Examkin

Design Secure Architectures

438 questions

All types438Multiple choice214Multiple select224
Question 181Question →

A solutions architect is configuring a security group for an Amazon EC2 instance that hosts a simple web server. The architect adds an inbound rule to allow TCP traffic on port 8080 from any source (0.0.0.0/00.0.0.0/0). What outbound rule must the solutions architect add to the security group to allow the HTTP response traffic to reach the clients?

Show answer & explanation

Answer: No outbound rule is required because security groups are stateful, meaning return traffic is automatically allowed.

Answer

No outbound rule is required because security groups are stateful, meaning return traffic is automatically allowed.
Security groups in AWS VPCs are stateful. When you create an inbound rule to allow traffic on a specific port (like port 8080), the security group automatically tracks the connection state and allows the return response traffic to flow outbound to the client. No corresponding outbound rule is required.

Step-by-Step Solution

1
Identify the type of firewalls being configured.
The architect is configuring an AWS Security Group at the EC2 instance level.
Determining the security resource type is critical because Security Groups and Network ACLs exhibit different connection-tracking behaviors.
2
Apply the stateful connection-tracking behavior of Security Groups.
Security groups are stateful. Once inbound traffic is allowed on port 8080, return traffic is automatically permitted.
This explains why no outbound rule is necessary to send responses back to the clients.

Key Concept

AWS Security Groups are stateful firewalls that operate at the instance level. They automatically track connection states and allow return traffic without requiring matching outbound rules.
Question 182Question →

A solutions architect is configuring network security for a standard multi-tier application within an Amazon VPC. The architect needs to establish the proper boundaries using Security Groups and Network Access Control Lists (Network ACLs). Which of the following statements correctly describe the characteristics of Security Groups and Network ACLs? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Security groups are stateful, so allowed inbound traffic automatically permits return outbound traffic.; Network ACLs are stateless, meaning both inbound and outbound traffic must be explicitly allowed.

Answer

Security groups are stateful, so allowed inbound traffic automatically permits return outbound traffic, and Network ACLs are stateless, meaning both inbound and outbound traffic must be explicitly allowed.
Security groups are stateful, which means any traffic allowed inbound is automatically allowed to return outbound, regardless of outbound rules. Network ACLs are stateless, meaning they evaluate traffic inbound and outbound independently, requiring explicit rules in both directions.

Step-by-Step Solution

1
Analyze the statefulness of Security Groups and Network ACLs.
Security groups are stateful (inbound allows outbound response), whereas Network ACLs are stateless (both directions require rules).
This establishes the basic traffic evaluation behavior of the two network security layers.
2
Analyze the scope of application for each component.
Security groups apply at the instance or Elastic Network Interface (ENI) level. Network ACLs apply at the subnet boundary level.
This determines where the traffic filtering takes place in the VPC topology.
3
Evaluate rule processing methods.
Security groups evaluate all rules together, allowing traffic if any rule matches. Network ACLs evaluate rules in numerical order, applying the first match.
This clarifies how rules are matched and executed for both controls.

Key Concept

VPC Network Security layer differences (Security Groups vs Network ACLs)
Question 183Question →

A company is hosting a secure data processing application on Amazon EC2 instances in a private subnet (Subnet A: 172.16.1.0/24172.16.1.0/24) within a VPC (172.16.0.0/16172.16.0.0/16). To comply with strict security requirements, the instances must not have internet access. Instead, they must interact with AWS Systems Manager (SSM) using an Interface VPC Endpoint located in a dedicated endpoint subnet (Subnet B: 172.16.2.0/24172.16.2.0/24). Both subnets are associated with custom Network ACLs (NACLs) that currently deny all inbound and outbound traffic. The security groups associated with the EC2 instances and the VPC endpoint are already correctly configured to allow HTTPS traffic (TCP port 443443) between them. Which configuration must the solutions architect apply to the Network ACL of Subnet A to allow the EC2 instances to successfully establish connections to and communicate with the SSM Interface VPC Endpoint?

Show answer & explanation

Answer: An outbound rule allowing TCP port 443443 to destination 172.16.2.0/24172.16.2.0/24, and an inbound rule allowing TCP ports 10241024-6553565535 from source 172.16.2.0/24172.16.2.0/24.

Answer

An outbound rule allowing TCP port 443443 to destination 172.16.2.0/24172.16.2.0/24, and an inbound rule allowing TCP ports 10241024-6553565535 from source 172.16.2.0/24172.16.2.0/24.
Network ACLs are stateless. Therefore, to allow a connection, rules must allow traffic in both directions. The client EC2 instances initiate HTTPS traffic to the Systems Manager (SSM) Interface VPC Endpoint on port 443443, which requires an outbound rule to destination 172.16.2.0/24172.16.2.0/24 on TCP port 443443. The return traffic from the SSM endpoint will be sent back to the client's dynamically allocated ephemeral ports (10241024-6553565535). Consequently, an inbound rule from source 172.16.2.0/24172.16.2.0/24 on TCP ports 10241024-6553565535 is required to allow the response traffic.

Step-by-Step Solution

1
Identify the communication flow and port numbers.
The client EC2 instances in Subnet A initiate HTTPS traffic (TCP port 443443) to the Interface VPC Endpoint (which uses ENIs in Subnet B).
Systems Manager Interface VPC Endpoints receive traffic on HTTPS port 443443.
2
Determine the outbound Network ACL requirements for Subnet A.
An outbound rule allowing TCP traffic to destination 172.16.2.0/24172.16.2.0/24 (Subnet B) on port 443443 is required.
To allow the outbound request from the EC2 instances to reach the VPC Endpoint's network interfaces.
3
Determine the inbound Network ACL requirements for Subnet A considering NACL statelessness.
An inbound rule allowing TCP traffic from source 172.16.2.0/24172.16.2.0/24 (Subnet B) on ephemeral ports 10241024-6553565535 is required.
Network ACLs are stateless, meaning return traffic is not automatically allowed. When the EC2 instances initiate the connection, they use dynamically allocated source ports (ephemeral ports 10241024-6553565535), which will be the destination ports for the response traffic.

Key Concept

Statelessness of Network ACLs and the requirement of ephemeral ports for return traffic in VPC communications.
Question 184Question →

A digital publishing company hosts a subscription-based platform on AWS. The static frontend is stored in an Amazon S3 bucket, and the dynamic subscription API runs on Amazon EC2 instances behind an Application Load Balancer (ALB). During a high-profile release, the platform suffers from a Layer 7 HTTP flood attack targeting the login API endpoint, causing database connection exhaustion. Concurrently, the infrastructure experiences a Layer 4 SYN flood attack that threatens to saturate the internet bandwidth. The company needs to block the application-layer attack, mitigate infrastructure-layer attacks at the network edge, and secure financial protection against EC2 auto-scaling charges incurred during DDoS attacks. Which combination of actions will meet these requirements with the least operational overhead?

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the S3 bucket and the ALB. Enable AWS Shield Advanced on the CloudFront distribution and associate an AWS WAF web ACL with a rate-based rule targeting the login endpoint.

Answer

Deploy an Amazon CloudFront distribution in front of the S3 bucket and the ALB. Enable AWS Shield Advanced on the CloudFront distribution and associate an AWS WAF web ACL with a rate-based rule targeting the login endpoint.
Deploying Amazon CloudFront in front of the S3 bucket and ALB places the entry point of the application at the AWS edge locations, providing a resilient outer layer. Associating an AWS WAF web ACL with a rate-based rule on the CloudFront distribution allows the system to identify and drop Layer 7 HTTP flood attacks targeting the login API endpoint before they reach the origin infrastructure. Furthermore, enabling AWS Shield Advanced on the CloudFront distribution provides dedicated Layer 3 and Layer 4 mitigation, access to the AWS Shield Response Team (SRT), and cost protection to cover scaling charges incurred due to auto-scaling during a DDoS attack.

Step-by-Step Solution

1
Determine the optimal location to place the entry point for DDoS mitigation.
Deploy Amazon CloudFront in front of both the S3 bucket and the Application Load Balancer.
Placing CloudFront at the edge locations ensures that malicious traffic is absorbed and filtered at the AWS network edge before reaching the origin servers.
2
Address the Layer 7 HTTP flood targeting the login endpoint.
Create an AWS WAF web ACL with a rate-based rule matching the login URI and associate it with the CloudFront distribution.
AWS WAF rate-based rules automatically track request rates from client IP addresses and temporarily block IPs exceeding the threshold, neutralizing the Layer 7 flood before it exhausts backend database connections.
3
Apply infrastructure protection and scaling charge safeguards.
Enable AWS Shield Advanced on the CloudFront distribution.
AWS Shield Advanced mitigates Layer 3/4 network and transport layer attacks (such as SYN floods) and provides financial protection to refund auto-scaling costs caused by DDoS-related traffic spikes.

Key Concept

Using Amazon CloudFront combined with AWS WAF and AWS Shield Advanced provides comprehensive edge-based Layer 3/4 and Layer 7 protection, along with financial safeguards against scaling charges.
Estimated Time:2m 30s
Question 185Question →

A company is designing a microservices application on Amazon EC2 instances. The application requires local EBS volumes to be encrypted at rest, and the encryption key must be rotated annually without requiring the re-encryption of existing data. Additionally, the database credentials used by the application must be stored securely, cannot be stored in plaintext, and must be rotated every 30 days. Which combination of actions should the solutions architect take to meet these security requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a symmetric customer managed key (CMK) in AWS KMS and enable automatic key rotation for EBS volume encryption.; Store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.

Answer

Create a symmetric customer managed key (CMK) in AWS KMS and enable automatic key rotation for EBS volume encryption, and store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.
The correct strategy combines using AWS Secrets Manager for credentials and a symmetric KMS Customer Managed Key (CMK) with automatic rotation enabled for EBS volume encryption. Secrets Manager securely stores the database credentials and manages rotation using Lambda. For EBS, KMS automatically rotates the key material annually without affecting the key ID or requiring manual re-encryption of existing data.

Step-by-Step Solution

1
Determine the secure storage and rotation mechanism for database credentials.
AWS Secrets Manager is chosen to securely store credentials and automate rotation via an AWS Lambda function.
Storing credentials in plaintext violates security rules, and Secrets Manager is designed for this specific use case.
2
Determine the encryption and rotation strategy for EBS volumes.
A symmetric Customer Managed Key (CMK) in AWS KMS is created with automatic rotation enabled.
Symmetric keys support automatic annual rotation of key material without needing manual re-encryption of existing data.

Key Concept

AWS KMS key rotation mechanics and secure secrets management
Question 186Question →

A financial services company processes transactions using an application hosted on AWS. The company needs to store transaction records in an Amazon S3 bucket. Compliance regulations mandate that the records must be encrypted at rest using a customer managed key (CMK) in AWS Key Management Service (AWS KMS). Additionally, the key material must be rotated annually, and the company must ensure that rotating the key does not require re-encrypting existing transaction data, while maintaining access to historical records. Which solution meets these requirements with the least operational effort?

Show answer & explanation

Answer: Enable automatic key rotation for the customer managed key in AWS KMS.

Answer

Enable automatic key rotation for the customer managed key in AWS KMS.
Enabling automatic key rotation for a customer managed key in AWS KMS automatically generates new key material annually. AWS KMS saves older key material to decrypt objects that were encrypted with those versions, avoiding the need to re-encrypt existing objects and minimizing operational effort.

Step-by-Step Solution

1
Analyze the encryption and compliance requirements.
The company needs to encrypt S3 data with a customer managed key, rotate it annually, keep access to historical data, and avoid re-encrypting existing data.
Understanding the security constraints helps eliminate options that do not support automatic rotation or require unnecessary re-encryption.
2
Evaluate the behavior of AWS KMS key rotation.
AWS KMS automatic key rotation creates new backing key material without changing the key ID. It retains older key material versions to decrypt historical data automatically without requiring object re-encryption.
This determines that enabling automatic rotation provides a zero-downtime, low-operational-overhead solution.
3
Identify and eliminate options that violate best practices or introduce operational overhead.
Discard manual key recreation and object re-encryption due to operational overhead, discard Parameter Store String parameters due to plaintext exposure, and discard root account usage due to privilege violations.
Ensures the selected answer is both compliant with security best practices and requires the least operational effort.

Key Concept

AWS KMS Automatic Key Rotation Mechanics
Question 187Question →

A logistics company is deploying a two-tier application in a new VPC. The web tier consists of Amazon EC2 instances in a public subnet (10.0.1.0/2410.0.1.0/24) behind an Application Load Balancer. The database tier consists of Amazon RDS MySQL instances in a private subnet (10.0.2.0/2410.0.2.0/24). The security team requires that the database subnet be isolated such that it only receives database connections from the web tier. Additionally, they must ensure the return traffic from the database can reach the web tier, while preventing any other egress traffic.

Which combination of Security Group and Network Access Control List (NACL) configurations meets these security requirements?

Show answer & explanation

Answer: Associate a security group with the database instances that allows inbound TCP port 33063306 traffic from the web servers' security group. Configure the database subnet Network ACL (NACL) to allow inbound TCP port 33063306 traffic from the public subnet CIDR block (10.0.1.0/2410.0.1.0/24), and allow outbound TCP traffic on ephemeral ports 1024−655351024-65535 to the public subnet CIDR block (10.0.1.0/2410.0.1.0/24).

Answer

Associate a security group with the database instances that allows inbound TCP port 3306 traffic from the web servers' security group. Configure the database subnet Network ACL (NACL) to allow inbound TCP port 3306 traffic from the public subnet CIDR block (10.0.1.0/24), and allow outbound TCP traffic on ephemeral ports 1024-65535 to the public subnet CIDR block (10.0.1.0/24).
The correct answer provides the necessary stateful and stateless configurations to achieve isolation. The Security Group configuration references the web servers' security group for strict instance-to-instance access, which automatically allows stateful outbound responses. The Network ACL configuration defines stateless inbound rules for port 33063306 and stateless outbound rules for the ephemeral ports (1024−655351024-65535) back to the public subnet, ensuring response packets are not dropped at the subnet boundary.

Step-by-Step Solution

1
Configure the database security group rule.
Create an inbound rule allowing TCP port 33063306 from the source Web Security Group.
Security groups are stateful and allow least-privilege tracking of individual EC2 instances rather than hardcoded CIDRs.
2
Configure the database subnet inbound Network ACL rule.
Create an inbound rule allowing TCP port 33063306 from the public subnet CIDR block (10.0.1.0/2410.0.1.0/24).
Network ACLs operate at the subnet boundary and filter traffic using CIDR blocks. This allows incoming database requests from the web tier.
3
Configure the database subnet outbound Network ACL rule.
Create an outbound rule allowing TCP ports 1024−655351024-65535 to the public subnet CIDR block (10.0.1.0/2410.0.1.0/24).
Since Network ACLs are stateless, return traffic must be explicitly allowed. MySQL client requests originating from the web servers use ephemeral ports (1024−655351024-65535) to receive the database response.

Key Concept

Stateful vs. Stateless Filtering in VPC Security
Question 188Question →

A company is configuring a newly created AWS account. A solutions architect must set up secure administrative access for a newly hired systems engineer who will perform daily operations, such as managing Amazon EC2 instances and configuring Amazon S3 buckets. The systems engineer should not have access to billing information.

Which actions should the solutions architect take to configure this access securely? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM user for the systems engineer and attach a policy that grants only the permissions required for daily operations.; Enable multi-factor authentication (MFA) on both the AWS account root user and the systems engineer's IAM user.

Answer

Create an IAM user with least-privilege permissions and enable multi-factor authentication (MFA) for both the root user and the systems engineer's IAM user.
Creating a dedicated IAM user with only the necessary permissions ensures that the systems engineer cannot access billing or perform unauthorized actions, adhering to the principle of least privilege. Enabling multi-factor authentication (MFA) on both the root user and the IAM user provides an essential layer of security to prevent unauthorized access.

Step-by-Step Solution

1
Analyze requirements for the newly hired systems engineer.
The systems engineer requires access to manage EC2 and S3 for daily tasks but must not have access to billing or the ability to close the account.
This establishes that the systems engineer should not use the root account and requires restricted permissions.
2
Select the correct IAM identity type and permissions model.
Create an IAM user for the systems engineer and apply a policy granting only the necessary permissions.
This implements the principle of least privilege, isolating standard administrative work from billing and account ownership.
3
Apply multi-factor authentication (MFA) requirements.
Enable MFA on both the AWS account root user and the systems engineer's IAM user.
MFA is essential to secure administrative access and protect the account from unauthorized access.

Key Concept

Principle of least privilege and securing credentials using IAM users and MFA.
Estimated Time:1m 0s
Question 189Question →

A company is setting up an automated deployment pipeline. A third-party CI/CD platform hosted outside of AWS needs to deploy infrastructure changes to the company's AWS account. The company's security policy prohibits the use of long-term credentials for external integrations. Which combination of actions should a solutions architect perform to grant the CI/CD platform access to the AWS account? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an OpenID Connect (OIDC) identity provider in IAM that trusts the external CI/CD provider as the issuer.; Create an IAM role with a trust policy that allows the external CI/CD provider's OIDC identity provider to assume the role using the sts:AssumeRoleWithWebIdentity action.

Answer

To grant secure access without long-term credentials, configure an OpenID Connect (OIDC) identity provider in IAM that trusts the external CI/CD provider as the issuer, and create an IAM role with a trust policy that allows the external OIDC provider to assume the role using the sts:AssumeRoleWithWebIdentity action.
To grant secure access without long-term credentials, the architect should use OpenID Connect (OIDC) identity federation. First, configuring an OpenID Connect (OIDC) identity provider in IAM establishes a trust relationship between AWS and the external CI/CD platform. Second, creating an IAM role with a trust policy that allows the external OIDC provider to assume the role using the sts:AssumeRoleWithWebIdentity action enables the CI/CD pipeline to exchange OIDC tokens for short-lived, temporary AWS credentials.

Step-by-Step Solution

1
Establish trust with the external provider.
An OpenID Connect (OIDC) identity provider (IdP) is registered in the company's AWS account, trusting the external CI/CD platform as the token issuer.
This allows AWS to validate authentication tokens issued by the external CI/CD provider without needing long-term AWS access keys.
2
Create an IAM role for authorization.
An IAM role is created with a trust policy allowing the OIDC provider to assume it via the sts:AssumeRoleWithWebIdentity action, and permissions are attached to it.
This grants temporary credentials to the external provider specifically during pipeline runs, adhering to the principle of least privilege.

Key Concept

OpenID Connect (OIDC) Federation for temporary AWS credentials
Question 190Question →

An e-commerce company hosts its inventory application tier on Amazon EC2 instances inside a public subnet with CIDR block 172.16.10.0/24172.16.10.0/24. The application connects to a MySQL database cluster running on EC2 instances in a private subnet with CIDR block 172.16.20.0/24172.16.20.0/24. A solutions architect is configuring a new custom Network ACL for the private subnet. The architect adds an inbound rule to the Network ACL allowing TCP port 33063306 from the public subnet CIDR block 172.16.10.0/24172.16.10.0/24. The database security group already permits inbound traffic on port 33063306 from the application instances. However, after applying the new Network ACL, database connections from the application tier fail. Which action will resolve this issue?

Show answer & explanation

Answer: Add an outbound rule to the private subnet's Network ACL that allows outbound TCP traffic to 172.16.10.0/24172.16.10.0/24 on ephemeral ports 1024−655351024-65535.

Answer

Add an outbound rule to the private subnet's Network ACL that allows outbound TCP traffic to 172.16.10.0/24172.16.10.0/24 on ephemeral ports 1024−655351024-65535.
The correct answer is to add an outbound rule to the private subnet's Network ACL allowing traffic to the public subnet on ephemeral ports. Network ACLs are stateless network boundaries. When an inbound connection on port 33063306 is allowed into the private subnet, the return traffic from the database to the application tier uses a high-numbered ephemeral destination port. Because Network ACLs do not automatically track session state, an outbound rule must explicitly permit this return traffic on ephemeral ports (1024−655351024-65535) for the connection to succeed.

Step-by-Step Solution

1
Analyze the stateful and stateless characteristics of the security controls in place.
The database security group is stateful, meaning it automatically allows outbound return traffic. The Network ACL is stateless, meaning it evaluates inbound and outbound traffic independently.
Understanding that Network ACLs require explicit rules for both directions is critical to resolving connectivity issues.
2
Determine the destination port used by the return traffic from the database to the application client.
The client establishes a connection from an ephemeral source port (typically 1024−655351024-65535) to the database destination port (33063306). The return traffic from the database back to the client will have a destination port in the ephemeral range.
Stateless filtering requires configuring outbound rules that match the destination ports of the response packets.
3
Configure the outbound rule on the private subnet's Network ACL to allow the ephemeral port range to the client's subnet.
Adding an outbound rule allowing TCP traffic to the public subnet (172.16.10.0/24172.16.10.0/24) on ports 1024−655351024-65535 enables the return traffic to pass successfully.
This completes the bidirectional path required by stateless Network ACLs for TCP handshakes and data exchange.

Key Concept

Network ACLs are stateless and require explicit outbound rules to permit return traffic. When a client connects to a server, the server responds to the client's ephemeral source port. Therefore, the stateless firewall protecting the server must allow outbound traffic to the client's IP address range on ephemeral ports (1024−655351024-65535).
Question 191Question →

A global SaaS provider hosts a multi-tenant application on AWS. The entry point is an Amazon CloudFront distribution that forwards requests to an Application Load Balancer (ALB) backed by Amazon EC2 instances in private subnets. During a promotional event, the application experiences a massive distributed denial of service (DDoS) attack consisting of a Layer 3/4 SYN flood and a Layer 7 HTTP flood. This causes resource exhaustion at the ALB level. A solutions architect needs to design a mitigation strategy to protect the application from future attacks of both types at the edge, while minimizing administrative overhead.

Which of the following actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Associate an AWS WAF web ACL with the CloudFront distribution and create a rate-based rule to block clients that exceed a threshold of requests.; Subscribe to AWS Shield Advanced and enable protection for the CloudFront distribution to leverage automatic Layer 3 and Layer 4 mitigation.

Answer

Associate an AWS WAF web ACL with the CloudFront distribution with a rate-based rule to block high-volume clients, and subscribe to AWS Shield Advanced to enable protection for the CloudFront distribution to leverage automated Layer 3 and Layer 4 mitigation.
The correct architecture uses a combination of AWS WAF and AWS Shield Advanced associated with Amazon CloudFront. The rate-based rule in AWS WAF inspects HTTP requests at the edge and automatically blocks clients that exceed rate thresholds, mitigating the Layer 7 HTTP flood. Subscribing to AWS Shield Advanced and protecting the CloudFront distribution mitigates Layer 3 and Layer 4 infrastructure attacks, such as SYN floods, at the edge before they can consume resources on the Application Load Balancer.

Step-by-Step Solution

1
Analyze the attack vectors to determine the target layers of the traffic floods.
Identify that the SYN flood is a Layer 3/4 infrastructure attack, whereas the HTTP flood is a Layer 7 application-layer attack.
Correct service selection requires distinguishing between network/transport layer attacks and application-layer exploits.
2
Mitigate the Layer 7 HTTP flood at the edge before it reaches the Application Load Balancer.
Configure AWS WAF with a rate-based rule and associate it with the CloudFront distribution.
AWS WAF inspects HTTP traffic at edge locations and can drop requests from offending IP addresses when rate thresholds are crossed.
3
Mitigate the Layer 3/4 infrastructure SYN flood at the edge before it exhausts ALB capacity.
Protect the CloudFront distribution with AWS Shield Advanced.
AWS Shield Advanced offers advanced monitoring, automated mitigation of infrastructure attacks at the CloudFront edge, and support from the Shield Response Team.

Key Concept

Edge and DDoS Protection
Question 192Question →

A B2B software-as-a-service (SaaS) provider hosts a multi-tenant enterprise application on AWS. The application architecture has two primary entry points exposed via an Application Load Balancer (ALB): a custom TCP-based protocol endpoint for real-time telemetry ingestion, and an HTTPS REST API for analytical reporting. During a recent audit, the security team identified a vulnerability to Layer 3/4 DDoS attacks targeting the TCP endpoint and Layer 7 HTTP flood attacks targeting the REST API. The provider has subscribed to AWS Shield Advanced and wants to implement a solution that mitigates these threats while minimizing latency for global tenants. Which TWO solutions should a solutions architect implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Create an AWS Global Accelerator accelerator for the custom TCP telemetry endpoint, route traffic to the Application Load Balancer, and enable AWS Shield Advanced on the accelerator.; Deploy an Amazon CloudFront distribution in front of the HTTPS REST API, associate an AWS WAF web ACL with the distribution, and configure a rate-limiting rule.

Answer

The correct solutions are to create an AWS Global Accelerator accelerator for the custom TCP telemetry endpoint, route traffic to the Application Load Balancer, and enable AWS Shield Advanced on the accelerator; and to deploy an Amazon CloudFront distribution in front of the HTTPS REST API, associate an AWS WAF web ACL with the distribution, and configure a rate-limiting rule.
The solution requires separate strategies for the custom TCP protocol and the HTTP/HTTPS protocol. For the custom TCP protocol, AWS Global Accelerator is used because CloudFront does not support custom TCP traffic. Enabling AWS Shield Advanced on the accelerator protects the TCP endpoint from Layer 3/4 DDoS attacks. For the HTTPS REST API, Amazon CloudFront is deployed, and an AWS WAF web ACL with a rate-limiting rule is associated with the distribution to protect against Layer 7 HTTP flood attacks at the edge before they hit the origin Application Load Balancer.

Step-by-Step Solution

1
Analyze the protocols used by the application endpoints.
The telemetry endpoint uses a custom TCP-based protocol, while the analytical reporting endpoint uses HTTP/HTTPS.
This determines which edge services are compatible. CloudFront only supports HTTP, HTTPS, and RTMP, whereas AWS Global Accelerator supports both TCP and UDP protocols.
2
Select the appropriate edge service for the custom TCP endpoint.
AWS Global Accelerator is selected because it routes TCP traffic over the AWS global network, reducing latency and providing static IP addresses that act as a front end.
This satisfies the low-latency requirement for the custom TCP endpoint while keeping the origin infrastructure shielded.
3
Select the appropriate edge service for the HTTPS REST API endpoint.
Amazon CloudFront is selected as the content delivery network (CDN) to serve the HTTPS REST API.
CloudFront caches responses at edge locations, integrates with AWS WAF, and provides built-in Layer 3/4 DDoS protection.
4
Determine the mitigation strategy for Layer 3/4 attacks on the TCP endpoint.
Enable AWS Shield Advanced on the AWS Global Accelerator resource.
AWS Shield Advanced integrates with Global Accelerator to provide resource-specific monitoring and mitigation of sophisticated Layer 3/4 DDoS attacks.
5
Determine the mitigation strategy for Layer 7 HTTP flood attacks on the HTTPS REST API.
Associate an AWS WAF web ACL with the CloudFront distribution and add a rate-limiting rule.
AWS WAF inspects HTTP/HTTPS requests at the edge. A rate-limiting rule temporarily blocks client IP addresses that exceed a configured request threshold, mitigating Layer 7 floods before they reach the ALB.

Key Concept

AWS Edge Security Architecture using CloudFront, Global Accelerator, AWS WAF, and AWS Shield Advanced
Estimated Time:3m 0s
Question 193Question →

A financial technology company hosts a payment gateway API on Amazon ECS container instances behind an Application Load Balancer (ALB). The API has recently been targeted by distributed denial of service (DDoS) attacks, including Layer 7 HTTP floods that consume ECS container resources and volumetric Layer 3/4 attacks that saturate network bandwidth. The company needs to implement a highly resilient edge security solution to mitigate these attacks before they reach the origin.

