SAA-C03 Design Secure Architectures Practice Question
An organization is using AWS Control Tower to manage multiple AWS accounts. They need to implement a set of guardrails to ensure that all accounts remain compliant with security best practices. Which THREE components or features are part of a standard AWS Control Tower landing zone implementation?
⚠ Common exam trap
SAA-C03 often tests which services are mandatory landing zone components vs optional add-ons, baiting candidates who assume popular services like GuardDuty or Macie are enabled by default.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Preventive guardrails implemented using Service Control Policies (SCPs).
Option A is correct because AWS Control Tower preventive guardrails are enforced through Service Control Policies (SCPs) attached to OUs, which restrict what actions member accounts can perform. Option B is correct because detective guardrails in Control Tower are implemented as AWS Config rules (often deployed via conformance packs) that detect and flag noncompliant resources. Option C is correct because a standard Control Tower landing zone provisions a dedicated log archive account for centralized logging and an audit (security tooling) account for security and compliance tooling. Option D is incorrect because Amazon Macie is not enabled by default on all S3 buckets as part of the landing zone; it is an optional data-security service. Option E is incorrect because GuardDuty is not automatically enabled across all accounts by Control Tower itself; it can be integrated via services like AWS Security Hub or delegated administration, but it is not a built-in landing zone component.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Preventive guardrails implemented using Service Control Policies (SCPs).
Why this is correct
Control Tower uses preventive guardrails to stop actions that would lead to non-compliance. These are implemented as SCPs that are applied to Organizational Units (OUs). For example, a preventive guardrail might block the ability to disable CloudTrail or change critical security settings across all member accounts.
- ✓
Detective guardrails implemented using AWS Config rules.
Why this is correct
Detective guardrails monitor the configuration of resources and alert administrators when a resource becomes non-compliant. Control Tower uses AWS Config rules to perform these checks continuously, allowing the security team to identify and remediate issues such as unencrypted S3 buckets or open security groups in real-time.
- ✓
A centralized logging account and a security tooling account.
Why this is correct
As part of the landing zone setup, Control Tower creates a set of core accounts, including a Log Archive account for centralized CloudTrail and Config logs, and an Audit account for security and compliance teams. This centralized structure ensures that logs are tamper-proof and accessible for organization-wide auditing.
- ✗
Amazon Macie enabled by default on all S3 buckets in member accounts.
Why it's wrong here
While Amazon Macie is a valuable security service, it is not a standard component automatically enabled or managed by AWS Control Tower's core landing zone setup. Macie must be configured separately, although it can be integrated into a broader security strategy for a multi-account environment.
- ✗
Amazon GuardDuty for automated threat detection across all accounts.
Why it's wrong here
Amazon GuardDuty provides critical threat detection, but it is not one of the primary mechanisms used by Control Tower to enforce guardrails. GuardDuty is often managed at the AWS Organizations level, but it is considered a separate service from the core landing zone and guardrail features of Control Tower.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
This SAA-C03 question is part of Courseiva's 149-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.