Question 11

Explanation

Correct option:

AWS Firewall Manager offers the freedom to use multiple AWS accounts and to host applications in any desired region while maintaining centralized control over their organization’s security settings and profile. Developers can develop and innovators can innovate, while the security team gains the ability to respond quickly, uniformly, and globally to potential threats and actual attacks.

Firewall Manager is built around named policies that contain WAF rule sets and optional AWS Shield advanced protection. Each policy applies to a specific set of AWS resources, specified by account, resource type, resource identifier, or tag. Policies can be applied automatically to all matching resources, or to a subset that you select. Policies can include WAF rules drawn from within the organization, and also those created by AWS Partners such as Imperva, F5, Trend Micro, and other AWS Marketplace vendors. This gives your security team the power to duplicate their existing on-premises security posture in the cloud.

Firewall Manager has three prerequisites:

1. AWS Organizations – Your organization must be using AWS Organizations to manage your accounts and all features must be enabled.

2. Firewall Administrator – You must designate one of the AWS accounts in your organization as the administrator for Firewall Manager. This gives the account permission to deploy AWS WAF rules across the organization.

3. AWS Config – You must enable AWS Config for all of the accounts in the Organization so that Firewall Manager can detect newly created resources.

Using AWS Firewall Manager to centrally manage your Web Application Portfolio:

via - https://aws.amazon.com/blogs/aws/aws-firewall-manager-central-management-for-your-web-application-portfolio/

Incorrect options:

Create an Amazon GuardDuty policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs - Amazon GuardDuty can automatically update the AWS Web Application Firewall Web Access Control Lists (WebACLs) and VPC Network Access Control Lists (NACLs) in response to GuardDuty findings. But, Amazon GuardDuty is a continuous security monitoring and threat detection service and not a security management service like AWS Firewall Manager. Even though GuardDuty can update web ACLs, it's a reaction to a threat. It cannot be used to proactively define rules for web ACLs across accounts to centrally manage the security infrastructure of an organization.

Configure a managed rule in AWS Config to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs - Enabling AWS Config is a prerequisite for using AWS Firewall Manager. AWS Config can track the status of resources, but AWS Firewall Manager is needed for centrally managing the security infrastructure.

AWS Firewall Manager and AWS Config:

via - https://aws.amazon.com/firewall-manager/

Create an Amazon Systems Manager policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs - This option has been added as a distractor and is irrelevant to the given use case.

References:

https://docs.aws.amazon.com/waf/latest/developerguide/get-started-fms-create-security-policy.html

https://docs.aws.amazon.com/waf/latest/developerguide/get-started-fms-create-security-policy.html