DOP-C02 · Question #268
A company's DevOps team manages a set of AWS accounts that are in an organization in AWS Organizations. The company needs a solution that ensures that all Amazon EC2 instances use approved AM Is…
The correct answer is D. Enable AWS Config across the organization. Create a conformance pack that uses the approved-. Explanation Option D is correct because enabling AWS Config across the entire organization with a conformance pack allows centralized enforcement of the approved-amis-by-id managed rule with automatic remediation actions, and when deployed at the organization level through AWS…
Question
A company's DevOps team manages a set of AWS accounts that are in an organization in AWS Organizations. The company needs a solution that ensures that all Amazon EC2 instances use approved AM Is that the DevOps team manages. The solution also must remediate the usage of AMIs that are not approved. The individual account administrators must not be able to remove the restriction to use approved AMIs. Which solution will meet these requirements?
Options
- AUse AWS CloudFormation StackSets to deploy an Amazon EventBridge rule to each account.
- BUse AWS CloudFormation StackSets to deploy the approved-amis-by-id AWS Config managed
- CCreate an AWS Lambda function that processes AWS CloudTrail events for Amazon EC2.
- DEnable AWS Config across the organization. Create a conformance pack that uses the approved-
How the community answered
(48 responses)- A29% (14)
- B15% (7)
- C6% (3)
- D50% (24)
Explanation
Explanation
Option D is correct because enabling AWS Config across the entire organization with a conformance pack allows centralized enforcement of the approved-amis-by-id managed rule with automatic remediation actions, and when deployed at the organization level through AWS Config, individual account administrators cannot remove or override the restrictions - satisfying the non-repudiation requirement.
Why the distractors fail:
- Option A (EventBridge rule via StackSets) only detects events but lacks built-in remediation and cannot prevent account admins from modifying or deleting the EventBridge rule in their accounts.
- Option B (Config managed rule via StackSets) deploys the rule per account but StackSets-deployed Config rules can be modified or deleted by individual account admins, failing the immutability requirement.
- Option C (Lambda + CloudTrail) is a custom, reactive solution requiring significant development effort, and account admins could disable CloudTrail or Lambda, breaking enforcement.
Memory Tip
Think "Organization-level Config = Lock it down" - whenever a question asks for centralized enforcement that individual accounts cannot override, AWS Config conformance packs deployed at the organization level is almost always the answer, since they are managed from the master/delegated admin account and cannot be tampered with by child account admins.
Topics
Community Discussion
No community discussion yet for this question.