SAP-C02 Practice Question 72: Firewall Manager Organization Wide WAF

AWS Certified Solutions Architect – Professional (SAP-C02) · Test 8 · question 2 of 10

Organizational Complexitymedium

A company has 80 AWS accounts in an AWS Organization, and application teams launch new public Application Load Balancers and new accounts every week. The security team must make sure that every public ALB in every account, including ones created later, is associated with an AWS WAF web ACL that contains the company's baseline rules, and that a baseline set of security group rules is applied in all member accounts. The security team wants non-compliant resources to be reported centrally and does not want to depend on each application team.

Which solution meets these requirements?

Show answer and explanation

Answer:

D. Designate a Firewall Manager administrator account and create AWS WAF and security group policies that apply to the whole organization

AWS Firewall Manager *"simplifies your administration and maintenance tasks across multiple accounts and resources"* for AWS WAF, Shield Advanced, security groups, Network Firewall and DNS Firewall: *"you set up your protections just once and the service automatically applies them across your accounts and resources, even as you add new accounts and resources."* It can protect *"all resources of a particular type"*, *"automatically adds protection to resources that are added to your account"*, and lets you *"apply security group rules to all member accounts or specific subsets of accounts ... and automatically apply the rules to new in-scope accounts"*. Compliance is reported centrally (option D). It requires AWS Organizations, and the charges are for the underlying services, such as AWS WAF and AWS Config.

- A is wrong because StackSets deploy a web ACL but do not associate it with ALBs created later, so protection depends on each application team. - B is wrong because building and maintaining a custom rule and remediation code in every account is exactly the operational load that Firewall Manager removes, and it has no central policy. - C is wrong because an SCP cannot check whether a web ACL is associated with a load balancer, and denying ALB creation blocks teams instead of protecting the resources.

Reference: AWS Firewall Manager

Practice Test 8 ›

Study guides for SAP-C02

Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.

SAP-C02 vs SAP-C03, the Solutions Architect Professional updateWhat changes when AWS replaces SAP-C02 with SAP-C03, the key dates, who should still sit SAP-C02, and how to study through the switch without wasted work.

AWS disaster recovery strategies, RTO and RPOBackup and restore, pilot light, warm standby and active/active on AWS, how RTO and RPO pick between them, and the services each strategy uses.

IAM users, roles and policies on AWSHow IAM users, roles, identity-based and resource-based policies, cross-account access, SCPs and permissions boundaries fit together for AWS exams.

SQS vs SNS vs EventBridge on AWSWhen to use an SQS queue, an SNS topic or an EventBridge bus, plus fan-out, FIFO ordering, visibility timeouts and dead-letter queues for AWS exams.

VPC endpoints vs NAT gateways on AWSWhen to use gateway endpoints, interface endpoints (PrivateLink) or a NAT gateway for private subnets, and the cost and security trade-offs exams test.