Design Secure Architectures

438 questions

All types438 Multiple choice214 Multiple select224

A logistics company is setting up a multi-account structure on AWS using AWS Organizations. The company wants to implement a centralized identity management solution to allow employees to access multiple AWS accounts using their existing corporate Active Directory credentials. Additionally, the security team needs to ensure that no member accounts can disable AWS CloudTrail.

Which two actions should a solutions architect take to meet these requirements? (Select two.)

Select all that apply

Configure AWS IAM Identity Center to federate with the corporate Active Directory to manage user access across all AWS accounts.

Create a Service Control Policy (SCP) that denies permissions to disable or delete CloudTrail, and attach it to the organizational units containing the member accounts.

Create individual IAM users with long-term credentials in each member account mapping to each corporate Active Directory user.

Write a restrictive IAM policy that denies the disabling of CloudTrail and attach it directly to the root user of each member account.

Create IAM roles with administrative privileges in the management account and share the root credentials of the management account with Active Directory administrators.

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate with the corporate Active Directory to manage user access across all AWS accounts.; Create a Service Control Policy (SCP) that denies permissions to disable or delete CloudTrail, and attach it to the organizational units containing the member accounts.

Answer

Configure AWS IAM Identity Center to federate with the corporate Active Directory, and create a Service Control Policy (SCP) that denies permissions to disable or delete CloudTrail attached to the organizational units containing the member accounts.

Centralizing identity federation using AWS IAM Identity Center allows users to authenticate once using their Active Directory credentials and access their assigned roles across AWS accounts securely. Utilizing Service Control Policies (SCPs) at the Organizational Unit (OU) level provides a governance guardrail that prevents any entity, including administrators and the root user in member accounts, from stopping or deleting CloudTrail logging.

Step-by-Step Solution

Address the centralized identity requirement by integrating the identity provider.

AWS IAM Identity Center is configured to federate with the corporate Active Directory, allowing centralized SSO across accounts.

This eliminates the need to create local IAM users in individual accounts.

Address the governance requirement to prevent member accounts from disabling CloudTrail.

A Service Control Policy is created with a Deny effect on CloudTrail modification APIs and attached to the Organizational Units (OUs).

SCPs apply to all users and roles within member accounts (including root users), enforcing the restriction centrally.

Key Concept

AWS multi-account governance using AWS Organizations, Service Control Policies, and centralized federation with AWS IAM Identity Center.

Question 202Question →

A company is deploying a secure containerized application on Amazon EC2 instances within a private subnet (Subnet A: $10.10.1.0/24$ ). The application must consume a third-party messaging service hosted in an on-premises data center via an established AWS Direct Connect connection. The on-premises messaging service endpoint is at $192.168.10.50$ and listens on TCP port $5672$ . The security team has implemented a custom Network Access Control List (NACL) for Subnet A. The Security Group (SG) associated with the EC2 instances allows outbound TCP traffic on port $5672$ to $192.168.10.50/32$ and has no inbound rules. Which configuration of NACL rules for Subnet A is required to establish successful outbound communication to the on-premises service while maintaining the principle of least privilege?

Inbound: No inbound rules are required because the Security Group is stateful. Outbound: Allow TCP traffic on port

5672

to destination

192.168.10.50/32

Inbound: Allow TCP traffic on ports

1024

65535

from source

192.168.10.50/32

. Outbound: Allow TCP traffic on port

5672

to destination

192.168.10.50/32

Inbound: Allow TCP traffic on port

5672

from source

192.168.10.50/32

. Outbound: Allow TCP traffic on port

5672

to destination

192.168.10.50/32

Inbound: Allow all traffic from source

0.0.0.0/0

. Outbound: Allow all traffic to destination

0.0.0.0/0

Show answer & explanation

Answer: Inbound: Allow TCP traffic on ports $1024$ - $65535$ from source $192.168.10.50/32$ . Outbound: Allow TCP traffic on port $5672$ to destination $192.168.10.50/32$ .

Answer

Inbound: Allow TCP traffic on ports

1024

65535

from source

192.168.10.50/32

. Outbound: Allow TCP traffic on port

5672

to destination

192.168.10.50/32

The correct option is the one that configures the outbound NACL rule to allow TCP port

5672

to the on-premises IP address, and configures the inbound NACL rule to allow the return traffic on the ephemeral port range (

1024

65535

) from the same IP address. Because Network ACLs are stateless, return traffic is not automatically permitted and must be explicitly allowed by matching the client's dynamic source ports.

Step-by-Step Solution

Analyze the connection flow direction.

The EC2 instances in Subnet A initiate outbound TCP connections to the on-premises endpoint (

192.168.10.50

) on service port

5672

This establishes that the outbound destination port is

5672

and the destination IP is

192.168.10.50/32

Determine the statefulness of the VPC security layers.

Security Groups are stateful (allowing return traffic automatically), but Network ACLs are stateless (requiring explicit rules for both request and response traffic).

Both inbound and outbound rules must be explicitly configured in the NACL for Subnet A to allow the traffic flow.

Identify the ports used for request and return traffic.

Outbound requests target destination port

5672

from client ephemeral ports (

1024

65535

). Returning traffic targets client ephemeral ports (

1024

65535

) from source port

5672

Knowing the correct ports ensures least privilege configuration without blocking the network response.

Formulate the minimal NACL rules.

Allow outbound TCP on port

5672

192.168.10.50/32

, and allow inbound TCP on ports

1024

65535

from

192.168.10.50/32

This configuration permits the initiating request and the corresponding stateless response under the principle of least privilege.

Key Concept

VPC Network ACLs are stateless and require explicit rules for both outbound request traffic and inbound ephemeral return traffic.

Estimated Time:2m 0s

Question 203Question →

An enterprise runs a mission-critical workload on Amazon EC2 instances with encrypted Amazon EBS volumes. The volumes are encrypted using an AWS KMS customer managed key. Corporate security policy dictates that the encryption keys must be rotated every year. A solutions architect needs to configure this rotation in the most operationally efficient way, while ensuring that all existing EBS snapshots can still be successfully restored at any time.

Which configuration strategy will meet these requirements?

Enable automatic key rotation for the customer managed key in AWS KMS, which rotates the backing key material annually while keeping the key ID and ARN unchanged.

Enable automatic key rotation for the customer managed key, which automatically schedules a background process in AWS KMS to decrypt and re-encrypt all existing EBS volumes and snapshots using the new key version.

Create a new customer managed key manually each year, update the Amazon EC2 launch templates to use the new key, and delete the previous key to avoid extra key storage charges.

Store the KMS key's administrative passwords and configuration metadata as a plain String parameter in AWS Systems Manager Parameter Store, and set up a custom AWS Lambda function to rotate them annually.

Show answer & explanation

Answer: Enable automatic key rotation for the customer managed key in AWS KMS, which rotates the backing key material annually while keeping the key ID and ARN unchanged.

Answer

Enable automatic key rotation for the customer managed key in AWS KMS, which rotates the backing key material annually while keeping the key ID and ARN unchanged.

Enabling automatic key rotation for the customer managed key in AWS KMS automatically generates new backing key material every year. Because the key ID, ARN, and key policies remain unchanged, applications can continue to use the key without modifications. Historical backing key material is retained by AWS KMS, meaning existing snapshots encrypted with the old backing key material can still be decrypted and restored automatically without needing manual re-encryption.

Step-by-Step Solution

Analyze the encryption requirements.

The requirement states that the customer managed key must be rotated annually with minimal operational overhead, while maintaining the ability to decrypt historical snapshots.

Understanding the core constraints helps filter out solutions that introduce manual overhead or risk data loss.

Evaluate the behavior of AWS KMS automatic key rotation.

Automatic key rotation manages the backing cryptographic material without changing the key ID, ARN, or metadata. Old backing keys remain available for decryption.

This confirms that existing snapshots remain decryptable without any configuration changes or manual key management.

Identify why other configurations fail.

Re-encrypting all snapshots is unnecessary and resource-intensive, deleting old keys makes historical backups unrestorable, and plain Systems Manager parameters expose credentials.

Ensures the selected option adheres to the principles of least privilege, operational efficiency, and data integrity.

Key Concept

AWS KMS Customer Managed Key Automatic Rotation Mechanics

Question 204Question →

A company stores compliance logs in an Amazon S3 bucket. The logs are encrypted at rest using an AWS KMS Customer Managed Key. The company's security policy dictates that when the KMS key is rotated, all existing historical logs must be immediately re-encrypted under the new key version. Additionally, the log ingestion application requires database credentials that must be rotated every $30$ days. Which combination of steps will meet these security requirements in the most secure manner?

Perform manual key rotation by creating a new customer managed key and updating the S3 bucket configuration. Delete the old customer managed key to ensure no historical logs can be read using the old key material. Store the database credentials in Systems Manager Parameter Store as a SecureString parameter and configure it to rotate every

30

days using an AWS Lambda function.

Enable automatic key rotation for the customer managed key, which automatically schedules a background job to re-encrypt all historical S3 objects with the new key version. Store the database credentials in Systems Manager Parameter Store as a String parameter and write a custom script to rotate the parameter value every

30

days.

Enable automatic key rotation for the customer managed key. Run an Amazon S3 Batch Operations copy job to copy the S3 objects to themselves using the same key to re-encrypt historical data. Store the database credentials in AWS Secrets Manager and configure automatic rotation every

30

days.

Log in as the AWS account root user to manually force rotation of the AWS managed key (aws/s3). Use the AWS CLI to run a script that downloads, decrypts, and re-uploads all historical objects. Store the database credentials as a plaintext parameter in Systems Manager Parameter Store with a lifecycle policy.

Show answer & explanation

Answer: Enable automatic key rotation for the customer managed key. Run an Amazon S3 Batch Operations copy job to copy the S3 objects to themselves using the same key to re-encrypt historical data. Store the database credentials in AWS Secrets Manager and configure automatic rotation every $30$ days.

Answer

30

days.

The correct option correctly configures automatic rotation for the customer managed key, which creates a new key version annually while maintaining historical versions for decryption. To immediately re-encrypt existing objects under the new key version, an S3 Batch Operations copy job copies objects to themselves, applying the active new key material. Finally, it uses AWS Secrets Manager, which natively and securely manages database credential storage and automatic rotation.

Step-by-Step Solution

Enable KMS Key Rotation

Automatic rotation is enabled, meaning AWS KMS will generate a new key version annually for new encryption operations while keeping the old key version active for decrypting existing data.

This complies with security policies requiring rotated keys for new data without manually updating application settings or key ARNs.

Re-encrypt Historical Data

Run an Amazon S3 Batch Operations copy job that copies S3 objects to themselves using the existing KMS key alias.

Because AWS S3 copy operations write objects as new writes, they are encrypted using the currently active version of the KMS key, satisfying the requirement to immediately re-encrypt historical data under the new key version.

Configure Secure Credentials Storage and Rotation

Deploy AWS Secrets Manager to hold the database credentials and configure a rotation schedule of

30

days.

AWS Secrets Manager natively integrates with database credentials to orchestrate rotation via Lambda and secures secrets at rest, unlike plaintext parameter configurations.

Key Concept

AWS KMS key rotation behavior combined with S3 Batch Operations copy actions for historical data re-encryption, and native secret management via AWS Secrets Manager.

Estimated Time:2m 30s

Question 205Question →

A municipal utility enterprise is deploying a new smart-metering application on AWS that must integrate with their existing on-premises Microsoft Active Directory. The enterprise plans to run Active Directory-aware application servers on Amazon EC2 instances in a VPC. The application must authenticate corporate users and domain-join the EC2 instances. The enterprise wants to minimize operational overhead, prevent any replication of Active Directory data to the cloud, and avoid setting up a trust relationship. Which solution meets these requirements with the least operational complexity?

Deploy AWS Managed Microsoft AD in the VPC, and establish a two-way forest trust relationship with the on-premises Microsoft Active Directory.

Use AWS Directory Service AD Connector to connect to the on-premises Active Directory, and use it to domain-join the EC2 instances and authenticate users.

Create individual IAM users in the AWS account for all corporate users, and configure a custom synchronization server on EC2 to replicate user credentials from the on-premises Active Directory.

Use the AWS account root user to generate a single set of long-term access keys, and hardcode these credentials in the application configuration to authenticate all incoming user requests.

Show answer & explanation

Answer: Use AWS Directory Service AD Connector to connect to the on-premises Active Directory, and use it to domain-join the EC2 instances and authenticate users.

Answer

Use AWS Directory Service AD Connector to connect to the on-premises Active Directory, and use it to domain-join the EC2 instances and authenticate users.

Using AWS Directory Service AD Connector meets all the requirements. AD Connector is a directory gateway that redirects directory requests to the on-premises Active Directory without caching or replicating any data in the cloud, and it does not require establishing a trust relationship. This minimizes operational complexity while satisfying the domain-join and user authentication needs.

Step-by-Step Solution

Analyze the requirements for Active Directory integration on AWS EC2 instances.

The requirements demand domain-joining EC2 instances and authenticating users using on-premises Microsoft Active Directory credentials without establishing trust relationships or replicating directory data.

This narrows down the Directory Service options to those that function as a proxy or directory gateway.

Evaluate the capabilities of AD Connector versus AWS Managed Microsoft AD.

AWS Managed Microsoft AD requires establishing a trust relationship and replicates directory records, whereas AD Connector acts as a pure directory gateway (proxy) redirecting requests to the on-premises Active Directory without caching or trust requirements.

This aligns with the enterprise's goal of avoiding data replication and trust relationships while minimizing operational overhead.

Select the option that configures AD Connector to domain-join instances and authenticate users.

The correct option is identified as using AWS Directory Service AD Connector.

It fulfills all technical and business constraints with the lowest operational complexity.

Key Concept

AWS Directory Service AD Connector serves as a directory gateway to redirect requests to an on-premises Active Directory without caching data or requiring trust relationships.

Estimated Time:2m 0s

Question 206Question →

A company is designing a secure multi-account architecture on AWS. Applications running on Amazon EC2 instances in Account A must write encrypted logs to an Amazon S3 bucket located in Account B. The logs must be encrypted at rest using an AWS KMS customer managed key owned by Account B. The security team needs to configure the required permissions to allow the applications to perform cryptographic operations and upload the logs securely. Which combination of configuration steps will meet these requirements? (Select TWO.)

Select all that apply

In the destination account (Account B), configure the KMS key policy to grant the source account (Account A) permission to perform the `kms:GenerateDataKey` and `kms:Decrypt` actions.

In the source account (Account A), attach an IAM policy to the EC2 instances' IAM role that grants permissions to perform the `kms:GenerateDataKey` and `kms:Decrypt` actions on the KMS key ARN in Account B.

In the destination account (Account B), grant administrative control of the KMS key directly to the AWS account root user of the source account (Account A) to manage cryptographic permissions, violating least privilege.

In the destination account (Account B), enable automatic key rotation for the KMS customer managed key, expecting AWS to immediately decrypt and re-encrypt all existing historical S3 objects using the new key version.

In the source account (Account A), configure the application to store the database credentials and KMS keys as plaintext String parameters in Systems Manager Parameter Store for direct retrieval by the application instances.

Show answer & explanation

Answer: In the destination account (Account B), configure the KMS key policy to grant the source account (Account A) permission to perform the `kms:GenerateDataKey` and `kms:Decrypt` actions.; In the source account (Account A), attach an IAM policy to the EC2 instances' IAM role that grants permissions to perform the `kms:GenerateDataKey` and `kms:Decrypt` actions on the KMS key ARN in Account B.

Answer

In Account B, configure the KMS key policy to grant the source account permissions for the cryptographic actions, and in Account A, attach an IAM policy to the application role granting permissions on the target KMS key ARN.

For cross-account access to AWS KMS customer managed keys, permissions must be explicitly declared on both sides. First, the key policy in the destination account must permit the source account's root user or the specific IAM principal to access the key. Second, the source account's IAM role must have an identity-based policy that explicitly grants permission to use the external key ARN for the necessary operations.

Step-by-Step Solution

Analyze cross-account KMS authorization flow.

Identify that cross-account access to a customer managed key requires permissions to be granted in both the resource-based policy (KMS key policy) and the identity-based policy (IAM policy).

AWS evaluates both policies for cross-account KMS requests, and both must explicitly allow the action.

Configure destination account resources.

Modify the KMS key policy in Account B to include Account A in the Principal block and allow the necessary cryptographic operations.

This establishes trust and delegates authorization decisions to Account A.

Configure source account identities.

Attach an IAM policy to the EC2 instance role in Account A specifying the target KMS key ARN and the cryptographic actions.

This authorizes the EC2 instances to request data keys from the external KMS key.

Key Concept

Cross-account AWS KMS authorization requires matching policies in both the resource owner account and the caller identity account.

Question 207Question →

A media streaming company is migrating its operations to AWS and setting up a multi-account environment managed by AWS Organizations. The company's developers need single sign-on (SSO) access to the AWS Management Console. The company maintains an on-premises Microsoft Active Directory to manage developer identities. The solution must minimize operational overhead, avoid the replication of Active Directory passwords to the AWS Cloud, and leverage existing Active Directory group memberships to control access permissions.

Which solution should a solutions architect recommend to meet these requirements?

Manually create individual IAM users with long-term credentials in each AWS account for all developers, and run a daily cron job to sync credentials from the on-premises Active Directory.

Configure AWS IAM Identity Center, connect it to the on-premises Active Directory using AWS Directory Service AD Connector, and map the Active Directory groups to permission sets in IAM Identity Center.

Enable SAML 2.0 federation directly on the AWS account root user of the management account, and share the root credentials with developers to manage resources across all member accounts.

Deploy a custom synchronization application on Amazon EC2 that queries the on-premises Active Directory to create matching IAM users, and store the Active Directory service account password as a plaintext parameter in AWS Systems Manager Parameter Store.

Show answer & explanation

Answer: Configure AWS IAM Identity Center, connect it to the on-premises Active Directory using AWS Directory Service AD Connector, and map the Active Directory groups to permission sets in IAM Identity Center.

Answer

Configuring AWS IAM Identity Center with AWS Directory Service AD Connector is the most efficient design to achieve single sign-on for on-premises Active Directory users in a multi-account environment. AD Connector acts as a directory gateway to forward authentication requests to the on-premises AD without replicating passwords to the AWS Cloud. Mapping AD groups to permission sets in IAM Identity Center ensures access control is centrally managed and leverages existing directory structures, minimizing operational overhead.

Step-by-Step Solution

Assess the need for centralized single sign-on (SSO) and minimal overhead in a multi-account setup.

Identify AWS IAM Identity Center as the recommended AWS service for centralized multi-account access.

AWS IAM Identity Center simplifies SSO access across AWS accounts and integrates with external identity providers.

Determine the directory integration method that avoids password replication and minimizes infrastructure management.

Choose AWS Directory Service AD Connector to redirect authentication requests to the on-premises Active Directory.

AD Connector acts as a directory gateway, proxying authentication requests without caching or replicating AD passwords in AWS.

Assign permissions based on existing on-premises groups.

Map Active Directory groups to permission sets in IAM Identity Center.

This leverages existing group structures to assign permissions to users dynamically as they authenticate, avoiding manual credential management.

Key Concept

Centralized multi-account access using AWS IAM Identity Center and AD Connector to federate with on-premises Active Directory without password replication.

Question 208Question →

A logistics company is deploying a fleet of Amazon EC2 instances in private subnets within a VPC. These instances must upload high volumes of archived tracking logs directly to Amazon S3, and communicate with an external shipping carrier's API over HTTPS to update package statuses. The solution must ensure secure connectivity, prevent direct inbound connections from the internet to the EC2 instances, and minimize data transfer costs. Which combination of configurations should a solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Create a Gateway VPC endpoint for Amazon S3 and associate it with the route tables of the private subnets.

Deploy a NAT gateway in a public subnet, and configure the route tables of the private subnets to route outbound traffic destined for the internet to the NAT gateway.

Configure a network ACL on the private subnets with a stateful rule that permits inbound traffic on ephemeral ports and outbound HTTPS traffic to the carrier's API.

Route all S3-bound traffic from the private subnets through a NAT gateway deployed in a public subnet to avoid establishing VPC endpoints.

Modify the security group of the EC2 instances in the private subnets to allow inbound traffic on HTTPS port 443 from the external shipping carrier's API endpoints.

Show answer & explanation

Answer: Create a Gateway VPC endpoint for Amazon S3 and associate it with the route tables of the private subnets.; Deploy a NAT gateway in a public subnet, and configure the route tables of the private subnets to route outbound traffic destined for the internet to the NAT gateway.

Answer

Create a Gateway VPC endpoint for Amazon S3 and associate it with the route tables of the private subnets, and deploy a NAT gateway in a public subnet, and configure the route tables of the private subnets to route outbound traffic destined for the internet to the NAT gateway.

The solution requires secure, cost-effective egress. Deploying a Gateway VPC endpoint for Amazon S3 establishes a secure, private connection to S3 that avoids the internet and NAT Gateway charges. A NAT gateway in a public subnet enables private EC2 instances to securely establish outbound-only communication with the external shipping carrier's API over the internet.

Step-by-Step Solution

Analyze the requirements for accessing Amazon S3 and the external shipping API from the private EC2 instances.

The S3 connection involves high-volume archived tracking logs. The external carrier API connection involves outbound-initiated HTTPS requests to the internet.

This helps identify the most cost-effective and secure routing mechanism for each target.

Select the optimal connectivity method for S3 to avoid high data transfer charges.

A Gateway VPC endpoint is chosen because it routes S3 traffic privately within AWS and is free of charge.

Routing S3 traffic through a NAT gateway incurs per-GB data processing charges, which is not cost-effective.

Select the optimal connectivity method for the external carrier's API on the internet.

A NAT gateway deployed in a public subnet is chosen, with private route tables updated to route 0.0.0.0/0 traffic to the NAT gateway.

NAT gateways allow instances in private subnets to initiate outbound-only communication to the internet while keeping them protected from inbound internet traffic.

Key Concept

VPC Network Security and Cost Optimization

Question 209Question →

A real estate property management firm is migrating its internal operations to a multi-account AWS environment. The firm currently manages its 300 agents and administrative staff using an on-premises Microsoft Active Directory. A solutions architect must design a security architecture that allows these employees to log in to the AWS Management Console to manage resources across multiple AWS accounts. The solution must allow the employees to use their existing Active Directory credentials, enforce the organization's existing multi-factor authentication (MFA) policies, and minimize the administrative overhead of managing identities. Which solution should the solutions architect recommend to meet these requirements?

Create individual IAM users in each AWS account for the 300 employees, and write a script to continuously synchronize password hashes from the on-premises Active Directory.

Enable AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector. Grant access to the AWS accounts using IAM Identity Center permission sets.

Use the AWS account root user to create a centralized IAM group in the management account, assign the required permissions to the group, and distribute the root credentials to the directory administrators to manage user access.

Deploy AWS Directory Service for Microsoft Active Directory in the cloud, establish a two-way forest trust, and configure the on-premises user directories to generate long-term AWS access keys for each employee.

Show answer & explanation

Answer: Enable AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector. Grant access to the AWS accounts using IAM Identity Center permission sets.

Answer

Enable AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector. Grant access to the AWS accounts using IAM Identity Center permission sets.

The correct answer is the option to enable AWS IAM Identity Center and connect it to the on-premises Active Directory using an AD Connector. This approach allows users to authenticate to the AWS Management Console using their existing corporate credentials without duplicating directory identities in AWS. AWS IAM Identity Center supports centralized management of permission sets and assigns AWS IAM roles to users when they log in, fulfilling all business and security requirements with the lowest operational overhead.

Step-by-Step Solution

Deploy AWS Directory Service AD Connector to establish a directory gateway with the on-premises Active Directory.

Authentication requests can be forwarded securely from AWS to the on-premises Active Directory without replicating directory data.

This bridges the on-premises directory and AWS services without local database synchronization overhead.

Enable AWS IAM Identity Center in the Organization's management account and configure the identity source to use the Active Directory via the AD Connector.

Users in the on-premises Active Directory can now be mapped directly to AWS IAM Identity Center and authenticate using their existing credentials and MFA.

This integrates the enterprise identity provider into AWS for single sign-on capabilities.

Create permission sets in AWS IAM Identity Center and associate them with Active Directory groups and AWS accounts.

Agents and administrative staff gain federated access to their respective AWS accounts with the correct permissions when logging in through the AWS access portal.

This implements role-based access control and minimizes administrative management overhead across a multi-account structure.

Key Concept

Centralized identity federation using AWS IAM Identity Center and AD Connector to integrate on-premises Active Directory without credential duplication.

Estimated Time:2m 0s

Question 210Question →

An application running on Amazon EC2 instances in AWS Account A needs to read encrypted payload logs from an Amazon S3 bucket located in AWS Account B. The security team requires that the S3 bucket use Server-Side Encryption with AWS KMS customer managed keys (SSE-KMS) and that the key undergoes annual rotation. Additionally, the configuration must allow the EC2 application role in Account A to decrypt the files while preventing the historical log files from needing manual re-encryption. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Configure the KMS key policy in Account B to allow the IAM role of the EC2 instances in Account A to perform the kms:Decrypt action, and grant kms:Decrypt permissions to the IAM role in Account A.

Enable automatic key rotation for the customer managed key in Account B, which automatically rotates the backing key material annually while retaining previous versions to decrypt existing logs.

Manually rotate the KMS key in Account B annually by creating a new key, and execute an S3 Batch Operations job to re-encrypt all historical logs with the new key version.

Configure the EC2 application in Account A to authenticate using IAM user access keys that are stored as a plaintext String parameter in AWS Systems Manager Parameter Store.

Use Account B's root user credentials on the EC2 instances in Account A to perform all log decryption tasks, bypassing cross-account KMS key policy configurations.

Show answer & explanation

Answer: Configure the KMS key policy in Account B to allow the IAM role of the EC2 instances in Account A to perform the kms:Decrypt action, and grant kms:Decrypt permissions to the IAM role in Account A.; Enable automatic key rotation for the customer managed key in Account B, which automatically rotates the backing key material annually while retaining previous versions to decrypt existing logs.

Answer

Configure the KMS key policy in Account B to allow the IAM role of the EC2 instances in Account A to perform the kms:Decrypt action, grant kms:Decrypt permissions to the IAM role in Account A, and enable automatic key rotation for the customer managed key in Account B.

To grant an EC2 instance in Account A access to a KMS key in Account B, both the key policy in Account B must permit the IAM role in Account A, and the IAM role in Account A must have permissions to decrypt. In addition, enabling automatic key rotation handles key rotation seamlessly because AWS KMS keeps older versions of backing keys available for decrypting historical data, preventing the need for manual re-encryption.

Step-by-Step Solution

Configure cross-account KMS permissions.

The key policy in Account B is updated to delegate permission to the IAM role in Account A, and the IAM role in Account A is granted permission to use the key.

For cross-account access, permissions must be granted in both the resource's key policy and the consumer's IAM policy.

Enable automatic key rotation on the customer managed key in Account B.

The key automatically rotates its backing material annually without affecting historical data.

AWS KMS automatic key rotation keeps previous versions of the backing key active for decryption, meaning existing logs do not need to be manually re-encrypted.

Key Concept

Cross-account KMS key policies and automatic key rotation mechanics

Estimated Time:2m 0s

Question 211Question →

A media processing workload is hosted on Amazon EC2 instances in a private subnet. The application must regularly download large video files from an Amazon S3 bucket in the same Region, and it must also access a third-party software repository on the public internet to download package updates. The solutions architect must design a secure network routing architecture that minimizes data transfer costs and prevents direct internet exposure of the EC2 instances.

Which combination of configurations will meet these requirements? (Select TWO.)

Select all that apply

Create a Gateway VPC endpoint for Amazon S3, and associate it with the route table of the private subnet.

Deploy a NAT Gateway in a public subnet, and configure the private subnet's route table to route traffic destined for

0.0.0.0/0

to the NAT Gateway.

Route all outbound traffic destined for Amazon S3 through the NAT Gateway to centralize external network pathways.

Configure a Network ACL on the private subnet to statefully permit outbound connections to the S3 service limits.

Deploy AWS WAF on the Network ACL of the private subnet to inspect and filter outbound Layer 7 requests.

Show answer & explanation

Answer: Create a Gateway VPC endpoint for Amazon S3, and associate it with the route table of the private subnet.; Deploy a NAT Gateway in a public subnet, and configure the private subnet's route table to route traffic destined for $0.0.0.0/0$ to the NAT Gateway.

Answer

Create a Gateway VPC endpoint for Amazon S3 associated with the private subnet's route table, and deploy a NAT Gateway in a public subnet with a route for

0.0.0.0/0

in the private subnet's route table.

To satisfy the requirements securely and cost-effectively, a Gateway VPC endpoint should be created for Amazon S3 and associated with the private subnet's route table. This configuration keeps S3 traffic on the private AWS network and eliminates NAT Gateway data processing costs. Additionally, to allow the private EC2 instances to download updates from the public internet without direct exposure, a NAT Gateway should be deployed in a public subnet, with the private subnet's route table configured to send

0.0.0.0/0

traffic to it.

Step-by-Step Solution

Analyze S3 traffic cost optimization and routing.

Determine that routing S3 traffic through a Gateway VPC Endpoint is free and routes traffic privately through the AWS internal network, avoiding NAT Gateway charges.

S3 Gateway Endpoints are the most cost-effective and secure method for private subnets to access S3.

Analyze external internet access for package updates.

Determine that outbound internet access requires a NAT Gateway placed in a public subnet with a route in the private subnet's route table targeting the NAT Gateway.

Private EC2 instances cannot access the internet directly; they require a NAT translation device in a public subnet.

Evaluate security and statefulness rules.

Confirm that Network ACLs are stateless and AWS WAF cannot be applied to subnets or NACLs.

This rules out distractors related to stateful Network ACLs and incorrect WAF deployments.

Key Concept

VPC Network Routing and Cost Optimization using VPC Endpoints and NAT Gateways

Question 212Question →

A financial services company hosts a high-frequency trading application on Amazon EC2 instances inside a private subnet of a VPC. A security architect needs to implement a threat detection and automated remediation system to identify and block outbound command-and-control (C2) traffic from these instances. The solution must immediately block outbound traffic to the identified malicious IP addresses at the subnet boundary to prevent data exfiltration, while ensuring that the rest of the legitimate application traffic in the subnet continues to flow without interruption. Which architecture should the security architect implement to meet these requirements with the lowest operational overhead?

Enable Amazon GuardDuty to analyze VPC Flow Logs and DNS logs. Create an Amazon EventBridge rule to trigger an AWS Lambda function when a C2 threat is detected. The Lambda function dynamically adds a stateless outbound DENY rule for the malicious destination IP address to the Network Access Control List (NACL) associated with the private subnet.

Deploy AWS WAF on the Application Load Balancer and enable AWS Shield Advanced. Configure AWS Shield Advanced to inspect outbound traffic from the EC2 instances for C2 signatures, and use AWS WAF to block the destination IP address at the subnet level.

Enable VPC Flow Logs to stream to Amazon CloudWatch Logs. Create a metric filter to detect C2 activity, which triggers an Amazon CloudWatch alarm. The alarm invokes an AWS Lambda function that adds an outbound DENY rule for the malicious IP address to the security group attached to the EC2 instances.

Enable Amazon GuardDuty to monitor the VPC. Configure GuardDuty to trigger an AWS Lambda function via Amazon EventBridge. The Lambda function adds an outbound DENY rule for the malicious IP address to the security group associated with the subnet.

Show answer & explanation

Answer: Enable Amazon GuardDuty to analyze VPC Flow Logs and DNS logs. Create an Amazon EventBridge rule to trigger an AWS Lambda function when a C2 threat is detected. The Lambda function dynamically adds a stateless outbound DENY rule for the malicious destination IP address to the Network Access Control List (NACL) associated with the private subnet.

Answer

The correct architecture utilizes Amazon GuardDuty to monitor network logs natively and trigger an automated EventBridge rule. The triggered Lambda function applies an explicit deny rule in the stateless Network ACL at the subnet boundary. This successfully isolates the outbound C2 communication at the perimeter while keeping other subnet traffic unaffected.

Step-by-Step Solution

Detect malicious C2 activity using a native AWS threat detection service.

Amazon GuardDuty is enabled, which natively analyzes VPC Flow Logs and DNS query logs to identify suspicious outbound patterns such as command-and-control server communication.

This avoids custom log parsing and maintains the lowest operational overhead for complex threat detection.

Automate threat remediation using EventBridge and Lambda.

An EventBridge rule matches GuardDuty finding types for C2 activity and triggers an AWS Lambda function, passing the metadata of the malicious destination IP.

This establishes a real-time, event-driven orchestration pipeline.

Implement the blocking mechanism at the subnet boundary.

The Lambda function updates the Network Access Control List (NACL) associated with the subnet, adding an explicit outbound DENY rule for the specific IP.

Network ACLs operate statelessly at the subnet boundary, allowing targeted blocking of traffic before it leaves the subnet while leaving legitimate traffic to other destinations unaffected.

Key Concept

Automated security threat detection and mitigation using Amazon GuardDuty, Amazon EventBridge, AWS Lambda, and Network ACLs.

Question 213Question →

A company is deploying a serverless microservice on AWS Lambda that requires access to a third-party payment gateway's API key. Security policies mandate that the API key must be encrypted at rest and rotated every 30 days. The rotation process must be automated, and the Lambda function should retrieve the latest key at runtime without requiring manual updates or redeployments. Which solution should a Solutions Architect implement to meet these requirements with the least administrative effort?

Store the API key in AWS Systems Manager Parameter Store as a standard String parameter. Configure an Amazon EventBridge rule to trigger a Lambda function every 30 days to update the parameter value.

Store the API key in AWS Secrets Manager. Configure automatic rotation using a custom AWS Lambda rotation function, and configure the application to retrieve the key dynamically at runtime using the AWS SDK.

Store the API key in AWS Systems Manager Parameter Store as a SecureString parameter. Enable automatic rotation on the associated customer managed key in AWS KMS to rotate the API key value every 30 days.

Store the API key as a SecureString parameter in AWS Systems Manager Parameter Store. Write a custom script that re-encrypts the existing parameter value with a new AWS KMS key version every 30 days to update the credential.

Show answer & explanation

Answer: Store the API key in AWS Secrets Manager. Configure automatic rotation using a custom AWS Lambda rotation function, and configure the application to retrieve the key dynamically at runtime using the AWS SDK.

Answer

Store the API key in AWS Secrets Manager, configure automatic rotation using a custom AWS Lambda rotation function, and retrieve the key dynamically at runtime using the AWS SDK.

AWS Secrets Manager securely stores the API key encrypted at rest and supports built-in integration with AWS Lambda to orchestrate custom rotation workflows. By fetching the secret dynamically using the AWS SDK, the client application always receives the active credential version without requiring redeployment.

Step-by-Step Solution

Store the sensitive credentials.

The third-party API key is saved as a secret in AWS Secrets Manager, ensuring it is encrypted at rest using an AWS KMS key.

AWS Secrets Manager is the recommended service for managing, rotating, and retrieving database credentials, API keys, and other secrets.

Configure the rotation mechanism.

An AWS Lambda rotation function is associated with the secret, and a rotation schedule of 30 days is configured.

Since the API key belongs to a third-party gateway, standard RDS rotation templates do not apply, so a custom Lambda function is required to communicate with the external API provider and update the secret.

Update the client application code.

The Lambda function uses the AWS SDK to retrieve the secret value dynamically during execution.

Retrieving the secret at runtime ensures that the application always uses the most current API key version without requiring configuration changes or code redeployments when rotation occurs.

Key Concept

AWS Secrets Manager supports native, automated rotation of secrets via custom AWS Lambda functions, enabling secure retrieval of credentials at runtime without application redeployment.

Question 214Question →

An enterprise application running on Amazon Elastic Kubernetes Service (EKS) requires access to two configuration settings: a database connection port ( $3306$ ) and a highly sensitive database password. The database password must be automatically rotated every $30$ days. The solutions architect must design a secure and cost-optimized solution that stores these parameters and supports the rotation requirement.

Which configuration management strategy should the solutions architect recommend?

Store both the database port and the database password as String parameters in AWS Systems Manager Parameter Store, and restrict access using IAM policies to ensure security while minimizing cost.

Store the database port as a String parameter in AWS Systems Manager Parameter Store. Store the database password as a SecureString parameter in Parameter Store, and enable automatic key rotation on the associated AWS KMS customer managed key to rotate the password value every

30

days.

Store the database port as a String parameter in AWS Systems Manager Parameter Store. Store the database password in AWS Secrets Manager and configure automatic rotation for the secret.

Store the database port in AWS Secrets Manager. Store the database password as a String parameter in AWS Systems Manager Parameter Store, and configure a custom AWS Lambda function to handle parameter rotation.

Show answer & explanation

Answer: Store the database port as a String parameter in AWS Systems Manager Parameter Store. Store the database password in AWS Secrets Manager and configure automatic rotation for the secret.

Answer

Store the database port as a String parameter in AWS Systems Manager Parameter Store, and store the database password in AWS Secrets Manager with automatic rotation configured.

Storing the non-sensitive database port as a String parameter in AWS Systems Manager Parameter Store is cost-effective because Standard parameters are free. AWS Secrets Manager is designed to secure sensitive credentials like database passwords and natively supports automatic credential rotation. This combination provides a secure and cost-optimized architecture that meets the rotation requirement.

Step-by-Step Solution

Analyze the security and rotation requirements for both configuration settings.

The database port (

3306

) is non-sensitive and does not require encryption or rotation. The database password is highly sensitive and requires automatic rotation every

30

days.

Separating parameters by security classification allows for a cost-effective design.

Select the storage mechanism for the non-sensitive configuration parameter.

Store the port as a standard String parameter in Systems Manager Parameter Store.

Standard parameters in Parameter Store are free of charge, minimizing operational costs for non-sensitive data.

Select the storage and rotation mechanism for the sensitive database credential.

Store the database password in AWS Secrets Manager and configure automatic rotation.

Secrets Manager provides native integration for rotating database credentials automatically, satisfying the compliance requirement securely.

Key Concept

Selecting and configuring secure storage and automatic rotation mechanisms for sensitive and non-sensitive configurations using Parameter Store and Secrets Manager.

Estimated Time:1m 30s

Question 215Question →

A company is designing a secure architecture to allow a third-party vendor's application, running in AWS Account B ( $222222222222$ ), to write diagnostic logs to an Amazon S3 bucket in the company's AWS Account A ( $111111111111$ ). The S3 bucket in Account A is encrypted using an AWS KMS customer managed key. The solution must ensure that the vendor cannot access other resources in Account A, does not use long-term AWS credentials, is protected against the confused deputy problem, and follows the principle of least privilege. Which TWO configurations must a solutions architect implement to meet these requirements?

Select all that apply

Create an IAM role in Account A with a trust policy that allows the principal `arn:aws:iam::222222222222:root` to perform `sts:AssumeRole`, and include a condition for `sts:ExternalId` matching a unique vendor-provided identifier.

Attach a permissions policy to the IAM role in Account A that grants `s3:PutObject` permissions on the S3 bucket and `kms:GenerateDataKey` permissions on the KMS key, and configure the KMS key policy to allow the IAM role to use the key.

Create a dedicated IAM user in Account A, attach the required S3 and KMS permissions, and save the access keys as a String parameter type in Systems Manager Parameter Store for the vendor to retrieve.

Use the AWS account root user of Account A to generate a pre-signed S3 URL with an extended expiration, and configure the vendor application to upload diagnostic logs directly using this URL.

Modify the S3 bucket policy in Account A to allow write access directly to the vendor's IAM role, and rely on automatic KMS key rotation to automatically update key access permissions.

Show answer & explanation

Answer: Create an IAM role in Account A with a trust policy that allows the principal `arn:aws:iam::222222222222:root` to perform `sts:AssumeRole`, and include a condition for `sts:ExternalId` matching a unique vendor-provided identifier.; Attach a permissions policy to the IAM role in Account A that grants `s3:PutObject` permissions on the S3 bucket and `kms:GenerateDataKey` permissions on the KMS key, and configure the KMS key policy to allow the IAM role to use the key.

Answer

The solutions architect must create an IAM role in Account A that trusts Account B with an external ID condition, and attach a policy allowing write access to the S3 bucket and permission to generate data keys from the KMS key.

To secure cross-account access without long-term credentials, a solutions architect should configure the third party to assume an IAM role in the resource-owning account. Trusting the root principal of Account B allows IAM administrators in Account B to delegate this role to their local resources, while the external ID prevents the confused deputy vulnerability. The assumed role must also possess write permissions for S3 and permissions to generate data keys for the KMS customer managed key to perform SSE-KMS encryption.

Step-by-Step Solution

Establish the cross-account trust relationship.

An IAM role in Account A is created, allowing Account B to assume it under the condition that a specific external ID is supplied.

This eliminates the need for long-term credentials and addresses the confused deputy problem.

Configure permissions for writing encrypted S3 data.

The IAM role permissions policy is configured with S3 write access and KMS data key generation permissions.

Writing to a bucket encrypted with a customer managed KMS key requires both S3 and KMS permissions.

Update resource-based key policies.

The KMS key policy is updated to explicitly trust the IAM role in Account A.

KMS customer managed keys require explicit key policy permissions to allow IAM identities to execute cryptographic operations.

Key Concept

Implementing secure cross-account delegation using IAM roles, trust policies with external IDs, and resource permissions for KMS-encrypted S3 buckets.

Estimated Time:3m 0s

Question 216Question →

A company has a global logistics application deployed on Amazon Elastic Kubernetes Service (EKS) across two AWS regions: us-east-1 and eu-west-1. The application requires access to a proprietary third-party API key to query shipping rates. The API key must be encrypted at rest using a customer managed key (CMK) and must be rotated automatically every 90 days. The application in both regions must retrieve the key with minimal latency. Which combination of actions should a solutions architect recommend to meet these requirements with the least operational overhead? (Select TWO.)

Select all that apply

Store the API key as a secret in AWS Secrets Manager in us-east-1, and configure replication of the secret to eu-west-1.

Create an AWS Lambda function that performs the API key rotation, and configure AWS Secrets Manager to trigger the function every 90 days.

Store the API key as a plaintext String parameter in AWS Systems Manager Parameter Store to allow direct access from both regions without decryption overhead.

Enable automatic key rotation on the KMS customer managed key (CMK) that encrypts the API key secret to automatically rotate the API key value every 90 days.

Store the API key as a SecureString parameter in AWS Systems Manager Parameter Store, and configure KMS key rotation to automatically update the API key value every 90 days.

Show answer & explanation

Answer: Store the API key as a secret in AWS Secrets Manager in us-east-1, and configure replication of the secret to eu-west-1.; Create an AWS Lambda function that performs the API key rotation, and configure AWS Secrets Manager to trigger the function every 90 days.

Answer

Store the API key as a secret in AWS Secrets Manager in us-east-1 with replication to eu-west-1, and create an AWS Lambda function triggered by Secrets Manager to rotate the secret every 90 days.

Storing the API key in AWS Secrets Manager with native replication to another region ensures local low-latency access in both regions. Creating a custom Lambda function to rotate the secret and scheduling it via Secrets Manager satisfies the 90-day automatic rotation requirement.

Step-by-Step Solution

Select a secure storage service that supports cross-region replication and automatic rotation.

AWS Secrets Manager is chosen because it supports native replication to multiple regions (for low-latency access in us-east-1 and eu-west-1) and built-in integration with AWS Lambda for automatic rotation.

Systems Manager Parameter Store does not support native cross-region replication or built-in rotation schedules for custom secrets, which would increase operational overhead.

Configure the replication of the secret from the primary region to the secondary region.

