Landing zone design: which statement correctly maps Control Tower guardrail types?
A.Preventive = SCPs blocking actions; Detective = Config rules detecting drift; Proactive = CloudFormation hooks checking resources before deploy
Correct — the three guardrail mechanisms in order.
B.Preventive = Config rules; Detective = SCPs; Proactive = GuardDuty
Swaps preventive and detective; GuardDuty is a threat-detection service, not a guardrail type.
C.All guardrails are implemented as SCPs
Only preventive guardrails use SCPs.
D.Preventive = IAM policies; Detective = CloudTrail; Proactive = Macie
Wrong services entirely — none of these define guardrail categories.
Why this answer
Control Tower guardrails: preventive (SCPs — disallow actions outright), detective (Config rules — flag noncompliance), proactive (CloudFormation hooks — block noncompliant deploys before creation).
Correct answer: A · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Security Governance practice session.
Practice Security Governance