Q17 — AWS SAA-C03 Ch.15

Question 17 of 100 | ← Chapter 15

Q1117. A company has an ecommerce site. The site is designed as a distributed web application that is hosted in multiple AWS accounts that are in one organization in AWS Organizations The web application is comprised of multiple microservices. All microservices expose their AWS services either through Amazon CloudFront distributions or public Application Load Balancers (ALBs). The company wants to protect public endpoints from malicious attacks. The company also wants to monitor security configurations.Which solution will meet these requirements with the LEAST operational overhead?

Correct Answer: A. Use AWS WAF to protect the public endpoints. Use AWS Firewall Manager from a dedicated security account to manage rules in AWS WAF. Use AWS Config rules to monitor the Regional and global WAF configurations.

Explanation

To determine the best solution for protecting public endpoints and monitoring security configurations with the least operational overhead, let's analyze the requirements and evaluate each option:Requirements:Protect public endpoints (CloudFront and ALBs) from malicious attacks:This requires a web application firewall (WAF) or DDoS protection.Monitor security configurations:This requires tools to check compliance with security policies (e.g., WAF rules, ALB configurations).Least operational overhead:The solution should centralize management and monitoring to reduce manual effort across multiple AWS accounts.Key Considerations:AWS WAF vs. AWS Shield Advanced:AWS WAF: Protects against common web exploits (e.g., SQL injection, XSS) and can be applied to CloudFront and ALBs.AWS Shield Advanced: Provides DDoS protection (Layer 3/4) and is automatically applied to CloudFront and ALBs. It does not protect against web application-layer attacks (Layer 7), which WAF does. For protecting against malicious attacks (e.g., SQLi, XSS), WAF is required, while Shield Advanced is optional (for DDoS).Centralized Management:AWS Firewall Manager: Centralizes WAF rule management across multiple accounts and Regions, reducing operational overhead.Applying WAF rules manually in each account increases overhead.Monitoring Security Configurations:AWS Config: Monitors and audits resource configurations (e.g., WAF rules, ALB settings) for compliance. AWS Security Hub: Aggregates security findings from AWS Config and other services, providing a centralized view.Amazon Inspector: Focuses on vulnerability scanning for EC2 instances and containers, not WAF/ALB configurations.Evaluation of Options:A. Use AWS WAF to protect the public endpoints. Use AWS Firewall Manager from a dedicated security account to manage rules in AWS WAF. Use AWS Config rules to monitor the Regional and global WAF configurations.Pros:WAF protects against web exploits (SQLi, XSS).Firewall Manager centralizes WAF rule management across accounts, reducing overhead.AWS Config monitors WAF configurations for compliance.Cons:No Security Hub integration (though Config alone can suffice for monitoring). Best Fit: This meets all requirements with minimal operational overhead (centralized WAF management and Config monitoring).B. Use AWS WAF to protect the public endpoints. Apply AWS WAF rules in each account. Use AWS Config rules and AWS Security Hub to monitor the WAF configurations of the ALBs and the CloudFront distributions.Pros:WAF protects against web exploits.AWS Config + Security Hub monitors WAF configurations.Cons:Applying WAF rules manually in each account increases operational overhead (violates "least operational overhead" requirement).Not the Best Fit: Manual WAF rule management is too complex for this use case. C. Use AWS WAF to protect the public endpoints. Use AWS Firewall Manager from a dedicated security account to manage the rules in AWS WAF. Use Amazon Inspector and AWS Security Hub to monitor the WAF configurations of the ALBs and the CloudFront distributions.Pros:WAF protects against web exploits.Firewall Manager centralizes WAF rule management.Cons:Amazon Inspector is not relevant for monitoring WAF/ALB configurations (it focuses on EC2 vulnerabilities).Security Hub alone without Config may not provide detailed configuration monitoring. Not the Best Fit: Inspector is misapplied here, and Security Hub alone is insufficient for configuration monitoring.D. Use AWS Shield Advanced to protect the public endpoints. Use AWS Config rules to monitor the Shield Advanced configuration for each account.Pros:Shield Advanced provides DDoS protection.Cons:Shield Advanced does not protect against web exploits (SQLi, XSS), which WAF does. No WAF protection (violates the requirement to protect against malicious attacks). Monitoring Shield Advanced configurations is not relevant to WAF/ALB security. Not the Best Fit: Shield Advanced alone is insufficient for web application-layer protection.Conclusion:Option A is the best solution because:It uses WAF to protect against malicious attacks (SQLi, XSS). It centralizes WAF rule management with Firewall Manager, reducing operational overhead. It monitors WAF configurations with AWS Config, ensuring compliance. It avoids unnecessary tools (like Inspector or Security Hub for this use case).Final 答案:A