Exam AWS Certified SysOps Administrator - Associate topic 1 question 351 discussion

Exam question from Amazon's AWS Certified SysOps Administrator - Associate

Question #: 351
Topic #: 1

[All AWS Certified SysOps Administrator - Associate Questions]

A company is managing multiple AWS accounts in AWS Organizations. The company is reviewing internal security of its AWS environment. The company’s security administrator has their own AWS account and wants to review the VPC configuration of developer AWS accounts.

Which solution will meet these requirements in the MOST secure manner?

A. Create an IAM policy in each developer account that has read-only access related to VPC resources. Assign the policy to an IAM user. Share the user credentials with the security administrator.
B. Create an IAM policy in each developer account that has administrator access to all Amazon EC2 actions, including VPC actions. Assign the policy to an IAM user. Share the user credentials with the security administrator.
C. Create an IAM policy in each developer account that has administrator access related to VPC resources. Assign the policy to a cross-account IAM role. Ask the security administrator to assume the role from their account.
D. Create an IAM policy in each developer account that has read-only access related to VPC resources. Assign the policy to a cross-account IAM role. Ask the security administrator to assume the role from their account.

Show Suggested Answer

Suggested Answer: D 🗳️

by kevino81 at June 29, 2023, 3:39 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

james2033

12 months ago

Selected Answer: D

read-only --> A, D. Assign policy to an IAM user --> remove A. Choose D.

upvoted 1 times

...

james2033

12 months ago

Selected Answer: D

A, D --> read-only access. D: cross-account IAM role --> Choose D.

upvoted 1 times

...

LudiVoss

1 year, 5 months ago

Selected Answer: D

D because I am D best admin in the world right now.

upvoted 3 times

...

seifskl

1 year, 9 months ago

Selected Answer: D

The most secure way to provide access between AWS accounts is by using IAM roles with cross-account access. And also, the security administrator only needs read-only access to review the VPC configuration.

upvoted 3 times

...

[Removed]

1 year, 11 months ago

Selected Answer: D

When you set permissions with IAM policies, grant only the permissions required to perform a task. You do this by defining the actions that can be taken on specific resources under specific conditions, also known as least-privilege permissions. https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html

upvoted 2 times

...

Christina666

1 year, 11 months ago

Selected Answer: D

d..........

upvoted 2 times

...

[Removed]

1 year, 11 months ago

The most secure way for the security administrator to review the VPC configuration of developer AWS accounts would be to create an IAM policy in each developer account that has read-only access related to VPC resources and assign the policy to a cross-account IAM role. The security administrator can then assume the role from their own account to review the VPC configuration. This approach avoids sharing user credentials and provides the security administrator with the necessary permissions to review the VPC configuration without granting unnecessary access. So, the correct answer would be D. Create an IAM policy in each developer account that has read-only access related to VPC resources. Assign the policy to a cross-account IAM role. Ask the security administrator to assume the role from their account.

upvoted 4 times

...