SCS-C03 practice question: Central security policies with Firewall Manager
Security Foundations and Governance A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A financial data company runs 80 AWS accounts for its customer portals. Each account has its own Application Load Balancers, and the web application teams create new load balancers often. A recent credential-stuffing attack hit one account because its load balancer had no web ACL.
The central security team wants every Application Load Balancer in the organization, including new ones, to have the same managed WAF rules, and no account administrator should be able to remove them. The company already uses AWS Organizations with a delegated security administrator account.
Which solution meets these requirements?
Choose one answer.
AA. From the delegated administrator account, create an AWS Firewall Manager WAF policy for Application Load Balancers across the organization, with auto-remediation turned on.
BB. Use an AWS CloudFormation StackSet to deploy the same WAF web ACL and association into each account, and run the StackSet once a month to catch new load balancers. Account administrators keep the template for their own changes.
CC. Enable AWS Security Hub CSPM in every account, and turn on a control that flags any load balancer without a web ACL. The security team reviews the findings each day and attaches web ACLs by hand.
DD. Attach a web ACL with the managed rules to the CloudFront distributions in the management account, and ask the application teams to place their load balancers behind those distributions. The distributions will then filter the traffic.
Show the answer and explanation
Answer: A
A. Right: Correct. A Firewall Manager policy in the delegated administrator account applies the web ACL to matching load balancers across accounts, including those created later. Auto-remediation reapplies the association if an account administrator removes it. Learn more: What is AWS Firewall Manager? (opens in a new tab)
B. Wrong: A monthly run leaves new load balancers unprotected for weeks, which misses the requirement. Account administrators could also edit or detach the web ACL between runs.
C. Wrong: Findings show gaps but do not enforce the rule, and a manual fix leaves the gap open until someone acts. The requirement is that protection is applied automatically to new load balancers.
D. Wrong: This protects only traffic that passes through the distributions, and the Application Load Balancers in member accounts can still be reached directly. It also relies on each team following the setup, which nothing enforces.
Explanation
Firewall Manager policies run from a delegated administrator account and apply WAF web ACLs to matching resources across an organization. Auto-remediation covers load balancers created later and reapplies the web ACL when it is removed. Monthly stacks, manual findings, and a CloudFront workaround each leave a gap in the requirement.
Want more on Central security policies with Firewall Manager? The 5 full-length practice sets have 5 more Central security policies with Firewall Manager questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →