Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
AWS Certified Solutions Architect - Professional · AWS
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Why Option B Is the Best Fit Proactive controls in AWS Control Tower use CloudFormation hooks to validate resource configurations before deployment. By setting the AssociatePublicIpAddress property to False, you ensure that: - New EC2 instances cannot be launched with public IPs. - The control is enforced across all accounts in the OU, maintaining centralized governance. - Deployment fails if the configuration violates the control, preventing misconfigurations before they occur. This approach is preventive and scalable, aligning perfectly with the requirement to block public IPs for both new and existing EC2 instances.
"Behavior of proactive controls Proactive controls check resources whenever those resources are created or updated by means of AWS CloudFormation stack operations. Specifically, these proactive controls are implemented as preCreate and preUpdate hook handlers. As a consequence, these controls may not affect requests that are made directly to services through the AWS console, through AWS APIs, or through other means such as AWS SDKs, or other Infrastructure-as-Code (IaC) tools. For more information about when preCreate and preUpdate hooks operate, see AWS CloudFormation hooks."
Control Tower's Proactive Control Uses Cloud Formation. This means AWS CLI, AWS API, AWS console will be able to bypass Proactive controls. OPtion C of using new SCP will enforce Public IP restriction effectively.