CLF-C02 Practice Question 75: Central Firewall Management

AWS Firewall Manager simplifies administering protections across multiple accounts and resources, including AWS WAF, AWS Shield Advanced, VPC security groups and network ACLs, AWS Network Firewall and Route 53 Resolver DNS Firewall. You set up the protections once, and Firewall Manager automatically applies them across your accounts and resources, even as you add new ones. AWS calls it particularly useful when you want to protect a whole organization rather than a few accounts, or when you add resources often.

Option A, AWS Shield Standard, gives automatic protection against common DDoS attacks, but it does not deploy or manage WAF rules. Option C, AWS Config, can *detect* resources that are not compliant, for example a load balancer without a web ACL. It does not centrally push the same rules into every account. Option D, Amazon GuardDuty, detects threats by analyzing logs and other data sources. It does not manage firewall rules.

Reference: AWS Firewall Manager