All practice questions

1462 questions

All types1,462 Multiple choice739 Multiple select723

A retail enterprise is establishing a multi-account environment on AWS to support its online commerce platform. The solutions architect needs to set up a governance structure that achieves the following:
1. Enforces centralized user authentication mapped to the company's external corporate identity provider without provisioning static IAM users.
2. Ensures that development and testing accounts cannot launch resources in unauthorized AWS Regions.
3. Prevents member accounts from deleting or modifying Amazon S3 buckets that contain centralized security logs.

Which combination of actions will meet these requirements? (Select TWO.)

Select all that apply

Configure AWS IAM Identity Center to federate with the external corporate identity provider, mapping corporate groups to permission sets.

Apply Service Control Policies (SCPs) to Organizational Units in AWS Organizations to deny resource creation in unauthorized Regions and protect log-archival Amazon S3 buckets.

Create individual IAM users in each member account with long-term credentials for each administrator and federate them individually.

Apply the restrictive Service Control Policies (SCPs) directly to the organization's management account to enforce global regional and bucket restrictions.

Configure Amazon Cognito user pools in the management account to manage corporate user identity federation and use IAM roles for cross-account access.

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate with the external corporate identity provider, mapping corporate groups to permission sets.; Apply Service Control Policies (SCPs) to Organizational Units in AWS Organizations to deny resource creation in unauthorized Regions and protect log-archival Amazon S3 buckets.

Answer

Configure AWS IAM Identity Center to federate with the external corporate identity provider, mapping corporate groups to permission sets, and apply Service Control Policies (SCPs) to Organizational Units in AWS Organizations to deny resource creation in unauthorized Regions and protect log-archival Amazon S3 buckets.

Centralized authentication without static credentials is best achieved by integrating AWS IAM Identity Center with an external IdP. To enforce regional and resource-level constraints across member accounts, Service Control Policies (SCPs) must be applied at the Organizational Unit (OU) level, which ensures guardrails are inherited by the member accounts while keeping the management account clear of policy restrictions.

Step-by-Step Solution

Set up identity federation using AWS IAM Identity Center.

Centralized authentication is mapped directly to the corporate identity provider groups without static local credentials.

Meets the requirement for centralized, credentials-free authentication.

Create and attach Service Control Policies (SCPs) to the relevant OUs.

Enforces regional restrictions and protects centralized S3 logging buckets across member accounts.

Enforces security guardrails at scale within the organization while ensuring they do not apply to the management account where admin flexibility is required.

Key Concept

Multi-Account Governance and Security Controls

Alternative Method

While AWS Control Tower landing zones could be deployed to establish these guardrails, configuring AWS IAM Identity Center and applying targeted SCPs via AWS Organizations represents the direct architectural mechanism to satisfy these specific compliance requirements.

Estimated Time:1m 30s

Question 1362Question →

A gaming analytics platform runs on Amazon EC2 instances in a private VPC subnet ( $10.10.2.0/24$ ). The instances successfully retrieve session logs from Amazon S3 in the same AWS Region using an S3 Gateway VPC Endpoint. However, when the instances attempt to send batch reports to an external audit API (`https://audit.example.com`) via a NAT Gateway located in a public subnet ( $10.10.1.0/24$ ), the connections consistently time out.

The private subnet's Network ACL (NACL) is configured as follows:
- Inbound Rule 100: Allow TCP ports $1024-65535$ from $10.10.1.0/24$
- Inbound Rule 110: Allow TCP ports $1024-65535$ from the S3 Prefix List (`pl-xxxxxx`)
- Outbound Rule 100: Allow TCP port 443 to $10.10.1.0/24$
- Outbound Rule 110: Allow TCP port 443 to the S3 Prefix List (`pl-xxxxxx`)
- Default rule: Deny all other traffic

The EC2 instances are associated with a Security Group that has the following rules:
- Inbound: Allow TCP port 443 from $10.10.1.0/24$
- Outbound: Allow TCP port 443 to $0.0.0.0/0$

Which of the following configurations will resolve the timeout issue while maintaining the principle of least privilege?

Modify the private subnet's Network ACL to allow outbound TCP port 443 to

0.0.0.0/0

and inbound TCP ports

1024-65535

from

0.0.0.0/0

Modify the EC2 instances' Security Group inbound rules to allow TCP ports

1024-65535

from

10.10.1.0/24

, and add a Network ACL outbound rule to allow TCP port 443 to the NAT Gateway's private IP address.

Add a Route Table entry to forward traffic for `audit.example.com` to the S3 Gateway VPC Endpoint, and modify the Network ACL to allow inbound TCP port 443 from

10.10.1.0/24

Change the EC2 instances' Security Group outbound rules to only allow TCP port 443 to

10.10.1.0/24

since all traffic is routed through the NAT Gateway, and add an inbound Network ACL rule allowing TCP port 443 from

0.0.0.0/0

Show answer & explanation

Answer: Modify the private subnet's Network ACL to allow outbound TCP port 443 to $0.0.0.0/0$ and inbound TCP ports $1024-65535$ from $0.0.0.0/0$ .

Answer

Modify the private subnet's Network ACL to allow outbound TCP port 443 to

0.0.0.0/0

and inbound TCP ports

1024-65535

from

0.0.0.0/0

The correct option correctly identifies that Network ACLs (NACLs) are stateless and inspect the actual source and destination IP addresses in the packet headers. When EC2 instances in the private subnet send packets to the external API, the destination IP remains the API's public IP address (not the NAT Gateway's IP). Consequently, the outbound NACL must allow traffic to

0.0.0.0/0

on TCP port 443. Similarly, when the return traffic arrives, the source IP is the API's public IP, and the destination port is the ephemeral port (

1024-65535

) allocated by the EC2 instance. Therefore, the inbound NACL must allow traffic from

0.0.0.0/0

on ports

1024-65535

. Security Groups are stateful and automatically permit return traffic, so no changes to the Security Group are needed.

Step-by-Step Solution

Analyze how packets are routed and formatted when sent from private EC2 instances to an external public IP via a NAT Gateway.

The routing table forwards packets to the NAT Gateway ENI, but the destination IP in the packet's IP header remains the public IP of `audit.example.com`, not the NAT Gateway's IP.

Understanding that network routing does not rewrite the destination IP address of outbound packets at the subnet boundary.

Evaluate the stateless Network ACL (NACL) behavior for outbound traffic.

Since the destination IP is a public address, the packet does not match the local public subnet CIDR (

10.10.1.0/24

). The outbound NACL blocks the packet because there is no rule allowing TCP port 443 to

0.0.0.0/0

Network ACLs are stateless and must explicitly allow the outbound destination IP address.

Evaluate the stateless NACL behavior for inbound return traffic.

Return packets from the external API arrive via the NAT Gateway. The source IP in the packet header is the public IP of the external API, and the destination port is an ephemeral port (

1024-65535

). The inbound NACL blocks this return traffic because it only allows ephemeral ports from the public subnet CIDR, not from

0.0.0.0/0

Since NACLs are stateless, return traffic must be explicitly allowed inbound based on the original source IP and ephemeral destination port.

Verify Security Group requirements.

Security groups are stateful. The outbound rule allows TCP port 443 to

0.0.0.0/0

, which matches both the S3 endpoint and the public API. No inbound security group rules are required because return traffic is automatically allowed.

Confirming that the stateful firewall layer is already correctly configured and does not block the return traffic.

Key Concept

Stateless Network ACLs evaluate IP headers based on original source and destination IPs, which are preserved across NAT Gateway routing. Ephemeral ports must be allowed in the return direction.

Estimated Time:3m 0s

Question 1363Question →

A company is deploying an application that requires access to a database password. The company's security policy mandates that this database password must be encrypted at rest and automatically rotated every 30 days. Which combination of steps should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Store the database password in AWS Secrets Manager.

Enable automatic rotation in AWS Secrets Manager and configure an AWS Lambda function to update the database credentials.

