All practice questions

1462 questions

All types1,462 Multiple choice739 Multiple select723

A company stores audit reports in an Amazon S3 bucket. The reports are encrypted at rest using an AWS KMS customer managed key. The company's compliance policy requires that the encryption keys must be rotated annually. A solutions architect needs to configure the rotation while ensuring that all previously encrypted reports remain accessible for decryption without administrative intervention or manual key version tracking. Which two actions should the solutions architect take to meet these requirements?

Select all that apply

Enable automatic key rotation for the customer managed key in AWS KMS.

Retain the original customer managed key in an active state without deleting it.

Run an Amazon S3 Batch Operations job to re-encrypt all historical reports with the new key version immediately after rotation.

Create a new customer managed key each year, delete the old key, and update the S3 bucket's default encryption configuration.

Store the rotated KMS key material as a plaintext parameter in AWS Systems Manager Parameter Store to allow S3 access.

Show answer & explanation

Answer: Enable automatic key rotation for the customer managed key in AWS KMS.; Retain the original customer managed key in an active state without deleting it.

Answer

Enable automatic key rotation for the customer managed key and retain the original key without deleting it.

Enabling automatic key rotation allows AWS KMS to create new key material annually under the same key ARN. AWS KMS automatically retains all historical backing key material associated with the key, enabling seamless decryption of older reports without requiring any modifications to S3 or manual key management.

Step-by-Step Solution

Enable automatic key rotation on the customer managed key used for the S3 bucket's encryption.

AWS KMS will generate a new backing key version annually.

This automates the rotation process without changing the key ARN or configuration.

Keep the customer managed key active and do not delete any older versions of the key material.

The old backing key material remains available in AWS KMS.

AWS KMS requires the historical backing key material to decrypt S3 objects that were encrypted before the rotation occurred.

Key Concept

AWS KMS customer managed key rotation mechanics and backing key preservation.

Question 1422Question →

An organization stores sensitive compliance logs in an Amazon S3 bucket encrypted using an AWS KMS Customer Managed Key. Compliance policies mandate that all new logs must be encrypted with key material that is rotated annually. Additionally, any logs older than one year must be re-encrypted using a completely new Customer Managed Key to comply with a cryptographic obsolescence policy. Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Enable automatic key rotation for the existing Customer Managed Key.

Create a new Customer Managed Key, configure the application to use it, and use Amazon S3 Batch Operations to copy and re-encrypt the historical logs older than one year under the new key.

Enable automatic key rotation on the existing Customer Managed Key to trigger AWS KMS to automatically decrypt and re-encrypt all historical logs in the S3 bucket using the new key version.

Deploy an AWS Lambda function running under AWS root account credentials to programmatically decrypt and re-encrypt historical logs to prevent key policy access errors.

Store the KMS key configuration and the database access passwords as a plain String parameter in AWS Systems Manager Parameter Store to allow the rotation script to easily retrieve them.

Show answer & explanation

Answer: Enable automatic key rotation for the existing Customer Managed Key.; Create a new Customer Managed Key, configure the application to use it, and use Amazon S3 Batch Operations to copy and re-encrypt the historical logs older than one year under the new key.

Answer

The correct actions are to enable automatic key rotation for the existing Customer Managed Key and to use Amazon S3 Batch Operations to re-encrypt historical logs. Automatic key rotation manages the rotation of backing key material for new writes, while historical data re-encryption must be executed manually or via S3 Batch Operations, as AWS KMS does not retroactively re-encrypt existing S3 objects. Managing credentials via IAM roles instead of the root account and securing parameters as SecureString are fundamental AWS security best practices.

Step-by-Step Solution

Enable automatic key rotation for the Customer Managed Key used for encrypting new logs.

AWS KMS will automatically rotate the backing key material every 365 days. Existing logs remain decryptable, and new logs will be encrypted using the rotated key material under the same key ARN.

This satisfies the requirement to rotate the key material used for new logs annually without breaking access to old logs.

Identify logs older than one year and prepare an Amazon S3 Batch Operations Copy job using a new Customer Managed Key.

The old logs are copied in-place or to a target prefix, decrypting them using the old key and re-encrypting them using the new key.

Because KMS key rotation does not retroactively re-encrypt existing objects, a new write operation (like S3 Batch Operations Copy) is required to re-encrypt historical data under a new key.

Key Concept

AWS KMS Key Rotation and Historical Data Re-encryption

Question 1423Question →

A logistics and supply chain enterprise is migrating its core applications to a multi-account AWS environment managed by AWS Organizations. The company's corporate identity store is located on-premises in a Microsoft Active Directory (AD) domain. The security policy requires that users authenticate using their existing corporate credentials, without duplicating any user credentials in the cloud. The solution must also minimize administrative overhead.

Which combination of actions should a Solutions Architect recommend to meet these requirements? (Select two.)

Select all that apply

Deploy an Active Directory Connector (AD Connector) in the AWS VPC with network connectivity to the on-premises directory.

Configure AWS IAM Identity Center to use AWS Directory Service as its identity source to enable single sign-on access to the AWS accounts.

Create individual IAM users with long-term credentials in each member account for every enterprise directory user.

Deploy AWS Managed Microsoft Active Directory in the cloud and configure a two-way forest trust with the on-premises directory, then create matching IAM users.

Configure AWS IAM Identity Center to map administrative Active Directory groups directly to the AWS account root user credentials for daily administrative operations.

Show answer & explanation

Answer: Deploy an Active Directory Connector (AD Connector) in the AWS VPC with network connectivity to the on-premises directory.; Configure AWS IAM Identity Center to use AWS Directory Service as its identity source to enable single sign-on access to the AWS accounts.

Answer

Deploy an Active Directory Connector (AD Connector) in the AWS VPC with network connectivity to the on-premises directory, and configure AWS IAM Identity Center to use AWS Directory Service as its identity source.

Deploying an Active Directory Connector (AD Connector) redirecting requests to the on-premises Active Directory avoids credential caching or replication in the cloud. Configuring AWS IAM Identity Center to use AWS Directory Service connects this proxy gateway to your AWS Organizations structure, enabling centralized single sign-on access to all member accounts with minimal management effort.

Step-by-Step Solution

Establish secure network connectivity between the AWS VPC and the on-premises network.

A Site-to-Site VPN or AWS Direct Connect connection is configured, allowing low-latency secure IP communication.

This setup allows the AD Connector in AWS to reach the on-premises Active Directory domain controllers.

Deploy an AD Connector using AWS Directory Service.

The AD Connector acts as a directory gateway, proxying authentication requests without replicating AD data in the cloud.

This satisfies the business requirement of not duplicating user credentials in the cloud.

Configure AWS IAM Identity Center to use AWS Directory Service as the identity source.

IAM Identity Center integrates with the AD Connector, enabling centralized single sign-on (SSO) and permissions assignment to AWS Organizations accounts.

This minimizes administrative overhead by allowing group-based AWS access assignment using existing AD identities.

Key Concept

Federating an on-premises Microsoft Active Directory with AWS IAM Identity Center using AD Connector to enable centralized SSO without credential replication.

Question 1424Question →

A company is hosting a database application on Amazon EC2 instances. The database data is stored on attached Amazon EBS volumes, which are encrypted using an AWS Key Management Service (AWS KMS) customer managed key. Due to updated corporate compliance policies, the company must now rotate this encryption key annually. A solutions architect needs to configure the rotation while ensuring that the application suffers no downtime and that existing data remains accessible. How will enabling automatic key rotation for this customer managed key satisfy these requirements?

AWS KMS generates new backing key material annually and retains the old key material to decrypt existing data, keeping the same Key ARN so that no application or resource configurations need to be updated.

AWS KMS generates new key material and immediately triggers a background service to re-encrypt all existing blocks on the EBS volumes under the new key version to ensure compliance.

AWS KMS creates a completely new customer managed key with a different Key ARN, requiring the solutions architect to update the EC2 launch templates and manually re-encrypt the EBS volumes.

AWS KMS deletes the older backing key material during rotation to enforce security boundaries, which requires the databases to be stopped so that the volumes can be decrypted using cached data keys before the rotation finishes.

Show answer & explanation

Answer: AWS KMS generates new backing key material annually and retains the old key material to decrypt existing data, keeping the same Key ARN so that no application or resource configurations need to be updated.

Answer

The correct option correctly describes AWS KMS key rotation behavior. When automatic key rotation is enabled for a customer managed key, KMS creates a new version of the backing key material every year. It retains all historical versions of the backing key material to decrypt any data previously encrypted with them. Because the Key ID and Key ARN do not change, applications and resources (like EBS volumes) continue to function without any configuration updates or downtime.

Step-by-Step Solution

Analyze how AWS KMS handles automatic key rotation for Customer Managed Keys.

Automatic rotation creates a new version of the backing key material annually, while keeping the Key ARN and key properties identical.

This avoids having to modify any resource policies, IAM policies, or application references pointing to the Key ARN.

Determine how KMS decrypts historical data after a rotation event occurs.

AWS KMS retains the older versions of the backing key material.

This allows KMS to automatically select the correct historical key version when decrypting existing data, removing the need to re-encrypt existing storage volumes or objects.

Key Concept

AWS KMS Automatic Key Rotation Mechanics

Estimated Time:1m 30s

Question 1425Question →

A digital marketing agency with 250 employees uses Google Workspace as its central identity provider. The agency has recently adopted a multi-account AWS environment managed under AWS Organizations to isolate client projects. The agency's solutions architect must implement a single sign-on (SSO) solution that allows developers to access their respective AWS accounts using their Google Workspace credentials. The solution must minimize operational complexity, avoid managing separate IAM users, and automatically synchronize user accounts when developers join or leave the agency.

Which solution should the solutions architect recommend to meet these requirements?

Deploy an AWS Directory Service AD Connector in a central VPC, configure it to connect to the Google Workspace directory via LDAP, and map directory groups to IAM roles in each individual AWS account.

Enable and configure AWS IAM Identity Center, set Google Workspace as an external identity provider using SAML 2.0, and configure automatic provisioning using the System for Cross-domain Identity Management (SCIM) protocol.

Create individual IAM users for each developer in each of the client AWS accounts, generate long-term access keys, and configure a custom synchronization script using the Google Workspace Directory API.

Configure a SAML 2.0 identity provider in each client AWS account, map Google Workspace groups to IAM roles, and configure the AWS Organizations management account root user to authenticate federated requests.

Show answer & explanation

Answer: Enable and configure AWS IAM Identity Center, set Google Workspace as an external identity provider using SAML 2.0, and configure automatic provisioning using the System for Cross-domain Identity Management (SCIM) protocol.

Answer

AWS IAM Identity Center is the modern, recommended service for managing single sign-on access across a multi-account AWS environment. By integrating with Google Workspace as an external identity provider using SAML 2.0, developers can authenticate securely with their existing corporate credentials. Furthermore, configuring SCIM automatic provisioning automates user lifecycle management (creation, updates, and deletion), directly fulfilling the requirement to minimize operational complexity and automate user synchronization.

Step-by-Step Solution

Enable AWS IAM Identity Center in the AWS Organizations management account.

Centralized identity and access management is initialized across the entire multi-account environment.

This establishes a centralized management point for user access across all AWS accounts in the organization.

Configure SAML 2.0 federation between AWS IAM Identity Center and Google Workspace.

A trust relationship is established, allowing users to authenticate via their Google Workspace credentials.

SAML 2.0 enables secure single sign-on (SSO) federation, eliminating the need to manage duplicate passwords or long-term credentials in AWS.

Configure automatic user provisioning using the SCIM protocol between Google Workspace and AWS IAM Identity Center.

Users and groups are automatically synchronized from Google Workspace to AWS.

SCIM handles the lifecycle of users automatically, ensuring that when developers join or leave the agency, their AWS access is provisioned or revoked without manual intervention.

Key Concept

Centralized identity federation using AWS IAM Identity Center integrated with an external identity provider and automatic provisioning via SCIM.

Estimated Time:1m 30s

Question 1426Question →

An enterprise is migrating a containerized microservice backend to Amazon ECS on AWS Fargate. The Fargate tasks are launched in private subnets of a VPC and must securely download container images from Amazon Elastic Container Registry (ECR) without routing traffic over the public internet. The company security policy mandates that no internet gateway or NAT gateway should be configured in this VPC. Which combination of VPC network security components should the solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Create interface VPC endpoints for ECR and attach a security group to them that allows inbound HTTPS traffic from the Fargate tasks' security group.

Create a gateway VPC endpoint for Amazon S3 and associate it with the route tables of the private subnets containing the Fargate tasks.

Deploy a NAT Gateway in the private subnets and add a route pointing

0.0.0.0/0

to the NAT Gateway to route image download traffic.

Configure the Network ACLs of the private subnets to allow outbound traffic to

0.0.0.0/0

on port 443, and allow inbound ephemeral port traffic to ensure return traffic is not blocked.

Deploy AWS WAF in the private VPC subnets to inspect and authorize outbound HTTPS traffic directed to the ECR service endpoints.

Show answer & explanation

Answer: Create interface VPC endpoints for ECR and attach a security group to them that allows inbound HTTPS traffic from the Fargate tasks' security group.; Create a gateway VPC endpoint for Amazon S3 and associate it with the route tables of the private subnets containing the Fargate tasks.

Answer

Create interface VPC endpoints for ECR with a security group allowing HTTPS traffic from the Fargate tasks, and create a gateway VPC endpoint for Amazon S3 associated with the private subnet route tables.

To pull container images from Amazon ECR without sending traffic over the internet or using a NAT gateway, the VPC must connect privately to the AWS services. Interface VPC endpoints must be created for ECR (both the API and Docker registry endpoints), and their security groups must permit inbound HTTPS (port 443) traffic from the Fargate tasks. Because ECR stores image layers in S3, a gateway VPC endpoint for Amazon S3 must also be created and associated with the private subnet route tables to enable private download of the image layers.

Step-by-Step Solution

Determine the network path requirements for pulling container images privately.

Identify that ECS Fargate tasks need private access to the ECR API endpoints and the underlying S3 buckets where ECR stores its image layers.

Since the VPC is isolated (no NAT Gateway or Internet Gateway), all traffic to AWS services must remain inside the AWS private network.

Configure the ECR endpoints.

Establish interface VPC endpoints for ECR and attach a security group that permits HTTPS traffic from the container tasks.

Interface endpoints provide private IP addresses for the ECR registry and API, allowing secure communication via private DNS.

Configure the S3 endpoint for layer retrieval.

Create an S3 gateway VPC endpoint and attach it to the route tables of the Fargate subnets.

ECR layers are stored in S3. Without the S3 gateway endpoint, the Fargate tasks will fail to retrieve the image layers even if they can authenticate with ECR.

Key Concept

VPC Endpoints (Interface vs. Gateway) and Security Groups for private AWS service communication

Question 1427Question →

A company is deploying a containerized application on Amazon ECS that requires access to an Amazon RDS for MySQL database. The security policy mandates that the database credentials must be rotated automatically every 30 days, and the database storage must be encrypted at rest using an AWS KMS customer managed key that is rotated annually. The solutions architect must implement a solution that requires the least operational effort and does not interrupt application availability or require manual re-encryption of historical data. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Store the database credentials in AWS Secrets Manager, and configure automatic rotation with a schedule of 30 days using the built-in AWS Lambda rotation template.

Enable automatic key rotation on the customer managed key in AWS KMS to rotate the key material annually.

Store the database credentials in AWS Systems Manager Parameter Store as a standard String parameter, and create an Amazon EventBridge rule to run a script that updates the parameter value every 30 days.

Create a new KMS customer managed key every year, and configure a script to manually copy and re-encrypt all existing RDS snapshots and DB instances under the new key.

Enable automatic key rotation on the AWS managed key (aws/rds) for the RDS instance, and configure the rotation interval to 30 days to align with the credential rotation schedule.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager, and configure automatic rotation with a schedule of 30 days using the built-in AWS Lambda rotation template.; Enable automatic key rotation on the customer managed key in AWS KMS to rotate the key material annually.

Answer

Store the database credentials in AWS Secrets Manager with automatic 30-day rotation enabled, and enable automatic key rotation on the KMS customer managed key.

The correct solution involves storing sensitive database credentials in AWS Secrets Manager and enabling automatic rotation, which natively manages 30-day cycles using a Lambda function. Additionally, enabling automatic key rotation on the KMS customer managed key allows AWS to rotate the cryptographic material annually without disrupting access to historical data or requiring re-encryption.

Step-by-Step Solution

Select AWS Secrets Manager to store the database credentials securely, and configure its built-in rotation schedule to 30 days using the provided AWS Lambda rotation function.

Database credentials are automatically changed in both Secrets Manager and the RDS instance every 30 days without application downtime.

This satisfies the requirement for automatic, secure credential rotation with the least operational effort.

Enable automatic key rotation on the AWS KMS customer managed key used for encrypting the RDS storage.

The key material is rotated annually by AWS KMS while keeping all historical versions active.

This satisfies the annual rotation requirement without needing manual re-encryption of existing data or snapshots, ensuring high availability.

Key Concept

AWS KMS customer managed key automatic rotation mechanics and AWS Secrets Manager integration for secure, automated credential rotation.

Estimated Time:2m 30s

Question 1428Question →

A company is deploying a new web application on Amazon EC2 instances. The application requires access to a database password and must encrypt configuration files at rest using an AWS Key Management Service (AWS KMS) customer managed key (CMK). The security team requires that the database password be stored securely, the CMK automatically rotate every year, and historical files encrypted with the CMK remain decryptable without manual key management or re-encryption. Which configuration meets these requirements with the least operational overhead?

Store the database password in AWS Secrets Manager. Enable automatic rotation on the KMS customer managed key (CMK).

Store the database password as a String parameter in AWS Systems Manager Parameter Store. Enable automatic rotation on the KMS customer managed key (CMK), and write a script to re-encrypt all historical files with the new backing key after rotation.

Store the database password in AWS Secrets Manager. Use the AWS account root user to manually delete the previous backing key version after rotation to ensure only the newest backing key is active.

Store the database password in AWS Systems Manager Parameter Store as a SecureString. Disable automatic key rotation, manually create a new customer managed key (CMK) each year, delete the old CMK, and update the application configuration with the new CMK ARN.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager. Enable automatic rotation on the KMS customer managed key (CMK).

Answer

Store the database password in AWS Secrets Manager, and enable automatic rotation on the KMS customer managed key (CMK).

Storing the database password in AWS Secrets Manager satisfies the requirement for secure credential storage. Enabling automatic key rotation on the KMS customer managed key (CMK) automatically creates a new backing key every year while preserving the previous backing key versions. This allows the application to seamlessly decrypt older files without manual intervention, script execution, or code changes.

Step-by-Step Solution

Select a secure storage mechanism for the database password.

AWS Secrets Manager is selected to securely store the database password.

Secrets Manager encrypts secrets at rest and supports automatic rotation, unlike standard String parameters in Systems Manager Parameter Store which store secrets in plaintext.

Configure key rotation for the customer managed key (CMK).

Enable automatic key rotation for the KMS CMK.

Enabling automatic key rotation provides hands-off key management where AWS KMS generates a new backing key every year.

Evaluate decryption requirements for historical data.

Confirm that KMS transparently retains previous backing key versions.

When automatic key rotation is enabled, AWS KMS keeps all older backing key versions active for decryption. There is no need to re-encrypt old data or update application code with new CMK ARNs.

Key Concept

AWS KMS Automatic Key Rotation and Secrets Management

Question 1429Question →

A biotechnology enterprise needs to grant its laboratory researchers single sign-on (SSO) access to multiple AWS accounts and several external third-party SaaS applications. The researchers currently authenticate using an on-premises Active Directory. The proposed architecture must minimize operational overhead, avoid replicating user passwords to the cloud, and enforce centralized access management. Which configuration meets these requirements?

Enable AWS IAM Identity Center, connect it to the on-premises Active Directory using an AD Connector, and integrate both the AWS accounts and the SaaS applications with IAM Identity Center.

Create individual IAM users in each AWS account for the laboratory researchers, configure their access permissions manually, and instruct them to use these credentials along with their Active Directory logins.

Access the AWS management console using the root user credentials of each AWS account to configure individual SAML 2.0 federation endpoints directly linked to the on-premises Active Directory.

Deploy an authentication portal on Amazon EC2 that queries the on-premises Active Directory, storing the Active Directory service account password as a plain text string parameter in Systems Manager Parameter Store.

Show answer & explanation

Answer: Enable AWS IAM Identity Center, connect it to the on-premises Active Directory using an AD Connector, and integrate both the AWS accounts and the SaaS applications with IAM Identity Center.

Answer

Enable AWS IAM Identity Center, connect it to the on-premises Active Directory using an AD Connector, and integrate both the AWS accounts and the SaaS applications with IAM Identity Center.

Connecting AWS IAM Identity Center to the on-premises Active Directory via AD Connector provides centralized authentication without replicating password data. Furthermore, IAM Identity Center natively supports single sign-on (SSO) to both AWS accounts and SaaS applications, meeting all design constraints while keeping operational overhead low.

Step-by-Step Solution

Connect on-premises Active Directory to AWS.

Use an AD Connector to redirect directory requests to the on-premises Active Directory without copying password data to AWS.

This satisfies the requirement to avoid replicating user credentials to the cloud.

Enable AWS IAM Identity Center.

Configure IAM Identity Center to use the Active Directory connection as its identity source.

This provides a centralized location to manage portal access, single sign-on, and permissions.

Integrate target systems.

Assign access to AWS accounts and register third-party SaaS applications within the IAM Identity Center application catalog.

This fulfills the SSO requirement for both cloud infrastructure and external software, minimizing administrative overhead.

Key Concept

Centralized multi-account and SaaS identity federation using AWS IAM Identity Center connected to on-premises Active Directory via AD Connector.

Estimated Time:1m 30s

Question 1430Question →

An application running on Amazon EC2 instances in a private subnet needs to read and write sensitive data to a specific Amazon S3 bucket. The company's security policy requires that all traffic to Amazon S3 must remain within the AWS network. Additionally, to prevent data exfiltration, the EC2 instances must be blocked from accessing any other Amazon S3 buckets, including those in other AWS accounts.

Which solution should a solutions architect implement to meet these requirements?

Create a gateway VPC endpoint for Amazon S3. Attach an endpoint policy to the gateway endpoint that allows actions only on the specific S3 bucket. Update the route table of the private subnet to direct S3 traffic through the gateway endpoint.

Create a gateway VPC endpoint for Amazon S3. Configure the private subnet's Network ACL with an outbound rule that allows traffic only to the Amazon Resource Name (ARN) of the specific S3 bucket.

Deploy a NAT Gateway in a public subnet, and configure the private subnet's route table to send S3 traffic to the NAT Gateway. Attach an IAM role to the EC2 instances that restricts S3 access to the specific bucket.

Create an interface VPC endpoint for Amazon S3. Associate an AWS WAF web ACL with the interface endpoint, and configure a rule to block S3 requests that target unauthorized bucket names.

Show answer & explanation

Answer: Create a gateway VPC endpoint for Amazon S3. Attach an endpoint policy to the gateway endpoint that allows actions only on the specific S3 bucket. Update the route table of the private subnet to direct S3 traffic through the gateway endpoint.

Answer

Create a gateway VPC endpoint for Amazon S3, attach a restricted VPC endpoint policy, and update the private subnet's route table.

The correct solution involves deploying a gateway VPC endpoint for Amazon S3, attaching a VPC endpoint policy that limits access to only the specific bucket, and routing S3 traffic through this endpoint by updating the private subnet route table. This ensures the traffic does not traverse the public internet and effectively prevents data exfiltration to unauthorized buckets.

Step-by-Step Solution

Create a Gateway VPC Endpoint for Amazon S3 in the VPC.

The VPC endpoint provides private connectivity to S3 without requiring an internet gateway or NAT gateway.

This satisfies the requirement that all traffic to Amazon S3 must remain within the AWS network.

Attach a custom VPC endpoint policy to the Gateway VPC Endpoint.

The policy restricts the endpoint to only allow actions targeting the specific S3 bucket.

This prevents data exfiltration by blocking the instances from accessing any other S3 buckets, even if they are in other AWS accounts.

Update the route table of the private subnet to include a route pointing to the Gateway VPC Endpoint.

Traffic destined for S3 from the private subnet is automatically routed through the gateway endpoint.

This establishes the routing rule required for the EC2 instances in the private subnet to use the gateway endpoint.

Key Concept

VPC Endpoint Routing and Policies for Data Exfiltration Prevention

Question 1431Question →

A company is designing a serverless application using AWS Lambda that needs to retrieve a database password to access an Amazon RDS DB instance. The company also uses an AWS Key Management Service (AWS KMS) customer managed key to encrypt sensitive configuration files stored in Amazon S3. The security team requires that the database password be rotated every 30 days and the KMS key be rotated annually, while ensuring that all historically encrypted data remains accessible.

Which of the following actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Store the database password in AWS Secrets Manager and configure automatic rotation for the secret every 30 days using an AWS Lambda function.

Enable automatic key rotation on the KMS customer managed key, which creates a new key version annually and retains older versions to decrypt existing data.

Store the database password as a plain String parameter in AWS Systems Manager Parameter Store and enable automatic version rotation.

Enable automatic key rotation for the customer managed key, and run a scheduled script to decrypt and re-encrypt all S3 objects using the new key version immediately after rotation.

Store the database password in AWS Systems Manager Parameter Store as a SecureString, and delete the previous versions of the KMS key annually after rotating the key to ensure compliance.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and configure automatic rotation for the secret every 30 days using an AWS Lambda function.; Enable automatic key rotation on the KMS customer managed key, which creates a new key version annually and retains older versions to decrypt existing data.

Answer

Store the database password in AWS Secrets Manager with automatic 30-day rotation, and enable automatic key rotation on the customer managed key to rotate key material annually while retaining older versions.

The correct architecture stores the database password in AWS Secrets Manager with automated rotation via an AWS Lambda function, and enables automatic key rotation on the customer managed key. Secrets Manager secure storage prevents exposure of credentials and automates rotation. KMS automatic key rotation creates a new key version annually but preserves all previous key material, allowing transparent decryption of existing files without manual re-encryption.

Step-by-Step Solution

Select the secure storage and rotation mechanism for database credentials.

Determine that AWS Secrets Manager should be used for the database password, as it natively supports automatic rotation every 30 days using AWS Lambda.

AWS Secrets Manager is built for database secrets and integrates with RDS for automated rotation, whereas Systems Manager Parameter Store String parameters expose secrets in plaintext.

Select the rotation mechanism for the customer managed key that preserves decryptability of historical data.

Enable AWS KMS automatic key rotation for the customer managed key.

KMS automatic key rotation generates new key material annually but keeps older versions active so that existing encrypted objects can be decrypted transparently without manual re-encryption or key deletion.

Key Concept

AWS KMS key rotation mechanisms and AWS Secrets Manager credential rotation

Question 1432Question →

A solutions architect is configuring network security for a database migration. An application running on Amazon EC2 instances in Subnet A ( $10.0.1.0/24$ ) must connect to an Amazon RDS for PostgreSQL database located in Subnet B ( $10.0.2.0/24$ ) within the same VPC. The company's security policy requires the use of Network Access Control Lists (Network ACLs) with a strict default-deny rule for both inbound and outbound traffic on all subnets. Which of the following Network ACL configurations will allow the application to connect to the database on the default PostgreSQL port while maintaining least privilege?

Configure the Network ACL for Subnet A to allow outbound traffic to Subnet B (

10.0.2.0/24

) on TCP port 5432 and inbound traffic from Subnet B (

10.0.2.0/24

) on TCP ports 1024–65535. Configure the Network ACL for Subnet B to allow inbound traffic from Subnet A (

10.0.1.0/24

) on TCP port 5432 and outbound traffic to Subnet A (

10.0.1.0/24

) on TCP ports 1024–65535.

Configure the Network ACL for Subnet A to allow outbound traffic to Subnet B (

10.0.2.0/24

) on TCP port 5432. Configure the Network ACL for Subnet B to allow inbound traffic from Subnet A (

10.0.1.0/24

) on TCP port 5432.

Configure the Network ACL for Subnet A to allow outbound traffic to Subnet B (

10.0.2.0/24

) on TCP port 5432 and inbound traffic from Subnet B (

10.0.2.0/24

) on TCP port 5432. Configure the Network ACL for Subnet B to allow inbound traffic from Subnet A (

10.0.1.0/24

) on TCP port 5432 and outbound traffic to Subnet A (

10.0.1.0/24

) on TCP port 5432.

Configure the Network ACL for Subnet A to allow outbound traffic to the security group of the database on TCP port 5432. Configure the Network ACL for Subnet B to allow inbound traffic from the security group of the EC2 instances on TCP port 5432.

Show answer & explanation

Answer: Configure the Network ACL for Subnet A to allow outbound traffic to Subnet B ( $10.0.2.0/24$ ) on TCP port 5432 and inbound traffic from Subnet B ( $10.0.2.0/24$ ) on TCP ports 1024–65535. Configure the Network ACL for Subnet B to allow inbound traffic from Subnet A ( $10.0.1.0/24$ ) on TCP port 5432 and outbound traffic to Subnet A ( $10.0.1.0/24$ ) on TCP ports 1024–65535.

Answer

Configure the Network ACL for Subnet A to allow outbound traffic to Subnet B on TCP port 5432 and inbound traffic from Subnet B on TCP ports 1024–65535, and configure the Network ACL for Subnet B to allow inbound traffic from Subnet A on TCP port 5432 and outbound traffic to Subnet A on TCP ports 1024–65535.

The correct configuration acknowledges that Network ACLs are stateless and require rules for both inbound and outbound traffic. Because a client initiates a connection to the PostgreSQL database on TCP port 5432 using an ephemeral source port, the network path must allow outbound traffic on destination port 5432 from the client subnet and inbound traffic on the same port at the database subnet. To allow the response, the database subnet must allow outbound traffic to the ephemeral port range (

1024

–

65535

) and the client subnet must allow inbound traffic on those same ports.

Step-by-Step Solution

Determine client-to-server traffic requirements.

Subnet A (client) must allow outbound TCP traffic to Subnet B (server) CIDR on the destination port 5432. Subnet B must allow inbound TCP traffic from Subnet A CIDR on destination port 5432.

This establishes the forward connection path from the application to the database.

Determine server-to-client return traffic requirements considering statelessness.

Subnet B must allow outbound TCP traffic to Subnet A CIDR on destination ephemeral ports (1024–65535). Subnet A must allow inbound TCP traffic from Subnet B CIDR on destination ephemeral ports (1024–65535).

Since Network ACLs are stateless, return traffic is not tracked automatically and must be explicitly allowed on the ephemeral ports allocated by the client OS.

Key Concept

Statelessness of Network Access Control Lists (NACLs) and the requirement of ephemeral port ranges for return traffic.

Question 1433Question →

A global consulting firm is establishing a multi-account environment in AWS Organizations. The firm wants to grant its consultants access to client-specific AWS accounts. The firm manages its employee identities in an on-premises Active Directory. The solution must support single sign-on (SSO), minimize administrative overhead, and avoid replicating user credentials or passwords to AWS.

Which combination of actions should a solutions architect recommend to meet these requirements? (Select two.)

Select all that apply

Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using an AWS Directory Service AD Connector.

Create permission sets in AWS IAM Identity Center and map them to Active Directory groups to control access to specific AWS accounts.

Create individual IAM users in each AWS account for all consultants and synchronize their passwords using a custom scheduled script.

Log in to the AWS account root user of each client account to manually configure cross-account IAM trust relationships and access keys for the consultants.

Deploy AWS Managed Microsoft AD in AWS and configure a synchronization script to replicate all on-premises Active Directory user accounts and passwords directly to AWS.

Show answer & explanation

Answer: Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using an AWS Directory Service AD Connector.; Create permission sets in AWS IAM Identity Center and map them to Active Directory groups to control access to specific AWS accounts.

Answer

Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using an AWS Directory Service AD Connector, and create permission sets in AWS IAM Identity Center and map them to Active Directory groups to control access.

Connecting AWS IAM Identity Center to the on-premises Active Directory using an AD Connector provides a seamless directory gateway that forwards authentication requests to the on-premises directory, satisfying the requirements to avoid password replication and minimize operational overhead. Creating permission sets in AWS IAM Identity Center and mapping them to Active Directory groups allows centralized, role-based access control across multiple AWS accounts.

Step-by-Step Solution

Select the identity source in AWS IAM Identity Center.

AWS IAM Identity Center is configured to use an external identity provider or directory.

This establishes a centralized single sign-on mechanism for the multi-account AWS environment.

Connect the on-premises Active Directory using AWS Directory Service AD Connector.

Authentication requests are redirected to the on-premises Active Directory without copying credentials.

Using AD Connector avoids password replication and minimizes operational overhead by acting as a directory gateway.

Create permission sets in AWS IAM Identity Center and map them to Active Directory groups.

Consultants are granted access to specific AWS accounts based on their existing group memberships.

This automates user provisioning and ensures least-privilege access is maintained dynamically.

Key Concept

Centralized identity federation using AWS IAM Identity Center and AD Connector to federate on-premises directory users without password replication.

Question 1434Question →

A company stores large archives in an Amazon S3 bucket. The data is encrypted at rest using an AWS KMS Customer Managed Key (CMK). A new compliance policy requires that the encryption keys be rotated annually. The security team wants to ensure that all historical data remains readable without manual intervention, while new data is encrypted using the rotated key material.

Which configuration meets these requirements with the least administrative effort?

Create a new Customer Managed Key annually, associate it with the S3 bucket, and delete the older Customer Managed Key to reduce key management costs.

Enable automatic key rotation for the existing Customer Managed Key.

Export the KMS key material, store it as a plaintext String parameter in AWS Systems Manager Parameter Store, and use an AWS Lambda function to rotate it annually.

Manually create a new Customer Managed Key each year, update the S3 bucket configuration, and re-encrypt all historical data using S3 Batch Operations.

Show answer & explanation

Answer: Enable automatic key rotation for the existing Customer Managed Key.

Answer

Enable automatic key rotation for the existing Customer Managed Key.

Enabling automatic key rotation on an AWS KMS Customer Managed Key (CMK) automatically schedules rotation of the backing key material once a year. When this occurs, AWS KMS keeps all older key material active so it can decrypt any historical ciphertexts. Newly written files will automatically be encrypted using the newly generated key material. This achieves compliance with zero management overhead and zero downtime.

Step-by-Step Solution

Identify the primary requirement for annual rotation of a Customer Managed Key (CMK) in AWS KMS.

The requirement is to rotate the key annually, ensure historical data remains readable, and minimize administrative overhead.

Establishing the objective allows selecting the solution with the lowest management overhead and highest compliance.

Evaluate the native rotation mechanism of AWS KMS Customer Managed Keys.

Enabling automatic key rotation on a CMK generates a new key version annually. AWS KMS retains older key material indefinitely to decrypt historical ciphertexts automatically.

This shows that re-encryption of historical data or updating the bucket configurations is not required.

Compare against options involving manual rotation, deletion, and Parameter Store.

Deleting old keys causes data loss, manually re-encrypting historical data introduces high cost and complexity, and exporting key material to plaintext Parameter Store parameters introduces major security risks.

By eliminating complex or insecure workarounds, the native KMS automatic rotation is confirmed as the correct path.

Key Concept

AWS KMS Automatic Key Rotation

Estimated Time:1m 30s

Question 1435Question →

A media production company uses PingFederate as its central Identity Provider (IdP). The company is setting up a multi-account structure in AWS Organizations and wants to enable its remote editors to log in to specific AWS accounts using their existing corporate credentials. The solution must support central permissions management and automatically synchronize user accounts and group memberships from PingFederate to AWS without manual user creation.

Which combination of actions should a solutions architect perform to meet these requirements? (Select two.)

Select all that apply

Configure SAML 2.0 federation between PingFederate and AWS IAM Identity Center by exchanging metadata.

Enable System for Cross-domain Identity Management (SCIM) provisioning in AWS IAM Identity Center, and configure the SCIM endpoint and access token in PingFederate.

Create individual IAM users in each AWS member account and configure cross-account IAM role assumptions for federated access.

Provision an AWS Directory Service AD Connector to establish a trust relationship between PingFederate and AWS Organizations.

Log in as the AWS Organizations management account root user to configure individual IAM role trust policies for each user in PingFederate.

Show answer & explanation

Answer: Configure SAML 2.0 federation between PingFederate and AWS IAM Identity Center by exchanging metadata.; Enable System for Cross-domain Identity Management (SCIM) provisioning in AWS IAM Identity Center, and configure the SCIM endpoint and access token in PingFederate.

Answer

Configure SAML 2.0 federation between PingFederate and AWS IAM Identity Center by exchanging metadata, and enable System for Cross-domain Identity Management (SCIM) provisioning in AWS IAM Identity Center and configure the SCIM endpoint and access token in PingFederate.

To integrate an external Identity Provider (IdP) like PingFederate with AWS IAM Identity Center, you first establish federated single sign-on (SSO) trust by exchanging SAML 2.0 metadata between the provider and AWS. To automate user and group provisioning without manual setup, you enable SCIM in AWS IAM Identity Center and configure the SCIM endpoint and bearer token in PingFederate to sync directory changes automatically.

Step-by-Step Solution

Establish a SAML 2.0 trust relationship

Federated authentication is enabled between PingFederate and AWS IAM Identity Center by exchanging the metadata XML files.

This allows remote editors to authenticate using their existing corporate credentials.

Enable and configure SCIM provisioning

Automatic identity synchronization is established using the SCIM endpoint URL and bearer token provided by AWS IAM Identity Center.

This automates user and group management without requiring manual user creation or custom replication scripts.

Key Concept

Centralized identity federation and automatic provisioning using AWS IAM Identity Center with SAML 2.0 and SCIM.

Question 1436Question →

A logistics company is designing a security architecture for its new multi-account AWS environment managed by AWS Organizations. The company manages all corporate identities in an on-premises Microsoft Active Directory. The security team wants to grant employees single sign-on (SSO) access to the AWS Management Console. The solution must authenticate users against the on-premises directory without replicating any Active Directory data to AWS, must avoid the creation of individual IAM users, and must minimize administrative effort. Which solution meets these requirements?

Configure AWS IAM Identity Center and connect it to the on-premises directory by deploying an AD Connector.

Create individual IAM users in each AWS account corresponding to Active Directory identities, and use an automation script to synchronize passwords.

Deploy AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) and configure a synchronization agent to replicate Active Directory credentials to AWS.

Set up SAML 2.0 federation in each AWS account using the AWS account root user to import metadata and establish role-mapping policies.

Show answer & explanation

Answer: Configure AWS IAM Identity Center and connect it to the on-premises directory by deploying an AD Connector.

Answer

Configure AWS IAM Identity Center and connect it to the on-premises directory by deploying an AD Connector.

Deploying an AD Connector as a proxy between AWS IAM Identity Center and the on-premises Microsoft Active Directory satisfies all security and operational requirements. AD Connector redirects authentication requests directly to the on-premises domain controllers, ensuring that directory data is never replicated to the cloud. AWS IAM Identity Center provides centralized single sign-on access control across all accounts within the AWS Organizations structure, eliminating the need to manage individual IAM users or credentials.

Step-by-Step Solution

Analyze directory replication constraints.

Identify that AD Connector is the only directory gateway service that acts as a proxy/redirector without replicating or caching Active Directory database data in the AWS cloud.

The scenario requires that no Active Directory data is replicated to AWS.

Select the centralized authentication interface for multiple AWS accounts.

Choose AWS IAM Identity Center (formerly AWS Single Sign-On) integrated with the AD Connector.

This centralizes user access management across the AWS Organizations multi-account structure, avoiding the need to configure federation or IAM users in each individual account.

Key Concept

Federating on-premises Active Directory to AWS Organizations using AD Connector and AWS IAM Identity Center to prevent data replication and minimize management overhead.

Estimated Time:1m 30s

Question 1437Question →

A company is deploying an application on Amazon ECS using AWS Fargate within private subnets of a VPC. The application needs to retrieve sensitive configuration data from AWS Systems Manager Parameter Store. Due to strict security policies, the VPC does not have an internet gateway or a NAT gateway, and all traffic must remain within the AWS network. A solutions architect creates interface VPC endpoints for Systems Manager in the private subnets. However, the ECS tasks are failing to retrieve the configuration data. Which network security configuration is required to resolve this issue while maintaining the principle of least privilege?

Configure the security group attached to the interface VPC endpoints to allow inbound HTTPS traffic on port 443 from the security group attached to the ECS tasks.

Add an outbound rule to the private subnet's Network ACL to allow TCP traffic on port 443 to the interface VPC endpoint's subnet, without adding a corresponding inbound rule for return traffic.

Add a route to the private subnet's route table directing all traffic destined for the Systems Manager service to the interface VPC endpoint ID as the target.

Attach an AWS WAF web ACL directly to the interface VPC endpoint to inspect and authorize the inbound HTTPS traffic from the ECS tasks.

Show answer & explanation

Answer: Configure the security group attached to the interface VPC endpoints to allow inbound HTTPS traffic on port 443 from the security group attached to the ECS tasks.

Answer

Configure the security group attached to the interface VPC endpoints to allow inbound HTTPS traffic on port 443 from the security group attached to the ECS tasks.

The correct configuration is to modify the security group attached to the interface VPC endpoint (which creates ENIs in the private subnets) to permit inbound HTTPS (port 443) traffic originating from the security group of the ECS Fargate tasks. Because security groups are stateful, this rule automatically allows the return traffic back to the ECS tasks.

Step-by-Step Solution

Analyze how AWS Fargate tasks resolve and connect to AWS Systems Manager in a private VPC without internet access.

The Fargate tasks use private DNS associated with the interface VPC endpoints to resolve the Systems Manager service endpoint to the private IP addresses of the endpoint's elastic network interfaces (ENIs).

Since there is no internet gateway or NAT gateway, all traffic must remain within the VPC using PrivateLink.

Determine the firewall requirements for the interface VPC endpoint ENIs.

The security group associated with the interface VPC endpoint must allow inbound traffic on port 443 (HTTPS) because Systems Manager APIs are HTTPS-based.

Security groups are stateful and act at the instance/ENI level, controlling incoming traffic to the endpoint.

Apply the principle of least privilege to the inbound rule.

Restrict the source of the inbound HTTPS rule on the endpoint's security group to the security group of the ECS Fargate tasks.

This ensures only authorized container tasks can access the Systems Manager Parameter Store via the endpoint.

Key Concept

Interface VPC Endpoints (AWS PrivateLink) require appropriate security group configurations to allow inbound traffic from the client resources. Unlike Gateway Endpoints, they do not use route tables; they rely on DNS resolution and stateful security groups.

Estimated Time:1m 30s

Question 1438Question →

A solutions architect is designing the network security for a new application running on Amazon EC2 instances in private subnets. The application must download configuration objects from Amazon S3 and publish event messages to Amazon Simple Notification Service (Amazon SNS). The company’s security policy strictly prohibits the private subnets from having any routing to the public internet, including through NAT gateways. Which combination of steps should the solutions architect take to securely establish this connectivity? (Select TWO.)

Select all that apply

Create a gateway VPC endpoint for Amazon S3, and associate it with the route tables of the private subnets.

Create an interface VPC endpoint for Amazon SNS, and configure the security group of the SNS endpoint to allow inbound HTTPS traffic on TCP port

443

from the EC2 instances' security group.

Deploy a NAT gateway in a public subnet, and configure the route tables of the private subnets to route all Amazon S3 traffic through the NAT gateway.

Create a gateway VPC endpoint for Amazon SNS, and configure the private subnets' network ACL to allow outbound traffic to the endpoint on port

80

Create an interface VPC endpoint for Amazon S3, and configure the private subnets' network ACL to allow inbound and outbound traffic to the endpoint on port

80

since network ACLs are stateful.

Show answer & explanation

Answer: Create a gateway VPC endpoint for Amazon S3, and associate it with the route tables of the private subnets.; Create an interface VPC endpoint for Amazon SNS, and configure the security group of the SNS endpoint to allow inbound HTTPS traffic on TCP port $443$ from the EC2 instances' security group.

Answer

The correct steps are to create a gateway VPC endpoint for Amazon S3 and associate it with the private subnet route tables, and to create an interface VPC endpoint for Amazon SNS with its security group configured to allow inbound HTTPS traffic on TCP port

443

from the EC2 instances.

To satisfy the security requirement of accessing Amazon S3 and Amazon SNS without internet routing (including NAT gateways), VPC endpoints must be used. For Amazon S3, a Gateway VPC endpoint is created and associated with the route tables of the private subnets. For Amazon SNS, an Interface VPC endpoint (AWS PrivateLink) is deployed, which assigns a private IP address within the subnet to the service. The interface endpoint is secured with a security group that must allow inbound HTTPS traffic on port

443

from the EC2 instances.

Step-by-Step Solution

Identify the endpoint type required for Amazon S3.

Determine that Amazon S3 supports Gateway VPC endpoints, which are free of charge and integrate directly with route tables.

VPC Gateway endpoints are the standard, secure, and cost-effective way to access Amazon S3 from private subnets without public internet routing.

Identify the endpoint type required for Amazon SNS.

Determine that Amazon SNS only supports Interface VPC endpoints (AWS PrivateLink).

AWS PrivateLink exposes the service as an Elastic Network Interface (ENI) within the subnet with a private IP address.

Configure the security controls for the Interface endpoint.

Configure the security group attached to the Amazon SNS Interface endpoint to allow inbound traffic on TCP port

443

(HTTPS) from the security group of the EC2 instances.

Interface endpoints use security groups for stateful access control, and communications to AWS APIs are conducted over HTTPS.

Key Concept

VPC Endpoints and Security Group Management

Estimated Time:2m 0s

Question 1439Question →

A company is deploying a three-tier web application on Amazon EC2 instances. The application needs to retrieve a database password to connect to an Amazon RDS DB instance, as well as an external API key that does not support automated rotation. Security requirements dictate that all credentials must be encrypted at rest, and the database password must be rotated every 30 days.

Which solution meets these requirements with the least administrative effort?

Store the database password in AWS Secrets Manager. Enable automatic rotation on the associated KMS customer managed key, which will automatically rotate the database credentials and re-encrypt the database table contents every 30 days.

Store the database password in AWS Secrets Manager and enable automatic rotation every 30 days using the built-in integration for Amazon RDS. Store the external API key as a SecureString parameter in AWS Systems Manager Parameter Store.

Store both the database password and the external API key as standard String parameters in AWS Systems Manager Parameter Store to simplify credential retrieval and reduce costs.

Store the database password in an Amazon S3 bucket with default encryption using an AWS KMS key. Enable automatic KMS key rotation on the customer managed key to automatically re-encrypt the existing credentials file with a new key version every 30 days.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and enable automatic rotation every 30 days using the built-in integration for Amazon RDS. Store the external API key as a SecureString parameter in AWS Systems Manager Parameter Store.

Answer

Store the database password in AWS Secrets Manager with automatic RDS rotation, and store the API key as a SecureString parameter in Systems Manager Parameter Store.

The correct solution stores the database password in AWS Secrets Manager because it has built-in integration to automatically rotate RDS credentials. The external API key is stored as a SecureString parameter in Systems Manager Parameter Store, which encrypts the value at rest using AWS KMS, meeting all security requirements with the least operational effort.

Step-by-Step Solution

Analyze the requirements for the database credentials.

The database password needs to be encrypted at rest and rotated every 30 days. AWS Secrets Manager offers native, automated integration to rotate database credentials for Amazon RDS instances.

Secrets Manager can automatically manage the lifecycle of database secrets without writing custom rotation logic, reducing operational overhead.

Analyze the requirements for the external API key.

The API key must be encrypted at rest but does not require rotation. AWS Systems Manager Parameter Store using the SecureString parameter type can encrypt the parameter using AWS KMS.

SecureString parameters provide a cost-effective, secure storage mechanism for secrets that do not require lifecycle management or automatic rotation.

Evaluate KMS key rotation behavior versus credential rotation.

Confirm that KMS key rotation only affects the backing key material used to generate new data keys and does not rotate the actual database password or update database user accounts.

Understanding key rotation mechanics prevents the misconception that key rotation solves application-level credential rotation.

Key Concept

Distinction between AWS Secrets Manager and Systems Manager Parameter Store, and the operational behavior of KMS key rotation vs credential rotation.

Question 1440Question →

A company's backend application runs on Amazon EC2 instances inside a private subnet. The application is required to call a partner's external API endpoint at a static public IP address ( $203.0.113.50$ ) using HTTPS. The private subnet is associated with a custom network ACL (NACL) that currently denies all inbound and outbound traffic. The security groups associated with the EC2 instances already allow all outbound HTTPS traffic.

Which configuration of rules must be added to the custom NACL to allow the EC2 instances to successfully establish connections to the external API?

An outbound rule allowing traffic to destination

203.0.113.50/32

on TCP port

443

. No inbound rule is required because network ACLs automatically allow return traffic for established connections.

An outbound rule allowing traffic to destination

203.0.113.50/32

on TCP port

443

, and an inbound rule allowing traffic from source

203.0.113.50/32

on TCP port

443

An outbound rule allowing traffic to destination

203.0.113.50/32

on TCP port

443

, and an inbound rule allowing traffic from source

203.0.113.50/32

on TCP ports

1024-65535

An outbound rule allowing traffic to destination

203.0.113.50/32

on TCP ports

1024-65535

, and an inbound rule allowing traffic from source

203.0.113.50/32

on TCP port

443

Show answer & explanation

Answer: An outbound rule allowing traffic to destination $203.0.113.50/32$ on TCP port $443$ , and an inbound rule allowing traffic from source $203.0.113.50/32$ on TCP ports $1024-65535$ .

Answer

An outbound rule allowing traffic to destination

203.0.113.50/32

on TCP port

443

, and an inbound rule allowing traffic from source

203.0.113.50/32

on TCP ports

1024-65535

The correct configuration requires allowing outbound traffic to the destination IP address on TCP port

443

, because the EC2 instances are initiating HTTPS requests. Since network ACLs are stateless, they do not automatically track connections or allow return traffic. Therefore, an inbound rule is also required. This inbound rule must allow traffic from the partner's IP address (acting as the source) on TCP source port

443

returning to the EC2 instances' ephemeral destination ports (TCP

1024-65535

Step-by-Step Solution

Analyze the direction and target ports of the initial request.

The EC2 instances initiate outbound HTTPS connections. This requires an outbound NACL rule allowing traffic to the destination IP address

203.0.113.50/32

on destination TCP port

443

Network ACLs are stateless, so both the initiating request and the return response must be explicitly permitted by distinct rules.

Determine the destination ports for the returning network traffic.

When a client initiates a TCP connection, the operating system allocates an ephemeral source port from the range

1024-65535

. The remote server sends the response back to this ephemeral port.

To allow the response to enter the subnet, an inbound NACL rule must permit traffic from the source IP address

203.0.113.50/32

originating from source port

443

and targeting the destination ephemeral port range

1024-65535

on the EC2 instances.

Combine the rules to form the complete stateless configuration.

The final network ACL configuration must contain the outbound port

443

rule and the inbound ephemeral ports rule.

Without both rules, either the connection request will be blocked on egress, or the return response will be blocked on ingress.

Key Concept

Stateless Network ACLs and Ephemeral Ports

Estimated Time:1m 30s

PreviousPage 72 / 74Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept