Design an enterprise cloud landing zone
cloud foundation and governance design.
multi-account or subscription structure, centralized identity and SSO, network topology like hub-and-spoke, guardrails via policy and SCPs, and centralized logging.
WHAT THIS TESTS This checks whether you can build a secure, governed foundation that scales to many teams while preventing them from making unsafe choices, the core idea of a landing zone.
A GOOD ANSWER COVERS Account structure: use a multi-account or multi-subscription model under an organization, separating workloads and environments to limit blast radius, isolate billing, and apply policy at scale. Identity: centralize on a single identity provider with SSO, federate access into accounts through roles, enforce least privilege and MFA, and forbid sharing root or long-lived keys. Networking: a hub-and-spoke topology with a shared connectivity hub for VPN, DNS, and inspection, and segmented spokes per workload. Security guardrails: preventive controls with service control policies or Azure Policy, plus baseline IaC and continuous compliance scanning so teams cannot disable encryption or open the world. Logging and monitoring: aggregate all audit logs, flow logs, and metrics into a dedicated, tamper-resistant logging account with alerting. The goal is safe self-service: teams build freely inside guardrails.
COMMON WRONG ANSWERS One shared mega-account with everyone in it. Granting teams admin or root. No preventive policy, relying on after-the-fact cleanup. Scattered, deletable logs. Hand-built networking with no segmentation.
LIKELY FOLLOW-UPS Preventive versus detective controls? How do you onboard a new team quickly? How do you stop log tampering? How do SCPs differ from IAM policies?
ONE CONCRETE EXAMPLE Using AWS Control Tower, you stand up an organization with separate accounts for security, logging, shared networking, and each workload. SCPs forbid disabling CloudTrail or creating public S3 buckets. IAM Identity Center federates SSO logins to scoped roles. A transit gateway connects spoke VPCs to a shared hub, and all CloudTrail and config logs flow to a locked-down logging account, so a new team gets a pre-baked, compliant account on request.
Interview question
Why do landing zones typically use multiple accounts or subscriptions rather than one shared account?
- a.They isolate blast radius, billing, and policy boundaries between workloads and teamsCorrect
- b.A single account cannot host more than one application
- c.Multiple accounts remove the need for IAM entirely
- d.Multiple accounts are required to use any cloud service
Why? this is the answer
Account segmentation limits the blast radius of a breach or misconfiguration, separates billing, and lets policies apply per boundary. A single account can technically host many apps, but it offers no isolation and still requires IAM.
Just read this? Test yourself on what you have been reading.
Read the original → learn.microsoft.com
- #landing-zone
- #cloud-governance
- #iam
- #security
- #enterprise
You just looked this up. Could you explain it out loud?
That is the part interviews actually test. Tezvyn takes questions like this one and gives you what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles