If you assemble Organizations and SCP by hand, you must code all of the following: OU design, log accounts, Organization CloudTrail, Config aggregation, SCP sets, and new account bootstrapping. AWS Control Tower automates all of this as a best-practices-based landing zone (Landing Zone), serving as a governance orchestrator. In the security exam, Control Tower appears as the answer to "How do we consistently establish and maintain a secure baseline across multiple accounts?" The core concepts are Guardrails (Controls), Account Factory, and Drift Detection.