Design Secure Architectures

438 questions

All types438 Multiple choice214 Multiple select224

An enterprise is designing a cross-account data ingestion pipeline. Applications running on Amazon EC2 instances in Account A ( $111111111111$ ) must retrieve sensitive log files from an Amazon S3 bucket located in Account B ( $222222222222$ ). The EC2 instances run inside an IAM instance profile associated with the IAM role `AppRole`. The S3 bucket in Account B is encrypted with a Customer Managed Key (CMK) in AWS KMS. The company's security policy requires that all cross-account access must utilize temporary credentials, enforce the principle of least privilege, and ensure all data remains encrypted.

Which configuration should the Solutions Architect implement to meet these requirements?

Create a new IAM user in Account B with permissions to read from the S3 bucket and decrypt using the KMS key. Generate long-term access keys for this IAM user, and configure the application on the EC2 instances in Account A to use these credentials.

Generate access keys for Account B's AWS account root user. Store these credentials in Systems Manager Parameter Store as a standard String parameter, and configure the applications on the EC2 instances in Account A to retrieve these credentials at runtime to perform S3 operations.

Configure the S3 bucket policy in Account B to grant s3:GetObject permissions to the IAM role AppRole in Account A. Attach an IAM policy to AppRole in Account A that allows s3:GetObject on the Account B S3 bucket. Configure the KMS key policy in Account B to allow AppRole the kms:Decrypt action, and enable automatic annual key rotation on the KMS key.

Configure the EC2 instances' AppRole in Account A to assume a role in Account B. Enable KMS automatic key rotation in Account B, and perform a manual re-encryption of all historical log files in S3 because rotating the Customer Managed Key disables the ability to decrypt historical logs encrypted under the previous key version.

Show answer & explanation

Answer: Configure the S3 bucket policy in Account B to grant s3:GetObject permissions to the IAM role AppRole in Account A. Attach an IAM policy to AppRole in Account A that allows s3:GetObject on the Account B S3 bucket. Configure the KMS key policy in Account B to allow AppRole the kms:Decrypt action, and enable automatic annual key rotation on the KMS key.

Answer

Configure the S3 bucket policy in Account B to grant s3:GetObject permissions to the IAM role AppRole in Account A, attach an IAM policy to AppRole in Account A allowing s3:GetObject, configure the KMS key policy in Account B to allow AppRole the kms:Decrypt action, and enable automatic annual key rotation on the KMS key.

The correct configuration establishes cross-account access using resource-based policies (S3 bucket policy and KMS key policy) to trust the IAM role AppRole in Account A. This allows the application running on the EC2 instances to directly access the bucket using temporary security credentials managed by the EC2 instance profile, conforming to security best practices. Enabling automatic KMS key rotation satisfies the encryption requirement without disrupting access to older objects.

Step-by-Step Solution

Configure permissions for the S3 bucket in Account B.

The resource-based S3 bucket policy in Account B allows access to the IAM role in Account A.

For cross-account access, both the IAM policy in the trusting account (Account A) and the resource policy in the trusted account (Account B) must explicitly grant access.

Configure the IAM role permissions in Account A.

The identity-based policy attached to AppRole allows it to perform s3:GetObject on the bucket in Account B.

This completes the IAM delegation requirement from the client side.

Grant decryption permissions on the KMS key in Account B.

The KMS key policy is modified to allow AppRole in Account A to call kms:Decrypt.

Since the bucket is encrypted with a Customer Managed Key, the caller must have decrypt permissions on the key. KMS key policies must explicitly grant cross-account access, as identity-based policies alone cannot delegate cross-account access without key policy approval.

Enable automatic annual key rotation on the KMS key.

AWS KMS will automatically rotate the key annually without affecting current access.

KMS key rotation preserves older key versions so that existing data remains readable without manual re-encryption.

Key Concept

Cross-account resource access using resource-based policies (S3 and KMS) in combination with identity-based IAM policies, while adhering to temporary credential security policies and KMS rotation behaviors.

Estimated Time:2m 30s

Question 222Question →

A software-as-a-service (SaaS) provider hosts its API on Amazon EC2 instances behind an Application Load Balancer (ALB). The API has been experiencing recurring Layer 7 HTTP flood attacks, causing resource exhaustion on the EC2 instances. The provider wants to mitigate these attacks at the AWS network edge before they reach the ALB, without blocking legitimate client requests.

Which solution should a solutions architect recommend?

Create an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL containing a rate-based rule with the distribution.

Rely on AWS Shield Standard, which is enabled by default on the Application Load Balancer, to automatically inspect and block the Layer 7 HTTP flood attacks.

Configure stateless Network Access Control Lists (NACLs) on the ALB subnets to automatically track connection states and block the HTTP flood traffic.

Update the security groups associated with the EC2 instances to dynamically block the source IP addresses of the HTTP flood attacks at the subnet boundary.

Show answer & explanation

Answer: Create an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL containing a rate-based rule with the distribution.

Answer

Create an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL containing a rate-based rule with the distribution.

Associating an AWS WAF web ACL with an Amazon CloudFront distribution allows the rate-limiting and filtering of Layer 7 HTTP flood attacks at AWS edge locations, preventing the traffic from reaching the Application Load Balancer and the backend EC2 instances.

Step-by-Step Solution

Identify the OSI layer of the attack.

The attacks are Layer 7 HTTP floods, which target the application layer.

Choosing the right defense requires understanding whether the attack is at the infrastructure layer (Layer 3/4) or the application layer (Layer 7).

Determine the appropriate AWS security services for Layer 7 mitigation.

AWS WAF is designed to inspect and filter Layer 7 traffic, while AWS Shield Standard only covers Layer 3/4.

AWS WAF rate-based rules are required to automatically identify and block clients exceeding a reasonable request threshold.

Deploy the protection at the network edge.

Position Amazon CloudFront in front of the Application Load Balancer, and associate the AWS WAF web ACL with the CloudFront distribution.

Placing CloudFront and AWS WAF at the edge ensures that malicious traffic is dropped before it consumes bandwidth or resources at the Application Load Balancer.

Key Concept

Mitigating Layer 7 DDoS attacks at the edge using Amazon CloudFront and AWS WAF rate-based rules.

Question 223Question →

A digital payment processing company provides a merchant API endpoint using an Application Load Balancer (ALB) backed by Amazon EC2 instances in a private subnet. The company must implement a security solution to defend against distributed denial of service (DDoS) attacks. The solution must protect the API from HTTP GET floods (Layer 7) and automatically mitigate UDP floods (Layer 3/4) before they reach the ALB. Additionally, the company requires 24/7 access to the AWS Shield Response Team (SRT) to assist in custom mitigation during active security incidents.

Which combination of AWS services and configurations should a solutions architect recommend to meet these security requirements with the least operational complexity?

Deploy Amazon CloudFront in front of the ALB. Associate an AWS WAF Web ACL with the CloudFront distribution and configure a rate-based rule. Subscribe to AWS Shield Advanced and enable it on the CloudFront distribution.

Deploy Amazon CloudFront in front of the ALB. Subscribe to AWS Shield Standard for the CloudFront distribution. Configure a custom AWS Lambda function triggered by Amazon CloudWatch Logs to dynamically add deny rules to the VPC Network Access Control Lists (NACLs) to block HTTP GET and UDP floods.

Associate an AWS WAF Web ACL directly with the ALB and configure a rate-based rule for HTTP GET floods. Enable AWS Shield Advanced on the ALB to mitigate UDP floods and obtain SRT access. Implement Security Group rules on the ALB to automatically drop UDP packets from untrusted CIDR blocks.

Subscribe to AWS Shield Advanced and enable it directly on the private EC2 instances. Configure AWS WAF on the ALB to filter the UDP floods. Set up a VPC gateway endpoint to automatically route all inbound API traffic through AWS Shield Response Team (SRT) scrubbing centers.

Show answer & explanation

Answer: Deploy Amazon CloudFront in front of the ALB. Associate an AWS WAF Web ACL with the CloudFront distribution and configure a rate-based rule. Subscribe to AWS Shield Advanced and enable it on the CloudFront distribution.

Answer

The correct architecture uses Amazon CloudFront as the entry point to absorb Layer 3 and Layer 4 attacks at the AWS edge using AWS Shield Advanced. This configuration also grants 24/7 access to the AWS Shield Response Team (SRT) for active assistance. Meanwhile, AWS WAF is associated with CloudFront to inspect Layer 7 traffic and enforce rate limits on HTTP GET requests, mitigating HTTP flood attacks automatically before they reach the backend Application Load Balancer.

Step-by-Step Solution

Analyze the requirements for L3/4 and L7 protection along with SRT engagement.

Identified the need for Layer 3/4 protection (UDP floods), Layer 7 protection (HTTP GET floods), and AWS Shield Response Team (SRT) access.

This establishes the scope of the services needed: AWS Shield Advanced is required for SRT access, and AWS WAF is required for Layer 7 rate limiting.

Determine the optimal point of enforcement.

Amazon CloudFront should be deployed in front of the ALB to act as the entry point at the AWS edge.

Enforcing security at the edge (CloudFront) prevents DDoS traffic from reaching the regional resources (ALB and EC2), protecting network capacity and compute resources from exhaustion.

Configure Layer 3/4 and Layer 7 protection on the edge resource.

Enable AWS Shield Advanced on CloudFront to mitigate L3/4 UDP floods and gain SRT support. Associate AWS WAF with CloudFront and configure a rate-based rule to automatically block IPs exceeding HTTP GET thresholds.

This combined architecture ensures automated protection at the edge, satisfies the requirement for SRT access, and handles both application-layer and infrastructure-layer attacks with minimal operational overhead.

Key Concept

Best practices for AWS Edge Security involve combining Amazon CloudFront, AWS Shield Advanced, and AWS WAF to mitigate Layer 3, 4, and 7 DDoS attacks before traffic reaches regional infrastructure.

Question 224Question →

A municipal utility company hosts a public portal on AWS for customers to view real-time energy usage and pay bills. The application runs on EC2 instances behind an Application Load Balancer (ALB) in a single AWS Region. The portal has recently experienced service outages due to sudden HTTP flood attacks targeting the login endpoint. The company needs to implement a cost-effective, automated edge security solution that mitigates these Layer 7 attacks before they reach the ALB, while minimizing latency for legitimate local users.

Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer.

Associate an AWS WAF web ACL with the CloudFront distribution and configure a rate-based rule to limit requests to the login endpoint.

Enable AWS Shield Standard on the Application Load Balancer to automatically block Layer 7 HTTP flood attacks.

Configure a stateless network ACL on the subnets containing the Application Load Balancer to block traffic from the attacker IP addresses.

Create a security group for the Application Load Balancer and enable rate-limiting rules to restrict concurrent TCP connections.

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer.; Associate an AWS WAF web ACL with the CloudFront distribution and configure a rate-based rule to limit requests to the login endpoint.

Answer

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer and associate an AWS WAF web ACL with the distribution to configure a rate-based rule to limit requests to the login endpoint.

Deploying Amazon CloudFront moves the entry point of the application to the AWS global edge network, which naturally absorbs Layer 3 and Layer 4 DDoS attacks. Associating AWS WAF with CloudFront allows the solutions architect to inspect Layer 7 HTTP requests and apply a rate-based rule to automatically block IP addresses that exceed a specified threshold of requests to the login endpoint. This provides automated, cost-effective Layer 7 protection before the malicious traffic can reach the Application Load Balancer or the backend compute resources.

Step-by-Step Solution

Analyze the attack pattern and application entry point.

The attack is a Layer 7 HTTP flood targeting a specific endpoint (the login page) of an ALB-backed application.

Identifying the target and type of attack ensures the mitigation is applied at the correct layer of the OSI model.

Introduce an edge network layer using Amazon CloudFront.

CloudFront acts as the public entry point, caching static content and distributing the threat surface globally across AWS edge locations.

Moving the endpoint to the edge prevents direct HTTP attacks from reaching the ALB and backend EC2 instances.

Implement Layer 7 filtering using AWS WAF and configure rate-based rules.

An AWS WAF web ACL is associated with the CloudFront distribution, containing a rate-based rule that tracks requests from client IP addresses and blocks them if they exceed a configured threshold.

This automatically detects and mitigates HTTP flood attacks targeting the login endpoint in real time without administrative overhead.

Key Concept

Edge protection and Layer 7 DDoS mitigation using Amazon CloudFront and AWS WAF rate-based rules.

