A retail enterprise with 120 accounts in Organizations needs consistent WAF rules on internet-facing ALBs and centrally managed VPC security groups without local edits. Which central policy deployment approach should the security architect implement to enforce firewall protections from the management account?
Select an answer to reveal the explanation.
Short Explanation
You're steering every ship from one helm, not handing out maps. Central Firewall Manager policies push and repair protections automatically across all accounts.
Full Explanation
AWS Firewall Manager is purpose-built for this scenario because it centrally creates and maintains WAF web ACL associations on internet-facing ALBs and audited security group policies across all 120 Organizations accounts from a delegated administrator, continuously detecting drift and auto-remediating noncompliance while preventing unauthorized local edits. Service control policies from the management account provide strong preventive guardrails that can deny unauthorized ALB or security group changes but cannot provision or attach WAF rules, so the deployment requirement remains unmet. CloudFormation StackSets with auto-deployment is a valid large-scale distribution method for identical WAF associations and baseline groups, yet it only deploys resources and does not continuously enforce compliance, leaving local modifications possible without separate drift control. A centralized inspection VPC with Network Firewall and security groups shared via Resource Access Manager is standard for network-layer filtering, but Network Firewall does not provide Layer-7 WAF protection for ALBs and sharing does not enforce attachment. For the exam, remember Firewall Manager requires Organizations integration and a designated Firewall Manager administrator account and depends on Config for compliance visibility. In practice, verify policy scope, enable auto-remediation with reporting, and test in one organizational unit that manual edits are reverted.