A biotech company has 12 standalone AWS accounts running lab workloads that must stay in place. It plans 30 new project accounts over the next year that need standardized baselines. Security requires centralized governance, an elective detective control for exposed snapshots, and a custom control blocking non-approved Regions. Which Control Tower enrollment and control strategy meets all account and governance requirements?

Enrolling the 12 existing lab accounts into Control Tower OUs brings them under centralized lifecycle and policy governance without requiring migration. Account Factory provides standardized, repeatable provisioning and baselines for the 30 new project accounts. The elective detective snapshot control must be opted into to monitor exposed snapshots, while Customizations for Control Tower (CfCT) supplies the custom logic to block non-approved Regions. Using mandatory controls plus a CfCT Region restriction fails because mandatory controls are always on and do not replace the required elective detective snapshot control. Using elective snapshot detection with a preventive Region guardrail fails because a standard preventive control enforces AWS-defined policies, not the required custom Region rule. Managing existing lab accounts only through Organizations fails because accounts not enrolled in Control Tower OUs miss Control Tower’s centralized lifecycle management, updates, and consistent control inheritance. The exam caveat is to distinguish account enrollment and provisioning from elective and custom controls; a centralized Organizations policy is not automatically equivalent to Control Tower enrollment. As a practical check, verify that all existing accounts are enrolled in the intended OUs and confirm that both the elective snapshot control and the CfCT custom Region control are enabled and passing before scaling account creation.