A Company with Multiple Accounts Is Currently Using a Configuration

question 263

Multiple Choice

A company with multiple accounts is currently using a configuration that does not meet the following security governance policies: Prevent ingress from port 22 to any Amazon EC2 instance. Require billing and application tags for resources. Encrypt all Amazon EBS volumes. A solutions architect wants to provide preventive and detective control, including notifications about a specific resource, if there are policy deviations. Which solution should the solutions architect implement?

• A) Create an AWS CodeCommit repository containing policy-compliant AWS CloudFormation templates. Create an AWS Service Catalog portfolio. Import the CloudFormation templates by attaching the CodeCommit repository to the portfolio. Restrict users across all accounts to items from the AWS Service Catalog portfolio. Use AWS Config managed rules to detect deviations from the policies. Configure an Amazon CloudWatch Events rule for deviations, and associate a CloudWatch alarm to send notifications when the TriggeredRules metric is greater than zero.
• B) Use AWS Service Catalog to build a portfolio with products that are in compliance with the governance polices in a central account. Restrict users across all accounts to AWS Service Catalog products. Share a compliant portfolio to other accounts. Use AWS Config managed rules to detect deviations from the policies. Configure an Amazon CloudWatch Events rule to send a notification when a deviation occurs.
• C) Implement policy-compliant AWS CloudFormation templates for each account, and ensure that all provisioning is completed by CloudFormation. Configure Amazon Inspector to perform regular checks against resources. Perform policy validation and write the assessment output to Amazon CloudWatch Logs. Create a CloudWatch Logs metric filter to increment a metric when a deviation occurs. Configure a CloudWatch alarm to send notifications when the configured metric is greater than zero.
• D) Restrict users and enforce least privilege access using AWS IAM. Consolidate all AWS CloudTrail logs into a single account. Send the CloudTrail logs to Amazon Elasticsearch Service (Amazon ES). Implement monitoring, alerting, and reporting using the Kibana dashboard in Amazon ES and with Amazon SNS.

---

Definitions:

Specified Texture

A defined surface quality or feel of a material, often detailed in engineering and design specifications to ensure consistency.

Mating Part

A component designed to connect with or fit into another component, ensuring a correct assembly or functional interaction between parts.

Material Removal

Material removal refers to the process of eliminating material from a workpiece through machining operations, such as cutting, drilling, or milling to achieve desired dimensions and features.

Material Removal

The process of eliminating excess material from a workpiece to achieve the desired shape, dimensions, or surface finish.