Exam AWS Certified Advanced Networking - Specialty ANS-C01 topic 1 question 209 discussion

CDE - Firewall policy and rule group sharing integrates with AWS Resource Access Manager (AWS RAM). AWS RAM is a service that enables you to share your AWS resources with any AWS account or through AWS Organizations. With AWS RAM, you share resources that you own by creating a resource share. A resource share specifies the resources to share, and the consumers with whom to share them. Consumers can be individual AWS accounts, organizational units, or an entire organization in AWS Organizations. https://docs.aws.amazon.com/network-firewall/latest/developerguide/sharing.html

this is CDE

This combination provides a comprehensive solution to prevent SQL injection attacks: Create a WAF web ACL with appropriate rules Use ALB that can be integrated with WAF Associate WAF with ALB for practical application protection Options B and F are not necessary because the application is internal and does not need CloudFront distribution. Option D is not applicable because NLB cannot be directly integrated with WAF. By implementing these three steps, the company can significantly improve the defense ability of its applications against SQL injection attacks.

Answer is CDE

By creating the firewall policy or rule group in the management account (the central account in AWS Organizations), the engineer can manage these policies centrally, which reduces the need to create and manage separate policies in each of the 50 accounts. AWS RAM allows you to share AWS resources, such as firewall policies and rule groups, across multiple AWS accounts within your organization. This helps minimize the number of policies that need to be created and ensures consistent web filtering across all accounts. Enabling sharing within AWS Organizations allows the resources shared via AWS RAM (such as firewall policies and rule groups) to be accessed by all accounts within the organization. This facilitates the centralized management and application of the web filtering rules across all VPCs in the 50 accounts.