A company's security engineer receives an alert that indicates that an unexpected principal is accessing a company-owned Amazon Simple Queue Service (Amazon SQS) queue. All the company's accounts…

Question

Options

• ACreate security groups that only accept inbound traffic from the CIDR blocks of all the VPCs in
• BIn all the VPCs in the organization, adjust the network ACLs to only accept inbound traffic from
• CCreate interface VPC endpoints for Amazon SQS in all the VPCs in the organization. Set the
• DUse a cloud access security broker (CASB) to maintain a list of managed resources. Configure

• A
  6% (3)
• B
  10% (5)
• C
  80% (40)
• D
  4% (2)

Explanation

Amazon SQS is an AWS-managed service and does not operate within customer VPCs. Therefore, security groups and network ACLs cannot be used to control access to SQS, making options A and B invalid. According to AWS Certified Security - Specialty documentation, the recommended approach to securely access AWS services from within a VPC is through interface VPC endpoints (AWS PrivateLink). By creating interface VPC endpoints for Amazon SQS, the company ensures that traffic to SQS stays within the AWS network and does not traverse the public internet. Adding an SQS resource policy with the aws:SourceVpce condition restricts access so that only requests originating from the specified VPC endpoint are allowed. Additionally, using the aws:PrincipalOrgId condition ensures that only principals belonging to the same AWS Organization can access the queue. Option D introduces an external tool, increasing cost and compliance complexity, which directly violates the requirement to minimize investment outside AWS. AWS documentation clearly identifies VPC endpoints combined with IAM condition keys as a best practice for securing service access in multi-account environments.

No community discussion yet for this question.