DOP-C02 · Question #30
A DevOps engineer needs to apply a core set of security controls to an existing set of AWS accounts. The accounts are in an organization in AWS Organizations. Individual teams will administer…
The correct answer is C. Designate an AWS Config management account. Create AWS Config recorders in all accounts by. This solution meets the requirements in the most operationally efficient way. It uses AWS CloudFormation StackSets to deploy AWS Config recorders in all accounts and AWS Config rules to the organization, which can be centrally managed from an AWS Config management account. A…
Question
A DevOps engineer needs to apply a core set of security controls to an existing set of AWS accounts. The accounts are in an organization in AWS Organizations. Individual teams will administer individual accounts by using the AdministratorAccess AWS managed policy. For all accounts. AWS CloudTrail and AWS Config must be turned on in all available AWS Regions. Individual account administrators must not be able to edit or delete any of the baseline resources. However, individual account administrators must be able to edit or delete their own CloudTrail trails and AWS Config rules. Which solution will meet these requirements in the MOST operationally efficient way?
Options
- ACreate an AWS CloudFormation template that defines the standard account resources. Deploy
- BEnable AWS Control Tower. Enroll the existing accounts in AWS Control Tower. Grant the
- CDesignate an AWS Config management account. Create AWS Config recorders in all accounts by
- DCreate an AWS CloudFormation template that defines the standard account resources. Deploy
How the community answered
(27 responses)- A22% (6)
- B7% (2)
- C59% (16)
- D11% (3)
Explanation
This solution meets the requirements in the most operationally efficient way. It uses AWS CloudFormation StackSets to deploy AWS Config recorders in all accounts and AWS Config rules to the organization, which can be centrally managed from an AWS Config management account. A CloudTrail organization trail can also be created in the organization’s management account to collect logs from all accounts. An SCP can be used to deny modification or deletion of the AWS Config recorders, ensuring that the baseline resources cannot be modified or deleted by individual account administrators. However, individual account administrators can still edit or delete their own CloudTrail trails and AWS Config rules.
Topics
Community Discussion
No community discussion yet for this question.