All practice questions

1462 questions

All types1,462 Multiple choice739 Multiple select723

A retail company is designing an event-driven system to process stock level updates from its physical stores. The updates must be processed in the exact order they occur for each product SKU to prevent database write conflicts and maintain accurate inventory levels. The system must also be able to scale and absorb sudden spikes in update traffic during promotional sales events.

Which solution meets these requirements with the least operational overhead?

Publish the updates to an Amazon SNS FIFO topic. Subscribe an Amazon SQS FIFO queue to the topic, and configure an AWS Lambda function to process the messages from the queue.

Publish the updates to a standard Amazon SNS topic. Subscribe a standard Amazon SQS queue to the topic, and configure an AWS Lambda function to process the messages from the queue.

Publish the updates to a standard Amazon SQS queue, and configure an AWS Lambda function to consume the messages using FIFO consumer configuration.

Publish the updates to an Amazon Kinesis Data Stream configured with a single shard, and configure an AWS Lambda function to process the records sequentially.

Show answer & explanation

Answer: Publish the updates to an Amazon SNS FIFO topic. Subscribe an Amazon SQS FIFO queue to the topic, and configure an AWS Lambda function to process the messages from the queue.

Answer

Publish the updates to an Amazon SNS FIFO topic, subscribe an Amazon SQS FIFO queue to the topic, and configure an AWS Lambda function to process the messages.

Utilizing an Amazon SNS FIFO topic combined with an Amazon SQS FIFO queue guarantees that messages are processed sequentially per product SKU (by using the SKU as the message group ID). This architecture ensures that stock updates are processed in the order they occurred, while AWS Lambda dynamically scales up to handle promotional traffic spikes without managing servers, minimizing operational overhead.

Step-by-Step Solution

Determine the decoupling and sequencing requirements.

Identified that events must be decoupled and processed in first-in, first-out order relative to each product SKU.

Sequential order prevents write conflicts and maintains inventory integrity.

Select the appropriate AWS messaging integration services that support ordering.

Chose Amazon SNS FIFO and Amazon SQS FIFO to route and queue updates while maintaining order.

Standard message routing options do not guarantee ordering and cannot satisfy the primary constraint.

Select a processing backend that minimizes operational overhead and handles sudden scale.

AWS Lambda is configured to consume batches from the SQS FIFO queue.

Lambda is serverless, requires no infrastructure provisioning, and automatically scales in response to queue depth.

Key Concept

Decoupling and ensuring sequential event processing using FIFO SNS and SQS integration patterns.

Question 1342Question →

A company is migrating its operations to AWS and wants to grant its employees access to the AWS Management Console. The employees' identities are currently managed in an on-premises Microsoft Active Directory. The company's security policy requires that employees sign in using their existing corporate credentials and that administrative overhead related to credential management in AWS be minimized. Which combination of actions should a solutions architect recommend to meet these requirements? (Select two.)

Select all that apply

Enable AWS IAM Identity Center and configure it to use the corporate Active Directory as its identity source.

Create permission sets in AWS IAM Identity Center and assign them to the corporate Active Directory groups.

Create individual IAM users in the AWS account for each employee and configure multi-factor authentication (MFA) for each user.

Configure the AWS account root user to allow concurrent logins and share the root password with all administrative staff.

Create a single shared IAM user named 'corporate-access' and distribute its password to all employees.

Show answer & explanation

Answer: Enable AWS IAM Identity Center and configure it to use the corporate Active Directory as its identity source.; Create permission sets in AWS IAM Identity Center and assign them to the corporate Active Directory groups.

Answer

To meet the requirements, the solutions architect should configure AWS IAM Identity Center with the corporate Active Directory as the identity source, and then map AWS permission sets to the existing Active Directory groups.

Connecting AWS IAM Identity Center to the on-premises Active Directory establishes federation, which supports using existing corporate credentials. Mapping permission sets to corporate Active Directory groups ensures administrative overhead is kept to a minimum by leveraging existing group memberships for access control.

Step-by-Step Solution

Connect the corporate directory to AWS.

AWS IAM Identity Center is enabled and integrated with the on-premises Active Directory.

This establishes identity federation, allowing employees to sign in with their existing credentials without creating local AWS IAM user accounts.

Define AWS access levels and assign them to groups.

Permission sets are created in AWS IAM Identity Center and assigned to Active Directory groups.

This maps corporate group memberships directly to AWS permissions, minimizing administrative overhead by automating access provisioning.

Key Concept

Using AWS IAM Identity Center to federate on-premises Microsoft Active Directory identities for single sign-on (SSO) to AWS accounts, reducing overhead and maintaining centralized credential management.

Question 1343Question →

A digital ticketing platform is designing a system to process flash sale ticket purchases. The application must handle sudden surges in transaction volume and process purchase requests asynchronously. To prevent double-booking, the requests for each specific event must be processed in the exact order they were submitted. If a transaction fails to process due to downstream database timeouts, it must be isolated for manual inspection without halting the processing of other purchases.

Which solution meets these requirements with the least operational overhead?

Send the purchase requests to an Amazon Simple Queue Service (Amazon SQS) Standard queue. Configure the consumer application to sort the transactions chronologically. Set up another SQS Standard queue as a dead-letter queue to capture failed messages.

Publish the purchase requests to an Amazon Simple Notification Service (Amazon SNS) Standard topic. Subscribe multiple Amazon SQS FIFO queues to the topic to buffer and process the messages, and configure a redrive policy on the queues to route failed messages to a dead-letter queue.

Send the purchase requests to an Amazon Simple Queue Service (Amazon SQS) FIFO queue. Configure the event ID as the message group ID. Set up another SQS FIFO queue as a dead-letter queue to capture failed messages after a specified number of retries.

Stream the purchase requests to an Amazon Kinesis Data Stream. Configure a single shard to guarantee ordering, and use AWS Lambda to process the records. Configure an AWS Lambda destination to send failed records to an Amazon Simple Storage Service (Amazon S3) bucket.

Show answer & explanation

Answer: Send the purchase requests to an Amazon Simple Queue Service (Amazon SQS) FIFO queue. Configure the event ID as the message group ID. Set up another SQS FIFO queue as a dead-letter queue to capture failed messages after a specified number of retries.

Answer

Send the purchase requests to an Amazon Simple Queue Service (Amazon SQS) FIFO queue, configure the event ID as the message group ID, and set up an Amazon SQS FIFO queue as a dead-letter queue (DLQ).

The correct solution uses an Amazon SQS FIFO queue. Specifying the event ID as the message group ID ensures that purchases for a specific ticket event are processed sequentially, avoiding concurrent modifications or out-of-order processing that could cause double-booking. Configuring an SQS FIFO dead-letter queue (DLQ) allows failed messages to be redirected after a set number of attempts, preventing head-of-line blocking for other events and allowing administrators to inspect the failure without halting the system.

Step-by-Step Solution

Select the messaging service that supports FIFO ordering.

Amazon SQS FIFO queue is chosen to ensure messages within the same message group (defined by the event ID) are processed in the exact order they are received.

Standard SQS queues and Standard SNS topics do not guarantee message ordering.

Configure the message grouping strategy.

Set the event ID as the Message Group ID.

This ensures that transactions for the same event are processed sequentially by a single consumer, preventing double-booking, while transactions for different events can be processed in parallel.

Establish a mechanism to handle message processing failures without blocking the queue.

Create a secondary SQS FIFO queue as a dead-letter queue (DLQ) and configure a redrive policy on the main SQS FIFO queue.

If a transaction repeatedly fails, the redrive policy routes the message to the DLQ after a max receive count is reached. This unblocks the queue for subsequent messages in the same group, allowing manual analysis of the failed transaction.

Key Concept

Decoupling message processing using SQS FIFO queues with Message Group IDs and SQS FIFO dead-letter queues to maintain ordering and handle errors.

Question 1344Question →

A global logistics company hosts its shipment tracking database on an Amazon RDS for PostgreSQL DB instance in the us-west-2 Region. The company needs to establish a disaster recovery (DR) plan in the us-east-1 Region. The DR solution must support a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 30 minutes, while keeping ongoing costs at a minimum. Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Create a cross-Region read replica of the RDS DB instance in the us-east-1 Region. If a disaster occurs, promote the read replica to a standalone DB instance.

Store the application tier as an AWS CloudFormation template in Amazon S3. In the event of a disaster, deploy the application tier in the us-east-1 Region using the template, and point Amazon Route 53 to the new application endpoints.

Configure the RDS DB instance with Multi-AZ replication to copy data synchronously to the us-east-1 Region, and configure Amazon Route 53 with an active-active failover policy.

Configure AWS Backup to take hourly snapshots of the RDS DB instance, copy them to an Amazon S3 Glacier Flexible Retrieval vault in the us-east-1 Region, and restore the DB instance from the vault during a disaster.

Create a cross-Region read replica of the RDS DB instance in the us-east-1 Region. Configure Amazon Route 53 with a latency routing policy to automatically route write traffic to the read replica during a primary database failure.

Show answer & explanation

Answer: Create a cross-Region read replica of the RDS DB instance in the us-east-1 Region. If a disaster occurs, promote the read replica to a standalone DB instance.; Store the application tier as an AWS CloudFormation template in Amazon S3. In the event of a disaster, deploy the application tier in the us-east-1 Region using the template, and point Amazon Route 53 to the new application endpoints.

Answer

Create a cross-Region read replica of the RDS DB instance in the us-east-1 Region and promote it during a disaster, combined with storing the application tier as an AWS CloudFormation template in Amazon S3 to deploy on-demand.

To meet the 5-minute RPO, database replication must be continuous. Creating an Amazon RDS cross-Region read replica provides asynchronous replication with a delay of seconds. During a disaster, promoting this read replica to a primary instance takes only a few minutes, meeting the 30-minute RTO. To meet the goal of minimizing costs, the application tier should not run continuously. Storing the infrastructure as an AWS CloudFormation template in Amazon S3 allows the entire application tier to be spun up on-demand in the secondary region within the 30-minute RTO window, incurring no active EC2 costs during normal operations.

Step-by-Step Solution

Select a replication mechanism that achieves an RPO of 5 minutes across AWS Regions.

Identify that Amazon RDS cross-Region read replicas replicate data asynchronously, typically with a lag of seconds, satisfying the 5-minute RPO requirement.

Hourly backups or multi-region synchronous replication are either too slow or unsupported for Amazon RDS.

Determine the database promotion strategy that fits within the 30-minute RTO.

Promoting a cross-Region read replica to a standalone primary database instance takes only a few minutes.

This meets the 30-minute RTO database-tier recovery requirement.

Determine the application tier recovery strategy that minimizes ongoing costs.

Keep zero active compute resources running in the disaster recovery region by storing the infrastructure definitions as AWS CloudFormation templates in Amazon S3.

This Pilot Light strategy achieves the lowest possible cost while allowing the environment to be deployed within the 30-minute RTO.

Key Concept

Disaster recovery (DR) strategies on AWS vary in cost, RTO, and RPO. Cross-Region read replicas meet low RPOs for databases by performing asynchronous replication, while Pilot Light strategies (like deploying via CloudFormation templates on-demand) minimize compute costs in the secondary region at the expense of a slightly higher RTO.

Estimated Time:1m 30s

Question 1345Question →

A food delivery platform hosts its order dispatch application in the us-west-2 Region. The application tier runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer, and the database tier uses an Amazon RDS for PostgreSQL Multi-AZ DB instance. The company wants to establish a disaster recovery (DR) solution in the us-east-1 Region. The solution must achieve a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes, while keeping ongoing standby costs as low as possible. Which disaster recovery strategy should a solutions architect recommend to meet these requirements?

Deploy an Auto Scaling group with a desired capacity of 0 EC2 instances behind an Application Load Balancer in the destination region. Create an Amazon RDS cross-region read replica in the destination region. Configure Route 53 failover routing with health checks. In the event of a disaster, promote the read replica to a primary DB instance and increase the desired capacity of the Auto Scaling group.

Deploy a scaled-down Auto Scaling group of EC2 instances behind an Application Load Balancer in the destination region. Create an Amazon RDS cross-region read replica in the destination region. Configure Route 53 failover routing with health checks. In the event of a disaster, promote the read replica to a primary DB instance and scale up the Auto Scaling group.

Create an Amazon RDS cross-region read replica in the destination region. Configure Route 53 latency routing to distribute traffic between the two regions. Rely on AWS to automatically promote the cross-region read replica to the primary DB instance if the primary region experiences an outage.

Configure daily automated database snapshots and copy them to Amazon S3 Glacier Flexible Retrieval in the destination region. Use an AWS CloudFormation template to deploy the application infrastructure. In the event of a disaster, restore the database from the snapshot in S3 Glacier and run the CloudFormation template.

Show answer & explanation

Answer: Deploy a scaled-down Auto Scaling group of EC2 instances behind an Application Load Balancer in the destination region. Create an Amazon RDS cross-region read replica in the destination region. Configure Route 53 failover routing with health checks. In the event of a disaster, promote the read replica to a primary DB instance and scale up the Auto Scaling group.

Answer

Deploy a scaled-down Auto Scaling group of EC2 instances in the destination region, create an Amazon RDS cross-region read replica, configure Route 53 failover routing, and promote the replica and scale up the instances during a disaster.

The correct strategy is a Warm Standby deployment. By keeping a scaled-down Auto Scaling group of EC2 instances running in the destination region, the application can start serving traffic immediately upon failover and then scale out. The Amazon RDS cross-region read replica maintains a near real-time copy of the database, ensuring the 5-minute RPO is met. During a disaster, the replica is promoted to primary and the EC2 instances are scaled up, which can be accomplished within the 15-minute RTO.

