AWS Certified DevOps Engineer - Professional DOP-C02

By Amazon · Question Mode

QuestionQ3

Security and Compliance

A company’s security team mandates that every external Application Load Balancer (ALB) and Amazon API Gateway API be associated with an AWS WAF web ACL. The company has hundreds of AWS accounts, all contained in one AWS Organizations organization. The company has enabled AWS Config for the organization. During an audit, the company discovers that some internet-facing ALBs have no associated AWS WAF web ACLs.

Which combination of actions should a DevOps engineer take to prevent future violations?

Choose two
Explanation

AWS Firewall Manager centrally applies AWS WAF policies across AWS Organizations accounts. A delegated Firewall Manager administrator can manage the organization-wide policy, and an AWS WAF Firewall Manager policy with automatic remediation creates and associates managed web ACLs for in-scope ALBs and API Gateway APIs that lack them. AWS Config supplies compliance monitoring but its managed rules do not themselves attach web ACLs; GuardDuty is unrelated to web ACL enforcement.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!