A healthcare holding company with 40 AWS accounts needs separate dev, test, and prod OUs, preventive guardrails on regions and encryption, and self-service account creation with approved baselines. Which organizational structure design meets these governance needs?

Control Tower on Organizations is correct because dedicated dev, test, and prod OUs provide environment isolation for 40 accounts, SCPs enforce preventive guardrails that deny unapproved regions and unencrypted resources before provisioning, and Account Factory delivers self-service account creation with approved baselines including logging, networking, and IAM roles. The centralized ticket-based design with correct OUs and SCPs fails the self-service requirement because manual cloud-team fulfillment creates bottlenecks and drifts from standardized baselines instead of empowering builders with guardrailed automation. The Control Tower design governed only by Config rules fails the preventive control requirement because Config is detective and audits after deployment, allowing noncompliant regions or unencrypted volumes to exist until remediation, whereas SCPs proactively block the API calls. The business-unit OU design with SCPs and Account Factory fails environment separation because mixing dev, test, and prod under the same OU prevents applying different preventive policies and blast-radius boundaries per lifecycle stage. Exam caveat is to distinguish preventive SCPs from detective Config rules and service-control versus identity permissions, since stems asking to prevent actions require deny-based guardrails. Practical check is to verify OU hierarchy in Organizations, inspect attached SCPs for region and encryption denies, and launch a test account via Account Factory to confirm baseline resources and guardrail enforcement.