Step-by-Step Solution

Evaluate RPO requirements against replication options.

An RPO of 5 minutes requires continuous replication. An Amazon RDS cross-region read replica provides asynchronous replication with lag typically under a few seconds, meeting the 5-minute RPO.

Backup-and-restore or snapshot copy methods cannot guarantee a 5-minute RPO due to the frequency of snapshots.

Evaluate RTO requirements against compute standby options.

An RTO of 15 minutes is very tight. Bootstrapping new EC2 instances from scratch (desired capacity 0) takes time to launch, run user data scripts, and pass load balancer health checks. Keeping a scaled-down Auto Scaling group with at least one active instance allows immediate traffic handling while the group scales up.

Distinguishing between Warm Standby (scaled-down active instances) and Pilot Light (no running instances) is critical for meeting short recovery times.

Determine the routing and failover mechanics.

Configure Route 53 failover routing with health checks to detect primary region failure. In a disaster, the read replica must be promoted manually or via automation, and the standby Auto Scaling group must be scaled up to handle production traffic.

RDS cross-region replication is not automatic and requires promotion to become a read-write primary database.

Key Concept

Warm Standby Disaster Recovery Strategy

Estimated Time:2m 0s

Question 1346Question →

A health insurance company is designing an asynchronous claim processing system. The system must process incoming claims in the exact order they are received to ensure compliance with auditing standards. If a claim fails to process successfully after multiple retries, it must be isolated for manual investigation without stopping or delaying the processing of subsequent claims. Which TWO components should the solutions architect combine to meet these requirements? (Select TWO.)

Select all that apply

An Amazon SQS FIFO queue to buffer incoming claims

A dead-letter queue (DLQ) configured on the Amazon SQS queue

An Amazon SQS standard queue to buffer incoming claims

An Amazon SNS standard topic to distribute claims to processing services

An Amazon S3 bucket with versioning enabled to manage sequence order

Show answer & explanation

Answer: An Amazon SQS FIFO queue to buffer incoming claims; A dead-letter queue (DLQ) configured on the Amazon SQS queue

Answer

An Amazon SQS FIFO queue to buffer incoming claims, combined with a dead-letter queue (DLQ) configured on the Amazon SQS queue.

The correct answer combines an Amazon SQS FIFO queue with a dead-letter queue. The SQS FIFO queue guarantees that message ordering is strictly preserved. Configuring a dead-letter queue on the SQS queue ensures that any claim failing to process after multiple attempts is redirected to the DLQ, freeing up the pipeline and preventing head-of-line blocking.

Step-by-Step Solution

Select a message queue that guarantees message ordering.

Amazon SQS FIFO queue is chosen over standard SQS to ensure first-in, first-out sequence for audit compliance.

Standard queues do not guarantee strict message ordering, while FIFO queues guarantee message delivery order.

Configure error isolation to prevent head-of-line blocking.

A dead-letter queue (DLQ) is attached to the primary SQS FIFO queue with a redrive policy.

If a claim consistently fails to process, the redrive policy routes it to the DLQ after maxReceiveCount is exceeded, permitting subsequent messages to continue processing.

Key Concept

Decoupling message-driven architectures that require strict processing order and fault isolation using SQS FIFO and DLQs.

Question 1347Question →

A logistics company uses a microservices-based application to track cargo pallet lifecycle events such as received, scanned, sorted, and loaded. If these updates are processed out of sequence, the inventory database becomes corrupted. The company needs to decouple the ingestion service from the backend database while ensuring that the updates for each individual pallet are processed in the exact chronological order in which they were generated. Which solution meets these requirements with the least operational overhead?

Publish the updates to an Amazon SQS Standard queue, and configure a message deduplication ID based on the event timestamp to guarantee chronological ordering.

Publish the updates to an Amazon SQS FIFO queue, using the pallet ID as the message group ID, and use consumer instances to process the messages.

Publish the updates to an Amazon SNS Standard topic, and subscribe multiple Amazon SQS Standard queues to process the updates in parallel.

Publish the updates to an Amazon SQS Standard queue, and use Message Group IDs to group and order the messages during consumer retrieval.

Show answer & explanation

Answer: Publish the updates to an Amazon SQS FIFO queue, using the pallet ID as the message group ID, and use consumer instances to process the messages.

Answer

Publishing the updates to an Amazon SQS FIFO queue, using the pallet ID as the message group ID, and using consumer instances to process the messages is the correct solution.

Publishing the updates to an Amazon SQS FIFO queue ensures that messages are processed in the exact order they are received. Using the pallet ID as the message group ID ensures that events for any single pallet are processed sequentially, preventing database corruption, while enabling parallel processing of different pallets across multiple consumers.

Step-by-Step Solution

Analyze the ordering and decoupling requirements.

The application requires message decoupling and strict message ordering per pallet to prevent database corruption.

If messages are processed out of order, the inventory status of a pallet will become incorrect.

Evaluate Amazon SQS queue options for ordering guarantees.

Select Amazon SQS FIFO queues instead of SQS Standard queues.

SQS Standard queues only offer best-effort ordering, whereas SQS FIFO queues guarantee that messages are processed in the exact order they are received.

Configure the partitioning/grouping strategy for concurrent processing.

Use the pallet ID as the Message Group ID on the SQS FIFO queue.

This guarantees that updates for the same pallet are processed in order, while allowing different pallets to be processed concurrently by multiple consumers.

Key Concept

Amazon SQS FIFO queues provide first-in, first-out delivery. By using Message Group IDs, you can group messages so that messages within the same group are processed in order, while allowing multiple consumer instances to process different groups in parallel.

Question 1348Question →

An automotive fleet telematics company processes vehicle telemetry data in the us-east-1 Region. The application tier runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The database tier uses an Amazon RDS for MySQL Multi-AZ DB instance. The company needs to design a disaster recovery (DR) strategy in the us-west-2 Region with a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. The solution must minimize costs during normal operations.

Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Configure Amazon RDS cross-Region replication to maintain a read replica in the secondary Region, which will be promoted to a standalone primary database during a failover event.

Prepare an AWS CloudFormation template containing the application tier resources, and deploy it in the secondary Region with the Auto Scaling group's desired capacity set to 0.

Enable Amazon RDS Multi-AZ replication to the secondary Region to achieve synchronous database replication and automatic failover.

Deploy a fully scaled, active application tier in the secondary Region, and use Amazon Route 53 latency-based routing to distribute user traffic.

Export database transaction logs to Amazon S3 hourly, transition them to Amazon S3 Glacier Flexible Retrieval in the secondary Region, and restore them during a disaster.

Show answer & explanation

Answer: Configure Amazon RDS cross-Region replication to maintain a read replica in the secondary Region, which will be promoted to a standalone primary database during a failover event.; Prepare an AWS CloudFormation template containing the application tier resources, and deploy it in the secondary Region with the Auto Scaling group's desired capacity set to 0.

Answer

Configure Amazon RDS cross-Region replication to maintain a read replica in the secondary Region to be promoted during failover, and prepare an AWS CloudFormation template to deploy the application tier in the secondary Region with the Auto Scaling group desired capacity set to 0.

The correct strategy combines database replication and compute infrastructure preparedness. Configuring Amazon RDS cross-Region replication provides continuous asynchronous data transfer to the secondary Region, satisfying the 15-minute RPO. Deploying the application tier infrastructure with an Auto Scaling group capacity of 0 ensures that no EC2 compute charges are incurred during normal operations. In a disaster recovery event, the solutions architect can promote the RDS read replica to a primary database and scale up the Auto Scaling group, recovering the application stack well within the 2-hour RTO.

Step-by-Step Solution

Address the 15-minute database RPO with asynchronous cross-Region database replication.

Create an Amazon RDS cross-Region read replica of the MySQL database in the target Region.

RDS cross-Region read replicas replicate changes asynchronously within seconds or minutes, guaranteeing the data loss remains well below the 15-minute target.

Minimize compute costs during normal operations while satisfying the 2-hour RTO.

Deploy an AWS CloudFormation template in the target Region with the Auto Scaling group capacity set to 0.

Keeping the Auto Scaling group capacity at 0 ensures that no EC2 instances are running or billed during standard operations, matching the Pilot Light strategy. During a disaster, the capacity is updated to scale up the instances.

Ensure the overall recovery process can complete within the 2-hour RTO limit.

Define recovery steps: promote the RDS read replica to primary and increase the Auto Scaling group desired capacity.

Promoting the read replica and launching EC2 instances via Auto Scaling takes under 15 minutes, which successfully satisfies the 2-hour RTO requirement.

Key Concept

Implementing a cost-optimized Pilot Light disaster recovery strategy across Regions using Amazon RDS cross-Region read replicas and scaled-down Auto Scaling groups.

Estimated Time:2m 0s

Question 1349Question →

A company is designing a secure identity and access management architecture. The company has a multi-account AWS environment managed under AWS Organizations. The engineering team consists of 150 developers whose identities are managed in an on-premises Active Directory (AD). Additionally, an on-premises application server requires access to an Amazon S3 bucket located in a production AWS account to write daily backup files. The security team mandates that no long-term AWS credentials should be stored on-premises, and administrative overhead must be minimized.

Which combination of actions will meet these requirements securely? (Select TWO.)

Select all that apply

Configure AWS IAM Identity Center (successor to AWS Single Sign-On) to federate with the on-premises Active Directory, and map AD groups to permission sets in the AWS accounts.

Set up AWS IAM Roles Anywhere, establish trust with the company's private Certificate Authority (CA), and configure the on-premises application server to exchange its X.509 certificate for temporary IAM credentials.

Create individual IAM users in each AWS account for all 150 developers, and implement an automation script to periodically synchronize user passwords from the on-premises Active Directory.

Generate an access key pair for the AWS Organizations management account root user, and configure the on-premises application server to use these credentials for writing backup files to the S3 bucket.

Create an IAM user with S3 write permissions, generate an access key, store the key in AWS Systems Manager Parameter Store as a Standard String parameter type, and configure the on-premises application to retrieve the parameter.

Show answer & explanation

Answer: Configure AWS IAM Identity Center (successor to AWS Single Sign-On) to federate with the on-premises Active Directory, and map AD groups to permission sets in the AWS accounts.; Set up AWS IAM Roles Anywhere, establish trust with the company's private Certificate Authority (CA), and configure the on-premises application server to exchange its X.509 certificate for temporary IAM credentials.

Answer

Configure AWS IAM Identity Center to federate with the on-premises Active Directory and map groups to permission sets, and set up AWS IAM Roles Anywhere to allow the on-premises application server to exchange its X.509 certificate for temporary credentials.

The correct solution uses AWS IAM Identity Center to federate on-premises Active Directory identities, enabling centralized single sign-on access to multiple AWS accounts. For the on-premises application server, AWS IAM Roles Anywhere is the secure and modern architectural pattern to obtain temporary IAM credentials using X.509 certificates, completely eliminating the need to configure or store long-term access keys on-premises.

Step-by-Step Solution

Establish centralized federation for the developer accounts.

AWS IAM Identity Center is configured to federate with the on-premises Active Directory, mapping AD groups directly to target permission sets in the member accounts.

This centralizes user management, minimizes administrative overhead, and avoids creating individual IAM users in each target AWS account.

Secure programmatic access for the on-premises workload without long-term credentials.

AWS IAM Roles Anywhere is configured to trust the company's private Certificate Authority (CA) and maps the server's certificate to an IAM role with S3 write permissions.

This allows the server to authenticate via an X.509 certificate and receive short-term session credentials, avoiding the risk of stored access keys.

Key Concept

AWS Identity and Access Management best practices dictate using federation via AWS IAM Identity Center for human access, and AWS IAM Roles Anywhere for secure machine access from outside AWS without long-term credentials.

Estimated Time:2m 0s

Question 1350Question →

A municipal energy utility company hosts its customer billing portal in the eu-west-1 Region. The application tier runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The database tier uses an Amazon RDS for PostgreSQL DB instance. The company needs to design a disaster recovery (DR) strategy in the eu-central-1 Region. The solution must achieve a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes, while minimizing ongoing costs. Which architecture should a solutions architect recommend to meet these requirements?

Configure an AWS CloudFormation template to deploy the Application Load Balancer and the EC2 Auto Scaling group on-demand in the secondary region during a failover. Configure an Amazon RDS cross-region read replica in the secondary region. In the event of a disaster, deploy the CloudFormation stack, promote the read replica to a primary database, and update Amazon Route 53 failover records.

Configure an Amazon RDS cross-region read replica in the secondary region. Deploy a scaled-down Auto Scaling group of EC2 instances behind an Application Load Balancer in the secondary region. Configure Amazon Route 53 active-passive failover routing so that the database and application traffic automatically failover to the secondary region without administrative intervention.

Configure an Amazon RDS cross-region read replica in the secondary region. Deploy a scaled-down Auto Scaling group of EC2 instances behind an Application Load Balancer in the secondary region. In the event of a disaster, promote the cross-region read replica to a standalone database instance, scale up the Auto Scaling group, and update Amazon Route 53 failover routing records to point to the secondary Application Load Balancer.

Configure a daily database snapshot and copy it to Amazon S3 Glacier Flexible Retrieval in the secondary region. Create an AWS CloudFormation template to deploy the Application Load Balancer and the EC2 Auto Scaling group. In the event of a disaster, retrieve the snapshot from S3 Glacier, restore it to a new RDS instance, deploy the CloudFormation stack, and update Amazon Route 53.

