Question 17 of 19
Single answerCertylQ A company is using AWS to run a long-running analysis process on data that is stored in Amazon S3 buckets. The deployed in a private subnet of a VPC that does not have internet access. The EC2 instances and the S3 buckets are in the same AWS account. The EC2 instances access the S3 buckets through an S3 gateway endpoint that has the default access policy. Each EC2 instance is associated with an instance profile role that has a policy that explicitly allows the s3:GetObject action and the s3:PutObject action for only the required S3 buckets. solution to stop this exfiltration of data and to keep the EC2 processing job functional. Which solution will meet these requirements?
AUpdate the policy on the S3 gateway endpoint to allow the S3 actions only if the values of the aws:ResourceOrglD and aws:PrincipalOrglD condition keys match the company's values. aws:ResourceOrgID condition key matches the company's value.
✓BOption B text unavailable (OCR).
CAdd a network ACL rule to the subnet of the EC2 instances to block outgoing connections on port 443.
DApply an SCP on the AWS account to allow the S3 actions only if the values of the aws:ResourceOrglD and aws:PrincipalOrglD condition keys match the company's values.
✓
Correct Answer: B
Option B text unavailable (OCR).
▥
Explanation
The correct answer is highlighted above. Review the wording carefully, then use the next question to continue building your understanding of AWS certification topics.