ANS-C01 Network Management and Operations Practice Question
An organization has a multi-account setup using AWS Organizations. The security team wants to centrally manage and enforce security group rules across all VPCs in all accounts. Which solution should they implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Firewall Manager to create common security group policies.
AWS Firewall Manager is the correct solution because it centralizes the management and enforcement of security group rules across all VPCs and accounts in an AWS Organization. It allows the security team to create common security group policies that are automatically applied to new and existing resources. Option A is incorrect because network ACLs are stateless and operate at the subnet level, not suitable for security group-like rules. Option B is incorrect: VPC Flow Logs capture network traffic information for analysis, not enforcement. Option C is incorrect: AWS Config can detect non-compliant security groups but cannot enforce rules; remediation requires additional automation, whereas Firewall Manager provides direct enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a centralized network ACL in each VPC.
Why it's wrong here
NACLs are stateless and not centrally managed.
- ✗
Enable VPC Flow Logs and analyze using Amazon Detective.
Why it's wrong here
Flow Logs are for monitoring, not enforcement.
- ✗
Use AWS Config rules to remediate non-compliant security groups.
Why it's wrong here
Config can detect but not proactively enforce rules.
- ✓
Use AWS Firewall Manager to create common security group policies.
Why this is correct
Firewall Manager centrally manages security groups across accounts.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.