Question

Based on the AWS Well-Architected Framework, how should a start-up company with a dynamic AWS environment manage its users and resources securely without affecting the cost? Select (TWO)

A. Create multiple unique IAM users with administrator access for each functional group of the company.

B. Use of AWS CloudFront template versions and revision controls to keep track of the dynamic configuration changes.

C. Use of AWS Organizations with respective OUs that differentiate billing across the company’s functions.

D. Implement the most stringent security measures on the VPC-edge rather than on the resource hosts.

E. Provisioning of resources and compute capacity that accommodates future growth.

Answer 1

Correct Answer: C and D.

Option A is INCORRECT because creating multiple IAM users with administrator privileges is not a best practice.

Rights and privileges should be assigned on a least privileged basis.

Option B is INCORRECT because AWS CloudFront service is a content distribution service that does not have configuration templates, neither does it perform this function.

This is the function of AWS CloudFormation.

Option C is CORRECT Based on the Cost and Optimization pillar, a focal area is the analysis of cost within the AWS environment and how they are distributed within functional groups or departments of the company.

And AWS Organization provides composite billing into a single account.

Option D is CORRECT Based on the Security pillar, it is advantageous to filter unwanted traffic at VPC-edge rather than on the hosts.

It is a best practice to drop undesirable packets before they enter the AWS.

Option E is INCORRECT because provisioning of resources and compute capacity that accommodates future growth means that there is a capacity that is idle in anticipation of long-term growth.

According to the AWS Well-Architected Framework reliability pillar, this is not cost-effective; the company should only pay for what is being used.