nerdexam
Amazon

SAP-C02 · Question #733

A company wants to use Amazon WorkSpaces in combination with thin client devices to replace aging desktops. Employees use the desktops to access applications that work with Clinical trial data…

The correct answer is A. Create an IP access control group rule with the list of public addresses from the branch offices. To restrict Amazon WorkSpaces client access to specific company branch office locations and efficiently manage future additions, an IP access control group should be created. This group lists the public IP addresses of authorized branch offices, allowing WorkSpaces to enforce…

Submitted by rachelw· Mar 6, 2026Continuous Improvement for Existing Solutions

Question

A company wants to use Amazon WorkSpaces in combination with thin client devices to replace aging desktops. Employees use the desktops to access applications that work with Clinical trial data. Corporate security policy states that access to the applications must be restricted to only company branch office locations. The company is considering adding an additional branch office in the next 6 months. Which solution meets these requirements with the MOST operational efficiency?

Options

  • ACreate an IP access control group rule with the list of public addresses from the branch offices.
  • BUse AWS Firewall Manager to create a web ACL rule with an IPSet with the list of public
  • CUse AWS Certificate Manager (ACM) to issue trusted device certificates to the machines
  • DCreate a custom WorkSpace image with Windows Firewall configured to restrict access to the

How the community answered

(20 responses)
  • A
    85% (17)
  • C
    5% (1)
  • D
    10% (2)

Why each option

To restrict Amazon WorkSpaces client access to specific company branch office locations and efficiently manage future additions, an IP access control group should be created. This group lists the public IP addresses of authorized branch offices, allowing WorkSpaces to enforce network-level access restrictions.

ACreate an IP access control group rule with the list of public addresses from the branch offices.Correct

Amazon WorkSpaces uses IP access control groups to restrict client connections to WorkSpaces directories based on source IP addresses, directly meeting the requirement for branch office access and allowing for efficient updates when new branch offices are added.

BUse AWS Firewall Manager to create a web ACL rule with an IPSet with the list of public

AWS Firewall Manager with WAF web ACLs is designed for HTTP/HTTPS traffic protection, which is not the appropriate mechanism for controlling client access to Amazon WorkSpaces at the network level.

CUse AWS Certificate Manager (ACM) to issue trusted device certificates to the machines

AWS Certificate Manager for trusted device certificates provides device authentication, not location-based (IP-based) access restriction, and therefore does not directly fulfill the requirement of restricting access to branch office IP ranges.

DCreate a custom WorkSpace image with Windows Firewall configured to restrict access to the

Configuring Windows Firewall within a custom WorkSpace image is less operationally efficient, as it would require modifying and redeploying the image or custom scripts whenever branch office IPs change, instead of managing a central IP access control group.

Concept tested: Amazon WorkSpaces IP Access Control Groups

Source: https://docs.aws.amazon.com/workspaces/latest/adminguide/workspaces-ip-access-control-groups.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAP-C02 Practice