Show answer & explanation

Answer: Configure an Amazon RDS cross-region read replica in the secondary region. Deploy a scaled-down Auto Scaling group of EC2 instances behind an Application Load Balancer in the secondary region. In the event of a disaster, promote the cross-region read replica to a standalone database instance, scale up the Auto Scaling group, and update Amazon Route 53 failover routing records to point to the secondary Application Load Balancer.

Answer

Configure an Amazon RDS cross-region read replica in the secondary region, deploy a scaled-down Auto Scaling group of EC2 instances behind an Application Load Balancer in the secondary region, and in the event of a disaster, promote the replica, scale up the Auto Scaling group, and update Route 53 failover routing.

A Warm Standby DR strategy is the most cost-effective solution that satisfies both the 15-minute RTO and 5-minute RPO. The cross-region read replica replicates data asynchronously, keeping the RPO under 5 minutes. The scaled-down Auto Scaling group keeps EC2 costs low while ensuring that virtual machines are pre-provisioned and can be scaled up immediately to meet the RTO. Manual promotion of the RDS read replica is required to make the secondary database active for write operations.

Step-by-Step Solution

Establish cross-region database replication to meet the RPO requirement.

Create an Amazon RDS cross-region read replica in the secondary region (eu-central-1) to asynchronously replicate the primary PostgreSQL DB instance.

Asynchronous replication runs continuously, keeping the replication lag to seconds or minutes, which satisfies the 5-minute RPO.

Set up the application tier in the recovery region to meet the RTO requirement cost-effectively.

Deploy an Application Load Balancer and a scaled-down Auto Scaling group of EC2 instances in the secondary region.

Keeping a Warm Standby (scaled-down Auto Scaling group and ALB) minimizes ongoing costs while ensuring the core compute infrastructure is already online and ready to scale up within minutes.

Orchestrate failover in the event of a primary region outage.

Promote the RDS cross-region read replica to a standalone DB instance, scale up the EC2 Auto Scaling group to production size, and update Route 53 DNS records to point to the secondary ALB.

Promoting the read replica and scaling up the existing compute capacity allows the environment to become fully active and handle production traffic within the 15-minute RTO.

Key Concept

Warm Standby Disaster Recovery Strategy

Estimated Time:1m 30s

Question 1351Question →

A solutions architect is explaining basic VPC security concepts to a new team member. The team is configuring security groups and Network Access Control Lists (NACLs) to secure a standard two-tier web application. Which TWO statements correctly describe the behavior or scope of these security resources?

Select all that apply

Security groups are stateful, meaning return traffic is automatically allowed regardless of inbound rules.

Network ACLs are stateless, meaning return traffic must be explicitly allowed by outbound rules.

Security groups operate at the subnet level and apply to all resources in that subnet automatically.

Network ACLs are stateful, so allowing inbound traffic automatically permits the corresponding outbound response.

Security groups can inspect HTTP request payloads to block common Layer 7 web exploits.

Show answer & explanation

Answer: Security groups are stateful, meaning return traffic is automatically allowed regardless of inbound rules.; Network ACLs are stateless, meaning return traffic must be explicitly allowed by outbound rules.

Answer

Security groups are stateful, meaning return traffic is automatically allowed, and Network ACLs are stateless, meaning return traffic must be explicitly allowed.

The correct statements are that security groups are stateful and network ACLs are stateless. Security groups automatically allow return traffic for any established connection they permit. Conversely, network ACLs do not track session state, which means both inbound and outbound paths must have explicit rule coverage to allow communications.

Step-by-Step Solution

Analyze the stateful behavior of Security Groups.

Confirm that Security Groups track connection state, allowing response traffic automatically.

This is a fundamental property of security groups in VPC network security.

Analyze the stateless behavior of Network ACLs.

Confirm that Network ACLs do not track connection state, requiring explicit inbound and outbound rules for a complete flow.

This contrasts with security groups and requires careful rule writing to prevent blocked return traffic.

Evaluate the incorrect options regarding scope and inspection capabilities.

Identify that security groups do not apply to subnets and cannot perform Layer 7 packet inspection.

Security groups operate at the network interface level (Layer 4), whereas Network ACLs operate at the subnet level, and Layer 7 protection is provided by AWS WAF.

Key Concept

Statefulness and boundaries of VPC Security Groups versus Network ACLs

Question 1352Question →

A smart wearable device company is designing a system to process user workout telemetry events (such as activity started, heart rate milestone, activity paused, and activity completed) from fitness trackers. The events must be processed in the exact chronological sequence they are generated for each individual user workout. The backend processing application is deployed on Amazon EC2 instances. During peak hours, the backend database occasionally experiences lock contention, causing temporary processing failures. If a telemetry event fails to process, the system must retry it. If it fails 5 times, it must be isolated for analysis without blocking subsequent events for that user's workout or other users' workouts.

Which solution meets these requirements with the least operational overhead?

Publish the workout events to an Amazon SQS FIFO queue, using the workout ID as the message group ID. Configure the backend EC2 instances to consume messages from the queue. Set up a dead-letter queue (DLQ) with a redrive policy on the primary SQS FIFO queue to capture failed messages after a maximum receive count of 5.

Publish the workout events to a standard Amazon SQS queue. Configure the backend EC2 instances to consume messages from the queue. Set up a dead-letter queue (DLQ) with a redrive policy on the primary standard SQS queue to capture failed messages after a maximum receive count of 5.

Ingest the workout telemetry events using an Amazon Kinesis Data Stream configured with a single shard to guarantee strict sequential ordering. Use AWS Lambda to process the stream events and write failed records to an Amazon S3 bucket for auditing.

Deploy an AWS Lambda function that runs continuously in a loop to poll the database for new telemetry events. Process the events, and write any failures to an Amazon SQS standard dead-letter queue after 5 retries.

Show answer & explanation

Answer: Publish the workout events to an Amazon SQS FIFO queue, using the workout ID as the message group ID. Configure the backend EC2 instances to consume messages from the queue. Set up a dead-letter queue (DLQ) with a redrive policy on the primary SQS FIFO queue to capture failed messages after a maximum receive count of 5.

Answer

The correct answer provides in-order event processing per user workout by using an Amazon SQS FIFO queue with a message group ID. Using a dead-letter queue (DLQ) with a maxReceiveCount of 5 handles failures by isolating problematic messages after multiple attempts without halting the processing of other messages.

Step-by-Step Solution

Select SQS FIFO over standard queues to maintain strict message ordering.

Ensures that events for a specific workout are processed chronologically.

Standard SQS queues only provide best-effort ordering, whereas FIFO guarantees first-in, first-out delivery.

Use the workout ID as the message group ID.

Enables parallel processing of different workouts while maintaining ordering within each individual workout.

Messages belonging to the same message group are always processed in order relative to each other.

Configure a dead-letter queue (DLQ) with a maxReceiveCount of 5.

Isolates poison pill messages after 5 failed processing attempts.

