AWS Certified DevOps Engineer - Professional DOP-C02Demo

By Amazon · Question Mode

QuestionQ3

Security and Compliance

A company’s security team mandates that every external Application Load Balancer (ALB) and Amazon API Gateway API be associated with an AWS WAF web ACL. The company has hundreds of AWS accounts, all contained in one AWS Organizations organization. The company has enabled AWS Config for the organization. During an audit, the company discovers that some internet-facing ALBs have no associated AWS WAF web ACLs.

Which combination of actions should a DevOps engineer take to prevent future violations?

Choose two
  • A Delegate AWS Firewall Manager to a security account.
  • B Delegate Amazon GuardDuty to a security account.
  • C Create an AWS Firewall Manager policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs.
  • D Create an Amazon GuardDuty policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs.
  • E Configure an AWS Config managed rule to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs.
Explanation

AWS Firewall Manager centrally applies AWS WAF policies across AWS Organizations accounts. A delegated Firewall Manager administrator can manage the organization-wide policy, and an AWS WAF Firewall Manager policy with automatic remediation creates and associates managed web ACLs for in-scope ALBs and API Gateway APIs that lack them. AWS Config supplies compliance monitoring but its managed rules do not themselves attach web ACLs; GuardDuty is unrelated to web ACL enforcement.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!