AWS Firewall Manager and Config Prerequisites

ANS-C01 By islever Editorial Last updated Aug 21, 2026

Short answer

BCE Configure all the accounts to join the organization. Set an account as the Firewall Manager administrator account. Set up AWS Config for all the accounts and all the Regions where the company has resources.

Question

A company's AWS infrastructure is spread across more than 50 accounts and across five AWS Regions. The company needs to manage its security posture with simplified administration and maintenance for all the AWS accounts. The company wants to use AWS Firewall Manager to manage the firewall rules and requirements. The company creates an organization with all features enabled in AWS Organizations. Which combination of steps should the company take next to meet the requirements? (Choose three.)

Configure only the Firewall Manager administrator account to join the organization.
Configure all the accounts to join the organization. Correct Answer
Set an account as the Firewall Manager administrator account. Correct Answer
Set an account as the Firewall Manager child account.
Set up AWS Config for all the accounts and all the Regions where the company has resources. Correct Answer

Key Takeaways

The question tests the specific architectural prerequisites for AWS Firewall Manager; the trap is thinking only the admin account needs configuration, whereas AWS Config must be enabled in all accounts/regions to detect non-compliant resources.

To centrally manage security posture across multiple AWS accounts using Firewall Manager, you must enable full AWS Organizations, designate a Firewall Manager administrator, and deploy AWS Config. Community consensus confirms that these three steps are mandatory prerequisites for centralized policy management.

Common mistake: Candidates often select options limiting scope to just the admin account (like A) or miss AWS Config entirely. They fail to realize that Firewall Manager relies on AWS Config to assess compliance across the entire organization, requiring it to be active everywhere.

Expert Analysis

Why the Answer Is Correct

BCE is the correct combination because AWS Firewall Manager requires an organizational structure to function at scale. Option B ensures all accounts are part of the AWS Organization, which is the foundation for centralized management. Option C designates the central control plane (the Admin account). Option E enables AWS Config, which is a strict prerequisite for Firewall Manager to evaluate resource compliance and enforce policies.

Why the Other Options Are Wrong

Option A is incorrect because restricting the organization to only the admin account prevents the other 50+ accounts from being managed. Option D is not a standard configuration step; accounts are simply members of the organization, not explicitly set as 'child accounts' for Firewall Manager purposes. Missing AWS Config (Option E) would leave the company unable to monitor security posture effectively.

Community Comment Notes

Comment [2] correctly highlights that AWS Config enables centralized monitoring across regions. Comment [3] explicitly lists the prerequisites: Full AWS Organizations, AWS Config, and RAM. These comments reinforce that skipping any of these components breaks the centralized security model.

Community Votes

BCE

100%

100% of anonymous learners picked answer BCE. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

rdiaz 👍 4

All accounts, firewall parent and aws config in all accounts.
AzureDP900 👍 2

Option B ensures that all 50+ AWS accounts are under the same management, making it easier to manage security posture. Option C sets up an administrator account within one of these accounts, which can manage all Firewall Manager configurations across the organization. Option E enables centralized monitoring and compliance for resources across all Regions, allowing the company to maintain consistency in their AWS security posture.
woorkim 👍 1

Pre-requisites for Firewall Manager • Enable AWS Organization (full features) • Enable AWS Config • Enable AWS Resource Access Manager (RAM)
cas_tori 👍 1

this is BCE

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide