SCS-C02 Management and Security Governance Practice Question

Which TWO are valid methods to centrally manage multiple AWS accounts? (Choose two.)

⚠ Common exam trap

SCS-C02 often tests the confusion between IAM (single-account identity) and Organizations/Control Tower (multi-account governance), tempting candidates to pick IAM for central management.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS Control Tower

AWS Control Tower (D) is correct because it provides a centralized landing zone that automates the setup of a multi-account AWS environment using AWS Organizations, IAM Identity Center, and guardrails (preventive and detective controls) to govern accounts at scale. AWS Organizations (E) is correct because it is the foundational service for centrally managing multiple AWS accounts, allowing consolidated billing, organizational units (OUs), service control policies (SCPs), and centralized policy-based governance across accounts. AWS IAM (A) is not correct because it manages users, groups, roles, and permissions within a single AWS account (or via roles across accounts), not centralized multi-account governance. AWS Service Catalog (B) is not correct because it lets administrators create and manage approved IT service portfolios for end users, but it does not itself centrally manage multiple AWS accounts. Amazon Cognito (C) is not correct because it provides identity, authentication, and authorization for web and mobile applications, not multi-account AWS management.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
AWS IAM
Why it's wrong here
AWS IAM is per-account: it manages users, groups, roles, and policies only within a single AWS account. There is no native IAM construct that spans accounts, so you would need to replicate IAM configurations or set up cross-account roles in each account individually. Centralizing multiple accounts requires AWS Organizations or Control Tower, not IAM itself.
✗
AWS Service Catalog
Why it's wrong here
AWS Service Catalog is designed to create and govern approved IT service products, such as pre-configured EC2 instances or RDS databases, that end users can launch. It does not manage the AWS accounts themselves; rather, it operates inside an account to provision resources. Therefore, it is not a mechanism for centrally managing a multi-account environment.
✗
Amazon Cognito
Why it's wrong here
Amazon Cognito is a customer identity and access management service for authenticating application users through user pools and identity pools. It is unrelated to the governance or structure of AWS accounts, which is an administrative control-plane concern. Cognito would not help you manage multiple AWS accounts centrally.
✓
AWS Control Tower
Why this is correct
AWS Control Tower is the correct answer because it provides a centralized governance solution specifically for multi-account environments. It automatically sets up a landing zone, provisions accounts through an account factory, and applies preventive and detective guardrails using AWS Organizations and IAM under the hood. Control Tower gives you a single pane of glass for managing account structure and compliance.
✓
AWS Organizations
Why this is correct
AWS Organizations is correct because it is the foundational service for centrally managing multiple AWS accounts. It allows you to consolidate accounts into organizational units (OUs), apply service control policies (SCPs) to restrict account-level actions, and enable centralized billing. Control Tower builds on Organizations to add additional governance, but Organizations itself is the core multi-account management service.

Go deeper

SCS-C02 Management and Security Governance Practice Question

Why each option matters

Option-by-option breakdown

Related to this question