A company needs a governed multi-account environment — account vending with guardrails, centralized logging, and a dashboard — provisioned quickly rather than hand-built. Which service delivers the managed landing zone?
A.AWS Organizations alone
Organizations is the foundation — Control Tower builds the governed layer on it.
B.AWS Control Tower
Correct. The managed multi-account landing zone.
C.AWS Config alone
Config powers detective guardrails — one ingredient, not the solution.
D.IAM Identity Center alone
Identity Center handles workforce SSO — one ingredient.
Why this answer
Control Tower automates a landing zone: account factory (vending), guardrails (preventive/detective/proactive), centralized logging/audit accounts, and a dashboard — built ON TOP of Organizations, Config, and Identity Center, which are its components rather than alternatives.
Correct answer: B · Last reviewed 2026-10-28
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Multi-Account Architecture practice session.
Practice Multi-Account Architecture