ANS-C01 practice question 29 of 35

A company's AWS infrastructure is spread across more than 50 accounts and across five AWS Regions. The company needs to manage its security posture…

A company's AWS infrastructure is spread across more than 50 accounts and across five AWS Regions. The company needs to manage its security posture with simplified administration and maintenance for all the AWS accounts. The company wants to use AWS Firewall Manager to manage the firewall rules and requirements. The company creates an organization with all features enabled in AWS Organizations. Which combination of steps should the company take next to meet the requirements? (Select THREE.)

Answer options

A: Configure only the Firewall Manager administrator account to join the organization.

B: Configure all the accounts to join the organization. Correct answer

C: Set an account as the Firewall Manager administrator account. Correct answer

D: Set an account as the Firewall Manager child account.

E: Set up AWS Config for all the accounts and all the Regions where the company has resources. Correct answer

F: Set up AWS Config for only the organization's management account.

Correct Answer:

B. Configure all the accounts to join the organization.; C. Set an account as the Firewall Manager administrator account.; E. Set up AWS Config for all the accounts and all the Regions where the company has resources.

Explanation

To use AWS Firewall Manager, several prerequisites must be met. The organization must have all features enabled in AWS Organizations. A specific account must be designated as the Firewall Manager administrator. All accounts that will be managed, including the administrator account, must be part of the organization. Crucially, AWS Config must be enabled for all member accounts in every AWS Region where you intend to manage resources. Firewall Manager relies on AWS Config to detect resources and monitor for non-compliant security policies. This combination of steps establishes the necessary foundation for centralized security policy management.

Why Incorrect

A. Firewall Manager requires all accounts to be managed, not just the administrator account, to be part of the organization for policy enforcement.
D. The correct term is a "member account" within AWS Organizations, and you designate an "administrator account," not a "child account," for Firewall Manager.
F. AWS Config must be enabled for all member accounts where resources are managed, not just the organization's management account, to ensure compliance checking.

References

1. AWS Firewall Manager Developer Guide. (2023). Prerequisites for AWS Firewall Manager. AWS Documentation. Retrieved from https://docs.aws.amazon.com/waf/latest/developerguide/fms-prereqs.html. (This page explicitly lists: 1. AWS Organizations, 2. A Firewall Manager administrator account, 3. AWS Config enabled for member accounts).

2. AWS Firewall Manager Developer Guide. (2023). AWS Config. AWS Documentation. Retrieved from https://docs.aws.amazon.com/waf/latest/developerguide/fms-prereqs.html#fms-prereqs-config. (This section states, "You must enable AWS Config for each member account in your organization...").

3. AWS Organizations User Guide. (2023). Enabling all features in your organization. AWS Documentation. Retrieved from https://docs.aws.amazon.com/organizations/latest/userguide/orgsmanageorgsupport-all-features.html. (This confirms the initial step mentioned in the question's premise).

Keep practicing

Take the free ANS-C01 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test