All practice questions

1462 questions

All types1,462 Multiple choice739 Multiple select723

An enterprise is hosting a secure data processing application in an Amazon VPC with a CIDR block of 10.0.0.0/16. The EC2 instances are located in a private subnet (10.0.1.0/24) and must retrieve datasets from an Amazon S3 bucket in the same AWS Region. A solutions architect has created an Amazon S3 Gateway VPC Endpoint and associated it with the route table of the private subnet. The security group assigned to the EC2 instances allows outbound TCP port 443 to 0.0.0.0/0 and denies all inbound traffic. A custom Network ACL (NACL) is associated with the private subnet and contains only the following rules:

* Inbound Rule 100: Allow TCP port 443 from 0.0.0.0/0
* Inbound Rule 110: Allow TCP ports 1024-65535 from 0.0.0.0/0
* Outbound Rule 100: Allow TCP port 443 to 0.0.0.0/0
* Outbound Rule 110: Allow TCP ports 1024-65535 to 0.0.0.0/0

During testing, the EC2 instances are unable to connect to the S3 bucket. Which of the following configuration omissions is preventing the EC2 instances from successfully accessing the Amazon S3 bucket?

The custom Network ACL does not permit outbound UDP traffic on port 53 to the Route 53 Resolver (Amazon Provided DNS) at 10.0.0.2, blocking DNS resolution for the Amazon S3 endpoint.

The security group associated with the EC2 instances lacks an inbound rule to permit return traffic on TCP ports 1024-65535 from the Amazon S3 prefix list.

The custom Network ACL lacks an inbound rule allowing TCP traffic on port 443 from AWS WAF to inspect the return packets from the S3 Gateway VPC Endpoint.

The security group associated with the Amazon S3 Gateway VPC Endpoint does not permit outbound TCP traffic on port 443 to the EC2 instances.

Show answer & explanation

Answer: The custom Network ACL does not permit outbound UDP traffic on port 53 to the Route 53 Resolver (Amazon Provided DNS) at 10.0.0.2, blocking DNS resolution for the Amazon S3 endpoint.

Answer

The custom Network ACL does not permit outbound UDP traffic on port 53 to the Route 53 Resolver (Amazon Provided DNS) at 10.0.0.2, blocking DNS resolution for the Amazon S3 endpoint.

Custom Network ACLs are stateless and deny all traffic that is not explicitly allowed. When an EC2 instance attempts to connect to Amazon S3, it must first resolve the S3 domain name via the Amazon Provided DNS (Route 53 Resolver) located at 10.0.0.2. Since the custom Network ACL rules only allow TCP port 443 and TCP ephemeral ports, the UDP port 53 DNS queries are dropped at the subnet boundary, preventing the instances from obtaining the IP address for the S3 service.

Step-by-Step Solution

Analyze the request flow from the EC2 instance to Amazon S3.

The EC2 instance must first resolve the S3 DNS hostname (e.g., s3.us-east-1.amazonaws.com) to an IP address before it can initiate an HTTPS session over port 443.

DNS resolution is a prerequisite for establishing an HTTPS connection to the S3 bucket.

Identify the target and protocol for DNS resolution within the VPC.

The instance sends a DNS query (typically UDP port 53) to the Route 53 Resolver (Amazon Provided DNS), which resides at the reserved IP address 10.0.0.2 (VPC network range plus two).

By default, instances in a VPC use the Amazon Provided DNS server for name resolution.

Evaluate the custom Network ACL rules for the private subnet.

The custom Network ACL only allows TCP port 443 and TCP ports 1024-65535. Outbound UDP port 53 traffic to 10.0.0.2 is blocked because custom Network ACLs are stateless and deny all traffic not explicitly allowed.

Because Network ACLs are stateless, both the outbound request and the inbound return traffic must be permitted explicitly.

Formulate the correction needed to allow DNS resolution.

Add an outbound Network ACL rule to allow UDP port 53 traffic to the Route 53 Resolver, and ensure inbound rules allow the return UDP traffic on ephemeral ports.

This allows the DNS resolution packets to cross the subnet boundary successfully.

Key Concept

Stateless Network ACLs and VPC DNS Resolution

Question 342Question →

A company is designing a secure network architecture on AWS. The solutions architect needs to implement a security barrier that controls inbound and outbound traffic at the subnet boundary for all resources within that subnet. Which AWS feature should the architect configure to meet this requirement?

Network Access Control Lists (Network ACLs)

Security Groups

AWS WAF

AWS Shield

Show answer & explanation

Answer: Network Access Control Lists (Network ACLs)

Answer

Network Access Control Lists (Network ACLs)

Network Access Control Lists (Network ACLs) serve as a stateless firewall for controlling traffic in and out of one or more subnets, making them the correct choice for enforcing controls at the subnet boundary.

Step-by-Step Solution

Identify the target boundary for the network security control.

The requirement states that the barrier must operate at the subnet boundary.

This helps distinguish between network-level firewalls and host-level firewalls.

Evaluate the capabilities of the available AWS network security tools.

Security groups apply to elastic network interfaces (ENIs) at the instance level. Network ACLs are associated directly with subnets and process all traffic crossing the subnet boundaries.

Matching the boundary requirement ensures the correct security feature is selected.

Key Concept

Subnet-level network security controls

Estimated Time:45s

Question 343Question →

A multinational financial firm manages its cloud infrastructure using a multi-account AWS Organizations environment. All corporate user identities and security groups are maintained in an on-premises Microsoft Active Directory. The firm's compliance policy strictly prohibits the storage or replication of any user credentials or identity database records in the public cloud. The firm wants to enable federated single sign-on (SSO) for its employees to access the AWS Management Console and AWS CLI across all member accounts. The network architecture includes a dedicated AWS Direct Connect connection between the on-premises data center and a shared services VPC. The solution must minimize ongoing operational overhead and infrastructure costs. Which configuration should a solutions architect recommend to satisfy these requirements?

Configure an AD Connector in the shared services VPC linked to the on-premises Active Directory. Enable AWS IAM Identity Center in the AWS Organizations management account, configure it to use the AD Connector as its directory source, and assign permission sets to on-premises Active Directory groups.

Provision individual IAM users in each AWS member account corresponding to each Active Directory user. Configure an on-premises synchronization script that uses the Active Directory LDAP interface to manage IAM access keys and credentials.

Configure federated access using the AWS Organizations management account root user credentials to establish a SAML trust directly with the on-premises Active Directory, allowing federated users to perform administrative tasks.

Deploy an AD Connector in the shared services VPC. Store the Active Directory administrator service account credentials as plaintext parameters in Systems Manager Parameter Store to automate the connection to the on-premises Active Directory.

Show answer & explanation

Answer: Configure an AD Connector in the shared services VPC linked to the on-premises Active Directory. Enable AWS IAM Identity Center in the AWS Organizations management account, configure it to use the AD Connector as its directory source, and assign permission sets to on-premises Active Directory groups.

Answer

The correct solution uses an AD Connector, which acts as a directory gateway to redirect directory requests to the on-premises Active Directory without caching or replicating any identity database records or user credentials in the public cloud. This directly satisfies the compliance requirement. By integrating AD Connector with AWS IAM Identity Center, the firm can centrally manage single sign-on access to the AWS Management Console and CLI across all accounts in AWS Organizations. Group-based access mapping ensures that permissions are assigned to existing Active Directory groups, minimizing operational overhead.

Step-by-Step Solution

Analyze compliance and data replication requirements.

Identified that identity data or credentials must not be replicated to the cloud, ruling out solutions that copy AD user accounts or store passwords in AWS.

Compliance policy strictly prohibits public cloud storage of user credentials or database records.

Select the appropriate directory integration service.

Choose AD Connector over AWS Managed Microsoft AD because AD Connector functions as a gateway proxy, redirecting authentication requests to the on-premises AD without data replication.

AD Connector avoids cloud identity storage and reduces costs compared to deploying managed domain controllers in AWS.

Configure the centralized authentication access mechanism.

Enable AWS IAM Identity Center in the AWS Organizations management account and associate it with the AD Connector.

Provides central management of access to console and CLI across multiple accounts, reducing operational overhead.

Map permissions to existing AD structures.

Assign AWS permission sets to existing on-premises Active Directory groups.

Allows group-based access control managed from the on-premises directory without manual mapping per user in AWS.

Key Concept

AWS IAM Identity Center integration with Active Directory using AD Connector to enable federated access without cloud-side credential replication.

Question 344Question →

A retail company is building a multi-account structure on AWS using AWS Organizations. The security team wants to mandate that all administrative and developer access across member accounts must go through AWS IAM Identity Center, which is integrated with their external identity provider. To enforce this, the team wants to prevent the creation of local IAM users and long-term access keys within all member accounts. The management account must remain exempt from this policy to allow break-glass access. Which solution should a solutions architect recommend to meet these requirements with the least administrative effort?

Create a custom IAM policy in each member account that denies the creation of IAM users and access keys, and assign this policy to the root user of each member account to prevent any local administrator from creating new credentials.

Configure AWS IAM Identity Center to handle federation. Create a Service Control Policy (SCP) that denies iam:CreateUser and iam:CreateAccessKey actions. Attach this SCP to the root of the organization.

Create individual IAM users with long-term security credentials in each member account, and configure a script that syncs these users with the external identity provider. Apply an IAM policy to these users that denies the creation of further IAM resources.

Enable federation using AWS IAM Identity Center. Create a Service Control Policy (SCP) that denies the iam:CreateUser and iam:CreateAccessKey actions. Attach the SCP directly to the organization's management account and configure the root user of the management account to perform all daily administrative tasks.

Show answer & explanation

Answer: Configure AWS IAM Identity Center to handle federation. Create a Service Control Policy (SCP) that denies iam:CreateUser and iam:CreateAccessKey actions. Attach this SCP to the root of the organization.

Answer

The correct solution uses AWS IAM Identity Center to enable centralized federation. By creating a Service Control Policy (SCP) that denies the creation of IAM users and access keys, and attaching it to the root of the organization, the rule is enforced on all member accounts. Because SCPs do not apply to the management account, the management account remains exempt from the policy, allowing break-glass root access in emergencies.

Step-by-Step Solution

Configure AWS IAM Identity Center

Enables centralized identity federation with the external identity provider for access to all AWS accounts.

Allows users to log in with their corporate credentials without creating individual IAM users in member accounts.

Create a Service Control Policy (SCP)

An SCP is defined that denies iam:CreateUser and iam:CreateAccessKey actions.

Ensures that member accounts cannot bypass the federated access mechanism by creating local users or access keys.

Attach the SCP to the root of the organization

The restriction applies to all member accounts, while the management account remains unaffected.

SCPs do not apply to the management account, which satisfies the requirement to keep it exempt for emergency break-glass access.

Key Concept

Centralized Governance using SCPs and IAM Identity Center

Question 345Question →

A company is designing a secure environment for its development teams across multiple AWS accounts managed under AWS Organizations. The security team wants to enforce two specific requirements:

1. Developers must be prevented from deleting any Amazon S3 buckets.
2. Developers must be allowed to create and manage IAM roles for their applications, but they must not be able to escalate their own permissions or assign administrator permissions to the new roles.

Which combination of mechanisms should a solutions architect recommend to satisfy these requirements? (Select TWO.)

Select all that apply

Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level that explicitly denies the s3:DeleteBucket action.

Use IAM permissions boundaries to define the maximum permissions that developers can assign to the roles they create.

Use the AWS account root user credentials to directly configure bucket policies on each S3 bucket to explicitly deny the s3:DeleteBucket action.

Create individual IAM users with long-term access keys for each developer and configure IAM Identity Center to map their enterprise directory identities to these users.

Enable AWS Key Management Service (AWS KMS) automatic key rotation to automatically update the S3 bucket policies and revoke delete permissions after each rotation cycle.

Show answer & explanation

Answer: Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level that explicitly denies the s3:DeleteBucket action.; Use IAM permissions boundaries to define the maximum permissions that developers can assign to the roles they create.

Answer

Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level that explicitly denies the s3:DeleteBucket action, and use IAM permissions boundaries to define the maximum permissions that developers can assign to the roles they create.

Applying an SCP at the OU level to explicitly deny the s3:DeleteBucket action provides a strong security guardrail that prevents any user or role in the member accounts from deleting buckets. Using IAM permissions boundaries allows the security team to delegate role creation to developers while ensuring that the permissions of the newly created roles cannot exceed the boundaries defined by the security team.

Step-by-Step Solution

Evaluate how to prevent S3 bucket deletion across multiple accounts under AWS Organizations.

An SCP is the most effective way to enforce coarse-grained policy controls across member accounts, overriding local administrators.

SCPs apply to all users and roles in member accounts, ensuring global compliance.

Determine how to delegate role creation without allowing privilege escalation.

Applying an IAM permissions boundary ensures that any role created or managed by the developers cannot exceed the boundary's permissions.

This prevents developers from creating administrative roles to bypass their own constraints.

Key Concept

Permissions Boundaries and Service Control Policies (SCPs) are used together to delegate administrative permissions safely and enforce guardrails in multi-account environments.

Question 346Question →

An Amazon EC2 instance in a private subnet needs to make outbound HTTPS requests to an external API. The security group associated with the instance is configured with an outbound rule that allows traffic to any destination on port $443$ . There are no inbound rules configured on the security group. How does the security group handle the response traffic from the external API?

The response traffic is automatically allowed because security groups are stateful.

The response traffic is blocked because security groups are stateless and require an explicit inbound rule for port

443

The response traffic is blocked because security groups operate at the subnet level and must allow return traffic for the entire CIDR block.

The response traffic is blocked by default because AWS Shield Standard blocks all inbound internet traffic to private subnets.

Show answer & explanation

Answer: The response traffic is automatically allowed because security groups are stateful.

Answer

The response traffic is automatically allowed because security groups are stateful.

The correct answer is that the response traffic is automatically allowed. Because security groups in Amazon VPC are stateful, any traffic that is explicitly allowed outbound is automatically allowed back inbound, bypassing the need for a corresponding inbound rule.

Step-by-Step Solution

Analyze the resource and rules configuration.

The EC2 instance uses a security group with an outbound rule allowing port

443

but no inbound rules.

To determine how return traffic is treated, we must evaluate the statefulness of the security control.

Determine the statefulness behavior of security groups.

Security groups are stateful. This means any allowed outbound connection will automatically permit the corresponding inbound response traffic.

Stateful packet filtering tracks the connection state and permits return traffic without requiring a matching rule in the opposite direction.

Key Concept

Security Group Statefulness

Question 347Question →

A logistics enterprise with a multi-account structure in AWS Organizations wants to implement centralized single sign-on (SSO) for its on-premises Active Directory (AD) users. The company's compliance policy strictly prohibits replicating user password hashes to AWS or deploying Microsoft Active Directory domain controllers inside the cloud environment. A dedicated AWS Direct Connect connection provides private network pathing to the on-premises environment. The solutions architect needs to design a secure, highly available identity federation solution that allows users to access the AWS Management Console of member accounts using their corporate AD credentials. Which two actions should the solutions architect take to meet these requirements? (Select two.)

Select all that apply

Configure an AD Connector in the AWS Organizations management account across two Availability Zones, providing the IP addresses of the on-premises Active Directory domain controllers for name resolution and authentication.

Enable AWS IAM Identity Center and change the identity source from the default identity store to the Active Directory directory associated with the newly deployed AD Connector.

Create matching IAM users with long-term access keys in each AWS Organizations member account, and run a synchronization script to replicate passwords from the on-premises Active Directory.

Provision an AWS Managed Microsoft AD directory in a dedicated shared services VPC, set up a two-way forest trust, and configure AWS Directory Service to synchronize all password hashes to the cloud.

Configure SAML 2.0 identity provider federation directly on the AWS Organizations management account's root user, using Active Directory Federation Services (ADFS) to bypass IAM role delegation.

Show answer & explanation

Answer: Configure an AD Connector in the AWS Organizations management account across two Availability Zones, providing the IP addresses of the on-premises Active Directory domain controllers for name resolution and authentication.; Enable AWS IAM Identity Center and change the identity source from the default identity store to the Active Directory directory associated with the newly deployed AD Connector.

Answer

To establish federation without replicating passwords or deploying cloud domain controllers, the solutions architect must configure an AD Connector across multiple Availability Zones pointing to the on-premises Active Directory, and configure AWS IAM Identity Center to use this Active Directory directory as its identity source.

Deploying AD Connector allows AWS to proxy authentication requests to the on-premises Active Directory domain controllers without storing password hashes in AWS or requiring domain controller deployments in the cloud. By changing the identity source in AWS IAM Identity Center to use this Active Directory directory, users can authenticate using their existing on-premises credentials to access the AWS Management Console across all accounts within the AWS Organization.

Step-by-Step Solution

Evaluate the architectural constraints concerning password storage and domain controller deployment.

Identify that AWS Managed Microsoft AD is unsuitable because it deploys domain controllers in the AWS Cloud, leaving AD Connector as the correct choice for proxying authentication requests.

Compliance rules prohibit replicating password hashes to the cloud and deploying new domain controllers in AWS.

Provision AD Connector in a highly available configuration.

Create the AD Connector across two Availability Zones in the primary VPC, configuring it with the IP addresses of the on-premises domain controllers accessible via the AWS Direct Connect connection.

Multi-AZ deployment ensures service availability, and routing traffic over the Direct Connect ensures secure, private communication.

Configure the identity source in AWS IAM Identity Center.

Navigate to the IAM Identity Center console, select the option to change the identity source, and connect it to the Active Directory directory provisioned by the AD Connector.

This establishes the link between IAM Identity Center and the on-premises Active Directory domain, allowing seamless user access without provisioning local IAM users.

Key Concept

Integrating on-premises Active Directory with AWS IAM Identity Center using AD Connector allows secure, high-availability federation without password replication or cloud-based domain controller deployments.

Question 348Question →

A company is designing a multi-account environment on AWS using AWS Organizations. The company has several business units, each requiring its own dedicated account under a specific OU. The security team requires centralized user authentication using the company's external identity provider. Additionally, the security team must prevent any member account from leaving the organization. Which of the following actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Configure AWS IAM Identity Center connected to the external identity provider to centrally manage user access across all accounts.

Apply a Service Control Policy (SCP) at the root level of the organization that denies the organizations:LeaveOrganization API action.

Create individual IAM users in each member account and configure SAML 2.0 federation mapping for each corporate user.

Apply a Service Control Policy (SCP) to the organization's management account to restrict the administrative actions of its root user.

Create IAM users in the management account with administrative permissions and configure cross-account roles to access each member account.

Show answer & explanation

Answer: Configure AWS IAM Identity Center connected to the external identity provider to centrally manage user access across all accounts.; Apply a Service Control Policy (SCP) at the root level of the organization that denies the organizations:LeaveOrganization API action.

Answer

Configure AWS IAM Identity Center connected to the external identity provider, and apply a Service Control Policy (SCP) at the root level that denies the organizations:LeaveOrganization action.

Integrating AWS IAM Identity Center with the external identity provider is the native, scalable method to grant federated access to AWS accounts without manual credential configuration. Applying a Service Control Policy that denies the organizations:LeaveOrganization action at the root level ensures that no member account can detach itself from the organization's governance boundary.

Step-by-Step Solution

Address the centralized identity requirement.

By using AWS IAM Identity Center, the solutions architect integrates the corporate external identity provider once to provide single sign-on access to all AWS accounts.

This centralizes user access and avoids the management overhead of creating local IAM users.

Address the multi-account governance and organization control requirement.

By applying an SCP denying organizations:LeaveOrganization at the root of the organization, the constraint is inherited by all member accounts.

SCPs are the standard mechanism to enforce organizational boundaries and security controls across accounts.

Key Concept

Centralized multi-account governance using AWS Organizations SCPs and AWS IAM Identity Center.

Question 349Question →

An enterprise is building an application that stores sensitive customer metadata in a shared Amazon DynamoDB table. The design requires strict tenant isolation, ensuring that users from one tenant cannot view or modify the metadata of another tenant. All client authentication is managed by an external identity provider (IdP) federated with AWS, which supplies a custom tenant identifier during the login process. The application must leverage AWS Identity and Access Management (IAM) to enforce this tenant separation dynamically at the database level.

Which design strategy should the solutions architect implement to meet these requirements securely with the least administrative overhead?

Allow federated sessions to assume the AWS account root user credentials, and write dynamic session policies to restrict database operations by the tenant partition key.

Create individual IAM users for each federated client user inside the AWS account, and attach custom policies that restrict access to their respective tenant partition key.

Implement an IAM policy for the application execution role that uses a condition block matching the dynamodb:LeadingKeys condition key with the federated user's tenant tag variable.

Store the database access credentials for each tenant as a plaintext string in Systems Manager Parameter Store, and configure the application to retrieve these parameters to authenticate requests.

Show answer & explanation

Answer: Implement an IAM policy for the application execution role that uses a condition block matching the dynamodb:LeadingKeys condition key with the federated user's tenant tag variable.

Answer

Implement an IAM policy for the application execution role that uses a condition block matching the dynamodb:LeadingKeys condition key with the federated user's tenant tag variable.

The correct strategy uses IAM policy variables to achieve fine-grained access control. By matching the dynamodb:LeadingKeys condition key with the federated session's principal tag (${aws:PrincipalTag/TenantID}), IAM dynamically verifies that the user can only read or write items whose partition key matches their tenant ID. This enforces strict logical tenant isolation within a single DynamoDB table without managing individual credentials or multiple database tables.

Step-by-Step Solution

Map the federated identity attributes to user tags in AWS STS when clients assume the role.

The tenant identifier is securely passed to the AWS session as a principal tag, accessible via the variable ${aws:PrincipalTag/TenantID}.

This establishes a dynamic session variable that uniquely and securely identifies the tenant context for each request.

Configure the DynamoDB table to use the tenant identifier as the partition key for all items.

Items belonging to a specific tenant are logically grouped under that tenant's partition key.

This structural requirement enables fine-grained access control using DynamoDB policy conditions.

Attach a policy to the application role with a condition statement that checks 'dynamodb:LeadingKeys' against '${aws:PrincipalTag/TenantID}'.

IAM dynamically enforces that any query, put, or delete operation on the DynamoDB table only targets partition keys matching the authenticated tenant tag.

This enforces the required isolation at the database level with minimal latency and no administrative overhead of managing separate users or credentials.

Key Concept

Fine-Grained Access Control in Amazon DynamoDB using IAM Policy Variables and Principal Tags

Estimated Time:2m 0s

Question 350Question →

A system administrator is reviewing the network access controls for a new application environment within an Amazon VPC. The administrator wants to ensure that the security groups and network access control lists (network ACLs) are configured correctly. Which TWO statements accurately describe the traffic-filtering behavior of these security components? (Select TWO.)

Select all that apply

A security group automatically permits outbound return traffic for any allowed inbound connection.

A network ACL requires a separate outbound rule to allow the return traffic of a permitted inbound connection.

A newly created custom network ACL automatically allows all inbound and outbound traffic by default.

A newly created security group automatically permits all inbound traffic from any source by default.

A network ACL is associated directly with individual Elastic Network Interfaces (ENIs) of EC2 instances to filter traffic.

Show answer & explanation

Answer: A security group automatically permits outbound return traffic for any allowed inbound connection.; A network ACL requires a separate outbound rule to allow the return traffic of a permitted inbound connection.

Answer

Security groups automatically permit outbound return traffic for any allowed inbound connection, and network ACLs require a separate outbound rule to allow the return traffic of a permitted inbound connection.

The correct options accurately describe that security groups automatically permit outbound return traffic for any allowed inbound connection due to their stateful nature, and network ACLs require a separate outbound rule to allow the return traffic of a permitted inbound connection because they are stateless.

Step-by-Step Solution

Analyze security group connection tracking behavior.

Security groups are stateful. When traffic is permitted in one direction, the return traffic is automatically allowed.

This is a fundamental design feature of AWS security groups to simplify rule management for established connections.

Analyze network ACL connection tracking behavior.

Network ACLs are stateless. Each rule evaluates packets independently without keeping track of the connection state.

Because they are stateless, returning response packets require an explicit rule matching their port and destination to pass through.

Evaluate the remaining options regarding default configurations and association scopes.

Custom network ACLs deny all traffic by default, newly created security groups deny all inbound traffic by default, and network ACLs apply at the subnet level rather than the network interface level.

Correctly identifying these configurations avoids common misconceptions about AWS VPC network security default behaviors.

Key Concept

Stateful vs. stateless traffic filtering in Amazon VPC using Security Groups and Network ACLs

Estimated Time:1m 0s

Question 351Question →

A software-as-a-service (SaaS) provider is building a collaborative document editing platform. When a user updates a document, the platform must send change notifications to a real-time collaboration service and a document version history service. The updates for each individual document must be processed in the exact order they occur to prevent version conflicts. Which combination of steps should a solutions architect take to decouple these services while ensuring correct update order? (Select TWO.)

Select all that apply

Publish the update events to an Amazon SNS FIFO topic using the document ID as the message group ID.

Create two Amazon SQS FIFO queues, subscribe them to the SNS FIFO topic, and have each backend service consume messages from its own queue.

Publish the update events to an Amazon SNS Standard topic, and subscribe two Amazon SQS FIFO queues to it.

Create a single Amazon SQS FIFO queue and have both backend services poll messages from this queue simultaneously.

Create an Amazon SNS FIFO topic and subscribe two Amazon SQS Standard queues to it to allow rapid parallel processing.

Show answer & explanation

Answer: Publish the update events to an Amazon SNS FIFO topic using the document ID as the message group ID.; Create two Amazon SQS FIFO queues, subscribe them to the SNS FIFO topic, and have each backend service consume messages from its own queue.

Answer

To decouple the services while preserving ordering and enabling fan-out, publish update events to an Amazon SNS FIFO topic with a message group ID based on the document ID, and subscribe two Amazon SQS FIFO queues to the topic, with each backend service consuming from its own queue.

Publishing events to an Amazon SNS FIFO topic with a message group ID based on the document ID ensures that all updates for a specific document are ordered sequentially and delivered to subscribers in that order. Subscribing two separate Amazon SQS FIFO queues to the SNS FIFO topic allows the message to be fanned out so that both backend services receive every event, and using SQS FIFO queues ensures that the order is preserved during consumer processing.

Step-by-Step Solution

Identify the need for event fan-out to multiple independent backend services.

Confirm that both the real-time collaboration service and the version history service must receive every event.

This establishes that a fan-out architecture (SNS) is required.

Choose a messaging service that supports fan-out while preserving strict message ordering.

Select Amazon SNS FIFO as the pub/sub component.

SNS FIFO guarantees first-in, first-out delivery to its subscribers.

Group messages by the document ID during publication.

Updates for the same document are processed sequentially.

Using the document ID as the message group ID ensures ordering is maintained per document while allowing parallel processing across different documents.

Ensure each receiving service has its own dedicated queue subscribed to the SNS FIFO topic.

Two SQS FIFO queues are created and subscribed to the SNS FIFO topic.

Each service requires a separate queue to receive all events (fan-out), and using SQS FIFO queues preserves the ordering guaranteed by the SNS FIFO topic.

Key Concept

End-to-end FIFO ordering in a fan-out architecture using SNS FIFO and SQS FIFO.

Question 352Question →

An enterprise is deploying a payment processing engine on Amazon EC2 instances in Subnet A (CIDR $10.0.1.0/24$ ) of a VPC. The instances must query a database service exposed via an Interface VPC Endpoint located in Subnet B (CIDR $10.0.2.0/24$ ) within the same VPC. The database listens on TCP port $3306$ . The network architecture mandates that Subnet A and Subnet B use custom, non-default Network Access Control Lists (NACLs). Which combination of Security Group (SG) and NACL configurations will allow successful communication while adhering to the principle of least privilege?

For the EC2 instances SG: Outbound rule allowing TCP port

3306

to the Interface Endpoint SG, and Inbound rule allowing TCP ports

1024-65535

from the Interface Endpoint SG. For the Interface Endpoint SG: Inbound rule allowing TCP port

3306

from the EC2 instances SG, and Outbound rule allowing TCP ports

1024-65535

to the EC2 instances SG. For Subnet A NACL: Outbound rule allowing TCP port

3306

10.0.2.0/24

. For Subnet B NACL: Inbound rule allowing TCP port

3306

from

10.0.1.0/24

For the EC2 instances SG: Outbound rule allowing TCP port

3306

to the Interface Endpoint SG. For the Interface Endpoint SG: Inbound rule allowing TCP port

3306

from the EC2 instances SG. For Subnet A NACL: Outbound rule allowing TCP port

3306

to the Interface Endpoint SG, and Inbound rule allowing TCP ports

1024-65535

from the Interface Endpoint SG. For Subnet B NACL: Inbound rule allowing TCP port

3306

from the EC2 instances SG, and Outbound rule allowing TCP ports

1024-65535

to the EC2 instances SG.

For the EC2 instances SG: Outbound rule allowing TCP port

3306

to the Interface Endpoint SG. For the Interface Endpoint SG: Inbound rule allowing TCP port

3306

from the EC2 instances SG. For Subnet A NACL: Outbound rule allowing TCP port

3306

10.0.2.0/24

, and Inbound rule allowing TCP ports

1024-65535

from

10.0.2.0/24

. For Subnet B NACL: Inbound rule allowing TCP port

3306

from

10.0.1.0/24

, and Outbound rule allowing TCP ports

1024-65535

10.0.1.0/24

For the EC2 instances SG: Outbound rule allowing TCP port

3306

10.0.2.0/24

. For the Interface Endpoint SG: Inbound rule allowing TCP port

3306

from

10.0.1.0/24

. For Subnet A NACL: Outbound rule allowing TCP port

3306

10.0.2.0/24

. For Subnet B NACL: Inbound rule allowing TCP port

3306

from

10.0.1.0/24

Show answer & explanation

Answer: For the EC2 instances SG: Outbound rule allowing TCP port $3306$ to the Interface Endpoint SG. For the Interface Endpoint SG: Inbound rule allowing TCP port $3306$ from the EC2 instances SG. For Subnet A NACL: Outbound rule allowing TCP port $3306$ to $10.0.2.0/24$ , and Inbound rule allowing TCP ports $1024-65535$ from $10.0.2.0/24$ . For Subnet B NACL: Inbound rule allowing TCP port $3306$ from $10.0.1.0/24$ , and Outbound rule allowing TCP ports $1024-65535$ to $10.0.1.0/24$ .

Answer

The correct configuration uses stateful Security Groups targeting port

3306

without reverse rules, and stateless Network ACLs that explicitly permit the request on port

3306

and the response traffic on ephemeral ports

1024-65535

between the two subnet CIDRs.

Security Groups are stateful. When the EC2 instance initiates a connection to the database endpoint on port

3306

, the Security Group automatically allows the return traffic. Therefore, the EC2 Security Group only requires an outbound rule to the Endpoint Security Group, and the Endpoint Security Group only requires an inbound rule from the EC2 Security Group. Conversely, Network ACLs are stateless. Subnet A's NACL must explicitly allow the outbound request to Subnet B on port

3306

, and it must also allow the inbound return traffic from Subnet B on the ephemeral port range (

1024-65535

). Similarly, Subnet B's NACL must allow the inbound request on port

3306

and the outbound return traffic to Subnet A on the ephemeral port range (

1024-65535

Step-by-Step Solution

Configure the Security Groups for the initiating client and the receiving endpoint.

EC2 Security Group allows outbound TCP

3306

to the Endpoint Security Group; Endpoint Security Group allows inbound TCP

3306

from the EC2 Security Group.

Since Security Groups are stateful, return traffic is automatically allowed, meaning no inbound ephemeral rules are required on the client side, and no outbound rules are required on the endpoint side.

Configure the Network ACL rules for Subnet A (the EC2 client subnet).

Subnet A NACL allows outbound TCP

3306

to the destination subnet CIDR (

10.0.2.0/24

) and inbound TCP

1024-65535

(ephemeral ports) from the destination subnet CIDR.

Network ACLs are stateless, so the return packets sent from the database to the client's ephemeral ports must be explicitly permitted inbound.

Configure the Network ACL rules for Subnet B (the VPC Endpoint subnet).

Subnet B NACL allows inbound TCP

3306

from the client subnet CIDR (

10.0.1.0/24

) and outbound TCP

1024-65535

to the client subnet CIDR.

Because Network ACLs are stateless, the outbound response traffic returning to the client's ephemeral ports must be explicitly allowed outbound.

Key Concept

VPC Network Security: Stateful Security Groups vs. Stateless Network ACLs

Question 353Question →

A biopharmaceutical corporation is designing a hybrid cloud architecture to connect its on-premises Microsoft Active Directory domain with a newly deployed multi-account AWS environment managed via AWS Organizations. The corporation requires corporate employees to authenticate using their existing Active Directory credentials to access resources across all AWS accounts. The solution must minimize administrative overhead, avoid synchronizing or replicating user passwords to the cloud, and support centralized permission management.

Which combination of actions will meet these requirements? (Select two.)

Select all that apply

Deploy an AWS Directory Service AD Connector to connect to the on-premises Active Directory domain controllers.

Enable AWS IAM Identity Center in the Organizations management account and configure it to use the AD Connector directory as the identity source.

Create individual IAM users in a centralized security account for each Active Directory user and configure cross-account IAM roles for access.

Use the AWS account root user credentials of the management account to configure SAML 2.0 federation endpoints in each member account.

Show answer & explanation

Answer: Deploy an AWS Directory Service AD Connector to connect to the on-premises Active Directory domain controllers.; Enable AWS IAM Identity Center in the Organizations management account and configure it to use the AD Connector directory as the identity source.

Answer

Deploy an AWS Directory Service AD Connector to connect to the on-premises Active Directory, and enable AWS IAM Identity Center in the Organizations management account, configuring it to use the AD Connector directory as the identity source.

Deploying an AWS Directory Service AD Connector allows AWS to proxy authentication requests directly to the on-premises Active Directory domain controllers without replicating credentials to the cloud. Combining this with AWS IAM Identity Center provides centralized federation and access management across all AWS accounts in the organization, meeting all requirements with minimal administrative overhead.

Step-by-Step Solution

Analyze the requirements for identity source and replication constraints.

The solution must authenticate against on-premises Active Directory without replicating password hashes or user credentials to AWS.

This rules out directory synchronization mechanisms and points to directory gateway or proxy solutions.

Select the appropriate directory integration service.

Choose AWS Directory Service AD Connector.

AD Connector acts as a proxy that redirects authentication requests to the on-premises domain controllers without storing or caching credentials.

Configure single sign-on access across the multi-account environment.

Enable AWS IAM Identity Center and bind it to the AD Connector.

IAM Identity Center integrates natively with AWS Organizations and AWS Directory Service, allowing centralized user access management with single sign-on capabilities.

Key Concept

Centralized hybrid identity federation using AWS Directory Service AD Connector and AWS IAM Identity Center

Question 354Question →

A company stores sensitive files in an Amazon S3 bucket encrypted with an AWS KMS Customer Managed Key. The security team wants to ensure that the key material is rotated automatically every year to comply with internal guidelines. Which of the following statements correctly describe the behavior and configuration of AWS KMS automatic key rotation? (Select TWO.)

Select all that apply

AWS KMS automatically rotates the key material annually without requiring any changes to the application's key ARN or code.

Enabling automatic key rotation does not automatically re-encrypt historical data, and AWS KMS retains the older key material to decrypt existing data.

Enabling automatic key rotation immediately decrypts and re-encrypts all existing data in the S3 bucket using the new key version.

When a key is rotated, the older key material is deleted, meaning older backups must be re-encrypted manually before rotation.

To support automatic rotation, the key's plaintext private key material must be saved in the AWS Systems Manager Parameter Store as a String parameter.

Show answer & explanation

Answer: AWS KMS automatically rotates the key material annually without requiring any changes to the application's key ARN or code.; Enabling automatic key rotation does not automatically re-encrypt historical data, and AWS KMS retains the older key material to decrypt existing data.

Answer

AWS KMS automatically rotates the key material annually without requiring any changes to the application's key ARN or code, and enabling automatic key rotation does not automatically re-encrypt historical data, with AWS KMS retaining the older key material to decrypt existing data.

AWS KMS automatic key rotation manages key material lifecycle seamlessly. It automatically generates a new version of the key material annually without modifying the key ID or ARN, ensuring applications require no changes. Additionally, it preserves historical key material versions so that existing data encrypted under those versions can be decrypted without needing immediate re-encryption.

Step-by-Step Solution

Identify the mechanics of AWS KMS customer managed key automatic rotation.

Understand that AWS KMS rotates key material once per year and maintains the key's metadata, including the ARN, unchanged.

This confirms that application configuration and code do not need to be updated.

Analyze how rotation affects existing historical data.

Recognize that rotation only applies to new data encryption; historical data remains encrypted with the old key material, which AWS KMS retains for decryption.

This establishes that existing data is not re-encrypted and old key versions are kept.

Key Concept

AWS KMS Automatic Key Rotation Mechanics

Question 355Question →

A company is migrating its internal resource scheduling application to AWS. The company's employees currently authenticate using an on-premises Active Directory. A solutions architect must design an access control solution that allows employees to sign in to the AWS Management Console using their existing corporate credentials, without introducing long-term AWS credentials or administrative overhead.

Which solution meets these requirements?

Configure AWS IAM Identity Center and establish a SAML 2.0 identity federation between the on-premises Active Directory and AWS.

Create individual IAM users in the AWS account for each employee, and implement a synchronization script to replicate on-premises password changes to AWS.

Use the AWS Account Root User credentials to generate access keys, and distribute them to employees to configure their local AWS CLI profiles.

Store the corporate LDAP credentials in Systems Manager Parameter Store as plaintext String parameters, and configure an IAM role to read these parameters during authentication.

Show answer & explanation

Answer: Configure AWS IAM Identity Center and establish a SAML 2.0 identity federation between the on-premises Active Directory and AWS.

Answer

Configure AWS IAM Identity Center and establish a SAML 2.0 identity federation between the on-premises Active Directory and AWS.

Establishing SAML 2.0 identity federation via AWS IAM Identity Center is the standard, secure, and recommended pattern for integrating an on-premises Active Directory with AWS. It allows employees to use their existing credentials to log in, and relies on AWS Security Token Service (STS) to generate temporary credentials, eliminating the need to manage static AWS IAM users and credentials.

Step-by-Step Solution

Evaluate the requirement for corporate directory integration without long-term AWS credentials.

Identify SAML 2.0 identity federation as the standard mechanism to map external corporate directory identities to AWS temporary credentials.

Federation enables single sign-on (SSO) and relies on short-term STS credentials rather than permanent IAM user credentials.

Select the appropriate AWS service for centralized single sign-on and directory integration.

Identify AWS IAM Identity Center (formerly AWS Single Sign-On) as the modern and recommended service for this scenario.

IAM Identity Center integrates out-of-the-box with SAML 2.0 providers and manages access permissions across multiple accounts from a single location.

Eliminate options that use long-term IAM users or root account credentials.

Discard solutions proposing individual IAM users or root access keys as they increase security risk and management overhead.

These violate the principle of least privilege and fail to meet the constraint of avoiding long-term credentials.

Key Concept

AWS Directory Federation and IAM Identity Center

Question 356Question →

A financial services company hosts a payment processing application on Amazon EC2 instances in a private VPC subnet with the CIDR block $172.16.5.0/24$ . The application must securely communicate with an on-premises hardware security module (HSM) on port $443$ via an AWS Site-to-Site VPN connection (on-premises network CIDR $192.168.10.0/24$ ). Additionally, the application must access the AWS Key Management Service (AWS KMS) via an Interface VPC Endpoint located at $172.16.5.50$ in the same subnet. The company enforces strict regulatory requirements: all external internet access is blocked, and Network ACLs (NACLs) must operate under a default-deny posture. Which of the following configurations are required to establish these network connections while adhering to the principle of least privilege and stateless inspection? (Select TWO).

