Q58 — AWS SAA-C03 Ch.17

Question 58 of 89 | ← Chapter 17

Q1358. A financial company is migrating its banking applications to a set of AWS accounts managed by AWS Organizations. The applications will store sensitive customer data on Amazon EBS volumes. The company will take regular snapshots for backup purposes.The company wants to implement controls across all AWS accounts to prevent sharing EBS snapshots publicly.Which solution will meet these requirements with the LEAST operational overhead?

• A. Enable AWS Config rules for each organizational unit(OU) in Organizations to monitor EBS snapshot permissions.
• B. Enable block public access for EBS snapshots at the organization level. ✓
• C. Create an IAM policy in the root account of the organization that prevents users from modifying snapshot permissions.
• D. Use AWS CloudTrail to track snapshot permission changes.

Correct Answer: B. Enable block public access for EBS snapshots at the organization level.

Explanation

The correct answer is B. Enable block public access for EBS snapshots at the organization level.Explanation:The company needs to prevent EBS snapshots from being shared publicly across all AWS accounts in its AWS Organizations structure with minimal operational overhead.Key Requirements:Prevent public sharing of EBS snapshots Ensure snapshots cannot be made accessible to the public. Apply controls across all AWS accounts Centralized enforcement is preferred. Least operational overhead Avoid manual configuration per account or complex monitoring setups.Why Option B is the best choice:AWS Organizations-level block public access for EBS snapshotsAutomatically applies to all accounts in the organization.Prevents snapshots from being shared publicly (no manual policy management needed).No ongoing maintenance required after initial setup.Most efficient and scalable solution for multi-account environments.Why the other options are incorrect:A. Enable AWS Config rules for each OUHigh operational overhead Requires setting up and maintaining Config rules in every OU. Reactive, not preventive Config only detects violations after they occur (does not block them).More complex than a simple organization-level block.C. Create an IAM policy in the root account to restrict snapshot permissions Not foolproof Users with sufficient permissions could still modify snapshot permissions. Harder to enforce Requires strict IAM policies across all accounts. More complex than using AWS's built-in block public access feature.D. Use AWS CloudTrail to track snapshot permission changesOnly provides audit logging Does not prevent public sharing; only detects it after the fact. Requires additional monitoring/alerting Increases operational overhead. Not a preventive control Does not meet the requirement of stopping public sharing before it happens.Comparison Table:OptionPrevention MethodOperational OverheadScopeBest ForAAWS Config (Detection)High (per OU setup)Organizational UnitsCompliance auditing BBlock Public Access (Prevention)Low (one-time setup)All accounts in OrgPreventing public snapshot sharingCIAM Policy (Prevention)Moderate (policy management)All accounts (if enforced)Fine-grained access controlDCloudTrail (Detection)High (logging + alerting)All accountsAudit trail of changes Conclusion:Option B is the best solution because:Automatically prevents public sharing of EBS snapshots across all accounts. Requires minimal setup (enabled once at the organization level).No ongoing maintenance needed.Avoid Options A, C, and D (they either don't prevent sharing or require more effort).