DOP-C02 · Question #51
A company's security team requires that all external Application Load Balancers (ALBs) and Amazon API Gateway APIs are associated with AWS WAF web ACLs. The company has hundreds of AWS accounts, all…
The correct answer is A. Delegate AWS Firewall Manager to a security account. C. Create an AWS Firewall Manager policy to attach AWS WAF web ACLs to any newly created. If instead you want to automatically apply the policy to existing in-scope resources, choose Auto remediate any noncompliant resources. This option creates a web ACL in each applicable account within the AWS organization and associates the web ACL with the resources in the When…
Question
A company's security team requires that all external Application Load Balancers (ALBs) and Amazon API Gateway APIs are associated with AWS WAF web ACLs. The company has hundreds of AWS accounts, all of which are included in a single organization in AWS Organizations. The company has configured AWS Config for the organization. During an audit, the company finds some externally facing ALBs that are not associated with AWS WAF web ACLs. Which combination of steps should a DevOps engineer take to prevent future violations? (Choose two.)
Options
- ADelegate AWS Firewall Manager to a security account.
- BDelegate Amazon GuardDuty to a security account.
- CCreate an AWS Firewall Manager policy to attach AWS WAF web ACLs to any newly created
- DCreate an Amazon GuardDuty policy to attach AWS WAF web ACLs to any newly created ALBs
- EConfigure an AWS Config managed rule to attach AWS WAF web ACLs to any newly created
How the community answered
(23 responses)- A65% (15)
- B17% (4)
- D4% (1)
- E13% (3)
Explanation
If instead you want to automatically apply the policy to existing in-scope resources, choose Auto remediate any noncompliant resources. This option creates a web ACL in each applicable account within the AWS organization and associates the web ACL with the resources in the When you choose Auto remediate any noncompliant resources, you can also choose to remove existing web ACL associations from in-scope resources, for the web ACLs that aren't managed by another active Firewall Manager policy. If you choose this option, Firewall Manager first associates the policy's web ACL with the resources, and then removes the prior associations. If a resource has an association with another web ACL that's managed by a different active Firewall Manager policy, this choice doesn't affect that association.
Topics
Community Discussion
No community discussion yet for this question.