Q16 — AWS SAA-C03 Ch.6

Question 16 of 65 | ← Chapter 6

Q381. A company manages multiple AWS accounts in an organization in AWS Organizations. The company's applications run on Amazon EC2 instances in multiple AWS Regions.The company needs a solution to simplify the management of security rules across the accounts in its organization. The solution must apply shared security group rules, audit security groups, and detect unused and redundant rules in VPC security groups across all AWS environments.Which solution will meet these requirements with the MOST operational efficiency?

• A. Use AWS Firewall Manager to create a set of rules based on the security requirements. Replicate the rules to all the AWS accounts and Regions
• B. Use AWS CloudFormation StackSets to provision VPC security groups based on the specifications across multiple accounts and Regions. Deploy AWS Network Firewall to define the firewall rules to control network traffic across multiple accounts and Regions
• C. Use AWS CloudFormation StackSets to provision VPC security groups based on the specifications across multiple accounts and Regions. Configure AWS Config and AWS Lambda to evaluate compliance information and to automate enforcement across all accounts and Regions ✓
• D. Use AWS Network Firewall to build policies based on the security requirements. Centrally apply the new policies to all the VPCs and accounts

Correct Answer: C. Use AWS CloudFormation StackSets to provision VPC security groups based on the specifications across multiple accounts and Regions. Configure AWS Config and AWS Lambda to evaluate compliance information and to automate enforcement across all accounts and Regions

Explanation

This solution allows for the centralized management of security group rules across multiple AWS accounts and Regions using AWS CloudFormation StackSets. defining the security group specifications in a CloudFormation template and deploying it using StackSets, you can ensure consistent security group configurations across all environments.Additionally, by configuring AWS Config and AWS Lambda, you can automate the evaluation of compliance information and enforce security group rules across all accounts and Regions. This helps in auditing security groups and detecting unused and redundant rules.Using AWS CloudFormation StackSets along with AWS Config and AWS Lambda provides a scalable and efficient solution for managing security group rules across multiple AWS accounts and Regions in an organization.