AWS Certified Solutions Architect – Professional (SAP-C02) — Question 115

A company wants to migrate to AWS. The company wants to use a multi-account structure with centrally managed access to all accounts and applications. The company also wants to keep the traffic on a private network. Multi-factor authentication (MFA) is required at login, and specific roles are assigned to user groups.

The company must create separate accounts for development. staging, production, and shared network. The production account and the shared network account must have connectivity to all accounts. The development account and the staging account must have access only to each other.

Which combination of steps should a solutions architect take 10 meet these requirements? (Choose three.)

Answer options

• A. Deploy a landing zone environment by using AWS Control Tower. Enroll accounts and invite existing accounts into the resulting organization in AWS Organizations.
• B. Enable AWS Security Hub in all accounts to manage cross-account access. Collect findings through AWS CloudTrail to force MFA login.
• C. Create transit gateways and transit gateway VPC attachments in each account. Configure appropriate route tables.
• D. Set up and enable AWS IAM Identity Center (AWS Single Sign-On). Create appropriate permission sets with required MFA for existing accounts.
• E. Enable AWS Control Tower in all accounts to manage routing between accounts. Collect findings through AWS CloudTrail to force MFA login.
• F. Create IAM users and groups. Configure MFA for all users. Set up Amazon Cognoto user pools and Identity pools to manage access to accounts and between accounts.

Correct answer: A, C, D

Explanation

The correct steps include deploying a landing zone with AWS Control Tower to manage account structure, creating transit gateways for connectivity, and setting up AWS IAM Identity Center for centralized access management with MFA. Options B, E, and F do not adequately address the requirement for a multi-account structure with proper connectivity and centralized access management.