SAA-C03 Q32 · Multi-Account

Question

A company wants to isolate its workloads by creating an AWS account for each workload. The company needs a solution that centrally manages networking components for the workloads. The solution also must create accounts with automatic security controls (guardrails). Which solution will meet these requirements with the LEAST operational overhead?

Accepted Answer

**Answer A satisfies every requirement with minimal operational overhead:**

1. **'Create accounts with automatic security controls (guardrails)'** → **AWS Control Tower** is purpose-built for this. It deploys a landing zone with pre-configured guardrails (preventive via SCPs and detective via AWS Config rules) automatically applied to every enrolled account. AWS Organizations alone does NOT provide automatic guardrails — you'd have to manually create and attach SCPs.

2. **'Centrally manages networking components'** → A dedicated **networking account** with a shared VPC is the simplest centralized networking model. The networking team manages one VPC in one account.

3. **'Isolate workloads by creating an account per workload'** → Control Tower's Account Factory automates account provisio

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips