Examkin

All practice questions

1462 questions

All types1,462Multiple choice739Multiple select723
Question 261Question →

An organization runs a data processing application on Amazon EC2 instances in a private subnet within the us-east-1 Region. Every day, the application writes 15 TB15\text{ TB} of processed analytics data directly to an Amazon S3 bucket located in the us-west-2 Region. Currently, the private subnet's route table sends all internet-bound traffic (0.0.0.0/00.0.0.0/0) through a NAT Gateway in a public subnet. The organization wants to modify the architecture to minimize data transfer costs. Which solution will reduce the data transfer costs the most?

Show answer & explanation

Answer: Provision a local Amazon S3 bucket in the us-east-1 Region and create an S3 Gateway VPC Endpoint in the VPC. Configure the application to write data to the local bucket, and enable S3 Cross-Region Replication (CRR) to replicate the files to the bucket in us-west-2.

Answer

Provision a local Amazon S3 bucket in the us-east-1 Region, create an S3 Gateway VPC Endpoint, write data locally, and use S3 Cross-Region Replication (CRR) to replicate the files to the bucket in us-west-2.
The correct option is to write data to a local S3 bucket in us-east-1 via a Gateway VPC Endpoint, and then use S3 Cross-Region Replication (CRR) to copy it to us-west-2. S3 Gateway Endpoints are free of charge but only route traffic to S3 buckets in the same Region. Writing to a local bucket via the Gateway Endpoint completely bypasses the NAT Gateway processing fees (0.045perGB).S3CRRthenreplicatesthedatatous−west−2overtheAWSnetworkbackbone,incurringonlythestandardcross−regiondatatransferfee(0.045 per GB). S3 CRR then replicates the data to us-west-2 over the AWS network backbone, incurring only the standard cross-region data transfer fee ( 0.02 per GB) and avoiding any NAT Gateway charges.

Step-by-Step Solution

1
Analyze the current data transfer path and costs.
Writing 15 TB15\text{ TB} daily from EC2 (us-east-1) to S3 (us-west-2) via a NAT Gateway costs 15,000×$0.045=$67515,000 \times \$0.045 = \$675 per day in NAT Gateway processing fees, plus 15,000×$0.02=$30015,000 \times \$0.02 = \$300 per day in cross-region data transfer fees, totaling \$975 daily.
This establishes the baseline cost to optimize.
2
Evaluate the regional constraints of S3 Gateway Endpoints.
S3 Gateway Endpoints only route traffic to S3 buckets in the same Region (us-east-1). Direct transfers to us-west-2 cannot use the local Gateway Endpoint and will continue to traverse the NAT Gateway.
Understanding S3 Gateway Endpoint limitations prevents choosing ineffective configurations.
3
Design a routing path that bypasses the NAT Gateway.
By writing to a local S3 bucket in us-east-1, traffic stays within the same region and is routed through the free S3 Gateway Endpoint, incurring \$0 in NAT Gateway processing and data transfer charges.
Bypassing the NAT Gateway eliminates the largest component of the daily network charges.
4
Replicate the data to the target region using the AWS backbone.
Enabling S3 Cross-Region Replication (CRR) copies the data from us-east-1 to us-west-2. S3 CRR bypasses the NAT Gateway and charges only the standard cross-region data transfer rate of \$0.02 per GB, reducing the total daily cost to \$300.
This satisfies the requirement to store the data in us-west-2 at the minimum possible cost.

Key Concept

S3 Gateway Endpoints are region-specific and free of charge. To avoid NAT Gateway charges for cross-region S3 transfers, data should be written to a local bucket via a Gateway Endpoint and replicated to the destination region using S3 Cross-Region Replication (CRR).
Estimated Time:2m 0s
Question 262Question →

A company is hosting a high-traffic Content Management System (CMS) on Amazon EC2 instances distributed across multiple Availability Zones. The instances must access a shared directory containing millions of small media files. The storage solution must deliver low-latency file operations and automatically scale throughput to handle sudden, unpredictable spikes in traffic without manual provisioning. Which storage configuration best meets these requirements?

Show answer & explanation

Answer: An Amazon EFS file system configured with Elastic throughput.

Answer

An Amazon EFS file system configured with Elastic throughput.
The correct option is the Amazon EFS file system configured with Elastic throughput. Amazon EFS is designed for shared file access across multiple Availability Zones, and Elastic throughput automatically adjusts performance dynamically to handle traffic spikes, paying only for what is used.

Step-by-Step Solution

1
Analyze the file access requirements.
The application requires concurrent, shared access to a single directory from multiple EC2 instances distributed across multiple Availability Zones.
This rules out standard Amazon EBS volumes, which are typically attached to a single instance in a single Availability Zone.
2
Evaluate the scaling and cost performance requirements.
The storage solution must deliver low-latency file operations and scale throughput automatically to handle unpredictable traffic spikes without manual over-provisioning.
This points to a serverless shared storage option with automatic scaling capabilities, such as Amazon EFS with Elastic throughput.
3
Eliminate sub-optimal or invalid storage options.
Amazon EBS gp3 does not support Multi-Attach, and EBS Multi-Attach is limited to a single Availability Zone. S3 Glacier is meant for archiving and introduces retrieval delays. Sharing EBS via NFS on a single EC2 instance introduces a single point of failure and bottleneck.
Eliminating these options confirms that Amazon EFS configured with Elastic throughput is the only highly available, high-performing, and cost-effective solution.

Key Concept

Shared file storage with automatic throughput scaling for unpredictable workloads across multiple Availability Zones.
Question 263Question →

An advertising agency stores high-resolution campaign image assets in an Amazon S3 bucket. Each asset is approximately 15 MB15\text{ MB} in size. The assets are accessed frequently for the first 1010 days of a campaign. After the campaign ends, the assets are accessed occasionally for reporting and analysis for another 1515 days. Once 2525 days have passed since upload, the assets are no longer needed and must be deleted. Which lifecycle configuration is the most cost-effective for these assets?

Show answer & explanation

Answer: Retain the assets in Amazon S3 Standard for the entire 2525 days, and configure a lifecycle rule to expire the objects after 2525 days.

Answer

Retain the assets in Amazon S3 Standard for the entire 25 days, and configure a lifecycle rule to expire the objects after 25 days.
The correct option is to retain the assets in S3 Standard for the entire 25 days and then delete them. Because the total lifecycle of these objects is only 25 days, any transition to Amazon S3 Standard-IA or Amazon S3 Glacier classes will trigger minimum storage duration charges (30 days for S3 Standard-IA and 90 days for S3 Glacier). Thus, keeping the assets in S3 Standard avoids these penalty charges, making it the most cost-effective solution.

Step-by-Step Solution

1
Analyze the lifecycle timeline and access patterns of the assets.
Assets are uploaded to Amazon S3, accessed frequently for 10 days, accessed occasionally for 15 days (days 11 to 25), and must be deleted on day 25.
Understanding the timeline helps determine if transition thresholds and minimum storage durations for S3 classes are met.
2
Evaluate the suitability of S3 Standard-IA storage tier rules.
Transitioning to S3 Standard-IA on day 10 and deleting on day 25 means the assets reside in S3 Standard-IA for only 15 days. This is less than the S3 Standard-IA minimum storage duration of 30 days.
Any deletion or transition prior to the 30-day minimum in S3 Standard-IA results in a prorated charge for the remaining days.
3
Evaluate the suitability of S3 Glacier storage tier rules.
Transitioning to S3 Glacier Flexible Retrieval on day 10 introduces retrieval delays during a period when the assets are still occasionally accessed for reporting. Furthermore, S3 Glacier has a 90-day minimum storage duration, which is violated when the assets are deleted on day 25.
Glacier is not suitable for active analysis, and the 90-day minimum charge leads to high cost penalties.
4
Select the most cost-effective option based on the analysis.
Keeping the assets in S3 Standard for the entire 25-day lifetime avoids all short-term storage penalties and transition fees.
Since the lifetime is shorter than the minimum durations of cost-optimized tiers, keeping files in S3 Standard is the cheapest solution.

Key Concept

Understanding Amazon S3 lifecycle constraints, specifically minimum storage durations for S3 Standard-IA (30 days) and S3 Glacier (90 days), to avoid cost penalties on transient data.
Question 264Question →

A logistics platform is designing an active-passive disaster recovery strategy for its tracking portal under the apex domain logistics-track.com. The primary application is hosted behind an Application Load Balancer (ALB) in the us-east-1 Region, while the secondary disaster recovery site is a static maintenance page hosted on Amazon S3 in the us-west-2 Region. The platform requires that users be directed automatically to the maintenance page if the primary application in us-east-1 becomes unavailable. Which Route 53 configuration should a solutions architect implement to meet these requirements with the least operational overhead?

Show answer & explanation

Answer: Create a primary Failover Alias record for logistics-track.com pointing to the ALB with Evaluate Target Health set to Yes. Create a secondary Failover Alias record pointing to the Amazon S3 bucket.

Answer

Create a primary Failover Alias record for logistics-track.com pointing to the ALB with Evaluate Target Health set to Yes, and a secondary Failover Alias record pointing to the S3 bucket.
The correct configuration uses Route 53 Alias records because CNAME records are invalid at the zone apex (logistics-track.com). It leverages the Failover routing policy to route traffic to the primary ALB when healthy and fall back to the secondary S3 bucket when unhealthy. By setting Evaluate Target Health to Yes, Route 53 automatically monitors the health of the backend targets registered with the ALB, removing the operational overhead of setting up separate Route 53 health checks.

Step-by-Step Solution

1
Determine the record type for the zone apex domain.
An Alias record must be used because standard DNS CNAME records cannot be created at the zone apex (logistics-track.com).
Alias records allow Route 53 to map the zone apex directly to selected AWS resources like ALBs and S3 buckets.
2
Select the appropriate routing policy for the active-passive disaster recovery requirement.
Failover routing policy is selected.
Failover routing is specifically designed for active-passive disaster recovery configurations where traffic is sent to a primary resource when healthy, and to a secondary resource when the primary is unhealthy.
3
Configure health checks for the primary destination.
Set Evaluate Target Health to Yes on the primary record.
Setting Evaluate Target Health to Yes allows Route 53 to use the health checks defined on the ALB's target groups, eliminating the need to create and manage custom Route 53 health checks manually.