Which combination of actions should the company take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer (ALB) and associate an AWS WAF web ACL containing a rate-based rule.; Enable AWS Shield Advanced on the Amazon CloudFront distribution to protect the entry point against volumetric Layer 3 and Layer 4 attacks.

Answer

Deploying an Amazon CloudFront distribution with an associated AWS WAF web ACL containing a rate-based rule, and enabling AWS Shield Advanced on the CloudFront distribution.
To mitigate both Layer 7 HTTP floods and Layer 3/4 volumetric DDoS attacks, the architecture should leverage Amazon CloudFront as the entry point. Associating AWS WAF with CloudFront allows the use of rate-based rules to detect and block clients sending unusually high volumes of HTTP requests at the edge, protecting ECS container resources from exhaustion. Enabling AWS Shield Advanced on the CloudFront distribution provides advanced DDoS protection against volumetric attacks targeting the infrastructure layers, along with access to the AWS Shield Response Team (SRT).

Step-by-Step Solution

1
Analyze the attack vectors affecting the payment gateway API.
Identified Layer 7 HTTP floods (requiring application-layer filtering) and volumetric Layer 3/4 attacks (requiring infrastructure-layer mitigation).
Edge protection must address different layers of the OSI model using appropriate security services.
2
Design Layer 7 mitigation at the network edge.
Place Amazon CloudFront in front of the Application Load Balancer and attach AWS WAF with rate-based rules.
CloudFront acts as the entry point at edge locations, and AWS WAF evaluates and blocks HTTP floods before they reach the ALB and ECS container instances.
3
Design Layer 3/4 volumetric protection.
Enable AWS Shield Advanced on the Amazon CloudFront distribution.
AWS Shield Advanced offers tailored mitigation and protection against volumetric DDoS attacks at the AWS edge network.

Key Concept

AWS Edge Security and DDoS Mitigation using CloudFront, WAF, and Shield
Question 194Question →

A company is designing the security architecture for a new application. The development team, consisting of 50 engineers who are managed in an on-premises Active Directory, needs administrator access to the AWS Management Console. Additionally, the application requires access to a database password that must be rotated every 30 days. The solution must follow AWS security best practices.

Which combination of actions should a solutions architect recommend? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate the on-premises Active Directory and grant console access to the engineers.; Store the database password in AWS Secrets Manager and enable automatic rotation every 30 days.

Answer

The correct actions are to configure AWS IAM Identity Center to federate the on-premises Active Directory for console access, and to store the database password in AWS Secrets Manager with automatic rotation enabled.
Configuring AWS IAM Identity Center with on-premises Active Directory enables centralized federation and single sign-on (SSO), avoiding the administrative overhead and security risks of managing long-term IAM user credentials. Storing the database password in AWS Secrets Manager allows for secure storage and built-in, automated credential rotation every 30 days, which meets the security compliance requirements.

Step-by-Step Solution

1
Evaluate the identity management requirement for console access.
AWS IAM Identity Center is selected to federate the on-premises Active Directory.
This allows the 50 engineers to authenticate using their existing corporate credentials without the administrative overhead of managing separate, long-term IAM users.
2
Evaluate the secret management and rotation requirement.
AWS Secrets Manager is selected to store the database password and configure a 30-day automatic rotation schedule.
Secrets Manager natively supports automatic rotation of database credentials, securing the password without requiring manual script maintenance.

Key Concept

Centralized identity federation and secure secrets management with automated rotation
Estimated Time:2m 0s
Question 195Question →

A software-as-a-service (SaaS) provider is structuring a new multi-account AWS environment using AWS Organizations. The security team wants to establish centralized governance and security controls. Specifically, they must integrate their external enterprise identity provider (IdP) for centralized single sign-on and administrative access across all accounts. They also need to enforce security policies that prevent member accounts from altering AWS CloudTrail configurations or deleting critical Amazon S3 audit log buckets. Which combination of actions should a solutions architect recommend to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable AWS IAM Identity Center and configure federation with the external identity provider to manage single sign-on user access across all accounts.; Create a Service Control Policy (SCP) in AWS Organizations that denies cloudtrail:StopLogging and s3:DeleteBucket actions, and apply it to the organizational units (OUs) containing member accounts.

Answer

The solutions architect should recommend enabling AWS IAM Identity Center and configuring federation with the external identity provider, while deploying a Service Control Policy (SCP) in AWS Organizations to deny cloudtrail:StopLogging and s3:DeleteBucket actions at the organizational unit (OU) level.
Centralizing governance requires combining identity management and preventative guardrails. The combination of AWS IAM Identity Center and Service Control Policies (SCPs) fulfills these goals. AWS IAM Identity Center integrates with external IdPs for single sign-on access without creating individual IAM users. SCPs in AWS Organizations restrict member accounts from modifying CloudTrail settings or deleting log buckets, enforcing strict compliance policies.

Step-by-Step Solution

1
Address the centralized identity and single sign-on requirement.
By enabling AWS IAM Identity Center and setting up federation with the external enterprise IdP, the organization can map enterprise directory groups to AWS permissions centrally, avoiding local IAM users.
This establishes a centralized, secure identity mechanism with temporary credentials across the entire Organization.
2
Implement policy guardrails to protect auditing and log storage in member accounts.
Create a Service Control Policy (SCP) that explicitly denies cloudtrail:StopLogging and s3:DeleteBucket and attach it to the member account OUs.
SCPs restrict the maximum permissions of all users in member accounts, including the root user, ensuring that localized administrative access cannot bypass centralized logging and auditing controls.

Key Concept

Centralized multi-account governance using AWS Organizations, Service Control Policies (SCPs), and AWS IAM Identity Center federation.
Estimated Time:2m 0s
Question 196Question →

A financial services company needs to grant its application developers command-line access to manage resources in several AWS accounts. The developers work from local workstations. To comply with security policies, the company must prevent the storage of long-term access keys on local machines, require multi-factor authentication (MFA), and ensure that permissions are automatically revoked when a developer leaves the company. The company currently manages developer identities in an external identity provider (IdP). Which solution should a solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate with the external identity provider, and instruct developers to configure the AWS CLI using the SSO command to obtain temporary credentials.

Answer

Configure AWS IAM Identity Center to federate with the external identity provider, and instruct developers to configure the AWS CLI using the SSO command to obtain temporary credentials.
Configuring AWS IAM Identity Center to federate with the external identity provider is the recommended best practice. It enables single sign-on (SSO) and ensures that developer access is automatically revoked when their account is deactivated in the external identity provider. Using the AWS CLI integration with IAM Identity Center allows developers to authenticate and receive short-term credentials, eliminating the need to store long-term access keys on their local workstations.

Step-by-Step Solution

1
Identify the security requirements: eliminate long-term access keys on local machines, integrate with an external identity provider, and enforce MFA.
Limits options to federation and temporary credential mechanisms.
Long-term credentials stored locally present a significant security risk if a workstation is compromised.
2
Evaluate AWS IAM Identity Center federation.
IAM Identity Center integrates with external IdPs using SAML 2.0 or OIDC, allowing centralized management and automatic deprovisioning.
When a developer leaves the company, revoking their identity in the external IdP automatically revokes their access to AWS.
3
Determine the CLI configuration for IAM Identity Center.
The AWS CLI integration with IAM Identity Center dynamically requests short-term, temporary credentials, satisfying the local storage restriction.
Temporary credentials automatically expire, mitigating the risk of credential leakage.

Key Concept

Federated access and temporary credentials using AWS IAM Identity Center
Question 197Question →

A global e-commerce company hosts its application on AWS using an Application Load Balancer (ALB) in front of an Auto Scaling group of Amazon EC2 instances. The company's security team detects two concurrent security events during a high-traffic sale: a volumetric UDP flood attack targeting the application's infrastructure, and a distributed HTTP GET flood targeting a database-intensive search endpoint (/api/v1/search) using randomized query parameters to bypass caching. The company requires a solution that automatically mitigates the volumetric traffic, provides application-layer protection for the search endpoint, secures cost protection against EC2 scaling charges incurred by the attack traffic, and grants 24/7 access to the AWS Shield Response Team (SRT). Which architecture meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Enable AWS Shield Advanced on the Application Load Balancer. Associate AWS WAF with the Application Load Balancer, and create a rate-based rule that inspects request parameters and matches the search endpoint path.

Answer

Enable AWS Shield Advanced on the Application Load Balancer, associate AWS WAF with the Application Load Balancer, and configure an AWS WAF rate-based rule targeting the search endpoint path.
The correct architecture leverages AWS Shield Advanced on the Application Load Balancer for automated mitigation of infrastructure-layer (Layer 3/4) attacks like UDP floods, cost protection to offset EC2 scaling charges incurred during a DDoS attack, and 24/7 access to the Shield Response Team. In addition, an AWS WAF rate-based rule is associated with the ALB to inspect HTTP requests and throttle clients that send high-volume HTTP GET requests to the resource-intensive search endpoint.

Step-by-Step Solution

1
Select AWS Shield Advanced for L3/L4 volumetric protection, cost protection, and SRT access.
Automatic mitigation of UDP floods at the AWS edge, reimbursement for scale-out costs, and 24/7 access to the Shield Response Team are enabled.
AWS Shield Standard does not cover scale-out costs or provide SRT support, which are critical requirements.
2
Deploy AWS WAF and associate it with the Application Load Balancer.
Layer 7 HTTP traffic can now be inspected at the load balancer layer.
Layer 7 mitigation requires AWS WAF since network firewalls and NACLs cannot inspect HTTP request payloads or paths.
3
Configure an AWS WAF rate-based rule matching the '/api/v1/search' URI path.
HTTP requests targeting the search endpoint are automatically throttled when they exceed the defined rate limit threshold.
A rate-based rule limits the rate of requests from any single IP address, mitigating HTTP GET flood attacks that attempt to bypass caching using randomized query parameters.

Key Concept

AWS Shield Advanced offers Layer 3 and Layer 4 DDoS protection, cost protection for scaled-out resources, and SRT engagement, while AWS WAF provides Layer 7 mitigation (such as rate-limiting) for specific application endpoints.
Estimated Time:2m 30s
Question 198Question →

A solutions architect is designing a secure architecture for a serverless web application. The application consists of AWS Lambda functions that need to query an Amazon RDS for PostgreSQL database. The database credentials must not be hardcoded in the application code, must be encrypted at rest, and must be rotated every 30 days without manual intervention or application downtime. Which combination of steps should the solutions architect perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in AWS-managed rotation function for Amazon RDS.; Configure the AWS Lambda function to retrieve the credentials dynamically at runtime using the Secrets Manager API, and grant the Lambda execution role permissions to retrieve the secret value.

