CCSP Cloud Platform and Infrastructure Security Practice Question
A cloud security architect is designing a multi-tenant SaaS platform on AWS. The platform must ensure that each tenant's data is logically isolated and that a compromised tenant cannot access another tenant's resources. The architect decides to use separate AWS accounts per tenant and wants to centralize security management. Which AWS service should be used to manage these accounts and apply security policies centrally?
⚠ Common exam trap
Candidates often confuse account access management or governance automation with the foundational service that actually groups and controls multiple accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Organizations
AWS Organizations is designed to centrally manage multiple AWS accounts, apply service control policies (SCPs) to enforce security boundaries, and simplify billing. It enables logical isolation by placing each tenant in a separate account while allowing centralized security governance. The other services provide access management, governance automation, or resource sharing but do not fulfill the core requirement of central account management and policy enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS IAM Identity Center
Why it's wrong here
AWS IAM Identity Center (successor to AWS SSO) is used for centralized access management and single sign-on to multiple accounts, but it does not provide the account grouping, policy application, and governance capabilities needed to manage security policies across accounts. It is not the primary service for multi-account security management.
- ✓
AWS Organizations
Why this is correct
AWS Organizations allows you to centrally manage multiple AWS accounts, apply service control policies (SCPs) to enforce security guardrails, and consolidate billing. It is the correct choice for centralizing security management across many accounts, enabling isolation between tenants while maintaining administrative control.
- ✗
AWS Resource Access Manager (RAM)
Why it's wrong here
AWS RAM allows sharing of resources across accounts, which could violate tenant isolation if misused. It does not provide centralized account management or security policy enforcement. It is not suitable for the stated requirement of centralizing security management across multiple accounts.
- ✗
AWS Control Tower
Why it's wrong here
AWS Control Tower automates the setup of a multi-account environment with best-practice blueprints, but it relies on AWS Organizations and does not itself manage accounts or apply security policies centrally. It is a governance service built on top of Organizations, not the core management service.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.