Why the AWS Account Is Still the Strongest Boundary
Most organizational complexity questions on this exam are really asking where you draw account lines. An account carries its own service quotas, its own blast radius, its own bill and its own set of ceilings, which is more separation than any VPC or tagging scheme can give you. Once you accept that, the design work becomes deciding which workloads deserve their own account and how the shared plumbing reaches them.
Exam tip. When a question wants hard isolation between tenants, environments or regulated and unregulated data, the answer is separate accounts, not separate VPCs in one account. If an option achieves the same separation with tags or with IAM conditions alone, it is usually the distractor.
SCPs, RCPs and Permissions Boundaries: The Three Ceilings
AWS gives you several controls that look like permissions but grant nothing at all. They only take access away, and understanding which one caps which thing is the difference between an answer that works and an answer that quietly locks out your own administrators. Effective access is always the overlap of every applicable ceiling and an explicit allow somewhere in an identity or resource policy.
Exam tip. If an answer says an SCP grants a team access to something, it is wrong on principle. SCPs and boundaries only ever subtract. When access unexpectedly fails in a member account and the IAM policy looks correct, the SCP on a parent organizational unit is the first place to look.
Federated Access at Scale with IAM Identity Center
Creating IAM users in every account stops working long before you reach a hundred accounts, because credentials multiply and joiners and leavers are handled by hand. IAM Identity Center replaces that with one connection to your corporate directory and a set of reusable permission sets that provision access into as many accounts as you point them at. The exam expects you to reach for federation by default and to justify long lived credentials as an exception.
Exam tip. When a scenario mentions an existing corporate directory and dozens of accounts, the intended answer is federation with permission sets. Any option that creates IAM users per account, or copies a policy manually into each account, is there to be eliminated.
Connecting Many VPCs Without Building a Mesh
VPC peering is perfectly good for two or three networks and becomes a maintenance problem well before you reach twenty, because it is not transitive and every pair needs its own route entries. The professional level answer is usually Transit Gateway as a hub, with PrivateLink used where only one service needs to be reachable rather than a whole network. Choosing between them comes down to whether you are joining networks or publishing a service.
Exam tip. Count the relationships in the scenario. Two or three VPCs that need full network reach point to peering, a growing estate points to Transit Gateway, and a vendor or a single internal API being consumed by many accounts points to PrivateLink.
Direct Connect and VPN: Choosing and Combining Them
Site to Site VPN and Direct Connect solve the same problem with completely different trade offs. VPN is available today over the internet you already pay for, while Direct Connect is a private circuit that takes weeks to provision and then delivers far more predictable latency and throughput. Serious designs frequently use both, with the VPN standing by as the backup path for the circuit.
Exam tip. Watch for the word immediately. If a scenario needs hybrid connectivity now, the answer is a VPN, possibly as an interim step while a circuit is ordered. If it stresses predictable latency or sustained large transfers, the answer is Direct Connect with a VPN backup.
Name Resolution Across Accounts and Data Centres
Hybrid designs fail on DNS more often than on routing, because packets can flow perfectly while names resolve to the wrong place or to nothing at all. Route 53 Resolver endpoints are the piece that joins the two worlds, and the direction of each endpoint is named from the point of view of the VPC. Getting this right early saves you from debugging it during a cutover window.
Exam tip. Remember the direction from the VPC outward: inbound endpoints let on premises ask AWS, outbound endpoints let AWS ask on premises. Scenarios where on premises servers cannot resolve an AWS private zone are asking for an inbound endpoint.
Logging and Security Tooling Across an Organization
Once you have more than a handful of accounts, security evidence has to be collected somewhere the workload teams cannot reach or edit. The standard pattern is an organization trail writing into a dedicated log archive account, with the security services enabled organization wide and delegated to a security account rather than run from the management account. What you are being tested on is whether the evidence survives a compromise of the account that produced it.
Exam tip. If a question asks how to guarantee audit logs cannot be tampered with, look for the combination of a separate account, a bucket policy without delete permission, and object level retention. Encryption alone does not stop deletion, and it is a common distractor.
Cost Visibility and Chargeback Across Many Accounts
In a large organization the finance question is rarely how much did we spend, it is who spent it and can they see that themselves. Consolidated billing pools discounts and simplifies payment, but attribution depends entirely on account structure, activated cost allocation tags and cost categories that mirror how the business is actually organised. Discount sharing across the organization is the part people forget until an unexpected bill arrives.
Exam tip. If a scenario asks for chargeback by team when workloads share accounts, the answer combines activated cost allocation tags with cost categories. If it asks for guaranteed separation of spend, the answer is a separate account per team, since that needs no tagging discipline at all.
Landing Zones, Account Vending and Standard Guardrails
A landing zone is the pre built environment new accounts are born into: the organizational unit structure, the logging, the identity integration and the controls, all applied before anybody deploys anything. Control Tower is the managed way to get one, and Organizations plus StackSets is the do it yourself way. The exam cares that new accounts inherit standards automatically rather than by somebody remembering a checklist.
Exam tip. When a scenario complains that every new account is configured slightly differently, the answer is an automated landing zone with an account factory, not tighter review of manual work. Look for options that apply the baseline at account creation.