Question 225Question →

A company is deploying a secure microservices application on Amazon EC2 instances within a private subnet ( $10.0.2.0/24$ ) of an Amazon VPC. The application must receive HTTPS requests on TCP port $8443$ from an internal Application Load Balancer (ALB) located in a separate private subnet ( $10.0.1.0/24$ ). Additionally, the EC2 instances must download container assets from Amazon S3 and write application logs to an S3 bucket. A Gateway VPC Endpoint is configured for S3 (`vpce-s3`) in the VPC. The company's security policy requires the use of strict, custom Network ACLs (NACLs) on the application subnet that operate under a default-deny posture, allowing only the minimum required traffic. Security Groups are also configured at the instance level.

Which of the following configurations must a solutions architect implement to establish secure, functional network connectivity for the application? (Select TWO.)

Select all that apply

An inbound rule in the application subnet NACL allowing TCP traffic from

10.0.1.0/24

on port

8443

, and an outbound rule in the same NACL allowing TCP traffic to

10.0.1.0/24

on ports

1024-65535

An outbound rule in the application subnet NACL allowing TCP traffic to the Amazon S3 prefix list on port

443

, and an inbound rule in the same NACL allowing TCP traffic from the Amazon S3 prefix list on ports

1024-65535

An outbound rule in the application Security Group allowing TCP traffic to the Amazon S3 prefix list on port

443

, and an inbound rule in the same Security Group allowing TCP traffic from the Amazon S3 prefix list on ports

1024-65535

An inbound rule in the application subnet NACL allowing TCP traffic from

10.0.1.0/24

on port

8443

, relying on the NACL's stateful tracking to automatically allow outbound return traffic to the ALB.

An outbound rule in the application subnet NACL allowing TCP traffic to the Amazon S3 prefix list on port

443

, while routing S3 traffic through a NAT Gateway deployed in the application subnet to bypass inbound NACL requirements.

Show answer & explanation

Answer: An inbound rule in the application subnet NACL allowing TCP traffic from $10.0.1.0/24$ on port $8443$ , and an outbound rule in the same NACL allowing TCP traffic to $10.0.1.0/24$ on ports $1024-65535$ .; An outbound rule in the application subnet NACL allowing TCP traffic to the Amazon S3 prefix list on port $443$ , and an inbound rule in the same NACL allowing TCP traffic from the Amazon S3 prefix list on ports $1024-65535$ .

Answer

Implementing an inbound rule in the application subnet NACL for port 8443 along with an outbound rule for the ephemeral port range 1024-65535 to the ALB subnet, and implementing an outbound rule in the application subnet NACL to the S3 prefix list on port 443 along with an inbound rule for the ephemeral port range 1024-65535 from the S3 prefix list.

The correct configurations involve setting up both inbound and outbound rules for the stateless Network ACL (NACL) to permit connection initiation and return traffic. For traffic initiated by the ALB, the NACL requires an inbound rule for the HTTPS traffic on port 8443 and an outbound rule to allow the response to reach the ALB's ephemeral port range (1024-65535). For traffic initiated by the EC2 instances to Amazon S3, the NACL requires an outbound rule to the S3 prefix list on port 443 and an inbound rule to allow S3's response to reach the EC2 instances' ephemeral port range.

Step-by-Step Solution

Analyze the statefulness of the VPC security layers.

Identify that Security Groups are stateful (automatically permit return traffic) and Network ACLs (NACLs) are stateless (must explicitly define rules for both inbound and outbound traffic directions).

This establishes the fundamental behavior required to define correct NACL rules without making stateful assumptions.

Evaluate the traffic flow from the ALB to the EC2 instances.

The connection is initiated by the ALB from subnet 10.0.1.0/24 on port 8443 to the EC2 instances in subnet 10.0.2.0/24. The return traffic goes from the EC2 instances back to the ALB's ephemeral port range (1024-65535).

This details the exact inbound port and outbound ephemeral port range needed in the stateless NACL for the ALB-to-EC2 path.

Evaluate the traffic flow from the EC2 instances to Amazon S3.

The connection is initiated by the EC2 instances in subnet 10.0.2.0/24 to S3 via the Gateway VPC Endpoint on port 443 (HTTPS). The return traffic goes from S3 (public IP addresses matched by the S3 prefix list) back to the EC2 instances' ephemeral ports (1024-65535).

This details the outbound port and inbound ephemeral port range needed in the stateless NACL for the EC2-to-S3 path.

Synthesize the rules and rule out incorrect options.

