A regulated bank manages 80 AWS accounts under AWS Organizations and must deploy baseline VPCs, logging roles, and guardrails to all accounts in three Regions. Updates must roll out centrally with automatic deployment to new accounts and rollback on failure. Which multi-account multi-Region deployment design enforces consistent infrastructure as code?

The service-managed design is correct because Organizations integration from the management account allows targeting OUs with automatic deployment, so new accounts receive baselines immediately, central template updates propagate across 80 accounts and three Regions in one operation, and StackSets provides ordered rollout with failure tolerance and rollback for consistent infrastructure as code. The self-managed design with explicit account lists fails on lifecycle automation because without OU attachment and automatic deployment, administrators must manually maintain targets for every new account, breaking centralized scale. The single-Region service-managed design fails on scope because VPCs, logging roles, and guardrails are required in all three Regions, so correct automation in only one Region leaves compliance gaps. The SCP and Config conformance pack design fails on provisioning because preventive and detective controls cannot create networks and roles and lack create-update-rollback semantics for baseline resources. For the exam, remember service-managed means OU targeting plus automatic deployment to new accounts, while self-managed means an administrator account with manually maintained account lists, and do not confuse deployment with policy enforcement. As a practical check, verify trusted access is enabled, automatic deployment is on for the OU, all three Regions are selected, and first update a test OU while confirming rollback and drift in CloudTrail and StackSets status.