Question
A company’s security team requires that all external Application Load Balancers (ALBs) and Amazon API Gateway APIs are associated with AWS WAF web ACLs. The company has hundreds of AWS accounts, all of which are included in a single organization in AWS Organizations. The company has configured AWS Config for the organization. During an audit, the company finds some externally facing ALBs that are not associated with AWS WAF web ACLs.
Which combination of steps should a DevOps engineer take to prevent future violations? (Choose two.)
- A. Delegate AWS Firewall Manager to a security account. Correct
- B. Delegate Amazon GuardDuty to a security account.
- C. Create an AWS Firewall Manager policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs. Correct
- D. Create an Amazon GuardDuty policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs.
- E. Configure an AWS Config managed rule to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs.
Explanation
AWS Firewall Manager can be delegated to a security account (Option A) for centralized management of security services across multiple accounts within an organization. Creating an AWS Firewall Manager policy (Option C) allows automatic attachment of AWS WAF web ACLs to new ALBs and API Gateway APIs, ensuring compliance with the company's security requirements.
