AWS Certified Advanced Networking - Specialty
Get started today
Ultimate access to all questions.
Which solution will allow the company's network security team to automatically receive alerts and terminate NAT gateways upon launch in any VPC, while minimizing administrative overhead and providing a straightforward method to review compliance history across multiple AWS accounts?
Which solution will allow the company's network security team to automatically receive alerts and terminate NAT gateways upon launch in any VPC, while minimizing administrative overhead and providing a straightforward method to review compliance history across multiple AWS accounts?
Explanation:
The question requires a solution that can be deployed across AWS accounts with minimal administrative overhead, provides immediate alerts to the network security team upon NAT gateway creation, and offers a simple way to view compliance history. Option A involves deploying a script on an EC2 instance in each account, which increases administrative overhead and does not provide a centralized compliance history view. Option B uses AWS Lambda and AWS SAM for deployment, which reduces administrative overhead, and Amazon OpenSearch Service for logging, providing a centralized view. However, it does not directly mention compliance history. Option C leverages Amazon GuardDuty and Amazon EventBridge for detection and response, with logs stored in Amazon S3, but it does not explicitly address compliance history. Option D utilizes AWS Config and AWS Systems Manager for detection, remediation, and deployment across accounts using AWS CloudFormation StackSets, which minimizes administrative overhead. AWS Config also provides a compliance history, making it the best option. Therefore, the correct answer is D.