Store the database password as a String parameter in AWS Systems Manager Parameter Store.

Store the database password as a SecureString parameter in AWS Systems Manager Parameter Store and configure Parameter Store automatic rotation.

Store the database password in AWS Secrets Manager and rely on AWS KMS automatic key rotation to update the database password value.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager.; Enable automatic rotation in AWS Secrets Manager and configure an AWS Lambda function to update the database credentials.

Answer

The database password must be stored in AWS Secrets Manager, with automatic rotation enabled using an AWS Lambda function.

AWS Secrets Manager provides built-in encryption at rest and integrates with AWS Lambda to automatically rotate database credentials on a schedule.

Step-by-Step Solution

Select the storage service that supports secret rotation.

AWS Secrets Manager is chosen.

Systems Manager Parameter Store lacks a native automated rotation mechanism.

Implement the rotation logic.

An AWS Lambda function is configured to update the secret and the target database.

Secrets Manager uses Lambda to securely rotate database credentials.

Key Concept

Credential Storage and Automated Rotation in AWS

Question 1364Question →

A company's security team wants to delegate the creation and management of IAM roles for microservices to development team leads in several member accounts within an AWS Organization. However, the security team must ensure that team leads cannot create roles or modify policies that allow access to a centralized audit Amazon S3 bucket. Which solution should the security team implement to meet these requirements?

Configure an IAM permissions boundary that denies access to the centralized audit S3 bucket, and require the team leads to apply this boundary when creating any new IAM roles.

Share the AWS account root user credentials of each member account with the team leads so they can perform role administration tasks securely without needing IAM policies.

Create individual IAM users with long-term credentials for each team lead, and store these credentials as plaintext String parameters in Systems Manager Parameter Store for the microservices to use.

Set up SAML-based identity federation for team lead access, but create individual IAM users with long-term access keys in each member account for their daily role management tasks.

Show answer & explanation

Answer: Configure an IAM permissions boundary that denies access to the centralized audit S3 bucket, and require the team leads to apply this boundary when creating any new IAM roles.

Answer

Configure an IAM permissions boundary that denies access to the centralized audit S3 bucket, and require the team leads to apply this boundary when creating any new IAM roles.

The correct solution uses an IAM permissions boundary. A permissions boundary is an advanced feature for using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity. When you delegate IAM role creation to a user or role, you can enforce that they can only create roles with a specific permissions boundary attached. This prevents the delegated administrator from creating roles that have more permissions than allowed, protecting resources like the central audit S3 bucket.

Step-by-Step Solution

Analyze the requirement to delegate IAM role creation to team leads while preventing them from granting access to a specific S3 bucket.

Identify that the team leads need permissions to create IAM roles, but must be restricted from escalating privileges beyond a certain limit.

This establishes the need for a mechanism that sets the maximum permissions an IAM entity can delegate.

Evaluate AWS IAM features designed for delegating administration with permission limits.

Identify IAM permissions boundaries as the native feature that controls the maximum permissions an IAM policy can grant to a principal or role.

Permissions boundaries ensure that even if a team lead creates a role with AdministratorAccess, that role's effective permissions are limited by the boundary.

Formulate a policy that denies access to the centralized audit S3 bucket and use it as the permissions boundary.

A boundary policy is created and enforced via an IAM policy on the team leads, requiring them to attach the boundary to any roles they create.

This meets the security requirement with the least operational overhead and aligns with AWS best practices.

Key Concept

IAM Permissions Boundaries

Estimated Time:1m 30s

Question 1365Question →

A restaurant chain is implementing a cloud-based kitchen display system. When a customer places an order, the order details must be sent to the kitchen terminal and to a real-time analytics dashboard. The kitchen terminal must receive and display orders in the exact sequence they were submitted by the customer. The analytics dashboard does not require strict ordering. If an order fails to process after multiple attempts, it must be isolated for troubleshooting with the least operational overhead.

Which combination of steps should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Create an Amazon SNS FIFO topic. Create an Amazon SQS FIFO queue for the kitchen terminal and a standard Amazon SQS queue for the analytics dashboard. Subscribe both queues to the SNS FIFO topic.

Configure a redrive policy on the SQS queues to send failed messages to a dead-letter queue (DLQ) after the maximum receive count is exceeded.

Create a standard Amazon SNS topic. Create standard Amazon SQS queues for both the kitchen terminal and the analytics dashboard, and subscribe both queues to the SNS topic.

Create an Amazon SNS FIFO topic. Create a standard Amazon SQS queue for the kitchen terminal and an Amazon SQS FIFO queue for the analytics dashboard, and subscribe both queues to the SNS FIFO topic.

Configure a dead-letter queue (DLQ) directly on the Amazon SNS FIFO topic to handle messages that the kitchen terminal application fails to process.

Show answer & explanation

Answer: Create an Amazon SNS FIFO topic. Create an Amazon SQS FIFO queue for the kitchen terminal and a standard Amazon SQS queue for the analytics dashboard. Subscribe both queues to the SNS FIFO topic.; Configure a redrive policy on the SQS queues to send failed messages to a dead-letter queue (DLQ) after the maximum receive count is exceeded.

Answer

Create an Amazon SNS FIFO topic, create an Amazon SQS FIFO queue for the kitchen terminal, subscribe both queues to the SNS FIFO topic, and configure a redrive policy on the SQS queues to send failed messages to a dead-letter queue (DLQ).

To achieve both event fan-out and strict ordering for one of the downstream consumers, the architect must combine an Amazon SNS FIFO topic with an Amazon SQS FIFO queue. SNS FIFO topics support fanning out messages to multiple SQS queues. By subscribing an SQS FIFO queue for the ordering-sensitive kitchen terminal and a standard SQS queue for the analytics dashboard (which does not require strict ordering), both consumers receive the messages appropriately. Furthermore, configuring a redrive policy on the SQS queues allows messages that repeatedly fail processing to be automatically sent to a dead-letter queue (DLQ) for isolation and troubleshooting with minimal operational overhead.

Step-by-Step Solution

Analyze the fan-out and ordering requirements.

Identified that the system requires sending a single event to two different consumers (fan-out pattern) with one consumer requiring strict message ordering (FIFO).

This determines that Amazon SNS is needed for fan-out and FIFO capabilities are required for ordering.

Select the correct SNS and SQS queue types.

Choose an Amazon SNS FIFO topic to publish events. For the kitchen terminal, select an Amazon SQS FIFO queue. For the analytics dashboard, select a standard Amazon SQS queue. Subscribe both queues to the SNS FIFO topic.

SNS FIFO topics can fan out to both SQS FIFO and standard SQS queues, preserving order for the FIFO queue while delivering to both.

Address the processing failure isolation requirement.

Configure a redrive policy on the SQS queues to direct failed messages to an SQS dead-letter queue (DLQ) after a specified maximum receive count.

SQS redrive policies isolate messages that fail application-level processing after multiple retries.

Key Concept

Decoupling message fan-out with ordering guarantees using Amazon SNS FIFO and SQS FIFO queues.

Question 1366Question →

A financial institution processes transactions in Account A using Amazon EC2 instances with encrypted Amazon EBS volumes. The volumes are encrypted using an AWS KMS customer managed key (CMK) for which the security team has enabled automatic annual key rotation. The compliance policy requires the institution to share periodic EBS snapshots with an external auditing firm operating in Account B. The auditing firm must restore these snapshots to EC2 instances in Account B. Additionally, the auditing application requires a database API key to write audit logs to a database in Account B. Which combination of actions will securely meet these requirements? (Select TWO.)

Select all that apply

In Account A, modify the key policy of the KMS customer managed key to grant Account B's IAM role permissions to perform kms:Decrypt, kms:DescribeKey, and kms:CreateGrant operations.

Rely on AWS KMS automatic key rotation to automatically retain older key versions, allowing Account B to decrypt and restore snapshots that were encrypted before the rotation occurred.

Manually copy and re-encrypt all historical EBS snapshots in Account A using the new key version immediately following each annual key rotation, as rotated keys cannot decrypt existing snapshots.

Store the database API key in Systems Manager Parameter Store as a standard String parameter to facilitate fast, plaintext retrieval by the EC2 instances in Account B.

Share the default AWS managed key aws/ebs from Account A with Account B to simplify snapshot sharing, and configure Account B's EC2 service-linked role to use this key.

Show answer & explanation

Answer: In Account A, modify the key policy of the KMS customer managed key to grant Account B's IAM role permissions to perform kms:Decrypt, kms:DescribeKey, and kms:CreateGrant operations.; Rely on AWS KMS automatic key rotation to automatically retain older key versions, allowing Account B to decrypt and restore snapshots that were encrypted before the rotation occurred.

Answer

Modifying the KMS key policy in Account A to allow Account B to decrypt and create grants, and relying on AWS KMS automatic key rotation to automatically retain older key versions for decrypting historical snapshots.

The correct solution involves modifying the KMS key policy in Account A to permit Account B's IAM role to decrypt the snapshots and create grants for the EC2 service in Account B. It also relies on AWS KMS automatic key rotation, which automatically preserves historical key versions to decrypt snapshots that were encrypted before the rotation occurred. This ensures continuous access without administrative overhead or security compromises.

Step-by-Step Solution

Evaluate key sharing capability based on key type

Identify that AWS managed keys cannot be shared cross-account, which confirms a Customer Managed Key (CMK) must be used in Account A.

AWS managed keys are bound to a single account and their policies cannot be customized for cross-account delegation.

Determine the required KMS key policy permissions for EBS snapshot sharing

Grant Account B permissions for kms:Decrypt, kms:DescribeKey, and kms:CreateGrant in the Account A CMK key policy.

The EC2 service in Account B needs kms:Decrypt to read the snapshot data and kms:CreateGrant to delegate key usage to the EC2 service-linked role for attaching the volume.

Analyze the impact of KMS key rotation on historical snapshots

Determine that automatic key rotation preserves previous key versions to decrypt older snapshots, making manual re-encryption unnecessary.

AWS KMS manages key version history automatically, mapping the ciphertext to the correct historical key version during decryption.

Determine the secure method for database API key storage

Reject plaintext String parameter storage in favor of SecureString or Secrets Manager.

Storing credentials in plaintext is a security risk and violates compliance policies.

Key Concept

Cross-account KMS key sharing, EBS snapshot restoration permissions, KMS key rotation mechanics, and secure secret storage.

Estimated Time:3m 0s

Question 1367Question →

A company uses an AWS Key Management Service (AWS KMS) customer managed key to encrypt data in an Amazon S3 bucket. The security team enables automatic annual key rotation for this key. What will happen to the existing data that was encrypted before the key rotation occurred?

AWS KMS automatically decrypts and re-encrypts all historical data in the S3 bucket using the new key version within 24 hours of rotation.

The existing data remains encrypted under the older key version, and AWS KMS automatically uses the older key version to decrypt the data when requested.

The solutions architect must manually download and re-encrypt all existing data in the S3 bucket using the new key version.

The encryption key material is rotated, and the previous key version must be stored as a plaintext parameter in Systems Manager Parameter Store to decrypt older data.

Show answer & explanation

Answer: The existing data remains encrypted under the older key version, and AWS KMS automatically uses the older key version to decrypt the data when requested.

Answer

The existing data remains encrypted under the older key version, and AWS KMS automatically uses the older key version to decrypt the data when requested.

When automatic key rotation is enabled for a customer managed key, AWS KMS retains all prior versions of the backing key. This allows AWS KMS to decrypt existing data encrypted with older key versions automatically without requiring any actions from the user or applications.

Step-by-Step Solution

Identify the mechanism of AWS KMS automatic key rotation for customer managed keys.

Rotation generates new backing key material for new encryption requests while keeping historical backing key material active.

This allows new data to be encrypted with the new key version while old data remains decryptable.

Analyze the impact of key rotation on existing data in Amazon S3.

Determine that existing S3 objects remain encrypted with the key version that was active when they were written.

AWS KMS preserves older backing keys to ensure seamless decryption of historical data.

Select the option that correctly describes the automatic retention and usage of historical keys.

Recognize that AWS KMS automatically resolves which backing key version is needed to decrypt the older S3 objects, requiring no manual intervention or re-encryption.

This aligns with AWS best practices for secure and operational efficiency in key management.

Key Concept

AWS KMS automatic key rotation mechanics and preservation of historical key material

Question 1368Question →

A company is deploying a secure processing application on Amazon EC2 instances in a private subnet (Subnet A: $10.0.1.0/24$ ). The EC2 instances must receive HTTPS requests on port $443$ from an internal Application Load Balancer (ALB) located in another private subnet (Subnet B: $10.0.2.0/24$ ). Additionally, the EC2 instances must securely retrieve configuration files from an Amazon S3 bucket. The company's security policy mandates that Subnet A must use a custom Network ACL (NACL) configured with a default-deny posture to block all unspecified traffic, and no traffic is allowed to transit the internet. Currently, a Gateway VPC Endpoint is used for Amazon S3, but the EC2 instances cannot connect to S3, and the ALB health checks are failing.

Which TWO actions should a solutions architect take to resolve these connectivity issues while complying with the security policy? (Select TWO.)

Select all that apply

Configure the Network ACL of Subnet A to allow inbound traffic from the ALB subnet (

10.0.2.0/24

) on port

443

, and allow outbound traffic to the ALB subnet (

10.0.2.0/24

) on ephemeral ports (

1024-65535

Replace the S3 Gateway VPC Endpoint with an Interface VPC Endpoint for Amazon S3, and configure the Network ACL of Subnet A to allow outbound traffic to the private IP addresses of the interface endpoint on port

443

, and inbound traffic from those private IP addresses on ephemeral ports (

1024-65535

Configure the Network ACL of Subnet A to allow inbound traffic from the ALB subnet (

10.0.2.0/24

) on port

443

, and rely on the stateful behavior of the EC2 Security Groups to automatically permit the outbound return traffic.

Modify the Network ACL of Subnet A to allow outbound traffic on port

443

to the Amazon S3 prefix list (pl-xxxxxx) and allow inbound traffic from the prefix list on ephemeral ports (

1024-65535

Configure the Network ACL of Subnet A to allow outbound traffic to the Amazon S3 Gateway Endpoint public IP addresses on port

443

, and rely on the default rule of the Network ACL to allow the inbound return traffic.

Show answer & explanation

Answer: Configure the Network ACL of Subnet A to allow inbound traffic from the ALB subnet ( $10.0.2.0/24$ ) on port $443$ , and allow outbound traffic to the ALB subnet ( $10.0.2.0/24$ ) on ephemeral ports ( $1024-65535$ ).; Replace the S3 Gateway VPC Endpoint with an Interface VPC Endpoint for Amazon S3, and configure the Network ACL of Subnet A to allow outbound traffic to the private IP addresses of the interface endpoint on port $443$ , and inbound traffic from those private IP addresses on ephemeral ports ( $1024-65535$ ).

Answer

Configure the Network ACL of Subnet A to allow inbound traffic from the ALB subnet on port

443

and outbound traffic on ephemeral ports, and replace the S3 Gateway VPC Endpoint with an Interface VPC Endpoint while allowing traffic to its private IP addresses.

The correct configuration requires addressing two separate network flows under a stateless network security model. First, for the ALB communication, because Network ACLs are stateless, allowing inbound traffic on port

443

from the ALB subnet must be paired with allowing outbound return traffic on the ephemeral port range (

1024-65535

) back to the ALB subnet. Second, for the S3 communication, Gateway VPC Endpoints utilize public IP addresses and routing tables, which would require opening the Network ACL to broad public ranges or a wildcard (

0.0.0.0/0

). By replacing it with an Interface VPC Endpoint, S3 traffic uses private IP addresses, enabling the Network ACL to restrict outbound traffic to those specific private IPs on port

443

and inbound return traffic on ephemeral ports, adhering to the company's strict security requirements.

Step-by-Step Solution

Analyze the stateless behavior of Network ACLs (NACLs) for the ALB traffic.

Since NACLs are stateless, they evaluate traffic in both directions independently. To allow inbound HTTPS requests from the ALB on port

443

, the NACL must allow inbound port

443

from the ALB subnet and outbound ephemeral ports (

1024-65535

) to the ALB subnet for the return traffic.

Health checks and client requests from the ALB will fail if the stateless NACL blocks the return traffic.

Evaluate the limitations of Gateway VPC Endpoints with custom default-deny NACLs.

Gateway Endpoints route traffic to S3's public IP addresses. NACLs do not support S3 prefix lists, meaning the NACL would require allowing outbound traffic to

0.0.0.0/0

on port

443

and inbound return traffic on ephemeral ports. This violates the security policy that prohibits internet-bound routes.

NACL rules only accept CIDR blocks, not logical constructs like AWS prefix lists.

Determine the secure alternative for S3 connectivity.

By using an Interface VPC Endpoint (powered by AWS PrivateLink) for S3, the endpoint is assigned private IP addresses from the VPC. The NACL can then be configured with highly restrictive rules allowing outbound HTTPS traffic only to these specific private IP addresses.

This maintains the strict default-deny and no-internet-transit policies while restoring S3 connectivity.

Key Concept

Stateless Network ACL configuration requires managing return traffic explicitly, and Interface Endpoints allow private IP-based NACL filtering unlike Gateway Endpoints.

Estimated Time:3m 0s

Question 1369Question →

An e-learning company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application needs protection from SQL injection attacks and volumetric Layer 3 and Layer 4 DDoS attacks. The company wants a solution that requires minimal operational overhead and integrates with their current architecture.

Which solution should a solutions architect recommend to meet these requirements?

Deploy Amazon CloudFront in front of the Application Load Balancer, associate AWS WAF with the CloudFront distribution to block SQL injection using managed rules, and rely on AWS Shield Standard for automatic Layer 3 and Layer 4 DDoS protection.

Enable AWS Shield Standard on the Application Load Balancer and configure custom rules within Shield to parse HTTP payloads and block SQL injection requests.

Configure the subnet Network ACLs (NACLs) to perform deep packet inspection to block SQL injection patterns, and configure the EC2 Security Groups to automatically rate-limit Layer 3 and Layer 4 traffic.

Deploy Amazon CloudFront in front of the Application Load Balancer, and configure the CloudFront distribution's Origin Access Control (OAC) to inspect incoming HTTP requests and drop SQL injection attacks.

Show answer & explanation

Answer: Deploy Amazon CloudFront in front of the Application Load Balancer, associate AWS WAF with the CloudFront distribution to block SQL injection using managed rules, and rely on AWS Shield Standard for automatic Layer 3 and Layer 4 DDoS protection.

Answer

Deploying Amazon CloudFront with an associated AWS WAF web ACL uses managed rules to inspect HTTP payloads at the edge and mitigate Layer 7 SQL injection attacks. AWS Shield Standard, which is automatically active for CloudFront, provides Layer 3 and Layer 4 DDoS protection with zero configuration or additional cost.

Step-by-Step Solution

Analyze security requirements at different network layers.

Identify that SQL injection is a Layer 7 application exploit, whereas volumetric DDoS attacks target Layers 3 and 4.

Choosing the correct security tools requires mapping the threat type to the OSI model layer.

Select the appropriate services to inspect application traffic and mitigate DDoS.

AWS WAF provides Layer 7 payload inspection, and AWS Shield Standard provides automatic Layer 3/4 protection at the edge when integrated with Amazon CloudFront.

AWS WAF handles web application firewall duties, and AWS Shield Standard handles edge DDoS mitigation, providing a complete security posture.

Integrate the edge security components with the load-balanced application.

Deploy Amazon CloudFront as the entry point in front of the Application Load Balancer, then attach AWS WAF to the CloudFront distribution.

Moving threat mitigation to the edge with CloudFront reduces load on origin EC2 instances and mitigates attacks before they reach the VPC.

Key Concept

Edge security and DDoS protection using AWS Shield and AWS WAF

Estimated Time:1m 30s

Question 1370Question →

A global logistics company hosts its shipment-tracking application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent downtime due to sophisticated Layer 7 HTTP flood attacks originating from a distributed botnet. The company needs to implement a solution that mitigates these HTTP floods at the network edge, minimizes latency for global users, and prevents unauthorized requests from bypassing the edge security controls.

Which two actions should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL containing a rate-based rule with the distribution.

Configure the Application Load Balancer's security group to restrict inbound traffic to only the Amazon CloudFront IP ranges using the AWS-managed prefix list.

Enable AWS Shield Standard on the Application Load Balancer to automatically detect and block the Layer 7 HTTP flood attacks.

Configure stateless Network Access Control Lists (NACLs) on the Application Load Balancer subnets to dynamically block the attacking IP addresses.

Modify the Application Load Balancer security group rules to rate-limit connections and block malicious payloads at the VPC border.

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL containing a rate-based rule with the distribution.; Configure the Application Load Balancer's security group to restrict inbound traffic to only the Amazon CloudFront IP ranges using the AWS-managed prefix list.

Answer

Deploying an Amazon CloudFront distribution with an AWS WAF web ACL rate-based rule, and restricting the Application Load Balancer security group to CloudFront IP addresses using the AWS-managed prefix list.

To protect the application from Layer 7 HTTP floods at the edge and minimize latency, deploying Amazon CloudFront and associating an AWS WAF web ACL with a rate-based rule is the recommended AWS best practice. The rate-based rule monitors client requests and automatically blocks IPs that exceed the set threshold. Furthermore, to prevent attackers from bypassing these edge controls and attacking the backend directly, the Application Load Balancer's security group must be locked down to only allow inbound traffic from the CloudFront IP ranges, which is easily managed using the AWS-managed prefix list.

Step-by-Step Solution

Analyze the attack vector and mitigation point.

The attack is a Layer 7 HTTP flood. The requirement is to mitigate this at the network edge and minimize latency for global users.

Layer 7 attacks must be mitigated using application-aware firewalls. Edge services like Amazon CloudFront and AWS WAF are best suited to inspect and block traffic globally before it reaches the backend.

Select edge security components.

Deploy Amazon CloudFront to cache content and reduce latency, and associate an AWS WAF web ACL with a rate-based rule to automatically block HTTP floods.

AWS WAF rate-based rules track the request rate from client IP addresses and temporarily block IPs that exceed the threshold, protecting against distributed L7 attacks at the edge.

Secure the origin backend.

Restrict access to the Application Load Balancer by configuring its security group to only allow traffic from CloudFront.

If the Application Load Balancer is publicly accessible, attackers can bypass CloudFront and AWS WAF entirely. Restricting the ALB security group using the AWS-managed prefix list for CloudFront ensures all traffic is forced through the edge security layer.

Key Concept

Mitigating Layer 7 HTTP flood attacks at the edge using CloudFront and AWS WAF, and securing the backend origin ALB from direct access.

Estimated Time:2m 0s

Question 1371Question →

A company is designing a secure web application that stores session logs in Amazon S3 and uses a database. The database credentials must be encrypted and rotated periodically. The session logs must be encrypted using a customer managed key in AWS KMS, and the security team requires that the KMS key be automatically rotated annually without requiring existing logs to be re-encrypted. Which of the following configurations should a solutions architect recommend to meet these security requirements? (Select TWO.)

Select all that apply

Enable automatic key rotation for the AWS KMS customer managed key, which creates a new backing key version annually while keeping the previous versions for decrypting older data.

Store the database credentials in AWS Secrets Manager and configure a rotation schedule using a built-in or custom AWS Lambda function.

Store the database credentials as a Standard String parameter in AWS Systems Manager Parameter Store to allow easy rotation via parameter updates.

Enable automatic key rotation for the KMS key and configure an S3 Batch Operations job to re-encrypt all historical logs under the new key version immediately after rotation.

Manually rotate the KMS key by creating a new key each year and deleting the old KMS key to ensure only the latest key version is active.

Show answer & explanation

Answer: Enable automatic key rotation for the AWS KMS customer managed key, which creates a new backing key version annually while keeping the previous versions for decrypting older data.; Store the database credentials in AWS Secrets Manager and configure a rotation schedule using a built-in or custom AWS Lambda function.

Answer

Enable automatic key rotation for the AWS KMS customer managed key, and store the database credentials in AWS Secrets Manager with an automated rotation schedule.

Enabling automatic key rotation for the KMS key generates a new backing key annually while retaining the old backing keys. This allows the application to read old data without any code changes or manual re-encryption. AWS Secrets Manager is the standard service for storing and rotating database credentials securely using Lambda.

Step-by-Step Solution

Select a secure storage service for the database credentials that supports automatic rotation.

AWS Secrets Manager is selected because it natively supports rotating secrets using AWS Lambda.

Storing passwords in plain text in Parameter Store is insecure, making Secrets Manager the ideal choice for credentials.

Configure AWS KMS key rotation for encrypting S3 session logs.

Enable AWS KMS automatic key rotation.

Automatic key rotation creates a new backing key version annually and retains old versions, which automatically decrypts historical data without re-encryption.

Key Concept

Key rotation and secure secret management are fundamental to AWS data encryption. AWS KMS automatic rotation handles backing key versions transparently, while AWS Secrets Manager secures and rotates database credentials using Lambda.

Question 1372Question →

An organization stores highly confidential regulatory reports in an Amazon S3 bucket. The security policy mandates that these reports must be encrypted using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS). The policy also dictates that the encryption key must be rotated every 90 days, and any reports older than one year must be re-encrypted using the most recent key material to ensure that historical key versions can eventually be retired. Which combination of actions will meet these security requirements with the least operational overhead?

Enable automatic key rotation on the CMK and set the rotation period to 90 days. Rely on AWS KMS automatic key rotation to automatically re-encrypt all existing objects in the S3 bucket upon key rotation.

Store the report encryption key as a plain string parameter in AWS Systems Manager Parameter Store with a custom 90-day rotation policy. Create an AWS Lambda function triggered by Amazon EventBridge to retrieve the plaintext key and re-encrypt S3 objects older than one year.

Enable automatic key rotation on the CMK and set the rotation period to 90 days. Run an Amazon S3 Batch Operations job with a Copy operation targeting objects older than one year, specifying the same CMK ARN as the encryption key.

Create a script to manually generate a new KMS CMK every 90 days and update the S3 bucket default encryption settings. Configure an Amazon S3 Lifecycle rule to transition and re-encrypt reports older than one year to S3 Standard-Infrequent Access (S3 Standard-IA).

Show answer & explanation

Answer: Enable automatic key rotation on the CMK and set the rotation period to 90 days. Run an Amazon S3 Batch Operations job with a Copy operation targeting objects older than one year, specifying the same CMK ARN as the encryption key.

Answer

Enable automatic key rotation on the CMK and set the rotation period to 90 days, then use Amazon S3 Batch Operations with a Copy operation to re-encrypt objects older than one year under the same CMK ARN.

The correct option addresses all compliance requirements with minimal operational overhead. Since May 2024, AWS KMS Customer Managed Keys support custom automatic key rotation periods between 90 and 730 days, satisfying the 90-day rotation requirement natively. Because automatic rotation does not retroactively re-encrypt existing objects, an in-place S3 Batch Operations Copy job targeting objects older than one year is the standard best practice to force S3 to request a new data key (which will be generated from the newly rotated backing key material) and re-encrypt the data.

Step-by-Step Solution

Configure the AWS KMS Customer Managed Key (CMK) for automatic rotation.

Automatic rotation is enabled, and the rotation period is set to 90 days using the custom rotation period capability of CMKs.

This meets the compliance requirement of rotating the key material every 90 days with zero operational overhead for key generation.

Identify objects older than one year that need to be re-encrypted.

An S3 Inventory list or custom filter identifies objects that have a creation date older than 365 days.

This defines the target dataset that must be re-encrypted to phase out the older key material.

Execute an S3 Batch Operations Copy job on the target objects using the same CMK ARN.

The objects are copied to themselves (in-place copy). S3 requests a new data key from KMS to write the copied object, which is generated using the newly rotated active key version.

This forces the re-encryption of the historical data under the latest key version, allowing the old backing key versions to eventually be retired without modifying the S3 bucket's configuration or changing object URLs.

Key Concept

AWS KMS Customer Managed Key custom rotation periods and Amazon S3 Batch Operations for data re-encryption.

Question 1373Question →

A smart home IoT monitoring service hosts its primary application in the us-east-1 Region. The architecture consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer, an Amazon RDS for PostgreSQL database, and static configuration files stored in an Amazon S3 bucket.

The company needs to establish a disaster recovery (DR) site in the us-west-2 Region. The DR solution must achieve a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes, while minimizing ongoing infrastructure costs.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Set up an Amazon RDS cross-region read replica in the secondary region, and configure Amazon S3 Cross-Region Replication (CRR) to copy static files to the secondary region.

Deploy an Application Load Balancer and configure an Auto Scaling group with the desired capacity set to zero in the secondary region, and ensure application Amazon Machine Images (AMIs) are pre-copied to the secondary region.

Configure Amazon RDS Multi-AZ replication to synchronize database writes between the primary and secondary regions for automatic failover.

Store the static files in Amazon S3 Glacier Flexible Retrieval in the secondary region and configure standard retrieval to recover data during a failover event.

Deploy a duplicate EC2 Auto Scaling group and Application Load Balancer running at full production capacity in the secondary region to maintain a hot standby.

Show answer & explanation

Answer: Set up an Amazon RDS cross-region read replica in the secondary region, and configure Amazon S3 Cross-Region Replication (CRR) to copy static files to the secondary region.; Deploy an Application Load Balancer and configure an Auto Scaling group with the desired capacity set to zero in the secondary region, and ensure application Amazon Machine Images (AMIs) are pre-copied to the secondary region.

Answer

Setting up an Amazon RDS cross-region read replica and Amazon S3 Cross-Region Replication (CRR) ensures data is replicated asynchronously to meet the 15-minute RPO. Pre-configuring the Application Load Balancer and an Auto Scaling group with zero capacity in the secondary region establishes a Pilot Light strategy that minimizes baseline cost while allowing full scaling within the 2-hour RTO.

The correct combination of actions uses a Pilot Light disaster recovery strategy to achieve the RTO and RPO goals cost-effectively. Creating an Amazon RDS cross-region read replica and configuring Amazon S3 Cross-Region Replication (CRR) ensures data is replicated asynchronously to the secondary region with minimal lag, satisfying the 15-minute RPO. Pre-configuring the Application Load Balancer and Auto Scaling group with desired capacity set to zero in the secondary region ensures compute costs are not incurred until a failover is initiated. Upon failover, the database replica is promoted and the Auto Scaling group is scaled up, which can be accomplished well within the 2-hour RTO.

Step-by-Step Solution

Analyze RTO, RPO, and cost constraints.

RTO is 2 hours (allows time to provision compute and promote databases), RPO is 15 minutes (requires continuous or highly frequent asynchronous replication), and costs must be minimized (favors Pilot Light or Warm Standby with resources scaled down).

Understanding the recovery boundaries is necessary to select the appropriate disaster recovery pattern.

Select the database and storage replication mechanism that satisfies the 15-minute RPO.

Amazon RDS cross-region read replicas use asynchronous replication with very low lag (usually seconds), meeting the 15-minute RPO. Amazon S3 Cross-Region Replication (CRR) replicates objects asynchronously, also meeting the 15-minute RPO.

This satisfies the data persistence requirements across regions within the allowed data loss envelope.

Select the compute staging mechanism that meets the 2-hour RTO while minimizing costs.

Deploying the Application Load Balancer and configuring the Auto Scaling group with the desired capacity set to zero minimizes compute costs, as no EC2 instances run during normal operations. Scaling up the group during failover takes minutes, fitting comfortably inside the 2-hour RTO.

This ensures the application layer is ready to be provisioned quickly without incurring active running costs.

Key Concept

Disaster Recovery (DR) strategies on AWS (specifically Pilot Light vs. Warm Standby / Hot Standby) and cross-region replication mechanisms for RDS and S3.

Question 1374Question →

An enterprise is securing a payment processing application running on Amazon EC2 instances in a private subnet (CIDR $10.0.1.0/24$ ). The application must securely access Amazon S3 to read transaction logs and connect to an external credit bureau API via HTTPS over the internet. Currently, all outbound traffic from the private subnet is routed through a NAT Gateway located in a public subnet. To optimize cost and security, the solution architect deploys a Gateway VPC Endpoint for Amazon S3. The architect now wants to restrict network access at both the subnet and instance levels to allow only these two destinations, adhering to the principle of least privilege. Which of the following configurations must the architect implement to achieve this? (Select TWO.)

Select all that apply

Add a route to the private subnet's route table that targets the S3 Gateway VPC Endpoint for the destination Amazon S3 prefix list, while keeping the default route (

0.0.0.0/0

) targeting the NAT Gateway.

Configure the security group associated with the EC2 instances to allow outbound traffic to the Amazon S3 prefix list on port

443

, and outbound traffic to the credit bureau's public IP range on port

443

Add an outbound rule to the private subnet's Network ACL that references the Amazon S3 prefix list (pl-xxxxxxxx) to restrict outbound subnet traffic to S3.

Add an inbound rule to the private subnet's Network ACL that references the S3 Gateway VPC Endpoint ID (vpce-xxxxxxxx) to allow stateless return traffic.

Replace the default route in the private subnet's route table with a route targeting the S3 Gateway VPC Endpoint for

0.0.0.0/0

, using the endpoint policy to filter and redirect non-S3 traffic to the NAT Gateway.

Show answer & explanation

Answer: Add a route to the private subnet's route table that targets the S3 Gateway VPC Endpoint for the destination Amazon S3 prefix list, while keeping the default route ( $0.0.0.0/0$ ) targeting the NAT Gateway.; Configure the security group associated with the EC2 instances to allow outbound traffic to the Amazon S3 prefix list on port $443$ , and outbound traffic to the credit bureau's public IP range on port $443$ .

Answer

To secure the architecture, the private subnet's route table must route S3 prefix list traffic through the S3 Gateway VPC Endpoint while retaining the default route to the NAT Gateway, and the EC2 instances' security group must outbound-allow HTTPS traffic to both the S3 prefix list and the credit bureau's IP range.

The correct configuration combines route table updates and stateful security group rules. The route table must have a route pointing the S3 prefix list to the S3 Gateway VPC Endpoint, while the default route remains pointed at the NAT Gateway for the credit bureau API. The instances' security groups should restrict outbound HTTPS traffic to the S3 prefix list and the credit bureau's IP range. Because security groups are stateful, return traffic is permitted automatically.

Step-by-Step Solution

Configure the route table for the private subnet.

Add a route with the S3 prefix list as the destination and the Gateway VPC Endpoint ID as the target. Maintain the default route (

0.0.0.0/0

) pointing to the NAT Gateway.

Gateway VPC Endpoints require route table entries mapped to the S3 prefix list. Other internet traffic (the credit bureau API) must continue using the NAT Gateway.

Configure security groups at the instance level.

Add two outbound rules: one allowing TCP port

443

to the S3 prefix list, and another allowing TCP port

443

to the credit bureau's CIDR.

Security groups are stateful, allowing return traffic automatically. They support referencing prefix lists and CIDR blocks to enforce least-privilege egress filtering.

Evaluate subnet-level Network ACL restrictions.

Keep the Network ACL rules configured with standard IP CIDRs and ephemeral ports if restricting at this layer, avoiding attempts to reference prefix lists or VPC endpoint IDs.

Network ACLs do not support AWS-specific resources like prefix lists or VPC endpoint IDs, so security group filtering is preferred for granular resource-level restriction.

Key Concept

Gateway VPC Endpoint routing and the operational limits of stateless Network ACLs vs stateful Security Groups.

Question 1375Question →

A developer is hosting a web application on a single Amazon EC2 instance. The developer wants to allow external users to access the application over HTTPS while blocking all other incoming traffic. To achieve this, which configuration should be applied to the security group associated with the EC2 instance?

Add an inbound rule allowing TCP port

443

from source

0.0.0.0/0

Add both an inbound rule allowing TCP port

443

from source

0.0.0.0/0

and an outbound rule allowing ephemeral TCP ports to destination

0.0.0.0/0

Add only an outbound rule allowing TCP port

443

to destination

0.0.0.0/0

Add a rule to the default AWS Shield protection to allow HTTPS traffic to the EC2 instance's IP address.

Show answer & explanation

Answer: Add an inbound rule allowing TCP port $443$ from source $0.0.0.0/0$ .

Answer

Add an inbound rule allowing TCP port

443

from source

0.0.0.0/0

The correct option is the one that recommends adding an inbound rule allowing TCP port

443

from source

0.0.0.0/0

. Since security groups are stateful firewalls, they automatically allow return traffic for established connections. Therefore, allowing inbound TCP port

443

is sufficient to enable external users to establish HTTPS connections and receive responses.

Step-by-Step Solution

Identify the resource security requirement.

The requirement is to allow external users to access an application hosted on an EC2 instance over HTTPS (TCP port

443

) while blocking all other traffic.

This establishes that we need to configure traffic rules at the host/instance level using security groups.

Determine the stateful behavior of the security group.

Security groups are stateful, meaning any allowed inbound traffic is automatically allowed to exit, and any allowed outbound traffic is automatically allowed to enter.

Understanding statefulness simplifies the rules needed, indicating that we do not need to configure corresponding outbound rules for return traffic.

Formulate the correct inbound rule.

Create an inbound rule allowing TCP port

443

from the internet (

0.0.0.0/0

) to the EC2 instance.

This allows external users to initiate HTTPS requests while the security group's default deny-all behavior blocks other unspecified ports.

Key Concept

Stateful behavior of AWS Security Groups

Estimated Time:45s

Question 1376Question →

A company is setting up a new multi-account AWS environment. The security team wants to establish a secure administrative access strategy for its systems administrators and migrate database credentials currently hardcoded in application configuration files. The solution must enforce the principle of least privilege, eliminate long-term credentials for daily management, and automatically rotate database passwords. Which TWO options should the solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Configure AWS IAM Identity Center to federate access from the company's identity provider and assign administrative roles using permission sets.

Use AWS Secrets Manager to store the database credentials and enable automatic rotation.

Create individual IAM users with long-term access keys in the AWS accounts for the administrators to use during daily operations.

Configure the AWS account root user credentials and distribute them among the systems administrators for standard administrative tasks.

Store the database credentials as plaintext Standard String parameters in AWS Systems Manager Parameter Store and enable KMS key rotation.

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate access from the company's identity provider and assign administrative roles using permission sets.; Use AWS Secrets Manager to store the database credentials and enable automatic rotation.

Answer

To secure administrative access and database credentials, the company must implement federated access using AWS IAM Identity Center and store the database credentials in AWS Secrets Manager with automatic rotation enabled.

Implementing federated access through AWS IAM Identity Center ensures that systems administrators use short-term credentials, fulfilling the security requirement to eliminate long-term keys. Storing credentials in AWS Secrets Manager allows the organization to systematically rotate the database passwords automatically without code changes.

Step-by-Step Solution

Federate administrative access.

By using AWS IAM Identity Center mapped to the corporate identity provider, administrators obtain temporary security credentials instead of relying on long-term keys.

This minimizes the credential exposure window and satisfies the requirement to eliminate long-term access keys.

Secure database passwords and configure lifecycles.

Moving hardcoded database passwords to AWS Secrets Manager protects them at rest and in transit.

Secrets Manager provides native capabilities to automatically rotate these passwords at scheduled intervals, satisfying compliance requirements.

Key Concept

Federated identity management and automated secrets lifecycle rotation under least privilege principles.

Question 1377Question →

An operations team is setting up a deployment pipeline and needs to store a sensitive API token that Amazon ECS tasks will use to access a third-party service. The solutions architect decides to store the token in AWS Systems Manager Parameter Store. Which configuration should the solutions architect choose to store and protect the token?

Create a Parameter Store parameter using the String type, storing the token directly in the parameter value to reduce API latency.

Create a Parameter Store parameter using the String type, and rely on AWS KMS automatic key rotation to secure the plaintext value.

Create a Parameter Store parameter using the SecureString type, which encrypts the token using an AWS Key Management Service (AWS KMS) key.

Create a Parameter Store parameter using the SecureString type, expecting that rotating the underlying KMS key will immediately re-encrypt all historical parameter versions.

Show answer & explanation

Answer: Create a Parameter Store parameter using the SecureString type, which encrypts the token using an AWS Key Management Service (AWS KMS) key.

Answer

Create a Parameter Store parameter using the SecureString type, which encrypts the token using an AWS Key Management Service (AWS KMS) key.

The correct option is to use a SecureString parameter in Systems Manager Parameter Store. This configuration automatically encrypts the sensitive API token at rest using an AWS KMS key. This prevents unauthorized users from viewing the credentials in plaintext and adheres to AWS security best practices.

Step-by-Step Solution

Identify the security requirement for the sensitive API token.

The API token is sensitive credential data that must be encrypted at rest.

Storing credentials in plaintext poses a security risk.

Evaluate Systems Manager Parameter Store parameter types.

The String type stores values in plaintext, while the SecureString type encrypts values using AWS KMS.

SecureString is the correct parameter type for sensitive data.

Determine the impact of KMS key rotation on stored secrets.

Rotating a KMS key generates a new backing key for new encryption requests, but does not re-encrypt existing ciphertext or affect plaintext parameters.

Understanding key rotation mechanics ensures correct architectural assumptions.

Key Concept

Using Systems Manager Parameter Store SecureString parameters encrypted with AWS KMS to securely store sensitive configuration data.

Question 1378Question →

An application hosted on Amazon EC2 instances in a private subnet (Subnet A: $10.0.1.0/24$ ) of a VPC must securely access AWS Key Management Service (AWS KMS) to decrypt sensitive transactional payloads. Compliance policies dictate that all traffic must remain within the AWS network, and no NAT Gateways or Internet Gateways are allowed. A solutions architect deploys an Interface VPC Endpoint for AWS KMS in a separate private subnet (Subnet B: $10.0.2.0/24$ ). Both subnets are associated with custom Network Access Control Lists (NACL A and NACL B) that currently deny all traffic. To achieve this secure communication while adhering to the principle of least privilege, which combination of Security Group and Network ACL rules is required?

EC2 Security Group allows outbound TCP

443

and inbound TCP

1024

65535

. KMS Endpoint Security Group allows inbound TCP

443

and outbound TCP

1024

65535

. NACL A allows outbound TCP

443

10.0.2.0/24

. NACL B allows inbound TCP

443

from

10.0.1.0/24

EC2 Security Group allows outbound TCP

443

to the KMS Endpoint Security Group. KMS Endpoint Security Group allows inbound TCP

443

from the EC2 Security Group. NACL A allows outbound TCP

1024

65535

10.0.2.0/24

and inbound TCP

443

from

10.0.2.0/24

. NACL B allows inbound TCP

1024

65535

from

10.0.1.0/24

and outbound TCP

443

10.0.1.0/24

EC2 Security Group allows outbound TCP

443

to the KMS Endpoint Security Group. KMS Endpoint Security Group allows inbound TCP

443

from the EC2 Security Group. NACL A allows outbound TCP

443

10.0.2.0/24

and inbound TCP

1024

65535

from

10.0.2.0/24

. NACL B allows inbound TCP

443

from

10.0.1.0/24

and outbound TCP

1024

65535

10.0.1.0/24

EC2 Security Group allows outbound TCP

443

. KMS Endpoint Security Group allows inbound TCP

443

. NACL A allows outbound TCP

443

10.0.2.0/24

. NACL B allows inbound TCP

443

from

10.0.1.0/24

. Associate an AWS WAF web ACL with the KMS Interface VPC Endpoint to inspect and allow only KMS decrypt operations.

Show answer & explanation

Answer: EC2 Security Group allows outbound TCP $443$ to the KMS Endpoint Security Group. KMS Endpoint Security Group allows inbound TCP $443$ from the EC2 Security Group. NACL A allows outbound TCP $443$ to $10.0.2.0/24$ and inbound TCP $1024$ - $65535$ from $10.0.2.0/24$ . NACL B allows inbound TCP $443$ from $10.0.1.0/24$ and outbound TCP $1024$ - $65535$ to $10.0.1.0/24$ .

Answer

Configure the EC2 Security Group to allow outbound TCP

443

to the KMS Endpoint Security Group, and the KMS Endpoint Security Group to allow inbound TCP

443

from the EC2 Security Group. Configure NACL A to allow outbound TCP

443

10.0.2.0/24

and inbound TCP

1024

65535

from

10.0.2.0/24

. Configure NACL B to allow inbound TCP

443

from

10.0.1.0/24

and outbound TCP

1024

65535

10.0.1.0/24

The correct option correctly accounts for the stateful nature of Security Groups and the stateless nature of Network ACLs. Security Groups only require rules allowing the flow in the direction of connection establishment (outbound TCP

443

on the client side, inbound TCP

443

on the server side). Network ACLs require explicit rules for both the initial outbound request (to destination port

443

) and the corresponding inbound return packet (to destination ephemeral ports

1024

65535

) on the client subnet, and vice versa on the server subnet.

Step-by-Step Solution

Determine Security Group configurations based on their stateful nature.

EC2 instances initiate traffic to the KMS endpoint on port

443

. Because Security Groups are stateful, the EC2 SG only needs an outbound rule to the KMS SG, and the KMS SG only needs an inbound rule from the EC2 SG. Return traffic is automatically tracked and allowed.

Security Groups track connections and allow response traffic to flow back without needing explicit reverse rules.

Analyze the client-server interaction to identify ports for the stateless Network ACL rules.

The client (EC2 in Subnet A) sends traffic from an ephemeral source port (range

1024

65535

) to the server (KMS Endpoint in Subnet B) on destination port

443

. The return traffic flows from source port

443

to the destination ephemeral port.

Stateless Network ACLs evaluate inbound and outbound packets independently and require rules for both request and response paths.

Define rules for NACL A (Subnet A).

Outbound rule: Allow TCP destination port

443

to Subnet B (

10.0.2.0/24

). Inbound rule: Allow TCP destination ports

1024

65535

(ephemeral range) from Subnet B (

10.0.2.0/24

NACL A must allow the outgoing requests to reach the endpoint subnet and allow the returning server responses back into the subnet.

Define rules for NACL B (Subnet B).