The secret is stored in us-east-1 and replicated to eu-west-1, allowing EKS pods in both regions to query local replica secrets with minimal latency.

This satisfies the requirement to access the secret with low latency across regions.

Implement automatic rotation of the third-party API key.

A custom AWS Lambda function is developed to interact with the third-party provider and update the secret value in Secrets Manager. Secrets Manager is configured to run this Lambda function every 90 days.

Since the API key belongs to a third-party service, automatic rotation requires custom logic implemented via a Lambda function. KMS key rotation only rotates the backing KMS key, not the secret content itself.

Key Concept

AWS Secrets Manager supports native cross-region replication and automated custom secret rotation via AWS Lambda functions, whereas KMS key rotation only rotates the cryptographic keys and not the secrets themselves.

Estimated Time:2m 0s

Question 217Question →

A financial technology company operates a transaction processing application deployed across two AWS Regions: us-east-1 and us-west-2. The application requires access to a third-party payment gateway API key that must be rotated every 30 days. To comply with security mandates, the key must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS, and the KMS CMK itself must be rotated annually. The solution must ensure that client applications in both Regions can retrieve the active API key with latency under $50\text{ ms}$ and experience no service interruptions during both API key rotation and KMS key rotation. Which architecture should a solutions architect recommend to meet these requirements with the least operational overhead?

Create a secret in AWS Secrets Manager in us-east-1 with replication to us-west-2. Use a Customer Managed Key (CMK) to encrypt the secret. Configure automated rotation every 30 days using a custom AWS Lambda function. Enable annual rotation on the KMS CMK, and configure the Lambda function to re-encrypt all historical secret versions using the new KMS key version immediately after KMS key rotation occurs.

Create a Systems Manager Parameter Store parameter of type String in both us-east-1 and us-west-2. Configure an AWS Lambda function triggered by an Amazon EventBridge scheduled event to update the parameter value in both Regions every 30 days. Configure the Customer Managed Key (CMK) used to encrypt the parameters to rotate automatically every year.

Create a secret in AWS Secrets Manager in us-east-1 and enable multi-Region replication to us-west-2. Configure the secret to use a Customer Managed Key (CMK) in each Region. Enable Secrets Manager automatic rotation every 30 days using a custom AWS Lambda function, and enable automatic key rotation on both KMS CMKs. Configure the application in each Region to read the secret from the local Secrets Manager endpoint.

Create a Systems Manager Parameter Store parameter of type SecureString in us-east-1. Configure a custom AWS Lambda function triggered by an Amazon EventBridge scheduled event to replicate the parameter value to us-west-2 and manually rotate the KMS Customer Managed Key (CMK) material every 30 days to keep the parameter and KMS key versions synchronized.

Show answer & explanation

Answer: Create a secret in AWS Secrets Manager in us-east-1 and enable multi-Region replication to us-west-2. Configure the secret to use a Customer Managed Key (CMK) in each Region. Enable Secrets Manager automatic rotation every 30 days using a custom AWS Lambda function, and enable automatic key rotation on both KMS CMKs. Configure the application in each Region to read the secret from the local Secrets Manager endpoint.

Answer

The correct architecture uses AWS Secrets Manager's native multi-Region replication to copy the secret to the secondary Region, allowing local applications to retrieve the secret with minimal latency. Encryption is handled using a Customer Managed Key (CMK) in each Region. Configuring automatic rotation via a custom Lambda function ensures the third-party credential is rotated every 30 days, and enabling automatic KMS CMK rotation ensures that key rotation occurs seamlessly without needing manual re-encryption or causing application downtime.

Step-by-Step Solution

Select AWS Secrets Manager for storing the sensitive API key rather than AWS Systems Manager Parameter Store.

Secrets Manager is chosen because it supports native multi-Region replication and automated rotation out-of-the-box, which aligns with the requirements of minimal latency (< 50 ms via local endpoints) and low operational overhead.

Systems Manager Parameter Store lacks native cross-Region replication and automated rotation features for third-party keys.

Configure multi-Region replication for the secret from us-east-1 to us-west-2 using local KMS CMKs in each Region.

The secret is automatically replicated and re-encrypted in us-west-2 using the destination Region's KMS CMK.

This guarantees that application instances in both Regions can query their local Secrets Manager endpoint to retrieve the secret with low latency.

Implement a custom AWS Lambda function to rotate the third-party API credential every 30 days, and configure Secrets Manager to trigger it.

Secrets Manager manages the execution of the Lambda function to update the secret value and propagates the updated secret to the replica Region.

Since the API key belongs to a third-party gateway, a custom Lambda function is necessary to call the gateway's API to obtain a new key and update the secret value.

Enable automatic annual key rotation on the KMS Customer Managed Keys in both Regions.

AWS KMS generates a new backing key annually while retaining the old backing key to decrypt any historical ciphertext.

This ensures that older secret versions can still be decrypted seamlessly without requiring manual re-encryption or causing application downtime.

Key Concept

AWS Secrets Manager multi-Region replication combined with custom rotation Lambda functions and AWS KMS automatic key rotation mechanics.

Estimated Time:3m 0s

Question 218Question →

A global media streaming platform uses Amazon Route 53 for DNS, Amazon CloudFront for content delivery, and an Application Load Balancer (ALB) backing an Auto Scaling group of Amazon EC2 instances. During peak events, the platform is frequently targeted by HTTP flood attacks (Layer 7) that cause the EC2 Auto Scaling group to scale out unnecessarily, resulting in high costs. Additionally, DNS query floods have recently threatened the availability of their DNS services. The platform requires a solution that automatically mitigates both Layer 7 and DNS-level DDoS attacks, provides real-time visibility into attacks, and offers financial protection against scaling costs incurred due to DDoS-related traffic spikes. Which solution will meet these requirements with the least administrative effort?

Subscribe to AWS Shield Advanced. Associate Shield Advanced with the Route 53 hosted zones, CloudFront distributions, and the ALB. Enable AWS WAF on the CloudFront distributions, configure rate-based rules, and enable Shield Advanced automatic application-layer DDoS mitigation.

Subscribe to AWS Shield Standard. Enable AWS WAF rate-based rules on the Application Load Balancer. Create a custom AWS Lambda function that parses VPC Flow Logs and dynamically updates Network ACLs at the subnet level to block malicious IPs and prevent EC2 scaling costs.

Subscribe to AWS Shield Advanced. Associate Shield Advanced with the VPC subnets containing the Application Load Balancer and EC2 instances. Enable AWS WAF on the ALB to mitigate DNS query floods, and configure Security Group rules to block volumetric Layer 4 attacks at the edge.

Enable AWS WAF on the Application Load Balancer. Implement AWS Shield Standard across the CloudFront distributions and ALB. Use AWS Firewall Manager to automatically create and deploy stateless Network ACL rules to the VPC boundary to filter out Layer 7 HTTP flood attacks.

Show answer & explanation

Answer: Subscribe to AWS Shield Advanced. Associate Shield Advanced with the Route 53 hosted zones, CloudFront distributions, and the ALB. Enable AWS WAF on the CloudFront distributions, configure rate-based rules, and enable Shield Advanced automatic application-layer DDoS mitigation.

Answer

Subscribe to AWS Shield Advanced, associate it with the Route 53 hosted zones, CloudFront distributions, and the Application Load Balancer, enable AWS WAF on CloudFront with rate-based rules, and enable automatic application-layer DDoS mitigation.

The correct solution uses AWS Shield Advanced associated with Amazon Route 53, Amazon CloudFront, and the Application Load Balancer. Shield Advanced protects Route 53 against DNS query floods, and when coupled with AWS WAF, it automatically creates rules to mitigate Layer 7 HTTP flood attacks. Additionally, Shield Advanced includes DDoS cost protection, which provides service credits for scaling costs (such as ALB and EC2 Auto Scaling charges) caused by DDoS attacks, meeting all requirements with minimal administrative overhead.

Step-by-Step Solution

Identify the requirements for Layer 7 HTTP flood protection, DNS query flood protection, and cost protection.

Determine that AWS Shield Advanced is required because AWS Shield Standard does not provide cost protection or DNS/L7 automatic mitigation.

AWS Shield Advanced offers financial protection for scaling costs and native integration with Route 53 and CloudFront/ALB.

Select the resources to protect with AWS Shield Advanced.

Associate Shield Advanced with Route 53 hosted zones (for DNS query floods), CloudFront distributions, and the ALB.

This establishes DDoS protection at both the DNS routing layer and the content delivery/load balancing layers.

Configure application-layer (Layer 7) defenses using AWS WAF and Shield Advanced features.

Enable AWS WAF on CloudFront and configure rate-based rules, and turn on the automatic application-layer DDoS mitigation feature of Shield Advanced.

This automatically creates and deploys AWS WAF rules when a Layer 7 DDoS attack is detected, preventing origin overload and unnecessary scaling.

Key Concept

AWS Shield Advanced protects Route 53, CloudFront, and ALB against sophisticated Layer 3/4 and Layer 7 DDoS attacks, provides automatic L7 mitigation via AWS WAF, and offers cost protection for scaling resources during an attack.

Estimated Time:3m 0s

Question 219Question →

A global e-commerce company hosts its web application on Amazon EC2 instances behind an Application Load Balancer (ALB), utilizing Amazon CloudFront for content delivery. During a promotional event, the security team identifies a massive spike in HTTP POST requests targeting the `/login` endpoint from a distributed botnet. This Layer 7 traffic is bypassing cache and exhausting the compute capacity of the origin EC2 instances. The company needs to detect and block this application-layer attack at the edge before it reaches the backend infrastructure. Which solution should a solutions architect recommend?

Configure stateless Network Access Control Lists (NACLs) on the ALB subnets to deny inbound traffic from the source IP addresses generating the HTTP POST requests

Deploy AWS WAF on the Amazon CloudFront distribution and configure a rate-based rule targeting the `/login` path

Enable AWS Shield Standard on the Amazon CloudFront distribution to automatically filter the Layer 7 HTTP POST requests

Create an inbound rule in the Application Load Balancer's security group that denies traffic from the offending IP addresses on port 443

Show answer & explanation

Answer: Deploy AWS WAF on the Amazon CloudFront distribution and configure a rate-based rule targeting the `/login` path

Answer

Deploy AWS WAF on the Amazon CloudFront distribution and configure a rate-based rule targeting the `/login` path

The correct solution is to deploy AWS WAF on the Amazon CloudFront distribution and create a rate-based rule for the `/login` path. AWS WAF operates at Layer 7 and is integrated with CloudFront at the AWS edge, allowing it to inspect HTTP/HTTPS request details like the request method (POST) and URI path. A rate-based rule tracks the number of requests originating from each IP address and blocks them once they exceed a defined threshold, effectively neutralizing the distributed botnet flood before the traffic reaches the backend ALB or EC2 origin.

Step-by-Step Solution

Analyze the attack vector and identify the target layer.

The attack consists of HTTP POST requests targeting a specific path (`/login`), which is a Layer 7 (application-layer) exploit bypassing cache.

This determines that network-level controls (Layer 3/4) alone will not suffice, and an application-aware firewall is required.

Select the appropriate AWS security service for edge protection.

Amazon CloudFront integrated with AWS WAF is chosen because AWS WAF inspects Layer 7 traffic and is deployed at the Edge locations.

Deploying the security control at the edge prevents malicious traffic from consuming bandwidth or compute resources at the origin ALB and EC2 layers.

Configure the detection and mitigation rule.

Create an AWS WAF rate-based rule that monitors requests to the `/login` URI path, blocking clients that exceed the specified request limit.

Rate-based rules automatically mitigate HTTP floods from distributed sources targeting specific high-load application endpoints.

Key Concept

Edge protection against Layer 7 application DDoS attacks using AWS WAF and Amazon CloudFront

Estimated Time:1m 30s

Question 220Question →

A solutions architect is designing a secure architecture for a web application. The application tier runs on Amazon EC2 instances and must access a database hosted on Amazon RDS. The database credentials must be encrypted at rest, and the security team requires that these credentials be rotated automatically every 30 days. In addition, the company's internal developers, who are authenticated via corporate Active Directory, need temporary administrative access to the AWS Management Console to manage the RDS instances. Which combination of actions will meet these requirements in the most secure manner?

Store the database credentials in AWS Secrets Manager and configure automatic rotation. Attach an IAM role to the EC2 instances with permission to retrieve the credentials. Create individual IAM users with long-term access keys for each corporate developer.

Store the database credentials in AWS Secrets Manager and configure automatic rotation. Attach an IAM role to the EC2 instances with permission to retrieve the credentials. Configure AWS IAM Identity Center to federate corporate Active Directory users, allowing them to assume an administrative IAM role.

Store the database credentials as plaintext parameters in Systems Manager Parameter Store. Attach an IAM role to the EC2 instances with permission to retrieve the parameters. Configure AWS IAM Identity Center to federate corporate Active Directory users, allowing them to assume an administrative IAM role.

Store the database credentials in AWS Secrets Manager and configure automatic rotation. Attach an IAM role to the EC2 instances with permission to retrieve the credentials. Provide the corporate developers with the AWS account root user credentials to manage the RDS instances.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation. Attach an IAM role to the EC2 instances with permission to retrieve the credentials. Configure AWS IAM Identity Center to federate corporate Active Directory users, allowing them to assume an administrative IAM role.

Answer

Storing database credentials in AWS Secrets Manager with automatic rotation ensures that credentials are encrypted at rest and rotated programmatically without application downtime. Attaching an IAM role to the EC2 instances allows them to securely access Secrets Manager using temporary security credentials rather than long-term credentials. Configuring AWS IAM Identity Center to federate corporate Active Directory users allows developers to sign in using their existing corporate credentials and assume an administrative IAM role with temporary credentials, aligning with the principle of least privilege and eliminating the overhead of managing long-term IAM user credentials.

Step-by-Step Solution

Store database credentials securely.

Store database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.

This encrypts the credentials at rest using AWS KMS and programmatically rotates them without manual intervention, satisfying database credentials security requirements.

Grant application access using IAM roles.

Attach an IAM role to the Amazon EC2 instances with a policy allowing access to the specific secret in AWS Secrets Manager.

This allows the application to dynamically retrieve database credentials using temporary security credentials instead of hardcoding credentials in code or configuration files.

Implement identity federation for administrative access.

Configure AWS IAM Identity Center integrated with the corporate Active Directory to allow corporate developers to log in and assume an administrative IAM role.

This eliminates the need to manage individual IAM users for federated corporate employees, ensuring administrative access is controlled, audited, and utilizes short-lived security tokens.

Key Concept

Implementing secure credential management with AWS Secrets Manager and administrative access federation with AWS IAM Identity Center.

Estimated Time:2m 0s

PreviousPage 11 / 22Next

Design Secure Architectures

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept