Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 137 discussion

Use a group email address for the management account's root user https://docs.aws.amazon.com/organizations/latest/userguide/orgs_best-practices_mgmt-acct.html#best-practices_mgmt-acct_email-address

Option B ensures that all future notifications are not missed by configuring the AWS account root user email addresses as distribution lists that are monitored by a few administrators. By setting up alternate contacts in the AWS Organizations console or programmatically, the notifications can be sent to the appropriate administrators responsible for monitoring and responding to alerts. This solution allows for centralized management of notifications and ensures they are limited to account administrators. A. Floods all users with notifications, lacks granularity. C. Manual forwarding introduces delays, centralizes responsibility. D. No flexibility for specific account administrators, limits customization.

//docs.aws.amazon.com/organizations/latest/userguide/orgs_best-practices_mgmt-acct.html#best-practices_mgmt-acct_email-address

Ans B - as opposed to option D, because the organisation account structure implies there is more than one root account: "The root email recipient missed a notification that was sent to the root user email address of one account."

"Use a group email address for root user credentials: Use an email address that is managed by your business and forwards received messages directly to a group of users. If AWS must contact the owner of the account, this approach reduces the risk of delays in responding, even if individuals are on vacation, out sick, or have left the business. The email address used for the root user should not be used for other purposes." https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-best-practices.html#ru-bp-group

Lol.. How is this AWS related question. Isnt it general knowledge.

No idea why "D" would be correct answer unless there is some missing context in the question or the answer. "B" is best practice as pointed out in other links.

the only answer with sense is "B", because "A" is not exclusive, "C" is exactly the case the want to avoid, and "D" just don't make sense

distribution list is the way to go

The reasons are: Alternate contacts allow defining other users to receive root emails. Distribution lists ensure multiple admins get notified. Limits notifications to account admins rather than all users. Using the same root email address for all accounts (Option D) is not recommended. Relying on one admin or external forwarding (Options A, C) introduces delays or single points of failure.

all admins need access or else some wont get the right mails and cant do their job, sending it only to a few would disrupt the workflowso it is D

From the links provided below there are no mention of having a distribution list capability within AWS: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_best-practices_mgmt-acct.html#best-practices_mgmt-acct_email-address As per link for best practices: Use a group email address for the management account's root user!

The clue is in the pudding!! Question: account "administrators" Answer: Configure all AWS account root user email addresses as distribution lists that go to a few "administrators"

Option A: wrong - sends email to everybody Option B: correct (but sub-optimal because distribution lists aren't all that secure) Option C: wrong - single point of failure on the new administrator Option D: wrong - each root email address must be unique, you can't change them all to the same one

The more aligned answer to this article: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_best-practices_mgmt-acct.html#best-practices_mgmt-acct_email-address is B. D would be best if it'd said that the email you configure as "root user email address" will be a distribution list. The phrase "all future notifications are not missed" points to D, cos' it said: ".. and all newly created accounts to use the same root user email address" so the future account that will be created will be covered with the business policy. It's not 100% clear, but I'll choose B.

Una pregunta si la gente va votando las preguntas por que los administradores no cambian la respuesta correcta. Es a interpretación y ya?

Using the method of crossing out the option that does not fit.... Option A: address to all users of organization (wrong) Option B: go to a few administration who can respond to alerts (question says to send notification to administrators not a selected few ) Option C: send to one administrator and giving him responsibility (wrong) Option D: correct (as this is the one option left after checking all others).