CLF-C02 Security and Compliance Practice Question
A company wants to set up a new multi-account AWS environment with pre-configured security guardrails, a logging account, an audit account, and a predefined structure for creating new accounts — all based on AWS best practices — with minimal manual configuration. Which AWS service provides this automated account setup?
⚠ Common exam trap
Many candidates confuse AWS Organizations (which provides the raw capability to manage multiple accounts) with AWS Control Tower (which automates the entire setup with best-practice guardrails and account factory), leading them to pick Organizations as the 'automated' solution when it actually requires significant manual configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Control Tower
AWS Control Tower is the correct answer because it provides a fully automated, best-practices-based setup for a multi-account AWS environment, including pre-configured security guardrails (using Service Control Policies), a logging account, an audit account, and a predefined account structure via Account Factory. This eliminates the need for manual configuration of these foundational components.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudFormation StackSets
Why it's wrong here
AWS CloudFormation StackSets can deploy the same CloudFormation template across multiple accounts and Regions, but using it for a landing zone means you must manually design, write, and maintain every template for account creation, logging bucket policies, audit IAM roles, and all guardrail rules. This approach is time-consuming, error-prone, and fails to provide the continuous governance and automated drift remediation that AWS Control Tower offers. StackSets is a generic deployment mechanism, whereas Control Tower is a purpose-built landing-zone service that creates and manages the accounts, logging, audit, and guardrails for you.
- ✗
AWS Organizations
Why it's wrong here
AWS Organizations is the foundational service that provides the hierarchical multi-account structure and enables service control policies (SCPs), but it does not automatically create the dedicated log archive and audit accounts, configure centralized CloudTrail and CloudWatch logging, or deploy detective AWS Config rules. While Organizations is a necessary building block for governance, it lacks the orchestration and lifecycle management needed to assemble a complete, well-architected landing zone; AWS Control Tower builds on and automates Organizations along with other services to deliver that full setup.
- ✓
AWS Control Tower
Why this is correct
Control Tower automates the entire landing zone setup: creates the management account structure, configures a log archive account, sets up an audit account, and applies mandatory guardrails (preventive SCPs and detective Config rules) following AWS best practices.
- ✗
AWS Security Hub
Why it's wrong here
AWS Security Hub is a security posture management service that aggregates and centralizes findings from services like GuardDuty, Inspector, and Config across accounts and Regions, displaying them in a single dashboard and consolidating them to a designated admin account. It does not provision any of the underlying multi-account infrastructure: it cannot create accounts, define an organizational hierarchy, configure CloudTrail logs, or apply service control policies. Security Hub is meant to operate on top of an already-built multi-account environment, so while it complements a landing zone, it cannot create one.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.