A company stores its sales and marketing data that includes personally identifiable information (PII) in Amazon S3. The company allows its analysts to launch their own Amazon EMR cluster and run…

Question

Options

• ACreate an EMR security configuration and ensure the security configuration is associated with the
• BCheck the security group of the EMR clusters regularly to ensure it does not allow inbound traffic
• CEnable the block public access setting for Amazon EMR at the account level before any EMR
• DUse AWS WAF to block public internet access to the EMR clusters across the board.

• A
  11% (2)
• B
  6% (1)
• C
  78% (14)
• D
  6% (1)

Explanation

Amazon EMR Block Public Access is an account-level setting that automatically blocks any EMR cluster from being created with security group rules that allow inbound traffic from the public internet (0.0.0.0/0 or ::/0). Enabling it once protects all current and future clusters across the account with no per-cluster configuration needed. Option A (EMR security configuration) must be explicitly attached to each cluster, relying on analysts to use it. Option B (regularly checking security groups) is a detective control, not a preventive one. Option D (AWS WAF) protects web applications, not EMR cluster networking.

No community discussion yet for this question.