AWS Multi-Account Architecture Quiz

1. In a multi-account setup, what should the security account be responsible for?

Running all production workloads

Centralized security monitoring and compliance

Hosting the main application servers

Managing all customer-facing APIs

2. What is a key consideration when designing cross-account IAM roles for least privilege?

Grant only necessary permissions and use specific resource ARNs

Grant full administrative access for simplicity

Allow all actions on wildcard resources

Use only temporary credentials without restrictions

3. How does AWS SSO (Single Sign-On) enhance multi-account user management?

Enables centralized user authentication across multiple accounts

Increases EC2 instance security

Improves database query performance

Reduces S3 storage costs

4. What is the primary purpose of AWS Config in a multi-account strategy?

Track resource compliance and configuration changes across accounts

Manage user access permissions

Route traffic between regions

Encrypt data at rest

5. In a multi-account environment, how should you structure AWS accounts for cost allocation?

One account per department or cost center

Combine all workloads in a single account

Create accounts randomly

Use only temporary accounts

6. Which AWS service provides SCPs (Service Control Policies) for enforcing account restrictions?

AWS Organizations

AWS IAM

AWS Lambda

AWS Config

7. What is the benefit of using a dedicated network/transit account in multi-account architecture?

Centralized routing and network connectivity management

Faster EC2 instance boot times

Reduced RDS database latency

Lower data transfer costs

8. How should you handle secrets and credentials across multiple AWS accounts?

Store in AWS Secrets Manager with cross-account access via resource policies

Hard-code them in application source code

Store in a shared S3 bucket accessible to all accounts

Use the same credentials across all accounts

9. What is a landing zone in AWS Control Tower?

A preconfigured multi-account environment with best practices

A region where data must be stored

A VPC subnet for incoming traffic

A backup recovery location

10. Which IAM policy condition is essential for enforcing multi-account access restrictions?

Aws:PrincipalOrgID

Aws:SourceIp

Aws:RequestedRegion

Aws:CurrentTime

11. What is the primary benefit of using AWS Organizations for managing multiple accounts?

Centralized billing and policy enforcement across accounts

Automatic failover between accounts

Simplified EC2 instance scaling

Enhanced database replication

12. How does AWS Resource Access Manager (RAM) facilitate multi-account architecture?

Shares specified AWS resources across accounts without copying

Replicates entire account configurations

Manages EC2 instance licenses

Consolidates all billing into one account

13. What is the recommended approach for managing shared resources like VPCs across multiple accounts?

Create separate VPCs per account with cross-account VPC peering

Share a single VPC across all accounts

Use only public subnets for simplicity

Avoid networking between accounts entirely

14. Which AWS service helps enforce security policies across multiple accounts?

AWS Security Hub

AWS AppSync

AWS Amplify

AWS DataSync

15. In a multi-account strategy, what is the purpose of a centralized logging account?

To aggregate CloudTrail and VPC Flow Logs from all accounts

To host all production databases

To manage DNS records across accounts

To serve as the primary compute hub

16. How does AWS Consolidated Billing simplify cost management in multi-account setups?

Combines usage across accounts for volume discounts

Eliminates the need for CloudTrail logging

Automatically terminates underutilized resources

Prevents data transfer between accounts

17. Which organizational unit (OU) structure best isolates production from non-production workloads?

Single OU containing all accounts

Separate OUs by environment (prod, dev, test)

OUs based only on geographic location

Random OU assignment for accounts

18. What does AWS Control Tower provide for multi-account governance?

Automated account provisioning and guardrails

Real-time network packet inspection

Database query optimization

EC2 instance performance monitoring

19. In a multi-account architecture, what is the recommended approach for cross-account access?

Share root account credentials between accounts

Use IAM roles with cross-account trust relationships

Enable public access to all resources

Use the same IAM user across all accounts

20. Which service allows you to delegate AWS account management tasks to member accounts within an organization?