SOA-C02 · Question #730
A company is using an organization in AWS Organizations to manage hundreds of AWS accounts across AWS Regions. AWS Config is turned on for the organization. The company requires all of its Amazon S3…
The correct answer is B. Create an AWS Config aggregator in an aggregator account. Specify the organization as the E. Use the AWS Config API to apply the s3-bucket-public-read-prohibited rule in all accounts for all. Apply the AWS Config managed rule s3-bucket-public-read-prohibited across all accounts/Regions, then use an organization-wide AWS Config aggregator to collect the compliance results in one place for reporting.
Question
A company is using an organization in AWS Organizations to manage hundreds of AWS accounts across AWS Regions. AWS Config is turned on for the organization. The company requires all of its Amazon S3 buckets to block public read access. A SysOps administrator must generate a monthly report that shows all the company’s S3 buckets and whether the S3 buckets comply with this requirement. Which combination of steps should the SysOps administrator take to collect this data for the report? (Choose two.)
Options
- AEdit the AWS Config policy in Organizations. Use the Organizations API to deploy AWS Config
- BCreate an AWS Config aggregator in an aggregator account. Specify the organization as the
- CCreate an AWS Config aggregator in each account. Specify an S3 bucket in an aggregator
- DUse the AWS Config compliance report from the aggregator S3 bucket. Configure Amazon
- EUse the AWS Config API to apply the s3-bucket-public-read-prohibited rule in all accounts for all
How the community answered
(24 responses)- A4% (1)
- B75% (18)
- C17% (4)
- D4% (1)
Explanation
Apply the AWS Config managed rule s3-bucket-public-read-prohibited across all accounts/Regions, then use an organization-wide AWS Config aggregator to collect the compliance results in one place for reporting.
Topics
Community Discussion
No community discussion yet for this question.