Discuss Amazon SAP-C02 Exam Topic 1 Question 9

A company has 10 accounts that are part of an organization in AWS Organizations AWS Config is configured in each account All accounts belong to either the Prod OU or the NonProd OU

The company has set up an Amazon EventBridge rule in each AWS account to notify an Amazon Simple Notification Service (Amazon SNS) topic when an Amazon EC2 security group inbound rule is created with 0.0.0.0/0 as the source The company's security team is subscribed to the SNS topic

For all accounts in the NonProd OU the security team needs to remove the ability to create a security group inbound rule that includes 0.0.0.0/0 as the source

Which solution will meet this requirement with the LEAST operational overhead?

AModify the EventBridge rule to invoke an AWS Lambda function to remove the security group inbound rule and to publish to the SNS topic Deploy the updated rule to the NonProd OU

BAdd the vpc-sg-open-only-to-authorized-ports AWS Config managed rule to the NonProd OU

CConfigure an SCP to allow the ec2 AulhonzeSecurityGrouplngress action when the value of the aws Sourcelp condition key is not 0.0.0.0/0 Apply the SCP to the NonProd OU

DConfigure an SCP to deny the ec2 AuthorizeSecurityGrouplngress action when the value of the aws Sourcelp condition key is 0.0.0.0/0 Apply the SCP to the NonProd OU

Suggested Answer: D

This solution will meet the requirement with the least operational overhead because it directly denies the creation of the security group inbound rule with 0.0.0.0/0 as the source, which is the exact requirement. Additionally, it does not require any additional steps or resources such as invoking a Lambda function or adding a Config rule.

An SCP (Service Control Policy) is a policy that you can use to set fine-grained permissions for your AWS accounts within your organization. You can use SCPs to set permissions for the root user of an account and to delegate permissions to IAM users and roles in the accounts. You can use SCPs to set permissions that allow or deny access to specific services, actions, and resources.

To implement this solution, you would need to create an SCP that denies the ec2:AuthorizeSecurityGroupIngress action when the value of the aws:SourceIp condition key is 0.0.0.0/0. This SCP would then be applied to the NonProd OU. This would ensure that any security group inbound rule that includes 0.0.0.0/0 as the source will be denied, thus meeting the requirement.

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html

https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_condition-keys.html

Get Premium SAP-C02 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Viola 11 months ago

Totally agree with D, it’s straightforward and effective!

Thaddeus 12 months ago

A is too complicated for what we need.

Tyra 12 months ago

Wait, can we really just use an SCP for this?

Justine 1 year ago

I think D is the best choice for security.

Mirta 1 year ago

Option B seems like the easiest fix.

Tori 1 year ago

I keep getting confused between modifying EventBridge rules and using SCPs. I feel like option A might add more overhead, so I’m leaning towards D for simplicity.

Raina 1 year ago

I practiced a similar question about security group rules and SCPs. I think option C could work too, but it seems more complex than just denying the action outright.

Felix 1 year ago

I'm not entirely sure, but I feel like using AWS Config rules could help. Option B sounds familiar, but I wonder if it actually prevents the creation of those rules effectively.

Shawn 1 year ago

I remember studying about Service Control Policies (SCPs) and how they can restrict actions across accounts. I think option D might be the right choice since it directly denies the action for 0.0.0.0/0.

Floyd 1 year ago

This seems like a straightforward question about business functions. I'll need to think carefully about the key responsibilities of each function type.

Socorro 1 year ago

I'm a bit stumped on this one. Enabling ARR doesn't seem to address the specific requirements we have for session state and HTTP response storage. I'll need to review the problem statement again and see if I can come up with a better solution.

Ashton 1 year ago

Hmm, I'm a bit unsure. Isn't there a difference between convenience and shopping products? I remember discussing that in class.

Amazon SAP-C02 Exam - Topic 1 Question 9 Discussion