Answer

Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in AWS-managed rotation function for Amazon RDS, and configure the AWS Lambda function to retrieve the credentials dynamically at runtime using the Secrets Manager API, granting the Lambda execution role permissions to retrieve the secret value.
Storing database credentials in AWS Secrets Manager allows for secure storage with encryption at rest using AWS KMS. Secrets Manager natively supports automatic rotation for Amazon RDS databases using a built-in AWS-managed Lambda function, which updates both the database password and the secret value without downtime. The Lambda function must dynamically retrieve these credentials at runtime via the Secrets Manager API, which requires that the Lambda function's IAM execution role has permissions to retrieve the secret value.

Step-by-Step Solution

1
Store the database credentials securely in AWS Secrets Manager.
The sensitive database credentials are encrypted at rest using AWS KMS.
Hardcoding secrets violates security standards; Secrets Manager provides central encrypted storage.
2
Configure AWS Secrets Manager to automatically rotate the secret every 30 days using the built-in Amazon RDS rotation template.
Secrets Manager automatically updates the password on the RDS PostgreSQL instance and updates the secret value concurrently.
This satisfies the requirement for automatic password rotation without application downtime or manual intervention.
3
Configure the AWS Lambda function to query the secret value dynamically at runtime using the AWS SDK.
The Lambda function retrieves the most current credentials directly from Secrets Manager.
Dynamically querying the credentials ensures the application always uses the rotated password without needing redeployment.
4
Grant the Lambda function's IAM execution role permission to retrieve the secret value.
The Lambda function is authorized to access the credentials at runtime.
Least privilege access must be enforced, allowing only authorized serverless components to decrypt the secret.

Key Concept

AWS Secrets Manager automatic RDS rotation and secure IAM access pattern for Lambda.
Question 199Question →

A financial technology startup is using AWS Organizations to manage multiple AWS accounts. The security team wants to enforce compliance across all member accounts by ensuring that AWS CloudTrail remains enabled and Amazon GuardDuty cannot be disabled or modified by member account administrators. Additionally, the startup wants to federate user access using their external Identity Provider (IdP) so that employees can access member accounts with their existing credentials without introducing long-term IAM credentials. Which strategy should the solutions architect recommend to meet these security and compliance requirements with the least operational effort?

Show answer & explanation

Answer: Enable AWS IAM Identity Center, configure federation with the external IdP, and assign permissions. Place the member accounts into Organizational Units (OUs) within AWS Organizations, and attach a Service Control Policy (SCP) to the OUs that denies API actions for disabling CloudTrail and GuardDuty.

Answer

Enable AWS IAM Identity Center, configure federation with the external IdP, and assign permissions. Place the member accounts into Organizational Units (OUs) within AWS Organizations, and attach a Service Control Policy (SCP) to the OUs that denies API actions for disabling CloudTrail and GuardDuty.
The correct strategy uses AWS IAM Identity Center to federate with the external IdP, which centralizes user management and avoids creating individual IAM users with long-term credentials in each member account. It also groups member accounts into Organizational Units (OUs) and applies Service Control Policies (SCPs) to deny disabling CloudTrail and GuardDuty. This enforces security guardrails across all member accounts with minimal operational effort.

Step-by-Step Solution

1
Centralize identity federation.
AWS IAM Identity Center is enabled and integrated with the external Identity Provider (IdP) to allow single sign-on access without creating individual IAM users or long-term credentials.
This meets the requirement of federating user access using existing credentials without introducing local IAM users.
2
Establish account structure in AWS Organizations.
Member accounts are grouped into Organizational Units (OUs) based on environment or governance needs.
This allows policies to be applied hierarchically and consistently across multiple accounts.
3
Enforce compliance using Service Control Policies (SCPs).
An SCP is attached to the OUs to explicitly deny administrative actions that would disable AWS CloudTrail or Amazon GuardDuty.
SCPs act as guardrails that apply to all users and roles within the member accounts, including the root user of those member accounts, ensuring compliance cannot be bypassed.

Key Concept

Centralized multi-account governance using AWS Organizations, Service Control Policies (SCPs), and AWS IAM Identity Center for external IdP federation.
Question 200Question →

A company is deploying a database instance in a private subnet. The database needs to receive traffic only from a web server running in a public subnet of the same VPC. Which of the following configurations are required to establish this network security boundary? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a security group for the database instance with an inbound rule that allows the database port traffic from the security group of the web server.; Configure the private subnet's Network ACL with an inbound rule allowing database port traffic from the public subnet CIDR, and an outbound rule allowing ephemeral port traffic back to the public subnet CIDR.

Answer

The correct configurations are to create a security group for the database instance that allows inbound traffic from the web server's security group, and to configure the private subnet's Network ACL with both inbound traffic rules and outbound ephemeral port return rules.
The correct choices are the security group inbound rule configuration and the Network ACL rules configuration. Security groups operate at the instance level and are stateful, so configuring an inbound rule referencing the web server's security group allows the traffic and its return flow. Network ACLs operate at the subnet level and are stateless, requiring explicit rules for both inbound database traffic and outbound ephemeral port return traffic.

Step-by-Step Solution

1
Analyze instance-level network security controls.
Identify that security groups operate at the instance level and are stateful, meaning they only require inbound configuration to allow bidirectional communication.
This confirms that an inbound rule on the database security group referencing the web server's security group is correct and sufficient at the instance level.
2
Analyze subnet-level network security controls.
Identify that Network ACLs operate at the subnet level and are stateless, meaning they require explicit rules for both inbound traffic and outbound return traffic.
This confirms that the Network ACL must allow inbound database port traffic and outbound ephemeral port traffic to enable successful bidirectional communication.

Key Concept

VPC Network Security controls comparison (Security Groups vs. Network ACLs)
PreviousPage 10 / 22Next
Design Secure Architectures Practice Questions — AWS Certified Solutions Architect - Associate — Page 10 | Examkin