SAP-C02 · Question #845
A company needs to apply consistent custom security audit rules across its organization in AWS Organizations. Accounts in the organization use a single AWS Region. The company uses AWS Config in…
The correct answer is A. Call the PutOrganizationConformancePack API operation from a delegated administrator account C. Create an AWS Config conformance pack that includes four custom policy rules and five AWS. Create one AWS Config conformance pack that bundles all nine rules (your four custom + five managed), then deploy it organization-wide with PutOrganizationConformancePack from the delegated admin. This applies the rules uniformly, locks edits from member accounts, and makes…
Question
A company needs to apply consistent custom security audit rules across its organization in AWS Organizations. Accounts in the organization use a single AWS Region. The company uses AWS Config in each account with four custom rules and five managed rules. The rules must be deployed to all accounts and must not be editable by member accounts. The company wants to easily update rules in the future. All required permissions are already in place. Which combination of steps will meet these requirements with the LEAST operational effort? (Choose two.)
Options
- ACall the PutOrganizationConformancePack API operation from a delegated administrator account
- BCreate an AWS Config conformance pack that includes four custom policy rules.
- CCreate an AWS Config conformance pack that includes four custom policy rules and five AWS
- DDeploy five AWS organizational rules and the conformance pack from a delegated administrator
- EUse AWS CloudFormation StackSets to deploy the conformance pack with termination protection.
How the community answered
(38 responses)- A71% (27)
- B5% (2)
- D16% (6)
- E8% (3)
Explanation
Create one AWS Config conformance pack that bundles all nine rules (your four custom + five managed), then deploy it organization-wide with PutOrganizationConformancePack from the delegated admin. This applies the rules uniformly, locks edits from member accounts, and makes future updates a single pack change.
Community Discussion
No community discussion yet for this question.