Prevents unprocessable messages from blocking the rest of the queue, allowing other workloads to proceed.

Key Concept

Decoupled architecture using SQS FIFO queues with a DLQ for ordered, resilient processing.

Estimated Time:1m 30s

Question 1353Question →

A solutions architect is designing the network security for a new application hosted on Amazon EC2 instances in a VPC. The architect needs to implement a stateful firewall at the instance level that automatically allows return traffic for any allowed inbound request. Which VPC security feature should the solutions architect use to meet this requirement?

Security Groups

Network Access Control Lists (Network ACLs)

AWS Web Application Firewall (AWS WAF)

AWS Shield Standard

Show answer & explanation

Answer: Security Groups

Answer

Security Groups

The correct option is the one specifying Security Groups. Security Groups act as a stateful firewall for Amazon EC2 instances, meaning any allowed inbound connection automatically allows the outbound response traffic to flow back to the client.

Step-by-Step Solution

Identify the level of security control required by the scenario.

The requirement specifies an instance-level firewall.

Security Groups operate at the instance or elastic network interface (ENI) level, whereas Network ACLs operate at the subnet level.

Determine the statefulness requirement.

The requirement specifies a stateful firewall that automatically allows return traffic.

Security Groups are stateful (automatically allowing return traffic), while Network ACLs are stateless (requiring explicit inbound and outbound rules).

Key Concept

Security Groups function as stateful firewalls at the Amazon EC2 instance level, automatically allowing response traffic for allowed requests.

Question 1354Question →

An organization runs order processing microservices on Amazon EC2 instances in a private subnet ( $10.10.2.0/24$ ) within an Amazon VPC. These instances must securely query a database in a dedicated database subnet ( $10.10.3.0/24$ ). They must also access a third-party payment processing API through an Interface VPC Endpoint hosted in a utility subnet ( $10.10.4.0/24$ ) within the same VPC.

Custom Network ACLs (NACLs) are configured as follows:
- The private subnet NACL allows outbound TCP traffic to the database subnet on port $5432$ and outbound TCP traffic to the utility subnet on port $443$ .
- The database subnet NACL allows inbound TCP traffic on port $5432$ and outbound TCP traffic to the private subnet on ephemeral ports ( $1024-65535$ ).
- The utility subnet NACL allows inbound TCP traffic on port $443$ from the private subnet and outbound TCP traffic to the private subnet on ephemeral ports ( $1024-65535$ ).

Currently, the EC2 instances successfully connect to the database, but all HTTPS connection attempts to the third-party API via the Interface VPC Endpoint fail.

Which two actions should the solutions architect take to resolve this connectivity issue while maintaining least privilege? (Select TWO.)

Select all that apply

Add an inbound rule to the private subnet Network ACL that allows TCP traffic from the utility subnet (

10.10.4.0/24

) on ephemeral ports (

1024-65535

Configure the security group associated with the Interface VPC Endpoint to allow inbound TCP traffic on port

443

from the security group associated with the EC2 instances.

Add an outbound rule to the security group associated with the Interface VPC Endpoint to allow TCP traffic to the private subnet's security group on ephemeral ports (

1024-65535

Add an outbound rule to the private subnet Network ACL that allows TCP traffic to the utility subnet (

10.10.4.0/24

) on ephemeral ports (

1024-65535

Attach an AWS WAF Web ACL to the Interface VPC Endpoint with a rule allowing inbound HTTPS traffic on ephemeral ports from the private subnet.

Show answer & explanation

Answer: Add an inbound rule to the private subnet Network ACL that allows TCP traffic from the utility subnet ( $10.10.4.0/24$ ) on ephemeral ports ( $1024-65535$ ).; Configure the security group associated with the Interface VPC Endpoint to allow inbound TCP traffic on port $443$ from the security group associated with the EC2 instances.

Answer

To resolve the connectivity issue, the solutions architect must add an inbound rule to the private subnet Network ACL allowing TCP traffic from the utility subnet on ephemeral ports, and configure the Interface VPC Endpoint's security group to allow inbound TCP traffic on port

443

from the EC2 instances' security group.

The correct options are the actions to add an inbound rule to the private subnet Network ACL allowing TCP traffic from the utility subnet on ephemeral ports, and to configure the Interface VPC Endpoint's security group to allow inbound TCP traffic on port

443

from the security group of the EC2 instances. Network ACLs are stateless firewalls. Although outbound traffic from the private subnet to the utility subnet is allowed on port

443

, the return traffic returning from the utility subnet uses ephemeral ports (

1024-65535

) and is blocked because the private subnet NACL does not have a rule allowing it. Adding the inbound rule resolves this. Additionally, since security groups are stateful, the security group for the Interface VPC Endpoint only needs to permit inbound traffic on port

443

from the EC2 instances. The response traffic is allowed automatically.

Step-by-Step Solution

Analyze the state of existing Network ACLs and connection flow.

The connection fails because Network ACLs are stateless. While outbound traffic from the private subnet to the utility subnet on port

443

is allowed, the return traffic from the utility subnet on ephemeral ports (

1024-65535

) is blocked at the private subnet boundary.

For stateless firewalls like NACLs, return traffic must be explicitly permitted by configuring an inbound rule with ephemeral port ranges.

Formulate the required Network ACL rule.

Add an inbound rule to the private subnet NACL that permits TCP traffic from the utility subnet (

10.10.4.0/24

) on destination ports

1024-65535

This allows return packets from the Interface VPC Endpoint to reach the initiating client instances in the private subnet.

Evaluate the stateful security group requirements.

The Interface VPC Endpoint must have a security group that permits inbound HTTPS traffic (TCP port

443

) from the EC2 instances' security group.

Since security groups are stateful, return traffic is automatically tracked and allowed outbound, making any outbound security group rules for ephemeral ports unnecessary.

Key Concept

Understanding the stateless behavior of Network ACLs compared to the stateful behavior of Security Groups, and configuring ephemeral ports correctly for return traffic.

Question 1355Question →

A global manufacturing enterprise is migrating its legacy ERP and supply chain applications to a multi-account AWS environment managed by AWS Organizations. The company's identity provider (IdP) is an on-premises Microsoft Active Directory domain. The enterprise security policy requires that all employee authentication must occur against the on-premises Active Directory, and users must be able to access the AWS Management Console with their corporate credentials without duplicating identities in the cloud. The solution must minimize operational overhead. Which two actions should the solutions architect take to meet these requirements? (Select two.)

Select all that apply

Enable AWS IAM Identity Center and configure it to use the AD Connector as the identity source for user authentication.

Deploy an Active Directory Connector (AD Connector) in the AWS VPC to proxy authentication requests to the on-premises Active Directory.

Create individual IAM users in each AWS account with long-term security credentials for every Active Directory user who requires console access.

Configure AWS IAM Identity Center to store user credentials in Systems Manager Parameter Store as plaintext parameters for cross-account synchronization.

Use the AWS account root user credentials to set up a SAML 2.0 federation trust directly between each AWS account and the on-premises Active Directory.

Show answer & explanation

Answer: Enable AWS IAM Identity Center and configure it to use the AD Connector as the identity source for user authentication.; Deploy an Active Directory Connector (AD Connector) in the AWS VPC to proxy authentication requests to the on-premises Active Directory.

Answer

Deploy an Active Directory Connector (AD Connector) in the AWS VPC to proxy authentication requests, and enable AWS IAM Identity Center configured to use the AD Connector as the identity source.

Deploying an Active Directory Connector (AD Connector) provides a directory gateway that redirects authentication requests to the on-premises Active Directory domain controllers, ensuring no credentials are cached or stored in AWS. Enabling AWS IAM Identity Center and configuring it to use the AD Connector as its identity source allows users to authenticate centrally and access resources across multiple accounts in AWS Organizations using their existing corporate credentials with minimum operational complexity.

Step-by-Step Solution

Set up network connectivity between the AWS VPC and the on-premises network, then deploy an Active Directory Connector (AD Connector).

The AD Connector acts as a directory gateway that proxies authentication requests directly to the on-premises Active Directory without caching credentials in AWS.

This meets the requirement of using corporate credentials without duplicating identities or credentials in the cloud.

Enable AWS IAM Identity Center in the AWS Organizations management account.

Centralized single sign-on access is established for the multi-account environment.

AWS IAM Identity Center simplifies multi-account access management and reduces operational overhead.

Configure AWS IAM Identity Center to use the deployed AD Connector as the identity source.

On-premises Active Directory users are mapped to AWS permissions and can log in to the console using their corporate credentials.

This completes the integration with minimal operational overhead.

Key Concept

AWS IAM Identity Center integration with on-premises Active Directory using Active Directory Connector (AD Connector) for federated multi-account access.

Question 1356Question →

A company wants to secure its web servers running on Amazon EC2 instances within a VPC. The security team requires that inbound traffic to the instances be restricted to port $443$ (HTTPS) from a specific office IP address. Additionally, the configuration must allow return traffic back to the office clients without requiring any explicit outbound rules. Which VPC feature should the solutions architect configure to implement this access control?

Security groups

Network access control lists (Network ACLs)

AWS WAF web ACLs

AWS Shield Standard

Show answer & explanation

Answer: Security groups

Answer

Security groups

Security groups are stateful. When an inbound rule allows traffic on port

443

from a specific IP address, the security group automatically permits the corresponding outbound return traffic to the client, satisfying the requirement to avoid explicit outbound rules.

Step-by-Step Solution

Analyze the requirement for stateful behavior where return traffic is allowed automatically.

Identify that a stateful firewall resource is required to handle the traffic without explicit outbound rules.

Security groups are stateful and allow return traffic automatically, whereas Network ACLs are stateless and require explicit rules in both directions.

Evaluate the options based on their placement in the VPC architecture.

Security groups operate at the instance level and support rules based on IP address and port.

This matches the requirement to restrict access to port

443

from a specific office IP address at the EC2 instance layer.

Key Concept

VPC Security Groups are stateful firewalls that operate at the instance level.

Estimated Time:45s

Question 1357Question →

A company is deploying a new application on Amazon EC2 instances in a private subnet. The application requires secure read-only access to an Amazon S3 bucket and must retrieve database passwords that are rotated monthly. The development team, who are federated from the company's on-premises Active Directory, also needs administrative access to manage the EC2 instances. The security architect must design a solution that enforces the principle of least privilege, avoids long-term credentials, and prevents credentials from being stored in plaintext. Which combination of actions will meet these requirements? (Select TWO.)

Select all that apply

Associate an IAM role with the EC2 instances via an instance profile to grant read-only access to the S3 bucket, and store the database passwords in AWS Secrets Manager with automatic rotation enabled.

Configure AWS IAM Identity Center and establish SAML 2.0 federation with the on-premises Active Directory to grant the development team temporary administrative access to the EC2 instances.

Generate access keys for the AWS account root user and configure them on the EC2 instances to grant S3 access, and use the root account to manage EC2 administrative tasks.

Create individual IAM users with long-term credentials for each developer in the on-premises Active Directory to allow them to log in and perform administrative tasks on the EC2 instances.

Store the database passwords as plaintext String parameters in Systems Manager Parameter Store and write a custom script on the EC2 instances to retrieve them.

Show answer & explanation

Answer: Associate an IAM role with the EC2 instances via an instance profile to grant read-only access to the S3 bucket, and store the database passwords in AWS Secrets Manager with automatic rotation enabled.; Configure AWS IAM Identity Center and establish SAML 2.0 federation with the on-premises Active Directory to grant the development team temporary administrative access to the EC2 instances.

Answer

The application should use an IAM role associated via an instance profile to access the S3 bucket, and database passwords should be stored in AWS Secrets Manager with automatic rotation. The development team should access the AWS environment through federation configured with AWS IAM Identity Center.

The correct strategy combines IAM roles on EC2 instances for secure, service-to-service access with AWS Secrets Manager for encrypted, rotated secrets. For human access, federating the existing Active Directory with AWS IAM Identity Center provides short-lived temporary access, eliminating long-term credentials and centralized credential management.

Step-by-Step Solution

Address application authorization by creating an IAM role with read-only permissions for the S3 bucket and attaching it to the EC2 instances via an instance profile.

The application on EC2 can securely read from S3 using automatically rotated temporary security credentials.

Eliminates the need for hardcoded, long-term AWS credentials on the EC2 instances.

Store the database connection credentials in AWS Secrets Manager, configure automatic rotation with a custom or template-based AWS Lambda function, and grant the EC2 IAM role read permissions to the secret.

The application retrieves the current password securely at runtime, and the password is rotated monthly without developer intervention.

Meets compliance requirements for secure, automated rotation of database credentials without plaintext exposure.

Configure AWS IAM Identity Center to federate with the on-premises Active Directory using SAML 2.0 to grant the developers temporary administrative access.

Developers use single sign-on (SSO) to access the AWS Management Console or AWS CLI with short-lived sessions.

Supports the goal of using centralized identity management and avoiding the creation of local IAM users.

Key Concept

Applying least privilege, temporary security credentials via IAM roles/federation, and secure secrets management with automated rotation.

Question 1358Question →

A company enables automatic annual key rotation for a customer managed key in AWS Key Management Service (AWS KMS) that is used to encrypt database backups. Which of the following describes how AWS KMS handles the encryption and decryption of existing and new backups after the rotation occurs?

New backups are encrypted using the new key version, while existing backups remain encrypted under the previous key version, which AWS KMS retains to decrypt them transparently.

AWS KMS immediately re-encrypts all existing database backups using the new key version to ensure uniform encryption.

The previous key version is deleted, requiring the administrator to manually decrypt and re-encrypt all existing backups using the new key version.

The existing database backups become inaccessible because AWS KMS only maintains the single active key version.

Show answer & explanation

Answer: New backups are encrypted using the new key version, while existing backups remain encrypted under the previous key version, which AWS KMS retains to decrypt them transparently.

Answer

New backups are encrypted using the new key version, while existing backups remain encrypted under the previous key version, which AWS KMS retains to decrypt them transparently.

When automatic key rotation is enabled for a customer managed key, AWS KMS generates a new backing key version every year. The service uses the new key version only for new encryption requests. To ensure that previously encrypted data can still be decrypted, AWS KMS preserves all older versions of the backing key and uses them transparently during decryption requests.

Step-by-Step Solution

Understand how AWS KMS Customer Managed Keys rotate.

Enabling automatic rotation creates a new key version (a new backing key) annually.

This limits the amount of data encrypted under a single backing key version.

Determine the impact of rotation on existing data (ciphertext).

Existing backups are NOT re-encrypted. AWS KMS retains the previous key versions so they can still be decrypted.

Re-encrypting existing data would be resource-intensive and is not done automatically by AWS KMS.

Identify the active key version for new encryption requests.

Only new data is encrypted using the newly active key version.

This meets the key rotation objective of using new keys for new cryptographic operations going forward.

Key Concept

AWS KMS Automatic Key Rotation Mechanics

Question 1359Question →

An architect is designing a secure log aggregation solution. A containerized application running on Amazon ECS in Account A must write encrypted JSON log files to an Amazon S3 bucket located in Account B. The logs must be encrypted at rest using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS) owned by Account B.

The security constraints are:
1. The ECS task role in Account A must be able to encrypt new logs during upload but must be strictly prohibited from decrypting any logs already stored in the S3 bucket.
2. The KMS key must be rotated annually without requiring manual re-encryption of existing logs, and older logs must remain decryptable by authorized security analysts in Account B.

Which configuration meets these requirements with the least privilege?

Configure the KMS key policy in Account B to allow the ECS task role in Account A to perform kms:GenerateDataKey and kms:DescribeKey operations. Enable automatic key rotation on the CMK in Account B.

Configure the KMS key policy in Account B to allow the ECS task role in Account A to perform kms:GenerateDataKey and kms:Decrypt operations. Enable automatic key rotation on the CMK, and configure an AWS Lambda function to automatically decrypt and re-encrypt all historical S3 objects using the new key version upon rotation.

Configure the ECS task to retrieve a plaintext encryption password stored as a String parameter in AWS Systems Manager Parameter Store in Account B, perform client-side encryption of the logs, and manually update the Parameter Store value with a new password annually.

Configure the KMS key policy in Account B to allow the ECS task role in Account A to perform kms:Encrypt and kms:Decrypt operations. Create a new KMS CMK manually in Account B every year, update the S3 bucket default encryption settings to use the new CMK, and delete the previous CMK after 90 days.

Show answer & explanation

Answer: Configure the KMS key policy in Account B to allow the ECS task role in Account A to perform kms:GenerateDataKey and kms:DescribeKey operations. Enable automatic key rotation on the CMK in Account B.

Answer

Configure the KMS key policy in Account B to allow the ECS task role in Account A to perform kms:GenerateDataKey and kms:DescribeKey operations, and enable automatic key rotation on the CMK in Account B.

The correct configuration grants the ECS task role in Account A access only to generate the data key (kms:GenerateDataKey) and describe the key (kms:DescribeKey), which allows S3 to encrypt the logs during the upload process. Since kms:Decrypt is not granted, the ECS task cannot read or decrypt the logs. Enabling automatic key rotation on the Customer Managed Key (CMK) rotates the underlying key material annually. AWS KMS automatically preserves previous key versions to decrypt historical data when requested by authorized users, requiring no manual re-encryption or administrative intervention.

Step-by-Step Solution

Analyze cross-account write-only encryption requirements.

To upload an object encrypted with SSE-KMS, the S3 service handles the encryption on behalf of the client. The client needs the permission to generate a data key (kms:GenerateDataKey) but does not need the permission to decrypt (kms:Decrypt).

By omitting the kms:Decrypt permission from the ECS task role, we satisfy the constraint that the application must be strictly prohibited from decrypting existing logs.

Evaluate KMS automatic key rotation mechanics.

Enabling automatic key rotation on a Customer Managed Key rotates the backing key material annually while keeping the same key ID, metadata, and key policy.

AWS KMS automatically retains all historical backing key versions. When S3 or an authorized user requests decryption of older logs, KMS uses the matching historical key version to decrypt them. No manual re-encryption of existing logs is required, ensuring operational efficiency and data accessibility.

Evaluate alternative secret storage and rotation methods.

Using Parameter Store with plaintext parameters is insecure. Creating new keys manually and deleting old ones breaks decryption for historical data.

This confirms that using the native KMS automatic key rotation and the correct IAM permissions is the most secure and compliant design.

Key Concept

Write-only KMS permissions for S3 uploads and KMS automatic key rotation behavior.

Estimated Time:3m 0s

Question 1360Question →

A solutions architect is configuring encryption for an Amazon Elastic Block Store (Amazon EBS) volume containing sensitive database backups. The company's security policy requires that the KMS key used for encryption be rotated automatically every year. Which solution meets this requirement with the minimum administrative effort?

Create a new customer managed key in AWS Key Management Service (AWS KMS) every year, delete the old key, and run a script to decrypt and re-encrypt the active EBS volume.

Store the encryption key in AWS Systems Manager Parameter Store as a plain String parameter and write an automated script to rotate it annually.

Create a customer managed key in AWS Key Management Service (AWS KMS) and enable automatic key rotation.

Enable automatic key rotation on the KMS key and write an AWS Lambda function to re-encrypt all existing data on the EBS volume using the new key version.

Show answer & explanation

Answer: Create a customer managed key in AWS Key Management Service (AWS KMS) and enable automatic key rotation.

Answer

Create a customer managed key in AWS Key Management Service (AWS KMS) and enable automatic key rotation.

The correct option is correct because enabling automatic key rotation on a customer managed key in AWS Key Management Service (AWS KMS) automatically rotates the backing key once per year. The key ID remains the same, and older backing keys are preserved by AWS KMS to decrypt existing data without requiring manual re-encryption or administrative intervention.

Step-by-Step Solution

Evaluate the security requirement of automatically rotating encryption keys annually.

Identify that AWS Key Management Service (AWS KMS) provides built-in automatic key rotation capabilities.

AWS KMS is the native service for managing encryption keys used by Amazon EBS.

Compare manual key rotation against automatic key rotation for customer managed keys.

Automatic rotation of customer managed keys requires only a single configuration toggle and handles historical data decryption automatically.

This minimizes the administrative overhead requested by the scenario.

Key Concept

AWS KMS Automatic Key Rotation

PreviousPage 68 / 74Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept