DOP-C02 practice question: Security Hub, GuardDuty and defense in depth (2 of 3)
Security and Compliance A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A video streaming service runs about 30 VPCs in one Region. Its services in those VPCs call a fixed list of third-party domains for licensing and analytics, and security wants all outbound internet traffic filtered by domain name and inspected centrally.
Some teams need to reach other domains for testing, and the security team wants those requests logged and blocked by default. The inspection must work for the whole estate from one place, with managed rule groups where possible.
Which approach meets these requirements?
Choose one answer.
AA. Tighten the security groups of every instance so that they only allow outbound traffic on ports 80 and 443, and rely on the security groups to restrict the destination domains.
BB. Add a network ACL to each subnet that denies traffic to any destination that is not on the list of approved IP addresses, and update the list when the third parties change addresses.
CC. Route outbound traffic through a transit gateway to an inspection VPC that runs AWS Network Firewall, with stateful domain rules that allow approved domains and drop the rest.
DD. Deploy AWS WAF in front of every service, and use a web ACL with a rule that blocks requests to domains that are not on the approved list.
Show the answer and explanation
Answer: C
A. Wrong: Security groups filter by IP address and port, not by domain name, and they cannot inspect the traffic. The requirement is domain-level filtering, which they do not provide. Learn more: Security group rules (opens in a new tab)
C. Right: Correct. Network Firewall in a central inspection VPC filters traffic by domain name using stateful rules, logs every decision, and can use managed rule groups. The transit gateway sends each VPC's outbound traffic to it. Learn more: What is AWS Network Firewall? (opens in a new tab)
AWS Network Firewall can sit in a central inspection VPC, reached from the other VPCs through a transit gateway, and its stateful rules can allow or drop traffic by domain name while logging each decision. Security groups and network ACLs work on addresses and ports, and WAF protects inbound web requests rather than outbound calls.
Want more on Security Hub, GuardDuty and defense in depth? The 5 full-length practice sets have 13 more Security Hub, GuardDuty and defense in depth questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →