ANS-C01 Network Security, Compliance and Governance Practice Question

Correct answer & explanation

To centrally manage and enforce the use of VPC endpoints for S3 across all accounts in AWS Organizations, you can combine AWS Service Control Policies (SCPs) to allow or deny VPC endpoint creation at the organizational level, AWS CloudFormation StackSets to deploy VPC endpoints consistently across multiple accounts, and AWS Config rules to detect non-compliant resources such as missing VPC endpoints. Option B (AWS Config rules) is correct because it can evaluate compliance and trigger remediation. Option C (AWS CloudFormation StackSets) is correct because it automates deployment of VPC endpoints in target accounts. Option D (AWS SCPs) is correct because it enforces policies on endpoint creation. Option A (VPC Flow Logs) is wrong because it only logs traffic, not enforce policies. Option E (AWS Transit Gateway) is wrong because it provides network connectivity, not endpoint management.