Select all that apply

Configure an outbound Network ACL rule for the EC2 subnet allowing TCP port

443

to the destination CIDRs (

192.168.10.0/24

and

172.16.5.50/32

), and a corresponding inbound Network ACL rule allowing TCP ports

1024-65535

from these destinations.

Configure a Security Group associated with the EC2 instances with outbound rules allowing TCP port

443

to the on-premises network CIDR (

192.168.10.0/24

) and the Security Group of the KMS interface endpoint, with no inbound rules configured for return traffic.

Configure an inbound Network ACL rule for the EC2 subnet allowing TCP port

443

from the destination CIDRs (

192.168.10.0/24

and

172.16.5.50/32

), relying on the stateful nature of Network ACLs to allow the outbound return traffic.

Configure a Security Group associated with the EC2 instances with an inbound rule allowing TCP ports

1024-65535

from the KMS interface endpoint and the on-premises network to accept response traffic.

Configure an outbound Route Table entry in the EC2 subnet routing traffic destined for the KMS interface endpoint IP (

172.16.5.50/32

) to the Virtual Private Gateway (

vgw-\text{xxxxxx}

) to leverage the VPN connection.

Show answer & explanation

Answer: Configure an outbound Network ACL rule for the EC2 subnet allowing TCP port $443$ to the destination CIDRs ( $192.168.10.0/24$ and $172.16.5.50/32$ ), and a corresponding inbound Network ACL rule allowing TCP ports $1024-65535$ from these destinations.; Configure a Security Group associated with the EC2 instances with outbound rules allowing TCP port $443$ to the on-premises network CIDR ( $192.168.10.0/24$ ) and the Security Group of the KMS interface endpoint, with no inbound rules configured for return traffic.

Answer

To establish secure connections under strict stateless controls, configure a Network ACL allowing outbound port 443 traffic to the destinations and inbound ephemeral port traffic (1024-65535) from them, and configure a stateful Security Group with outbound port 443 permissions without any inbound return rules.

Network ACLs are stateless, meaning both request and response paths must be explicitly defined; hence, an outbound rule for port 443 and an inbound rule for ephemeral return ports (1024-65535) are required. Security Groups are stateful, so allowing outbound port 443 to the destinations automatically permits the return response traffic without needing inbound rules.

Step-by-Step Solution

Analyze Network ACL stateless behavior.

Determined that outbound traffic to the destinations requires an explicit rule on port 443, and the return traffic requires an inbound rule on ephemeral ports (1024-65535).

Network ACLs are stateless and do not automatically allow return traffic.

Analyze Security Group stateful behavior.

Determined that allowing outbound port 443 traffic to the destinations automatically permits response traffic, without needing inbound rules.

Security Groups are stateful and automatically track connections to allow return traffic.

Verify VPC routing rules for Interface Endpoints.

Confirmed that local routes in the route table handle Interface Endpoint traffic natively within the VPC.

VPC Interface Endpoints are hosted inside the VPC and do not rely on Virtual Private Gateways for routing.

Key Concept

VPC Network Security and Statefulness Comparison (Security Groups vs Network ACLs)

Estimated Time:2m 30s

Question 357Question →

A company is designing a secure multi-account architecture using AWS Organizations. The security team requires that all employee authentication be integrated with their existing enterprise Identity Provider (IdP) for centralized access control. Additionally, member account administrators must be prevented from disabling or deleting AWS CloudTrail resources.

Which solution should a Solutions Architect recommend to meet these requirements?

Create individual IAM users in each member account with long-term credentials mapped to each employee in the external IdP, and configure local IAM policies to restrict CloudTrail access.

Enable AWS IAM Identity Center and configure it to federate with the external IdP. Apply a Service Control Policy (SCP) to the organization's root or organizational units (OUs) that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.

Enable AWS IAM Identity Center for federation. Attach a Service Control Policy (SCP) to the organization's management account to prevent CloudTrail modifications, and require security administrators to use the management account's root credentials for daily compliance monitoring.

Configure AWS IAM Identity Center for federation with the external IdP. Store the integration's sensitive API credentials as a plaintext parameter in Systems Manager Parameter Store, and allow administrators in member accounts to modify local IAM policy settings to restrict CloudTrail.

Show answer & explanation

Answer: Enable AWS IAM Identity Center and configure it to federate with the external IdP. Apply a Service Control Policy (SCP) to the organization's root or organizational units (OUs) that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.

Answer

The correct solution involves configuring AWS IAM Identity Center to federate authentication with the company's external Identity Provider (IdP). This provides a centralized single sign-on experience without manual creation of IAM users. To prevent member account administrators from disabling or deleting AWS CloudTrail, a Service Control Policy (SCP) must be applied at the organization's root or OU level. SCPs apply to all IAM users and roles in member accounts, including the root user of those accounts, ensuring compliance cannot be bypassed locally.

Step-by-Step Solution

Establish centralized authentication with the external IdP using AWS IAM Identity Center.

Employees can authenticate using their existing enterprise directory credentials to access authorized AWS accounts.

Centralizing authentication reduces administrative overhead and eliminates the need to manage individual IAM users.

Write a Service Control Policy (SCP) that explicitly denies actions like cloudtrail:StopLogging and cloudtrail:DeleteTrail.

A policy document is created containing the explicit deny rule.

SCPs serve as permission guards that define the maximum permissions for member accounts.

Attach the Service Control Policy (SCP) to the organization's root or specific OUs containing the member accounts.

The restriction is enforced across all users and roles within the targeted member accounts, including account administrators.

This ensures that member account administrators cannot modify or disable AWS CloudTrail.

Key Concept

Multi-account governance using AWS Organizations and AWS IAM Identity Center federation.

Estimated Time:1m 30s

Question 358Question →

A financial auditing firm is deploying a reporting engine on Amazon EC2 instances in a private subnet ( $172.16.8.0/22$ ) within a VPC. The reporting engine must access compliance data stored in Amazon S3 and write audit results to Amazon DynamoDB. Additionally, the reporting engine must perform outbound HTTPS requests (port $443$ ) to an external regulatory API at `api.compliance-registry.org` to validate audit certificates. Company security policy mandates that all AWS service traffic must not traverse the public internet or NAT gateways, and data transfer costs must be minimized. Outbound internet egress must be strictly restricted to the regulatory API domain, and all other outbound traffic must be denied.

Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Create Gateway VPC endpoints for Amazon S3 and Amazon DynamoDB, and associate them with the route table of the private subnet.

Route outbound internet traffic from the private subnet through an AWS Network Firewall deployed in a public subnet, and configure a stateful rule group with a domain list containing `api.compliance-registry.org`.

Configure the outbound security group of the EC2 instances to allow HTTPS traffic (port

443

) targeting the destination `api.compliance-registry.org`.

