Central security policies with Firewall Manager: SCS-C03 study notes and practice questions

What to know for the exam

These questions describe many accounts and VPCs that must share the same protections, sometimes with new accounts joining later. Firewall Manager is the answer when the requirement is central, consistent and automatic. The underlying service that filters traffic still depends on the layer the question names.

What decides the answer

• Setup needs AWS Organizations with all features and a designated Firewall Manager administrator account, often the security tooling account. Many policy types also depend on AWS Config recording in each account.
• WAF policies apply web ACLs with managed rule groups to supported resources, such as CloudFront distributions, Application Load Balancers and API Gateway stages, across the accounts in scope.
• Shield Advanced policies turn on Shield Advanced protections for resources across accounts, for DDoS protection at scale.
• Network Firewall policies deploy AWS Network Firewall into VPCs and route traffic through it, using the rule groups in the policy.
• DNS Firewall policies apply Route 53 Resolver DNS Firewall rules across VPCs.
• Security group policies enforce a common set of rules across VPCs, audit for rules that are not allowed, or find unused security groups.
• Automatic scope: a policy applies to accounts in scope when they join the organization or OU, and to new resources of the supported types. That is why Firewall Manager is the answer for “accounts created later.”
• Firewall Manager does not inspect traffic. WAF, Shield, Network Firewall and DNS Firewall do the filtering. Firewall Manager deploys and maintains them.

How to choose

Common traps

• Calling Firewall Manager a firewall. It is a central manager for other firewalls.
• Using WAF for non-web traffic. WAF inspects HTTP and HTTPS requests. For traffic inside VPCs, the answer is Network Firewall.
• Creating the same rules by hand in each account when the requirement is consistency and automatic coverage.
• Skipping the administrator account setup. Policies cannot be created until the delegated administrator is designated.
• Using Security Hub CSPM to block traffic. Security Hub CSPM reports findings. Firewall Manager deploys the controls.
• Forgetting AWS Config. Many policy types depend on Config recording in each account in scope, so an account without it is not fully covered.

Read the Firewall Manager developer guide and the AWS Network Firewall overview. The first explains policy types and prerequisites, and the second explains the firewall that Firewall Manager deploys into VPCs.

Try the 1 practice question ↓