Confirm that the NACL must have the ALB inbound/outbound rules and the S3 outbound/inbound rules. Rule out options that rely on NACL statefulness, misapply Security Group rule requirements, or suggest incorrect NAT Gateway configurations.

Ensures that all distractors are successfully eliminated based on cloud architecture rules.

Key Concept

VPC Network Security

Question 226Question →

An advertising agency has a hybrid cloud architecture spanning an on-premises data center and a multi-account AWS environment managed under AWS Organizations. The agency manages its employee identities in an on-premises Microsoft Active Directory (AD) environment. The security team requires that employees use their existing AD credentials to access the AWS Management Console and the AWS CLI across different accounts. The solution must ensure that credentials are not replicated to the cloud, must support authentication redirection to the on-premises directory, and must integrate with their existing on-premises RADIUS server for multi-factor authentication (MFA) with minimal administrative overhead. Which solution meets these requirements?

Enable AWS IAM Identity Center in the Organization's management account, configure an Active Directory directory source, and deploy an AWS Directory Service AD Connector to connect to the on-premises AD. Enable multi-factor authentication (MFA) on the AD Connector pointing to the on-premises RADIUS server.

Deploy AWS Directory Service AD Connector to connect to the on-premises Active Directory, and write a script to dynamically create matching IAM users with long-term credentials in each AWS account, mapping Active Directory group memberships to IAM policies.

Use the AWS account root credentials in the Organization's management account to configure a custom SAML 2.0 identity provider (IdP) in each AWS account, and configure the on-premises AD to generate federated SAML assertions mapping directly to the root user.

Deploy AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) in a multi-region deployment, establish a two-way forest trust with the on-premises AD, and provision individual IAM users with virtual MFA devices enabled in the management account.

Show answer & explanation

Answer: Enable AWS IAM Identity Center in the Organization's management account, configure an Active Directory directory source, and deploy an AWS Directory Service AD Connector to connect to the on-premises AD. Enable multi-factor authentication (MFA) on the AD Connector pointing to the on-premises RADIUS server.

Answer

The correct solution uses AWS IAM Identity Center combined with an AD Connector to federate identities from the on-premises Active Directory without replicating passwords or credentials. Since the AD Connector acts as a proxy, it redirects authentication requests back to the on-premises Active Directory and supports native integration with an on-premises RADIUS server for multi-factor authentication (MFA). This provides single sign-on access to both the console and CLI with minimal operational overhead.

Step-by-Step Solution

Enable AWS IAM Identity Center in the management account of AWS Organizations to centrally manage access to all AWS accounts.

Centralized access control capability is established across the organization.

Allows mapping AD groups to permission sets across multiple accounts without managing individual policies per account.

Deploy an AWS Directory Service AD Connector pointing to the on-premises Active Directory domain controllers.

A directory proxy is created that redirects authentication requests without replicating database records or credentials.

Meets the technical requirement of not replicating credentials to the cloud while utilizing the existing directory.

Configure the identity source in IAM Identity Center to use the deployed AD Connector.

IAM Identity Center is linked to the on-premises Active Directory.

Enables users to log in with their corporate credentials.

Configure Multi-Factor Authentication (MFA) on the AD Connector to redirect MFA validation requests to the on-premises RADIUS server.

MFA is enforced using the existing corporate RADIUS server.

Integrates with existing security mechanisms and satisfies the requirement to use the current RADIUS infrastructure.

Key Concept

AWS IAM Identity Center integration with on-premises Active Directory using AD Connector and RADIUS MFA

Estimated Time:2m 30s

Question 227Question →

A solutions architect is configuring the network security for a two-tier application in a new Amazon VPC. The application consists of web servers deployed in a public subnet and a MySQL database cluster deployed in a private subnet. The web servers must be accessible from the internet, and the database cluster must only accept connections from the web servers. Which TWO configurations should the solutions architect implement to secure these tiers? (Select TWO.)

Select all that apply

Configure the database security group to allow inbound traffic on TCP port 3306 with the source set as the web server security group.

Configure the web server security group to allow inbound traffic on TCP port 443 from any source (0.0.0.0/0).

Configure the database network ACL to allow inbound database traffic on TCP port 3306, relying on its stateful nature to permit the return traffic automatically.

Add an outbound rule to the database security group that explicitly allows TCP port 3306 response traffic back to the web server security group.

Associate the web server security group directly with the database subnet to permit traffic between the subnets.

Show answer & explanation

Answer: Configure the database security group to allow inbound traffic on TCP port 3306 with the source set as the web server security group.; Configure the web server security group to allow inbound traffic on TCP port 443 from any source (0.0.0.0/0).

Answer

To secure the two-tier application, the database security group should allow inbound database traffic on TCP port 3306 from the web server security group, and the web server security group must allow inbound HTTPS traffic from any source.

Allowing database traffic from the web server security group ensures database access is limited to the web tier. Allowing HTTPS traffic from any source allows public clients to access the web tier. Both configurations use stateful security groups to properly manage access at the instance level.

Step-by-Step Solution

Configure database security group rules.

Create an inbound rule allowing TCP port 3306 traffic, setting the source as the web server security group ID.

This establishes a secure database tier by limiting traffic to only the web servers.

Configure web server security group rules.

Create an inbound rule allowing TCP port 443 traffic from any source (0.0.0.0/0).

This allows clients on the internet to establish secure HTTPS connections with the web servers.

Key Concept

Configuring stateful security groups using security group references as sources or destinations to implement a secure multi-tier architecture.

Question 228Question →

A multiplayer game studio is building a new development environment consisting of multiple AWS accounts managed under AWS Organizations. The studio's corporate identity provider (IdP) is PingFederate, which holds all employee credentials. The game developers need single sign-on (SSO) access to both the AWS Management Console and several external SaaS-based collaboration tools. The solution must support automatic user provisioning and ensure that access is dynamically updated when developers join or leave projects, without managing long-term credentials in individual AWS accounts. Which solution meets these requirements with the least operational complexity?

Configure PingFederate as a SAML 2.0 identity provider directly in each member AWS account. Create a script that automatically provisions IAM users with long-term credentials in each AWS account when a developer is added in PingFederate, and configure the same credentials for SaaS tool access.

Deploy an AD Connector in the management account to link PingFederate to AWS. Configure a script that creates individual IAM users with programmatic keys for each developer within the management account, and use cross-account IAM roles to delegate access to member accounts.

Configure AWS IAM Identity Center, integrated with AWS Organizations, to use PingFederate as an external identity provider using SAML 2.0. Enable SCIM-based automatic provisioning from PingFederate to IAM Identity Center. Configure permission sets in IAM Identity Center for the AWS accounts and add custom SAML 2.0 applications for the SaaS collaboration tools.

Configure PingFederate to federate directly with the AWS account root user of each member account using SAML 2.0. Use the root user credentials to establish API integrations with the SaaS collaboration tools to automate access management.

Show answer & explanation

Answer: Configure AWS IAM Identity Center, integrated with AWS Organizations, to use PingFederate as an external identity provider using SAML 2.0. Enable SCIM-based automatic provisioning from PingFederate to IAM Identity Center. Configure permission sets in IAM Identity Center for the AWS accounts and add custom SAML 2.0 applications for the SaaS collaboration tools.

Answer

The correct solution leverages AWS IAM Identity Center integrated with AWS Organizations to centralize access control. By configuring PingFederate as an external SAML 2.0 identity provider and enabling SCIM-based automatic provisioning, the studio automates user lifecycle management and access dynamically. Furthermore, AWS IAM Identity Center supports custom SAML applications, allowing developers to authenticate into both AWS environments and SaaS collaboration tools from a single user portal without managing long-term credentials.

Step-by-Step Solution

Establish federation between the external identity provider (PingFederate) and AWS IAM Identity Center.

Trust is configured centrally, allowing users to authenticate with their existing PingFederate credentials.

Centralizing federation avoids the operational overhead of setting up SAML configurations individually in each AWS account.

Enable SCIM-based automatic provisioning between PingFederate and AWS IAM Identity Center.

User accounts and group memberships are automatically synchronized and updated when developers join or leave the studio.

SCIM removes the need for custom scripts or manual synchronization, satisfying the requirement to keep access dynamically updated with minimal overhead.

Create permission sets and assign them to users or groups for member accounts, and configure custom SAML 2.0 applications in IAM Identity Center for external SaaS tools.

Developers get single sign-on access to all assigned AWS accounts and SaaS tools through a single portal.

IAM Identity Center natively supports both multi-account AWS access and external SAML applications, eliminating individual account credential management.

