CLF-C02 Cloud Technology and Services Practice Question
Which AWS service provides a landing zone and automated multi-account setup with pre-configured security baselines and guardrails for AWS Organizations?
⚠ Common exam trap
It's easy for candidates to confuse AWS Organizations (the underlying service) with AWS Control Tower (the managed orchestration service), thinking Organizations alone provides the landing zone and guardrails, when in fact it only provides the multi-account structure and policy framework without the automated setup and pre-configured baselines.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Control Tower
AWS Control Tower is the correct service because it provides a pre-configured landing zone and automates the setup of a multi-account environment based on AWS Organizations. It enforces security baselines and guardrails (preventive and detective controls) using AWS Service Catalog and AWS Config rules, ensuring compliance from the start.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Organizations
Why it's wrong here
AWS Organizations is the native multi-account management service that provides consolidated billing, centralized policy management via service control policies (SCPs), and logical account groupings. However, Organizations alone does not automate the creation of a landing zone with pre-configured guardrails, centralized logging, or AWS IAM Identity Center (SSO) integration; it is an underlying building block that AWS Control Tower configures and orchestrates. Without Control Tower, you would have to manually design the governance framework and implement all supporting services yourself, so Organizations is necessary but not sufficient for the complete solution described in the question.
- ✓
AWS Control Tower
Why this is correct
AWS Control Tower is the correct answer because it is a fully managed orchestration service that automatically provisions a secure, well-governed multi-account environment called a landing zone. During setup, it creates the AWS Organizations structure, configures AWS IAM Identity Center for SSO, enables centralized CloudTrail and CloudWatch Logs, and deploys both preventive guardrails (SCPs) and detective guardrails (AWS Config rules) across enrolled accounts. Control Tower also offers Account Factory for account provisioning and continuous governance monitoring, making it the complete landing zone solution.
- ✗
AWS CloudFormation StackSets
Why it's wrong here
AWS CloudFormation StackSets extends CloudFormation to deploy the same template to multiple accounts and Regions in a single operation, which simplifies resource rollout. While Control Tower may use infrastructure-as-code and stack-based deployments internally, StackSets are only a mechanism for repeating template deployments; they do not create the Organizations hierarchy, configure SSO, set up centralized logging, or manage ongoing guardrails. Treating StackSets as the answer would confuse a deployment tool with the orchestrated governance framework that Control Tower provides.
- ✗
AWS Service Catalog
Why it's wrong here
AWS Service Catalog enables organizations to publish a catalog of approved products (CloudFormation templates) that users can provision through a controlled, self-service portal with pre-defined launch constraints. It controls which products and versions can be launched and who can access them, but it assumes the underlying accounts, networking, and security baselines already exist. Service Catalog does not establish the multi-account governance foundation, so it is not the service that builds a landing zone; it complements Control Tower rather than replacing it.
Go deeper
Related to this question
About these practice questions
One of 993 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.