DOP-C02 · Question #383
A DevOps engineer is implementing governance controls for a company that requires its infrastructure to be housed within the United States. The company has many AWS accounts in an organization in AWS
The correct answer is A. Create an Organizations SCP deny policy that has a condition that the aws:RequestedRegion B. Configure AWS CloudTrail to send logs to Amazon CloudWatch Logs. Enable CloudTrail for all. To restrict AWS Region usage and monitor activity outside of the allowed regions, a combination of preventative and detective controls is necessary. 1. Prevent AWS services from being used outside US Regions SCP Deny Policy is the correct choice because a deny policy ensures that
Question
A DevOps engineer is implementing governance controls for a company that requires its infrastructure to be housed within the United States. The company has many AWS accounts in an organization in AWS Organizations that has all features enabled. The engineer must restrict which AWS Regions the company can use. The engineer must also ensure that an alert is sent as soon as possible if any activity outside the governance policy occurs. The controls must be automatically enabled on any new Region outside the United States. Which combination of steps will meet these requirements? (Choose two.)
Options
- ACreate an Organizations SCP deny policy that has a condition that the aws:RequestedRegion
- BConfigure AWS CloudTrail to send logs to Amazon CloudWatch Logs. Enable CloudTrail for all
- CUse an AWS Lambda function that checks for AWS service activity. Deploy the Lambda function
- DUse an AWS Lambda function to query Amazon Inspector to look for service activity in non-US
- ECreate an Organizations SCP allow policy that has a condition that the aws:RequestedRegion
How the community answered
(26 responses)- A69% (18)
- C4% (1)
- D8% (2)
- E19% (5)
Explanation
To restrict AWS Region usage and monitor activity outside of the allowed regions, a combination of preventative and detective controls is necessary. 1. Prevent AWS services from being used outside US Regions SCP Deny Policy is the correct choice because a deny policy ensures that AWS actions in non- US Regions are blocked unless explicitly allowed. The aws:RequestedRegion condition ensures that requests in non-US Regions are rejected. The policy must include exceptions for global services like IAM and Route 53, which operate across all Regions. 2. Detect any unexpected activity outside of the allowed Regions CloudTrail + CloudWatch Logs + Alerts is the correct choice for monitoring. CloudTrail records all API activity, which can be sent to CloudWatch Logs for real-time Metric filters in CloudWatch Logs can detect usage in unauthorized Regions and trigger an alarm if activity is found in a non-US Region.
Topics
Community Discussion
No community discussion yet for this question.