Amazon Exam ANS-C01 Topic 1 Question 42 Discussion

Actual exam question for Amazon's ANS-C01 exam

Question #: 42
Topic #: 1

A company is planning to host external websites on AWS. The websites will include multiple tiers such as web servers, application logic services, and databases. The company wants to use AWS Network Firewall. AWS WAR and VPC security groups for network security.

The company must ensure that the Network Firewall firewalls are deployed appropriately within relevant VPCs. The company needs the ability to centrally manage policies that are deployed to Network Firewall and AWS WAF rules. The company also needs to allow application teams to manage their own security groups while ensuring that the security groups do not allow overly permissive access.

What is the MOST operationally efficient solution that meets these requirements?

ADefine Network Firewall firewalls. AWS WAFv2 web ACLs. Network Firewall policies, and VPC security groups in code Use AWS CloudFormation to deploy the objects and Initial policies and rule groups. Use CloudFormation to update the AWS WAFv2 web ACLs. Network Firewall policies, and VPC security groups. Use Amazon GuardDuty to monitor for overly permissive rules.

BDefine Network Firewall firewalls. AWS WAFv2 web ACLs. Network Firewall policies, and VPC security groups in code. Use the AWS Management Console or the AWS CLI to manage the AWS WAFv2 web ACLs. Network Firewall policies, and VPC security groups. Use Amazon GuardDuty to invoke an AWS Lambda function to evaluate the configured rules and remove any overly permissive rules.

CDeploy AWS WAFv2 IP sets and AWS WAFv2 web ACLs with AWS CloudFormation. Use AWS Firewall Manager to deploy Network Firewall firewalls and VPC security groups where required and to manage the AWS WAFv2 web ACLs, Network Firewall policies, and VPC security groups.

DDefine Network Firewall firewalls. AWS WAFv2 web ACLs. Network Firewall policies, and VPC security groups in code. Use AWS CloudFormation to deploy the objects and initial policies and rule groups. Use AWS Firewall Manager to manage the AWS WAFv2 web ACLs. Network Firewall policies, and VPC security groups. Use Amazon GuardDuty to monitor for overly permissive rules.

Show Suggested Answer

Suggested Answer: D

by Lucia at Nov 19, 2024, 01:36 AM

Limited Time Offer

25%

19 days ago

This seems like a pretty straightforward question. I think option D is the best solution as it allows for centralized management of the security policies while still giving the application teams the ability to manage their own security groups.

upvoted 0 times

Natalya

2 days ago

Centralized management of security policies is crucial for maintaining a secure environment.

upvoted 0 times

...

Scarlet

7 days ago

I think using AWS CloudFormation for deployment and AWS Firewall Manager for management is a good approach.

upvoted 0 times

...

Leslee

8 days ago

I agree, option D seems like the most efficient solution for this scenario.

upvoted 0 times

...