billing and account management, means nothing important runs without guardrails.The management account can't create VPCs or databases.Not this one. It can create anything any account can. The problem is that nothing restricts it.Resources in the management account are billed twice.Not this one. Billing is consolidated once, at the organization level. Where a resource runs makes no difference to its price.The management account has no CloudTrail.Not this one. It has CloudTrail like every account. That isn't why it's kept empty.

Learn it: AWS Organizations · SCP (service control policy) · Set up AWS: Day 0

Question 2Todo.io runs six AWS accounts and wants a single bill, with usage across all six counted together for volume pricing. What gives them that?

AWS Organizations, with every account in one organization (consolidated billing).Correct. The management account pays for every member account on one bill, and usage is combined across them.Tagging every resource in every account with "todo-io".Not this one. Tags help you split and analyse costs. They don't merge six bills into one.Moving everything into one account.Not this one. That gives one bill, but throws away the isolation that separate accounts give you.Signing in to all six accounts through IAM Identity Center.Not this one. Identity Center handles sign-in. It has nothing to do with billing.

Learn it: AWS Organizations

Question 3Todo.io attaches an SCP to its Workloads OU. The Prod and Dev accounts sit in that OU, and a Sandbox OU sits inside it. Which accounts does the SCP apply to?

Every account in the Workloads OU, including accounts in the Sandbox OU inside it.Correct. A policy on an OU is inherited by every account below it, however deep.Only accounts created after the SCP was attached.Not this one. Existing accounts are covered the moment the SCP is attached.Prod and Dev, but not the accounts in the Sandbox OU.Not this one. Nested OUs inherit their parent's policies.Only the IAM users in those accounts, not the roles.Not this one. SCPs apply to every user and role in a member account, root included.

Learn it: AWS Organizations · SCP

Question 4Todo.io creates a new member account from its management account with AWS Organizations. Nobody knows a password for the new account. How does an administrator get in the first time?

From the management account, assume the OrganizationAccountAccessRole that Organizations created in the new account.Correct. Organizations creates that role in every account it creates, and trusts the management account to assume it. Borrowing a role means no new passwords or keys.Sign in to the new account as root with the management account's password.Not this one. Each account has its own root user and email address. The management account's password doesn't open it.Use the IAM user that Organizations creates for the administrator.Not this one. Organizations creates a role, not an IAM user.Wait for the new account to accept an invitation.Not this one. Invitations are for existing accounts that join. A new account created by the organization is a member at once.

Learn it: AWS Organizations · Set up AWS: Day 0 · IAM role

Question 5Todo.io wants every production account, including ones it adds next year, to get the same guardrails automatically. What should it do?

Group the production accounts in a Prod OU and attach the guardrails (SCPs) to the OU.Correct. An OU is a folder of accounts. Move a new account into it and it inherits everything attached there.Attach the SCPs to each production account one by one.Not this one. It works today, but next year's accounts are only protected if someone remembers.Put the production accounts in an IAM group.Not this one. IAM groups hold IAM users, not accounts.Tag each production account "prod".Not this one. Tags don't attach policies by themselves.

Learn it: AWS Organizations · SCP

Question 6What does "AWS Organizations" mean?

Groups many AWS accounts under one management account, with one bill and shared guardrails.Correct. Think of it as: The building management company that owns every flat.A second proof of identity, like a code from an app or a security key, on top of a password.Not this one. That describes MFA (multi-factor authentication).An organization-wide guardrail that sets the most any identity in an account may do.Not this one. That describes SCP (service control policy).The identity you sign in as with the account's email address. It can do almost anything; only an SCP can limit it.Not this one. That describes Root user.

Learn it: AWS Organizations

Question 7Which term is this? "Groups many AWS accounts under one management account, with one bill and shared guardrails."

AWS OrganizationsCorrect. Yes. Think of it as: The building management company that owns every flat.MFA (multi-factor authentication)Not this one. MFA (multi-factor authentication) is: A second proof of identity, like a code from an app or a security key, on top of a password.SCP (service control policy)Not this one. SCP (service control policy) is: An organization-wide guardrail that sets the most any identity in an account may do.Root userNot this one. Root user is: The identity you sign in as with the account's email address. It can do almost anything; only an SCP can limit it.

Learn it: AWS Organizations

Question 8Which AWS term is described by this analogy? "The building management company that owns every flat."

AWS OrganizationsCorrect. Yes: Groups many AWS accounts under one management account, with one bill and shared guardrails.MFA (multi-factor authentication)Not this one. MFA (multi-factor authentication) is: A second proof of identity, like a code from an app or a security key, on top of a password. Its analogy: A PIN on top of the key card.SCP (service control policy)Not this one. SCP (service control policy) is: An organization-wide guardrail that sets the most any identity in an account may do. Its analogy: The building's rules. Your lease can't give you permission to break them.Root userNot this one. Root user is: The identity you sign in as with the account's email address. It can do almost anything; only an SCP can limit it. Its analogy: The master key to the whole building.

Learn it: AWS Organizations

AWS Organizations

Worth another look

Your weak spots

Services

Concepts