ExpertHard1 markMultiple Choice
AWS SAP-C02 · Question 51 · Domain 1.2: Security Controls
An enterprise wants to enforce strict data perimeter controls. They must ensure that IAM principals in their organization can only access AWS resources from within their corporate network or their VPCs. Which TWO mechanisms should be used together? (Select TWO)
An enterprise wants to enforce strict data perimeter controls. They must ensure that IAM principals in their organization can only access AWS resources from within their corporate network or their VPCs. Which TWO mechanisms should be used together? (Select TWO)
Answer options:
A.
AWS Organizations Service Control Policies (SCPs) with aws:SourceIp conditions.
B.
VPC Endpoints with resource policies restricting access to the Organization ID.
C.
AWS WAF attached to all S3 buckets.
D.
Security Groups allowing only corporate IPs.
E.
AWS Network Firewall blocking outbound internet access.
F.
IAM Identity Center permission sets with MFA enabled.
How to approach this question
Combine identity-based and network-based controls.
Full Answer
AWS Organizations Service Control Policies (SCPs) with aws:SourceIp conditions., VPC Endpoints with resource policies restricting access to the Organization ID.
Data perimeters are built using SCPs to restrict network origin (aws:SourceIp/aws:SourceVpc) and VPC endpoint policies to restrict resource access to specific organizations.
Common mistakes
Thinking Security Groups can protect AWS API endpoints.
Practice the full AWS Solutions Architect Professional SAP-C02 Practice Exam 3
75 questions · hints · full answers · grading
More questions from this exam
Q01An enterprise has 100 VPCs across 5 AWS Regions. They need to establish a highly available, trans...HardQ02A company uses AWS Organizations. The CISO requires that no EC2 instances can be launched outside...MediumQ03An application uses Amazon Aurora PostgreSQL. To meet disaster recovery requirements, the databas...HardQ04A company is setting up a new multi-account AWS environment. They want to automate the creation o...MediumQ05An organization wants to allocate AWS costs to specific departments. They use multiple AWS accoun...Medium