Discuss Amazon PAS-C01 Exam Topic 1 Question 10

A company is planning to move all its SAP applications to Amazon EC2 instances in a VPC Recently the company signed a multiyear contract with a payroll software-as-a-service (SaaS) provider integration with the payroll SaaS solution is available only through public web APIs.

Corporate security guidelines state that all outbound traffic must be validated against an allow list. The payroll SaaS provider provides only fully qualified domain name (FQDN) addresses and no IP addresses or IP address ranges Currently, an on-premises firewall appliance filters FQDNs. The company needs to connect an SAP Process Orchestration (SAP PO) system to the payroll SaaS provider.

What must the company do on AWS to meet these requirements?

AAdd an outbound rule to the security group of the SAP PO system to allow the FODN of the payroll SaaS provider and deny all other outbound traffic

BAdd an outbound rule to the network ACL of the subnet that contains the SAP PO system to allow the FQDN of the payroll SaaS provider and deny all other outbound traffic

CAdd an AWS WAF web ACL to the VPC Add an outbound rule to allow the SAP PO system to connect to the FQDN of the payroll SaaS provider

DAdd an AWS Network Firewall firewall to the VPC Add an outbound rule to allow the SAP PO system to connect to the FQDN of the payroll SaaS provider

Suggested Answer: A

Get Premium PAS-C01 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

33 comments · newest first

Joseph 11 months ago

I agree with A, keeping it simple is key!

Mireya 12 months ago

Definitely need to use D for better security.

Lashunda 12 months ago

Wait, can we really filter FQDNs like that?

Ming 1 year ago

I think B might be better for subnet control.

Andra 1 year ago

Sounds like option A is the way to go!

Benedict 1 year ago

I think option D sounds promising since AWS Network Firewall can handle more complex rules, but I’m unsure if it’s necessary for just allowing an FQDN.

Elbert 1 year ago

I feel like AWS WAF is more for web applications, so I'm hesitant about option C. It seems like it wouldn't fit the requirement for validating outbound traffic.

Juan 1 year ago

This question seems similar to one we practiced about managing outbound rules. I think using a network ACL might be the right approach, but I can't recall the specifics.

Arlette 1 year ago

I remember we discussed the importance of security groups for controlling outbound traffic, but I'm not sure if they can filter by FQDN directly.

Staci 1 year ago

Okay, I've got a good feeling about this one. The time range selected must be the key factor in how the data is bucketed, right? I'll mark that as my answer.

Timothy 1 year ago

This question seems pretty straightforward. I'm pretty confident that the correct answer is C - an EMR is electronically stored information about an individual's health status and health care.

Aide 1 year ago

This reminds me of a practice question about denial-of-service attacks where the computer had similar symptoms. I wonder if that's the right answer here too?

Tamekia 1 year ago

I'm just wondering if the payroll SaaS provider has a sense of humor and accepts 'payroll@juggernaut.com' as an FQDN. Worth a shot, right?

Cheryl 1 year ago

↳ replying to Tamekia

Yeah, that way we can ensure that only the necessary outbound traffic is allowed.

Vince 1 year ago

↳ replying to Tamekia

Adding an outbound rule to the security group of the SAP PO system seems like the best option.

Charlesetta 1 year ago

↳ replying to Tamekia

I agree, we should stick to the FQDN provided by the payroll SaaS provider.

Eden 1 year ago

↳ replying to Tamekia

That's a creative idea, but I don't think it will work. We need to follow the guidelines.

Samira 1 year ago

Option A is simple, but I don't know if I'd trust a security group to handle this critical requirement. Better to use a dedicated firewall solution.

Huey 1 year ago

Hmm, Option C with the AWS WAF web ACL sounds interesting, but I'm not sure if that's the best fit for this scenario. Seems a bit overkill.

Audra 1 year ago

I think Option D is the way to go. Adding an AWS Network Firewall and configuring the outbound rule seems like a more robust solution than just using a security group.

Fletcher 1 year ago

↳ replying to Audra

I'm leaning towards option C, adding an AWS WAF web ACL for extra protection.

Barbra 1 year ago

↳ replying to Audra

I think option A could work too, just adding an outbound rule to the security group.

Patria 1 year ago

↳ replying to Audra

I agree, option D with the AWS Network Firewall sounds like a secure choice.

Romana 1 year ago

↳ replying to Audra

I would go with Option D as well. The AWS Network Firewall seems like a solid solution.

Carlton 1 year ago

↳ replying to Audra

I think Option D is the best option too. It provides an extra layer of protection.

Rosalia 1 year ago

↳ replying to Audra

I agree, Option D with the AWS Network Firewall sounds like a secure choice.

Kate 1 year ago

Option B seems the most straightforward way to meet the requirements. Allowing only the FQDN of the payroll SaaS provider through the network ACL is a good approach.

Marion 1 year ago

↳ replying to Kate

Definitely, it's important to follow corporate security guidelines.

Flo 1 year ago

↳ replying to Kate

Agreed, filtering the FQDN through the network ACL is a secure method.

Gail 1 year ago

↳ replying to Kate

Option B seems the most straightforward way to meet the requirements.

Bobbye 2 years ago

I think option C could also work by adding an AWS WAF web ACL to the VPC. It's important to consider all options before making a decision.

Junita 2 years ago

I agree with Owen. It's important to only allow the necessary outbound traffic to meet the security guidelines.

Owen 2 years ago

I think the company should add an outbound rule to the security group of the SAP PO system to allow the FQDN of the payroll SaaS provider.

Amazon PAS-C01 Exam - Topic 1 Question 10 Discussion