ANS-C01 Question 481
Select 2Your organization uses multiple AWS accounts managed under AWS Organizations. As part of a security audit, you need to ensure that all VPCs across your accounts comply with centrally defined security rules for network configurations, such as approved security group settings and firewall rules. Which combination of AWS services should you use to achieve this efficiently?
- A
AWS Config and AWS Config Rules
- B
AWS Firewall Manager
- C
AWS Trusted Advisor
- D
AWS Systems Manager
- E
Amazon Inspector
Show answer and explanation
Correct answers: A, B
Explanation
To efficiently audit and enforce network security configurations across multiple AWS accounts, AWS Config with Config Rules is used to continuously track and evaluate compliance. AWS Firewall Manager complements this by providing centralized enforcement of security group rules and other firewall policies across accounts within an AWS Organization. Trusted Advisor, Systems Manager, and Amazon Inspector serve different purposes and are not focused on network security configuration auditing.
- A. Correct.
AWS Config and AWS Config Rules allow you to track resource configurations and evaluate compliance with security rules. This is essential for auditing network security configurations.
- B. Correct.
AWS Firewall Manager provides centralized management of firewall rules and security policies across multiple accounts and resources, making it ideal for enforcing network security configurations in a multi-account environment.
- C. Incorrect.
AWS Trusted Advisor provides recommendations for improving security, cost, and performance but is not designed for enforcing or auditing detailed network security configurations.
- D. Incorrect.
AWS Systems Manager helps with operational management, such as automation and patching, but it is not primarily used for auditing or enforcing network security configurations.
- E. Incorrect.
Amazon Inspector is a vulnerability management tool that identifies security issues in EC2 instances and other resources but does not audit or enforce network-level security configurations.