Inbound rule: Allow TCP destination port

443

from Subnet A (

10.0.1.0/24

). Outbound rule: Allow TCP destination ports

1024

65535

(ephemeral range) to Subnet A (

10.0.1.0/24

NACL B must allow the incoming requests to reach the KMS endpoint and allow the outgoing responses to return to the EC2 instances.

Key Concept

Stateless Network ACLs vs Stateful Security Groups

Estimated Time:3m 0s

Question 1379Question →

An enterprise is designing a secure network architecture for a sensitive payment processing workload running on Amazon EC2 instances inside a dedicated private subnet. The workload needs to securely access Amazon DynamoDB for database operations and a third-party compliance API hosted on the public internet. The architecture must satisfy the following requirements:
1. The EC2 instances must not have a direct route to an Internet Gateway or have public IP addresses.
2. Access to DynamoDB must remain entirely within the AWS network and must not incur data processing or hourly usage fees.
3. Network access control must be enforced statelessly at the subnet boundary and statefully at the instance level.

Which combination of steps should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the private subnet's route table.

Configure the private subnet's Network ACL with an outbound rule allowing TCP port

443

to the NAT Gateway's subnet, and an inbound rule allowing TCP ports

1024

65535

from the NAT Gateway's subnet.

Create an Interface VPC Endpoint (AWS PrivateLink) for Amazon DynamoDB and configure the private subnet's route table to route DynamoDB traffic through the endpoint.

Configure the EC2 instances' Security Group with an inbound rule allowing TCP ports

1024

65535

from the NAT Gateway subnet to permit return traffic from the third-party API.

Deploy an AWS WAF web ACL and associate it directly with the private subnet's Network ACL to inspect Layer 7 payloads sent to the third-party compliance API.

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the private subnet's route table.; Configure the private subnet's Network ACL with an outbound rule allowing TCP port $443$ to the NAT Gateway's subnet, and an inbound rule allowing TCP ports $1024$ - $65535$ from the NAT Gateway's subnet.

Answer

Create a Gateway VPC Endpoint for Amazon DynamoDB associated with the private subnet's route table, and configure the private subnet's Network ACL to allow outbound TCP port

443

to the NAT Gateway's subnet and inbound TCP ports

1024

65535

from the NAT Gateway's subnet.

To satisfy the requirements, the Solutions Architect must configure a Gateway VPC Endpoint for Amazon DynamoDB to enable secure, direct, and cost-free communication. Additionally, because Network ACLs are stateless, the private subnet's Network ACL must explicitly allow both the outbound traffic on HTTPS port

443

to the NAT Gateway subnet and the inbound return traffic on ephemeral ports

1024

65535

from the NAT Gateway subnet. Security groups, being stateful, do not require corresponding inbound ephemeral rule configurations.

Step-by-Step Solution

Address the DynamoDB connectivity and cost requirements by selecting a Gateway VPC Endpoint.

DynamoDB traffic is routed privately through the AWS network without traversing the NAT Gateway, preventing data processing fees since Gateway endpoints are free of charge.

Interface VPC endpoints (PrivateLink) incur usage and data processing charges, making them incorrect for a requirement to avoid fees.

Address the stateless network access control requirements at the subnet boundary for the third-party compliance API.

The Network ACL must be updated with an outbound rule for port

443

and an inbound rule for ephemeral ports (

1024

65535

) to allow return traffic.

Network ACLs are stateless, meaning return traffic must be explicitly permitted, unlike stateful security groups which track connection states automatically.

Confirm stateful behavior at the instance level.

Ensure security groups only require outbound rules for HTTPS (

443

) to the NAT Gateway, with no inbound ephemeral port rules required.

Security groups track connections statefully, rendering inbound ephemeral rules unnecessary and insecure.

Key Concept

VPC Network Security requires combining stateful Security Groups (acting at the instance ENI level) with stateless Network ACLs (acting at the subnet boundary), along with proper VPC endpoint routing (Gateway vs. Interface) to balance security, performance, and cost.

Question 1380Question →

A medical device company is designing a multi-Region, multi-account architecture to store and protect patient telemetry data. The raw data is stored in Amazon S3 buckets in Account A (ingestion account) located in the `us-east-1` Region and encrypted using an AWS Key Management Service (AWS KMS) customer managed key ( $K_1$ ). To comply with regulatory requirements, the data must be replicated to Account B (compliance archive account) in the `us-west-2` Region. The replicated data must be encrypted at rest using a customer managed key ( $K_2$ ) owned by Account B. The database credentials for accessing the data warehouse must be rotated every $15$ days automatically, and no plaintext sensitive configuration parameters should be stored in source code or plain parameter fields. Additionally, the security team requires that the encryption keys ( $K_1$ and $K_2$ ) are rotated annually, but they are concerned about whether historical backups will remain readable after rotation. Which two actions should a solutions architect recommend to implement these security requirements? (Select TWO.)

Select all that apply

Enable automatic key rotation for the customer managed keys in AWS KMS, as KMS automatically retains historical backing key material to decrypt data encrypted under previous versions.

Store the database credentials in AWS Secrets Manager and configure automatic rotation every 15 days using a custom AWS Lambda function, referencing the secret Amazon Resource Name (ARN) in the application configuration.

Enable automatic key rotation in AWS KMS, and schedule an Amazon S3 Batch Operations job to re-encrypt all historical data in Account B with the new key material immediately after rotation.

Store the database credentials as standard String parameters in AWS Systems Manager Parameter Store to minimize costs, and configure an Amazon EventBridge rule to execute an API call that rotates the parameter value every 15 days.

Configure manual key rotation by creating new KMS keys annually, update the application to use the new key ARNs, and delete the old KMS keys to avoid key storage fees.

Show answer & explanation

Answer: Enable automatic key rotation for the customer managed keys in AWS KMS, as KMS automatically retains historical backing key material to decrypt data encrypted under previous versions.; Store the database credentials in AWS Secrets Manager and configure automatic rotation every 15 days using a custom AWS Lambda function, referencing the secret Amazon Resource Name (ARN) in the application configuration.

Answer

Enable automatic key rotation for the customer managed keys in AWS KMS, as KMS automatically retains historical backing key material to decrypt data encrypted under previous versions; and store the database credentials in AWS Secrets Manager and configure automatic rotation every 15 days using a custom AWS Lambda function, referencing the secret Amazon Resource Name (ARN) in the application configuration.

The correct options recommend enabling automatic key rotation for the customer managed keys in AWS KMS and using AWS Secrets Manager for credential storage and rotation. Automatic key rotation ensures that KMS keeps old backing keys to decrypt older data, meaning that historical backups remain readable without any re-encryption tasks. Storing credentials in AWS Secrets Manager allows automatic rotation every 15 days using a custom Lambda function, while referencing the credentials via their ARN avoids exposing them in plaintext.

Step-by-Step Solution

Evaluate the database credential management requirements.

Determine that Secrets Manager is the optimal service because it natively supports automatic rotation of credentials (via AWS Lambda) every 15 days and integrates with VPCs and IAM policies for secure, non-plaintext referencing.

This satisfies the constraint that database credentials must be rotated automatically and cannot be stored in plaintext parameter fields or source code.

Analyze KMS key rotation behavior for compliance and disaster recovery.

Confirm that when automatic key rotation is enabled for Customer Managed Keys, KMS handles the creation of new backing keys while keeping old ones intact.

This guarantees that older ciphertexts (historical backups/replicated data) can still be decrypted by KMS automatically without manual overhead or data re-encryption.

Assess the risk of manual key rotation and deletion.

Recognize that deleting old keys renders any historical data encrypted under those keys permanently unrecoverable, making manual rotation with deletion highly dangerous.

This rules out solutions that suggest deleting the old keys or manual management schemes that introduce operational overhead and risk data loss.

Key Concept

AWS KMS key rotation maintains older key versions to allow decryption of historical ciphertexts, while AWS Secrets Manager provides secure, automated credential rotation without exposing plaintext variables.

PreviousPage 69 / 74Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Alternative Method

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution