A fintech startup has 12 AWS accounts created manually with separate bills and no consistent guardrails. Leadership requires centralized billing, grouped workloads by environment, and preventive controls that block disallowed Regions. Which Organizations configuration should the architect implement to centralize account deployment with preventive guardrails?

Enabling all features in AWS Organizations provides consolidated billing plus full management capabilities including organizational units and policy management, and structuring accounts into OUs by environment or workload allows SCPs to centrally enforce preventive guardrails such as denying disallowed Regions or services, which directly satisfies billing centralization, grouping, and prevention requirements. Using consolidated billing only provides payment aggregation without OUs or SCP enforcement, so it misses preventive controls and structured deployment. Consolidating into a single shared account with separate VPCs weakens blast-radius isolation and account-level governance and cannot apply SCPs, failing scalability and guardrail needs. Using IAM Identity Center with permission boundaries in one account improves authentication and delegation but does not provide organization-wide deployment or preventive SCP guardrails across multiple accounts. For the exam remember that all features is required for SCPs versus consolidated billing only, and in practice verify the management account stays clean and test SCP effects in a sandbox OU first.