A financial services company hosts a web application on Amazon ECS Fargate tasks behind an internet-facing Application Load Balancer (ALB). The application's administrative endpoints under the path `/admin/*` are currently protected by basic authentication. The security team mandates that the identity and network security of these endpoints must be strengthened. The `/admin/*` portal must be restricted to authenticated corporate employees who connect exclusively from the corporate office's public IP CIDR range (). In addition, audit logs stored in an Amazon S3 bucket must be encrypted using a key that can be shared with a security audit role in a separate AWS audit account. Which two actions should the Solutions Architect implement to meet these requirements? (Select TWO.)
- Configure an AWS WAF WebACL rule that matches the path `/admin/*` and blocks all requests that do not originate from the IP set containing the corporate CIDR range , and assign this rule the highest evaluation priority in the WebACL.Cevap
- Modify the ALB listener rules to authenticate users requesting `/admin/*` using an Amazon Cognito user pool federated with the company's corporate identity provider, and route authenticated sessions to the ECS target group.Cevap
- CAdd an AWS WAF WebACL rule that allows requests targeting `/admin/*` from the corporate IP set, and position it at the lowest evaluation priority after the default action of allow.
- DConfigure default encryption on the S3 bucket using an AWS-managed KMS key (`aws/s3`), and delegate cross-account permissions by updating the default key policy to trust the security audit role in the external AWS account.
- EAttach a Service Control Policy (SCP) to the member account's Organizational Unit (OU) that explicitly permits administrative access to `/admin/*` paths for the `AdminAccess` role, which automatically grants local permissions to federated users without needing local IAM policies.