Exam AWS Certified Solutions Architect - Professional topic 1 question 936 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional

Question #: 936
Topic #: 1

[All AWS Certified Solutions Architect - Professional Questions]

A company has an organization in AWS Organizations that has a large number of AWS accounts. One of the AWS accounts is designated as a transit account and has a transit gateway that is shared with all of the other AWS accounts. AWS Site-to-Site VPN connections are configured between all of the company's global offices and the transit account. The company has AWS Config enabled on all of its accounts.
The company's networking team needs to centrally manage a list of internal IP address ranges that belong to the global offices. Developers will reference this list to gain access to their applications securely.
Which solution meets these requirements with the LEAST amount of operational overhead?

A. Create a JSON file that is hosted in Amazon S3 and that lists all of the internal IP address ranges. Configure an Amazon Simple Notification Service (Amazon SNS) topic in each of the accounts that can be invoked when the JSON file is updated. Subscribe an AWS Lambda function to the SNS topic to update all relevant security group rules with the updated IP address ranges.
B. Create a new AWS Config managed rule that contains all of the internal IP address ranges. Use the rule to check the security groups in each of the accounts to ensure compliance with the list of IP address ranges. Configure the rule to automatically remediate any noncompliant security group that is detected.
C. In the transit account, create a VPC prefix list with all of the internal IP address ranges. Use AWS Resource Access Manager to share the prefix list with all of the other accounts. Use the shared prefix list to configure security group rules in the other accounts.
D. In the transit account, create a security group with all of the internal IP address ranges. Configure the security groups in the other accounts to reference the transit account's security group by using a nested security group reference of "<transit-account-id>/sg-1a2b3c4d".

Show Suggested Answer

Suggested Answer: C 🗳️

by Cloudxie at Sept. 14, 2022, 12:46 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

redipa

Highly Voted 2 years, 8 months ago

Selected Answer: C

C - Prefix list Customer-managed prefix lists — Sets of IP address ranges that you define and manage. You can share your prefix list with other AWS accounts, enabling those accounts to reference the prefix list in their own resources. https://docs.aws.amazon.com/vpc/latest/userguide/managed-prefix-lists.html

upvoted 8 times

...

Jonfernz

Most Recent 2 years, 7 months ago

Selected Answer: C

https://docs.aws.amazon.com/vpc/latest/userguide/sharing-managed-prefix-lists.html

upvoted 1 times

...

Cloudxie

2 years, 8 months ago

https://docs.aws.amazon.com/vpc/latest/userguide/managed-prefix-lists.html

upvoted 4 times

...