Examkin

Soru

Zorluk: ZorThreat Protection and Web Application Firewall (WAF)

A SysOps administrator needs to deploy a standardized security policy to protect all Application Load Balancers (ALBs) across multiple AWS accounts within an organizational unit (OU) named ProductionOU. The security policy must block known malicious IP addresses and mitigate HTTP flood attacks. The solution must centrally deploy the configurations, automatically remediate any local disassociations or modifications to the security rules, and ensure all changes are audited. Which combination of actions will meet these requirements? (Select TWO.)

  1. Designate a delegated administrator account for AWS Firewall Manager, and create a Firewall Manager WAF policy targeting ALBs in the ProductionOU with auto-remediation enabled.Cevap
  2. Include a rate-based rule and the AWS Managed Rules Amazon IP Reputation list rule group within the Firewall Manager WAF policy.Cevap
  3. C
    Create a custom AWS Config rule in each member account to monitor ALB associations, and configure an Amazon EventBridge rule to trigger an AWS Systems Manager Automation document that reassociates the Web ACL.
  4. D
    Deploy stateless Network Access Control Lists (NACLs) to the ALB subnets across all accounts to block malicious IPs, and configure the outbound NACL rules to restrict traffic to ports 80 and 443 only.
  5. E
    Configure a multi-region organizational CloudTrail trail to log WAF API activity to a centralized S3 bucket in the management account, and enable SSE-KMS encryption without updating the KMS key policy to allow CloudTrail service principal access.

Cevap

To meet the requirements, the administrator should designate a delegated administrator account for AWS Firewall Manager and create a WAF policy targeting ALBs in the ProductionOU with auto-remediation enabled. Additionally, the policy must include a rate-based rule and the AWS Managed Rules Amazon IP Reputation list rule group.
AWS Firewall Manager provides centralized management of AWS WAF rules across multiple accounts in an AWS Organization. By designating a delegated administrator and targeting the ProductionOU with auto-remediation enabled, any non-compliant local changes are automatically corrected. Including the Amazon IP Reputation list and a rate-based rule in the policy ensures protection against known threats and HTTP floods.

Adım Adım Çözüm

1
Establish centralized management using AWS Firewall Manager by designating a delegated administrator account and defining a security policy targeting Application Load Balancers in the ProductionOU.
Standardized Web ACLs are pushed to all target ALBs in the specified accounts.
Firewall Manager centralizes the deployment and lifecycle of security rules across accounts.
2
Define protection rules within the Firewall Manager policy, including the AWS Managed Rules Amazon IP Reputation list to block known malicious IPs and a rate-based rule to mitigate HTTP floods.
Both threat vectors (known bad actors and rate-based floods) are blocked at the Web ACL level.
This satisfies the technical threat protection requirements.
3
Enable auto-remediation in the policy to automatically overwrite local disassociations or modifications.
Any local changes deviate from the policy are automatically corrected, returning the resources to compliance.
Ensures consistent enforcement of the security policy across all accounts.

Anahtar Kavram

Centralized threat protection and Web Application Firewall (WAF) deployment using AWS Firewall Manager to enforce security compliance across multiple AWS Organization accounts.
Bu soruyu puanla

Konular

Threat Protection and Web Application Firewall (WAF)

Bu konudan daha fazla soru