Topic 1 Question 189
A company needs to ensure that flow logs remain configured for all existing and new VPCs in its AWS account. The company uses an AWS CloudFormation stack to manage its VPCs. The company needs a solution that will work for any VPCs that any IAM user creates.
Which solution will meet these requirements?
Add the AWS::EC2::FlowLog resource to the CloudFormation stack that creates the VPCs.
Create an organization in AWS Organizations. Add the company's AWS account to the organization. Create an SCP to prevent users from modifying VPC flow logs.
Turn on AWS Config. Create an AWS Config rule to check whether VPC flow logs are turned on. Configure automatic remediation to turn on VPC flow logs.
Create an IAM policy to deny the use of API calls for VPC flow logs. Attach the IAM policy to all IAM users.
ユーザの投票
コメント(4)
- 正解だと思う選択肢: C
SCPs only prevent people from changing the VPC flow log configuration. It doesn't ensure it's on.
👍 2d262e672024/01/02 - 正解だと思う選択肢: C
It's C, here is a reference how to do it:
https://aws.amazon.com/blogs/mt/how-to-enable-vpc-flow-logs-automatically-using-aws-config-rules/
👍 1csG132023/12/29 - 正解だと思う選択肢: C
Answer is C.
👍 1kabary2024/01/01
シャッフルモード