Key Concept

Route 53 DNS Failover for Zone Apex using Alias Records
Question 265Question →

A financial company runs a daily audit process that analyzes transaction logs uploaded to an Amazon S3 bucket. The daily processing workload is highly variable: 95%95\% of the log files are small and take less than 22 minutes to process, while the remaining 5%5\% of the files contain aggregated transaction records and can take up to 2525 minutes to process. The audit process must scale dynamically to handle volume spikes during quarter-end reporting and minimize idle compute costs.

Which combination of actions should a solutions architect recommend to meet these requirements most cost-effectively? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Trigger AWS Lambda functions from Amazon S3 Event Notifications to process the files that take less than 1515 minutes to run.; Submit containerized processing jobs to AWS Batch running on AWS Fargate Spot for files that take longer than 1515 minutes to run.

Answer

The most cost-effective solution uses AWS Lambda to process the short-running files (under 1515 minutes) and AWS Batch on AWS Fargate Spot to process the long-running files (up to 2525 minutes).
For the files that take less than 22 minutes to run, AWS Lambda provides a fully managed, serverless execution model that scales automatically with the input and charges only for execution time. For the aggregated transaction files taking up to 2525 minutes, AWS Lambda cannot be used due to its hard timeout limit of 1515 minutes. Packaging these jobs into containers and running them via AWS Batch using AWS Fargate Spot capacity providers allows the jobs to run without timeout limits while avoiding idle compute costs and achieving up to a 70%70\% discount compared to On-Demand rates.

Step-by-Step Solution

1
Analyze the execution times of the workload to determine compute boundaries.
Identify that 95%95\% of files finish in under 22 minutes (well below the 1515-minute timeout of AWS Lambda), while 5%5\% of files require up to 2525 minutes (which exceeds the limit of AWS Lambda).
This shows that a hybrid compute strategy is required because AWS Lambda cannot execute for longer than 1515 minutes.
2
Select the most cost-effective option for the short-running tasks.
Choose AWS Lambda triggered by Amazon S3 Event Notifications.
AWS Lambda is serverless, scales automatically with the files uploaded, and incurs no charges when there are no files to process.
3
Select the most cost-effective option for the long-running tasks.
Choose AWS Batch running on AWS Fargate Spot.
AWS Batch manages containerized batch workloads without administrative overhead, and Fargate Spot provides a serverless execution model with a discount of up to 70%70\% compared to On-Demand pricing, which is ideal for stateless batch jobs.

Key Concept

Using a hybrid serverless model to handle variable workloads, aligning compute choice (AWS Lambda vs. AWS Batch on Fargate Spot) with execution time limits to optimize cost and scalability.
Question 266Question →

A company is developing a hybrid cloud application. A component of the application runs on a physical server in the company's on-premises data center and requires programmatic access to write transaction logs to an Amazon DynamoDB table. To comply with security standards, the application must not use long-term AWS credentials, and access must be secured using the company's existing on-premises public key infrastructure (PKI). Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Configure AWS IAM Roles Anywhere. Establish a trust anchor using the on-premises Certificate Authority (CA) and associate it with an IAM role that has write permissions to the DynamoDB table. Configure the on-premises application to exchange its X.509 digital certificate for temporary AWS credentials.

Answer

Configure AWS IAM Roles Anywhere by establishing a trust anchor with the on-premises Certificate Authority (CA), associating it with an IAM role, and exchanging X.509 digital certificates for temporary AWS credentials.
The correct solution uses AWS IAM Roles Anywhere to extend IAM role capabilities to workloads outside of AWS. By setting up a trust anchor with the on-premises Certificate Authority (CA), the on-premises application can exchange its X.509 certificate for temporary, short-lived AWS credentials. This avoids the use of long-term credentials and utilizes the existing PKI infrastructure.

Step-by-Step Solution

1
Establish trust with the on-premises environment.
Create a trust anchor in AWS IAM Roles Anywhere using the company's existing Certificate Authority (CA) certificate.
This establishes a cryptographic trust relationship between AWS IAM Roles Anywhere and the on-premises PKI.
2
Define permissions and trust relationships.
Create an IAM role with write permissions to the DynamoDB table, and define a trust policy that allows the IAM Roles Anywhere service principal (rolesanywhere.amazonaws.com) to assume the role.
This ensures the temporary credentials obtained will have the correct permissions and that IAM Roles Anywhere is authorized to assume the role.
3
Associate the role with a profile and request credentials.
Create an IAM Roles Anywhere profile containing the IAM role. Configure the on-premises application to use the credential helper tool to sign requests with its X.509 certificate and request temporary credentials.
This dynamically generates short-lived IAM credentials for the application without storing any long-term AWS access keys on-premises.