Create Interface VPC endpoints for Amazon S3 and Amazon DynamoDB in the private subnet, and update the private subnet's route table to route traffic through these endpoints.

Configure the private subnet's outbound Network ACL to allow port

443

traffic to the domain `api.compliance-registry.org` and deny all other outbound traffic.

Show answer & explanation

Answer: Create Gateway VPC endpoints for Amazon S3 and Amazon DynamoDB, and associate them with the route table of the private subnet.; Route outbound internet traffic from the private subnet through an AWS Network Firewall deployed in a public subnet, and configure a stateful rule group with a domain list containing `api.compliance-registry.org`.

Answer

Create Gateway VPC endpoints for Amazon S3 and Amazon DynamoDB, and route outbound internet traffic through an AWS Network Firewall with a stateful rule group allowing the regulatory API domain.

Gateway VPC endpoints are the most cost-effective and direct routing mechanism for S3 and DynamoDB because they do not incur hourly charges or data processing costs, unlike Interface endpoints. To restrict internet egress traffic to a specific domain name (FQDN), an AWS Network Firewall deployed in a public subnet with a stateful rule group using domain list filtering is required, as standard Security Groups and Network ACLs do not support filtering by hostnames.

Step-by-Step Solution

Select the most cost-effective connection type to access AWS services privately.

Identify Gateway VPC endpoints as the optimal solution for Amazon S3 and Amazon DynamoDB traffic.

Gateway endpoints keep traffic within the AWS private network and are free, unlike Interface endpoints which charge hourly and data processing fees.

Evaluate subnet-level and instance-level security options for domain-specific filtering.

Recognize that Security Groups and Network ACLs cannot filter outbound traffic based on Fully Qualified Domain Names (FQDN).

Security groups and Network ACLs only support IP addresses and CIDR blocks, meaning they cannot resolve or restrict egress based on hostnames like `api.compliance-registry.org`.

Identify the service capable of domain list filtering.

Select AWS Network Firewall to filter outbound HTTP/HTTPS requests.

AWS Network Firewall provides stateful rule groups that allow domain name filtering to restrict outbound internet egress to specific allowed destinations.

Configure the private subnet routing table to direct traffic to the correct targets.

Associate S3 and DynamoDB routes with Gateway endpoints, and route default outbound traffic (

0.0.0.0/0

) to the AWS Network Firewall endpoint.

This setup separates internal AWS traffic from external compliance API traffic and enforces least-privilege egress controls.

Key Concept

VPC routing and endpoint configuration for private AWS service communication, combined with stateful domain-level egress filtering using AWS Network Firewall.

Question 359Question →

An application running on an Amazon EC2 instance in a development AWS account needs to securely access and read objects from an Amazon S3 bucket located in a separate production AWS account. The company's security policy strictly prohibits the use of long-term credentials and requires that all access logs identify the specific EC2 instance making the requests. Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

In the production account, create an IAM role with a trust policy that allows the development account's EC2 instance IAM role to assume it.

In the development account, attach an IAM policy to the EC2 instance's IAM role that grants the sts:AssumeRole permission for the production account's role.

In the production account, configure the S3 bucket policy to grant read access to the root user of the development account.

In the development account, create an IAM user with API keys, and store the keys as plaintext parameters in Systems Manager Parameter Store.

In the development account, manually create individual IAM users with long-term credentials for the EC2 instances to access the production bucket.

Show answer & explanation

Answer: In the production account, create an IAM role with a trust policy that allows the development account's EC2 instance IAM role to assume it.; In the development account, attach an IAM policy to the EC2 instance's IAM role that grants the sts:AssumeRole permission for the production account's role.

Answer

To securely access the S3 bucket in a separate account without long-term credentials, create an IAM role in the production account that trusts the development EC2 instance role, and grant the EC2 instance role permission to assume that production role.

The correct solution involves setting up cross-account access using an IAM role. In the production account, an IAM role is created with a trust policy that allows the IAM role attached to the EC2 instance in the development account to assume it. In the development account, the EC2 instance role is granted permission to perform the sts:AssumeRole action on the production role. This approach ensures access is secure, temporary, and easily auditable.

Step-by-Step Solution

Configure the IAM role in the target production account.

An IAM role is created in the production account with a trust policy allowing the development EC2 instance's IAM role to assume it, along with a permissions policy granting read access to the specific S3 bucket.

This defines who is trusted to access the production resources and what actions they can perform once authorized.

Configure the IAM role in the source development account.

An IAM role is attached to the EC2 instance as an instance profile, and its policy is updated to allow the sts:AssumeRole action targeting the ARN of the IAM role in the production account.

This authorizes the EC2 instance to request temporary credentials by assuming the trusted role in the production account.

Assume the role from the EC2 instance.

The application running on the EC2 instance calls the AWS Security Token Service (STS) to assume the production IAM role, receiving short-lived temporary security credentials to access the S3 bucket.

This satisfies the security requirement to use temporary credentials instead of long-term keys.

Key Concept

Cross-account access using IAM roles and STS AssumeRole.

Question 360Question →

A solutions architect is configuring network security controls for a new application within a VPC. The architect needs to understand the default behavior of the default security group and the default network access control list (NACL). Which of the following statements accurately describe the default configurations of these resources? (Select TWO.)

Select all that apply

The default security group allows all inbound traffic originating from resources associated with that same security group.

The default network ACL allows all inbound and outbound traffic.

The default security group blocks all outbound traffic until an outbound rule is explicitly added.

The default network ACL is stateful, meaning any allowed inbound traffic automatically permits the corresponding return outbound traffic.

The default security group operates at the subnet level to block traffic from specific IP addresses.

Show answer & explanation

Answer: The default security group allows all inbound traffic originating from resources associated with that same security group.; The default network ACL allows all inbound and outbound traffic.

Answer

The correct answers are the options stating that the default security group allows all inbound traffic from resources associated with the same security group, and that the default network ACL allows all inbound and outbound traffic.

The default security group is configured to allow inbound traffic only if it originates from resources that are associated with the same security group. All other inbound traffic is blocked. Meanwhile, the default network ACL is preconfigured to allow all inbound and outbound traffic, acting as a pass-through until custom rules are written.

Step-by-Step Solution

Analyze security group default configuration rules.

The default security group allows all outbound traffic and allows inbound traffic only from resources associated with the same security group.

This establishes the baseline behavior for instances launched into the default security group.

Analyze network ACL default configuration rules.

The default network ACL allows all traffic to pass both inbound and outbound.

This ensures that subnets associated with the default NACL do not have traffic blocked until custom rules are defined.

Differentiate security group and network ACL characteristics.

Identify that security groups are stateful and operate at the interface level, while network ACLs are stateless and operate at the subnet level.

This filters out incorrect options that confuse statefulness and placement levels.

Key Concept

Default VPC Network Security Configurations

PreviousPage 18 / 74Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept