Amazon ANS-C01 Exam - Topic 4 Question 44 Discussion

Actual exam question for Amazon's ANS-C01 exam

Question #: 44
Topic #: 4

A company has AWS accounts in an organization in AWS Organizations. The company has implemented Amazon VPC IP Address Manager (IPAM)in its networking AWS account. The company is using AWS Resource Access Manager (AWS RAM) to share IPAM pools with other AWS accounts. The company has created a top-level pool with a CIDR block of 10.0.0.0/8. For each AWS account, the company has created an IPAM pool within the top-level pool.

A network engineer needs to implement a solution to ensure that users in each AWS account cannot create new VPCs. The solution also must prevent users from associating a CIDR block with existing VPCs unless the CIDR block is from the IPAM pool for that account.

Which solution will meet these requirements?

ACreate a new AWS Config rule to find all VPCs that are not configured to allocate their CIDR block from an IPAM pool. Invoke an AWS Lambda function to delete these VPCs.

BCreate a new SCP in Organizations. Add a condition that denies the CreateVpc and AssociateVpcCidrBlock Amazon EC2 actions if the lpv4lpamPoolld context key value is not the ID of an IPAM pool.

CCreate an AWS Lambda function to check for and delete all VPCs that are not configured to allocate their CIDR block from an IPAM pool. Invoke the Lambda function at regular intervals.

DCreate an Amazon EventBridge rule to check for AWS CloudTrail events for the CreateVpc and AssociateVpcCidrBlock Amazon EC2 actions. Use the rule to invoke an AWS Lambda function to delete all VPCs that are not configured to allocate their CIDR block from an IPAM pool.

Show Suggested Answer

Suggested Answer: B

by Sharika at Jan 12, 2025, 02:46 AM

Limited Time Offer

25%

Off

Get Premium ANS-C01 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Rosalyn

3 months ago

EventBridge sounds cool, but is it really necessary for this?

upvoted 0 times

...

Rebbecca

3 months ago

I think option A is too aggressive. Better to just restrict creation.

upvoted 0 times

...

Jettie

3 months ago

Wait, can you really delete VPCs automatically? Sounds risky.

upvoted 0 times

...

Sharika

4 months ago

I agree, SCPs are super effective for this!

upvoted 0 times

...

Luther

4 months ago

Option B is the best choice for restricting VPC creation.

upvoted 0 times

...

Sage

4 months ago

I remember discussing IPAM and its integration with AWS RAM. Option B seems like it directly addresses the requirement to prevent VPC creation, but I’m not 100% sure.

upvoted 0 times

...

Chau

4 months ago

I recall a practice question about using EventBridge for monitoring actions. Option D might be the right approach, but I'm not confident about the deletion part.

upvoted 0 times

...

Luis

4 months ago

I'm not entirely sure, but I feel like using AWS Config rules could be a way to enforce compliance. Maybe option A or C could work?

upvoted 0 times

...

Francis

5 months ago

I think option B sounds familiar. I remember studying Service Control Policies and how they can restrict actions based on conditions.

upvoted 0 times

...

Verona

5 months ago

This is a great question that really tests our understanding of AWS networking and security features. I'm feeling confident that I can work through this and select the best solution.

upvoted 0 times

...

Royal

5 months ago

I'm not sure I fully understand the difference between the AWS Config rule and the EventBridge rule options. I'll need to review the details of each to determine which one is more appropriate.

upvoted 0 times

...

Micaela

5 months ago

Option B seems like the most straightforward solution to me. Implementing an SCP to control the VPC creation and CIDR block association actions is a clean way to enforce the requirements.

upvoted 0 times

...

Lenna

5 months ago

I'm a bit confused by the details in this question. I'll need to make sure I understand the different AWS services and how they work together before I can confidently select an answer.

upvoted 0 times

...

Rolande

5 months ago

This looks like a tricky question, but I think I have a good strategy. I'll carefully read through the options and try to identify the one that best meets the stated requirements.

upvoted 0 times

...

Mammie

1 year ago

I wonder if the exam writer had to come up with a way to make 'lpv4lpamPoolld' sound like a real thing. Gotta love those AWS acronyms!

upvoted 0 times

Alva

12 months ago

B: D) Create an Amazon EventBridge rule to check for AWS CloudTrail events for the CreateVpc and AssociateVpcCidrBlock Amazon EC2 actions. Use the rule to invoke an AWS Lambda function to delete all VPCs that are not configured to allocate their CIDR block from an IPAM pool.

upvoted 0 times

...

William

12 months ago

A: B) Create a new SCP in Organizations. Add a condition that denies the CreateVpc and AssociateVpcCidrBlock Amazon EC2 actions if the lpv4lpamPoolld context key value is not the ID of an IPAM pool.

upvoted 0 times

...