Key Concept

AWS IAM Roles Anywhere enables on-premises workloads to securely obtain temporary AWS credentials using local digital certificates (X.509) instead of using long-term IAM access keys, aligning with security best practices.
Question 267Question →

A startup is setting up its AWS environment and wants to establish secure access for its developers and applications. The solutions architect needs to follow the principle of least privilege and AWS security best practices. Which TWO actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate the company's corporate identity provider for user access.; Create IAM roles with least-privilege permissions and require users or applications to assume them.

Answer

Configuring AWS IAM Identity Center to federate the company's corporate identity provider and creating IAM roles with least-privilege permissions.
Configuring AWS IAM Identity Center for identity federation and utilizing IAM roles with least-privilege policies are standard AWS best practices. Federation provides central access management using temporary security credentials, while roles enforce granular access limits without relying on long-term keys.

Step-by-Step Solution

1
Evaluate user access requirements.
Identify that using AWS IAM Identity Center for federation is the best practice for directory users.
This avoids creating individual IAM users with long-term access keys and centralizes user management.
2
Apply the principle of least privilege for permissions.
Create IAM roles with minimal necessary permissions that users and systems assume dynamically.
Roles issue short-lived credentials, which reduces the threat window if credentials are intercepted.

Key Concept

AWS Identity and Access Management (IAM) security best practices including identity federation, least-privilege IAM roles, and avoiding long-term credentials or root user usage.
Estimated Time:1m 0s
Question 268Question →

A company needs to grant daily administrative access to a team of solutions architects. The administrators will perform tasks such as launching Amazon EC2 instances and configuring Amazon S3 buckets. Additionally, the company needs to store database connection strings and passwords securely.

Which design choice represents the most secure approach for these requirements?

Show answer & explanation

Answer: Configure individual IAM users or roles with policies granting least privilege for daily administrative tasks, and store the database credentials in AWS Secrets Manager.

Answer

Configure individual IAM users or roles with policies granting least privilege for daily administrative tasks, and store the database credentials in AWS Secrets Manager.
The correct configuration utilizes individual IAM identities (users or roles) adhering to the principle of least privilege, while leveraging AWS Secrets Manager to securely encrypt, store, and manage database credentials. This aligns with AWS security best practices.

Step-by-Step Solution

1
Evaluate the mechanism for administrative access, ensuring the root account is restricted to account-level actions only.
The root account should not be used, and standard administrative tasks should be executed via individual IAM users or roles.
This enforces the principle of least privilege and provides accountability for administrative actions.
2
Analyze the requirement for database credential storage, comparing secure storage options with plaintext parameters.
Sensitive credentials must be encrypted using Secrets Manager, rather than being stored in plaintext.
Plaintext parameters in Systems Manager Parameter Store expose credentials to unauthorized access.
3
Verify if federated access should be used over local IAM users.
If users authenticate via an external identity provider, identity federation is preferred over creating long-term IAM users.
This reduces administrative complexity and centralizes user lifecycle management.

Key Concept

AWS IAM Best Practices (least privilege, avoiding root accounts, and securing sensitive data)
Question 269Question →

A company is onboarding a third-party audit firm to perform security compliance checks on their AWS infrastructure. The auditor needs access to read configuration logs from an Amazon S3 bucket located in the company's production AWS account. The S3 bucket is encrypted using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS). The auditor also needs to retrieve database credentials from AWS Secrets Manager to verify rotation compliance. Which configuration meets these requirements securely under the principle of least privilege?

Show answer & explanation

Answer: Configure a cross-account IAM role in the production account that the auditor's AWS account can assume. Attach an IAM policy to the role that grants read access to the S3 bucket, decryption permissions on the KMS key, and read access to the Secrets Manager secret. Update the KMS key policy in the production account to allow the cross-account role to perform the kms:Decrypt action.

Answer

Configure a cross-account IAM role in the production account that the auditor's AWS account can assume, attach an IAM policy to the role granting access to the S3 bucket, the KMS key, and the Secrets Manager secret, and update the KMS key policy to permit the role to perform the kms:Decrypt action.
The correct configuration implements cross-account access using an IAM role, which is the AWS-recommended security best practice for granting external third-party access. It avoids creating long-term credentials. Since the S3 bucket is encrypted using a Customer Managed Key (CMK), cross-account access requires permissions to be granted in both the role's identity-based policy and the key policy of the KMS key. Granting the role access to the S3 bucket, the KMS key, and the Secrets Manager secret follows the principle of least privilege.

Step-by-Step Solution

1
Create a cross-account IAM role in the production AWS account.
An IAM role is created with a trust policy that permits the auditor's AWS account to assume it.
This establishes secure cross-account delegation and avoids the creation of long-term credentials for external entities.
2
Attach an identity-based policy to the IAM role.
The role is granted permissions to read from the S3 bucket, decrypt using the KMS key, and retrieve the secret from Secrets Manager.
This defines the specific actions the role is authorized to perform under the principle of least privilege.
3
Modify the KMS Customer Managed Key policy in the production account.
The key policy is updated to explicitly allow the cross-account role to perform the kms:Decrypt action.
For cross-account access to resources encrypted with KMS, both the identity-based policy in the calling account/role and the resource-based key policy in the owning account must explicitly allow the action.

Key Concept

Cross-account access delegation using IAM roles, S3 bucket policies, Secrets Manager, and KMS key policies.
Estimated Time:2m 0s
Question 270Question →

A solutions architect is designing a secure architecture for an application running on Amazon EC2 instances. The application needs to retrieve database credentials to connect to an Amazon Aurora database. Which combination of actions should the solutions architect take to grant the application access to the credentials securely? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation.; Create an IAM role with permissions to access the secret, and attach it to the EC2 instances using an instance profile.

Answer

Store the database credentials in AWS Secrets Manager and create an IAM role with permissions to access the secret, attaching it to the EC2 instances using an instance profile.
The correct solution involves storing the credentials in AWS Secrets Manager, which secures and automatically rotates the secret, and using an IAM role attached to the EC2 instance profile. This design allows the application to dynamically retrieve temporary credentials to access the secret, satisfying the principle of least privilege and eliminating long-term hardcoded credentials.

Step-by-Step Solution

1
Store the credentials in AWS Secrets Manager.
The credentials are encrypted at rest and can be rotated automatically.
Securing database credentials prevents unauthorized access and meets security compliance requirements.
2
Create an IAM role that grants access to the specific secret and assign it to the EC2 instance profile.
The application running on the EC2 instances can fetch temporary security credentials automatically.
This avoids hardcoding long-term access keys or using administrative credentials on the instance.

Key Concept

Applying IAM roles for EC2 instances and using Secrets Manager for secure credential storage.
Question 271Question →

A company is onboarding an external contractor team to manage application servers running on Amazon EC2. The contractors authenticate using an external SAML 2.0 identity provider (IdP). The solutions architect must grant the contractors permission to start and stop EC2 instances, ensuring they can only manage instances assigned to their specific project team. The solution must avoid the use of long-term credentials and minimize administrative overhead. Which solution should the solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Configure SAML 2.0 federation to allow contractors to assume an IAM role. Attach an IAM policy to the role that allows ec2:StartInstances and ec2:StopInstances, using a policy condition that matches the principal's project tag with the EC2 instance's project tag.

Answer

The solution that configures SAML 2.0 federation to allow contractors to assume an IAM role, and uses a policy condition to match the principal's project tag with the EC2 instance's project tag.
Configuring SAML 2.0 federation allows users to authenticate via their corporate identity provider and assume an IAM role, which provides temporary security credentials. Employing Attribute-Based Access Control (ABAC) by matching principal tags with resource tags dynamically enforces fine-grained access control. This solution automatically scales as new project teams are added without needing to modify existing IAM policies, thus minimizing administrative overhead.

Step-by-Step Solution

1
Establish federation with the corporate identity provider.
Contractors can authenticate and assume an IAM role to receive temporary security credentials, avoiding long-term access keys.
Security best practices dictate using temporary credentials via federation for external users.
2
Implement Attribute-Based Access Control (ABAC) using resource and principal tags.
The solutions architect designs an IAM policy that checks if the principal tag matches the resource tag.
This dynamically restricts contractors to only start and stop EC2 instances belonging to their specific project team.
3
Verify that no administrative secrets are exposed.
Root credentials are secure, and no access keys are stored in plaintext parameters.
This guarantees compliance with SAA security guidelines and prevents unauthorized privilege escalation.

Key Concept

Attribute-Based Access Control (ABAC) and SAML 2.0 Federation
Question 272Question →

A solutions architect is configuring security for a new AWS account. The account will host an application that connects to an Amazon RDS database. The solutions architect needs to provide access to the AWS Management Console for a team of database administrators who already authenticate using the corporate Active Directory. Additionally, the architect needs to store the database credentials securely. Which TWO actions should the solutions architect take? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure identity federation using AWS IAM Identity Center to grant the database administrators access to the AWS Management Console.; Store the database credentials in AWS Secrets Manager and configure automatic credential rotation.

Answer

The database administrators should access the AWS Management Console using identity federation with AWS IAM Identity Center, and the database credentials should be stored in AWS Secrets Manager with automatic rotation enabled.
The correct actions are to configure identity federation using AWS IAM Identity Center and to store database credentials in AWS Secrets Manager with automatic rotation. Integrating AWS IAM Identity Center with the corporate Active Directory allows users to authenticate using their existing credentials and avoids the need to manage individual IAM users with long-term security keys. AWS Secrets Manager is the designated service to securely store, manage, and automatically rotate database credentials.

Step-by-Step Solution

1
Determine the optimal identity management strategy for the database administrators.
Since the database administrators already authenticate via a corporate Active Directory, configure identity federation using AWS IAM Identity Center instead of creating individual IAM users.
This avoids creating individual IAM users with long-term credentials, conforming to AWS security best practices.
2
Select the correct mechanism for securing database credentials.
Store the credentials in AWS Secrets Manager and enable automatic rotation.
Secrets Manager is built to securely store, retrieve, and automatically rotate credentials, ensuring compliance and minimizing the risk of credential exposure.

Key Concept

AWS Identity and Access Management (IAM) best practices mandate using identity federation instead of long-term credentials for existing directory users, avoiding the use of root user accounts for daily tasks, and securing sensitive database credentials using dedicated secrets management services with automatic rotation.
Question 273Question →

A Solutions Architect is designing a secure multi-account environment using AWS Organizations. The company needs to centrally manage single sign-on access for all employees across the accounts. Additionally, the security team must enforce compliance policies to prevent member accounts from disabling logging. Which combination of AWS services or features should the Solutions Architect implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS IAM Identity Center to configure centralized single sign-on access.; SCPs in AWS Organizations to prevent member accounts from disabling logging.

Answer

AWS IAM Identity Center to configure centralized single sign-on access, and SCPs in AWS Organizations to prevent member accounts from disabling logging.
Centralizing access is best achieved via AWS IAM Identity Center, while enforcing cross-account configuration constraints is the primary function of SCPs applied via AWS Organizations.

Step-by-Step Solution

1
Identify the identity management requirements.
AWS IAM Identity Center provides federated single sign-on across the organization.
This satisfies the requirement for central access control without manual user management in individual accounts.
2
Identify the governance policy requirements.
SCPs in AWS Organizations act as permission guardrails for member accounts.
This allows the security team to block actions like disabling logging at the organizational unit or account level.

Key Concept

AWS multi-account governance using AWS IAM Identity Center for centralized access and SCPs in AWS Organizations for compliance enforcement.
Question 274Question →

A company runs an application on an Amazon EC2 instance. The application needs to read and write items in an Amazon DynamoDB table. According to AWS security best practices, which approach should a solutions architect use to grant the application access to the DynamoDB table?

Show answer & explanation

Answer: Create an IAM role with the required DynamoDB permissions and attach it to the EC2 instance profile.

Answer

Create an IAM role with the required DynamoDB permissions and attach it to the EC2 instance profile.
Creating an IAM role and attaching it to the EC2 instance profile allows the application to automatically and securely obtain temporary credentials. This eliminates the need to manage, distribute, or rotate long-term credentials, adhering to AWS security best practices.

Step-by-Step Solution

1
Define an IAM policy that grants the required read and write actions on the specific DynamoDB table.
An IAM policy document containing the necessary DynamoDB permissions is created.
This enforces the principle of least privilege by restricting access to only the necessary table and actions.
2
Create an IAM role and attach the DynamoDB policy to it.
An IAM role with the correct permissions is created.
Roles are designed to be assumed by AWS services, allowing them to obtain temporary credentials.
3
Attach the IAM role to an EC2 instance profile and associate the instance profile with the EC2 instance.
The EC2 instance is configured with the IAM role.
This allows the application running on the EC2 instance to automatically retrieve temporary credentials via the Instance Metadata Service (IMDS).

Key Concept

AWS service authentication using IAM roles and instance profiles to avoid long-term credentials.
Question 275Question →

An enterprise architecture uses a centralized logging account (Account A) containing an Amazon S3 bucket for security audit logs. The bucket is encrypted using an AWS KMS customer managed key owned by Account A. A security auditing application runs on Amazon EC2 instances in a production account (Account B) and must write compliance reports directly to the S3 bucket in Account A.

Which combination of configuration steps will allow the application to securely write reports to the bucket while adhering to the principle of least privilege?

Show answer & explanation

Answer: Configure the S3 bucket policy in Account A to allow the IAM role of the EC2 instances in Account B to perform the s3:PutObject action. Configure the KMS key policy in Account A to allow the EC2 instances' IAM role to perform the kms:GenerateDataKey action. Attach an identity-based policy to the EC2 instance IAM role in Account B that grants permissions for both actions.

Answer

Configure the S3 bucket policy in Account A to allow the IAM role of the EC2 instances in Account B to perform the s3:PutObject action. Configure the KMS key policy in Account A to allow the EC2 instances' IAM role to perform the kms:GenerateDataKey action. Attach an identity-based policy to the EC2 instance IAM role in Account B that grants permissions for both actions.
For cross-account access where the target S3 bucket is encrypted using a Customer Managed Key, two conditions must be met: both the identity-based policy (in the caller's account) and the resource-based policies (S3 bucket policy and KMS key policy in the target account) must allow the actions. The EC2 instance role in Account B must be granted permissions to perform 's3:PutObject' and 'kms:GenerateDataKey'. Correspondingly, Account A's S3 bucket policy and KMS key policy must trust and allow the EC2 role from Account B to perform these actions.

Step-by-Step Solution

1
Analyze cross-account S3 access requirements.
Identify that the destination S3 bucket is in Account A and the source EC2 instance is in Account B. To allow access, we need both a resource-based policy (S3 bucket policy in Account A) allowing the external entity, and an identity-based policy (IAM role in Account B) allowing the action.
For cross-account access, AWS evaluates permissions in both the truster and trustee accounts; both must explicitly allow the action.
2
Analyze KMS encryption requirements for cross-account S3 uploads.
Determine that since the bucket uses a Customer Managed Key in Account A, the S3 client must generate a data key. This requires kms:GenerateDataKey permissions. Both the KMS key policy in Account A and the IAM role in Account B must allow this action.
When writing to a KMS-encrypted S3 bucket, S3 requires the caller to possess permissions to interact with the KMS key for data key generation.
3
Compare credential management and security best practices.
Confirm that using an EC2 instance profile (IAM role) is the most secure method because it automatically handles rotation of temporary credentials. Reject options that use IAM user long-term credentials or root user credentials, and reject storing sensitive keys in plaintext.
This adheres to the AWS Well-Architected Framework security pillar, specifically the principle of least privilege and avoiding long-term credentials.

Key Concept

Cross-Account IAM and Resource Policy Evaluation with KMS Encryption
Question 276Question →

An enterprise application running on Amazon ECS tasks in AWS Account A (111111111111111111111111) must retrieve sensitive daily reports from an Amazon S3 bucket located in AWS Account B (222222222222222222222222). The S3 bucket is encrypted using an AWS KMS customer managed key (CMK) in Account B. The solution must ensure that only the ECS tasks can access the data, adhere strictly to the principle of least privilege, and avoid the use of long-term credentials. Which combination of configurations will securely meet these requirements?

Show answer & explanation

Answer: Configure the ECS task role in Account A with permissions to perform `s3:GetObject` on the S3 bucket and `kms:Decrypt` on the KMS key. In Account B, update the S3 bucket policy and the KMS key policy to explicitly grant `s3:GetObject` and `kms:Decrypt` permissions to the specific ECS task role ARN from Account A.

Answer

Configure the ECS task role in Account A with S3 and KMS permissions, and explicitly grant access to this task role in both the S3 bucket policy and the KMS key policy of Account B.
The correct solution uses an IAM Task Role to supply temporary credentials to the ECS tasks. S3 cross-account access requires the bucket policy in Account B to trust the Task Role ARN from Account A, and the Task Role's identity policy to allow `s3:GetObject`. Crucially, because the bucket is encrypted with a customer managed key, the KMS key policy in Account B must also explicitly trust the Task Role ARN from Account A, as S3 bucket policies cannot delegate KMS permissions.

Step-by-Step Solution

1
Configure the ECS Task Role in Account A.
The tasks assume a temporary security credential with identity-based permissions to call `s3:GetObject` and `kms:Decrypt`.
The application must be authorized to perform these actions by its own account before cross-account policies can evaluate the request.
2
Update the S3 bucket policy in Account B to trust the ECS Task Role ARN.
Cross-account read access to the S3 objects is authorized at the storage layer.
By default, cross-account access to S3 resources requires the resource owner to explicitly trust the external IAM entity.
3
Update the KMS key policy in Account B to trust the ECS Task Role ARN.
Cross-account decryption access is authorized at the cryptographic layer.
S3 bucket policies cannot delegate permissions for KMS CMKs; the key policy itself must explicitly trust the external IAM principal for decryption.

Key Concept

Cross-account IAM authorization for KMS-encrypted S3 resources
Question 277Question →

An organization needs to implement centralized user access management for its engineering department across a newly created multi-account AWS environment. The security policy mandates that engineers use their existing corporate directory credentials to log in, and no long-term credentials should be distributed.

Which solution should a Solutions Architect implement to meet these governance requirements?

Show answer & explanation

Answer: Deploy AWS IAM Identity Center in the organization, integrate it with the corporate directory, and assign the engineers to appropriate permission sets.

Answer

Deploy AWS IAM Identity Center in the organization, integrate it with the corporate directory, and assign the engineers to appropriate permission sets.
Deploying AWS IAM Identity Center allows organizations to centrally manage single sign-on access to all AWS accounts. Integrating it with an external identity provider ensures that engineers can use their existing corporate directory credentials, and temporary security credentials are automatically requested when they access their designated accounts, fulfilling the security policy.

Step-by-Step Solution

1
Enable and configure AWS IAM Identity Center from the organization's management account.
Centralized single sign-on service is activated across the entire organization.
This establishes a centralized directory and access portal for all member accounts.
2
Integrate AWS IAM Identity Center with the existing corporate directory (e.g., Active Directory or external identity provider).
Users can authenticate using their existing corporate credentials.
This eliminates the need to create new sets of credentials for the engineers.
3
Create permission sets defining the required access levels and assign them to the engineering directory groups in the target accounts.
Engineers gain federated access to target accounts with temporary credentials.
This ensures compliance with the security policy against distributing long-term credentials.

Key Concept

Centralized Identity Management and Federation in Multi-Account Environments
Question 278Question →

A retail company has migrated its business units into separate AWS accounts controlled by AWS Organizations. The compliance department demands that all developer access be federated from the company's external Active Directory, granting role-based access without long-term credentials. Furthermore, the company must guarantee that no administrator in any member account can delete or stop AWS CloudTrail logging. Which combination of AWS configurations will satisfy these requirements?

