Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 137 discussion

I think C: https://aws.amazon.com/blogs/security/automatically-block-suspicious-traffic-with-aws-network-firewall-and-amazon-guardduty/

C is correct . Only Network Firewall can block traffic at VPC level. A only updates the list , no blocking action B- WAF and Web ACL can block only HTTPS traffic for a API/VPC endpoint/ Cloudfron distribution not for enire VPC

C, AWS Network Firewall can block traffic at VPC level. https://aws.amazon.com/blogs/security/automatically-block-suspicious-traffic-with-aws-network-firewall-and-amazon-guardduty/

B blocks traffic at the http/https web traffic layer not for VPC layer

C is correct: <a solution to automatically deny traffic> means network FW. A: irrelevant B: We need network fw, not WAF D: irrelevant

hmmm is this the last question as of now(25th Nov 23)

Here's the rationale for choosing this option: AWS Network Firewall: AWS Network Firewall is designed to provide centralized network traffic inspection and filtering. It's a suitable choice for implementing network-level controls. Lambda Function for Automation: Creating a Lambda function to trigger the creation of a Drop action rule in the firewall policy allows for automated response based on Security Hub findings. This enables you to take immediate action when suspicious sources are detected. Specific Action (Drop): The Drop action rule is effective for denying traffic from suspicious sources, effectively controlling access and preventing unwanted traffic. This approach aligns well with the requirement to automatically deny traffic when GuardDuty identifies a new suspicious source, enhancing security in the multi-tenant VPC environment.

A only will upadte threat list. the requirement is to block the taffic. B is corerect. Also it is event driven immditae action

A is right