Q50 — AWS SAA-C03 Ch.11

Question 50 of 100 | ← Chapter 11

Q750. A company has multiple AWS accounts in an organization in AWS Organizations that different business units use. The company has multiple offices around the world. The company needs to update security group rules to allow new office CIDR ranges or to remove old CIDR ranges across the organization. The company wants to centralize the management of security group rules to minimize the administrative overhead that updating CIDR ranges requires.Which solution will meet these requirements MOST cost-effectively?

• A. Create VPC security groups in the organization's management account. Update the security groups when a CIDR range update is necessary.
• B. Create a VPC customer managed prefix list that contains the list of CIDRs. Use AWS Resource Access Manager (AWS RAM) to share the prefix list across the organization. Use the prefix list in the security groups across the organization. ✓
• C. Create an AWS managed prefix list. Use an AWS Security Hub policy to enforce the security group update across the organization. Use an AWS Lambda function to update the prefix list automatically when the CIDR ranges change.
• D. Create security groups in a central administrative AWS account. Create an AWS Firewall Manager common security group policy for the whole organization. Select the previously created security groups as primary groups in the policy.

Correct Answer: B. Create a VPC customer managed prefix list that contains the list of CIDRs. Use AWS Resource Access Manager (AWS RAM) to share the prefix list across the organization. Use the prefix list in the security groups across the organization.

Explanation

Option B, creating a VPC customer managed prefix list and using AWS Resource Access Manager (AWS RAM) to share the prefix list across the organization, is the most cost-effective solution for centralizing the management of security group rules. By creating a customer managed prefix list, you can define a list of CIDR ranges for the offices around the world. AWS RAM allows you to share the prefix list across the organization, making it accessible to multiple AWS accounts in AWS Organizations. By using the shared prefix list, you can update security group rules in each account to reference the prefix list rather than specific CIDR ranges. This approach centralizes the management of CIDR ranges and reduces administrative overhead and costs by avoiding the need to update security groups individually in each account.Option A, creating VPC security groups in the organization's management account and updating the security groups when a CIDR range update is necessary, does not provide a centralized management solution. It would require manual updates to each security group individually, which can be time-consuming and error-prone.Option C, creating an AWS managed prefix list and using an AWS Security Hub policy to enforce security group updates across the organization, may not be the most cost-effective solution. AWS managed prefix lists cannot be directly modified, so updating them automatically would require a custom solution using AWS Lambda. This approach adds complexity and may not be the most efficient or cost-effective way to manage security group rules.Option D, creating security groups in a central administrative AWS account and using AWS Firewall Manager to manage security group policies for the entire organization, is a valid solution but may not be the most cost-effective. AWS Firewall Manager can incur additional costs, and for solely managing CIDR ranges, using a customer managed prefix list shared via AWS RAM would be a more cost-effective approach.Therefore, the solution that meets the requirements of centralizing the management of security group rules across an organization in AWS Organizations, while minimizing administrative overhead and cost, is B: Create a VPC customer managed prefix list that contains the list of CIDRs. Use AWS Resource Access Manager (AWS RAM) to share the prefix list across the organization. Use the prefix list in the security groups across the organization.