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate with the external Active Directory, define permission sets for developer roles, and apply Service Control Policies (SCPs) at the organizational unit (OU) level to deny the CloudTrail:StopLogging and CloudTrail:DeleteTrail actions.

Answer

Configure AWS IAM Identity Center to federate with the external Active Directory, define permission sets for developer roles, and apply Service Control Policies (SCPs) at the organizational unit (OU) level to deny the CloudTrail:StopLogging and CloudTrail:DeleteTrail actions.
The correct option correctly suggests integrating the external Active Directory with AWS IAM Identity Center to provide federated role-based access using temporary credentials. To enforce governance and prevent administrators in member accounts from stopping CloudTrail logging, Service Control Policies (SCPs) applied at the OU level must be used, as they act as a maximum permission boundary that cannot be bypassed by administrators in member accounts.

Step-by-Step Solution

1
Configure AWS IAM Identity Center integration with the external Active Directory to allow users to authenticate and receive temporary security credentials.
Developers can sign in to their respective AWS accounts using their existing Active Directory credentials without needing long-term IAM access keys.
This establishes federated access and complies with identity governance requirements.
2
Define permission sets in AWS IAM Identity Center to manage role-based access controls across accounts.
Developers are mapped to the correct IAM roles within member accounts based on Active Directory group membership.
This enforces least privilege access control across multiple AWS accounts.
3
Create and attach a Service Control Policy (SCP) to the relevant Organizational Units (OUs) that denies permissions for disabling or deleting CloudTrail logs.
Even users with administrator permissions in member accounts are blocked from stopping or deleting CloudTrail trails.
SCPs define the maximum permission boundaries for member accounts, overriding local administrator actions.

Key Concept

Multi-account identity federation and centralized governance using Service Control Policies (SCPs)
Question 279Question →

An enterprise is planning to grant its network engineering team access to manage resources in the AWS Cloud. The network engineers are currently managed in the company's on-premises Active Directory. The company's security policy requires that engineers authenticate using their existing corporate credentials and that no long-term AWS credentials, such as access keys, are created or stored. Which solution meets these requirements while following AWS security best practices?

Show answer & explanation

Answer: Configure identity federation using AWS IAM Identity Center integrated with the company's Active Directory, and assign permission sets to the engineering group.

Answer

Configure identity federation using AWS IAM Identity Center integrated with the company's Active Directory, and assign permission sets to the engineering group.
The correct solution uses AWS IAM Identity Center to federate the on-premises Active Directory. This allows network engineers to sign in with their corporate credentials and access AWS resources using short-term, temporary credentials. This directly fulfills both requirements of using existing corporate credentials and avoiding long-term access keys.

Step-by-Step Solution

1
Identify the authentication and credential requirements.
The requirements specify using existing corporate credentials (on-premises Active Directory) and avoiding the creation or storage of long-term AWS credentials.
This sets the boundary that IAM users with access keys should be avoided, and federation is required.
2
Select the appropriate AWS service for identity federation.
AWS IAM Identity Center provides native integration with active directories to enable federated single sign-on using temporary security tokens.
IAM Identity Center centralizes access management and eliminates the need for long-term IAM credentials for enterprise directory users.
3
Map permissions to the federated identities.
Assign AWS permission sets to the Active Directory engineering group to grant administrative access.
Permission sets define the level of access users have to AWS accounts and resources based on their directory group membership.

Key Concept

Identity Federation and Single Sign-On (SSO) with IAM Identity Center
Question 280Question →

An organization needs to grant console access to its team of internal software developers. The developers already authenticate daily using the company's central Active Directory. Which approach represents the most secure method for granting AWS Management Console access to these developers?

Show answer & explanation

Answer: Configure identity federation using AWS IAM Identity Center to map Active Directory groups to AWS permissions.

Answer

Configure identity federation using AWS IAM Identity Center to map Active Directory groups to AWS permissions.
The correct approach is to configure identity federation using AWS IAM Identity Center. This maps the company's existing Active Directory groups directly to AWS permissions, allowing developers to authenticate using their existing corporate credentials. This adheres to the principle of least privilege, minimizes administrative overhead, and avoids the creation of long-term IAM user credentials.

Step-by-Step Solution

1
Identify the existing identity store used by the developers.
The developers are already authenticated using the company's central Active Directory.
This indicates that identity federation is the preferred approach to avoid credential duplication.
2
Select the appropriate AWS service for centralized identity management and federation.
AWS IAM Identity Center is the recommended service for directory federation.
It integrates directly with Active Directory to manage single sign-on access to AWS accounts and applications.
3
Evaluate the security implications of alternative options.
Creating individual IAM users, sharing root credentials, or storing keys in plaintext parameters violate AWS security best practices.
These alternatives introduce credential management overhead, violate the principle of least privilege, and expose sensitive credentials.

Key Concept

AWS identity federation using IAM Identity Center allows organizations to grant AWS access based on existing corporate directory identities without managing separate IAM user credentials.
Estimated Time:1m 0s
PreviousPage 14 / 74Next
All practice questions — AWS Certified Solutions Architect - Associate | Examkin