Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
AWS Certified Solutions Architect - Professional · AWS
Select 3 answers.
This question asks for 3 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
A makes sense because AWS Control Tower with Organizations sets up a governed multi-account structure and lets you manage accounts like dev, staging, prod, and shared networking. C is needed for private connectivity. Transit Gateway + route tables gives you control over which accounts can talk to each other (e.g., dev ↔ staging only, while prod and shared network can talk to all). D is for centralized access. IAM Identity Center (SSO) allows MFA, group-based role assignments, and access control across all accounts. B, E, and F don’t fit: B/E mention CloudTrail and Security Hub but those don’t enforce MFA. F mixes IAM users with Cognito, which is for app auth — not ideal for managing access across AWS accounts.
A. Deploy a landing zone environment by using AWS Control Tower. Enroll accounts and invite existing accounts into the resulting organization in AWS Organizations. C. Create transit gateways and transit gateway VPC attachments in each account. Configure appropriate route tables. D. Set up and enable AWS IAM Identity Center (AWS Single Sign-On). Create appropriate permission sets with required MFA for existing accounts.
A, C and D are right answers. Option C is though not clear. Transit gateway needs to be created in shared network account and tgw vpc attachment in all accounts. But option C says "create tgw and tgw vpc attachment in all accounts", which is a bit confusing