Key Concept

Centralized Identity Federation and Directory Services with AWS IAM Identity Center and SCIM

Question 229Question →

A company needs to grant 500 external contractors access to specific AWS resources in a single AWS account. The contractors already have identities managed in an external OpenID Connect (OIDC) compliant identity provider. The company's security policy states that no long-term AWS credentials should be created for these contractors, and they must authenticate using their existing corporate credentials. Which solution meets these security requirements with the least administrative overhead?

Establish a trust relationship between AWS and the external OIDC identity provider by creating an OIDC identity provider in IAM, map the provider to IAM roles with the necessary permissions, and configure the contractors to assume these roles.

Create individual IAM users in the AWS account for each contractor, assign them to an IAM group with the required permissions, and require them to set up multi-factor authentication (MFA) for console login.

Enable console access for the AWS account root user, share the root credentials with the contractor team lead, and instruct the lead to create and manage the necessary resources on behalf of all contractors.

Retrieve the corporate credentials from the OIDC identity provider, store them as plaintext String parameters in AWS Systems Manager Parameter Store, and write a custom Lambda function to validate contractors during login.

Show answer & explanation

Answer: Establish a trust relationship between AWS and the external OIDC identity provider by creating an OIDC identity provider in IAM, map the provider to IAM roles with the necessary permissions, and configure the contractors to assume these roles.

Answer

Establishing a trust relationship with the external OIDC provider and mapping groups to IAM roles allows contractors to assume roles and receive temporary credentials. This satisfies the requirement of using existing corporate credentials, avoids creating long-term AWS credentials, and minimizes administrative overhead.

Step-by-Step Solution

Configure the identity provider (IdP) in AWS IAM.

AWS IAM establishes a trust relationship with the external OIDC-compliant identity provider.

This enables external users to authenticate using their existing corporate credentials without storing their passwords in AWS.

Create IAM roles with appropriate trust policies and permissions.

Roles are created that trust the OIDC identity provider and have permission policies attached.

This allows the external users to assume these roles and obtain short-term security credentials for access.

Configure the mapping between the IdP groups and AWS IAM roles.

Contractors are mapped to specific roles based on their group membership in the external IdP.

This ensures the principle of least privilege is enforced dynamically based on user identity, with zero long-term credentials created.

Key Concept

Federating identity providers with AWS IAM using OIDC allows external users to securely access AWS resources using temporary security credentials, avoiding the administrative overhead and security risks of managing individual IAM users.

Question 230Question →

An application is deployed on Amazon EC2 instances inside a private subnet (CIDR $10.0.2.0/24$ ) of an Amazon VPC. The application must regularly download large datasets from Amazon S3 and invoke a public, third-party payment gateway API over the internet. A public subnet (CIDR $10.0.1.0/24$ ) in the VPC contains a NAT Gateway. A Gateway VPC Endpoint for Amazon S3 has already been created for the VPC. Security policies require strict control over outbound traffic, minimal data processing charges, and the enforcement of the principle of least privilege. Which TWO configurations are required to establish secure, cost-effective connectivity for the application?

Select all that apply

Update the private subnet route table to direct traffic destined for the Amazon S3 prefix list to the S3 Gateway VPC Endpoint.

Configure the private subnet Network ACL to allow outbound traffic to the payment gateway IP range on port

443

and allow inbound traffic from the payment gateway IP range on ephemeral ports

1024

65535

Add an inbound rule to the EC2 instances' Security Group allowing TCP port

443

traffic from the payment gateway IP range to authorize the returning API response payloads.

Add a route to the private subnet route table that directs Amazon S3 traffic to the NAT Gateway to ensure all external data transfers are centrally logged.

Associate the S3 Gateway VPC Endpoint with the EC2 instances' Security Group to control and secure traffic flow between the instances and S3.

Show answer & explanation

Answer: Update the private subnet route table to direct traffic destined for the Amazon S3 prefix list to the S3 Gateway VPC Endpoint.; Configure the private subnet Network ACL to allow outbound traffic to the payment gateway IP range on port $443$ and allow inbound traffic from the payment gateway IP range on ephemeral ports $1024$ - $65535$ .

Answer

Update the private subnet route table to direct traffic destined for the Amazon S3 prefix list to the S3 Gateway VPC Endpoint, and configure the private subnet Network ACL to allow outbound traffic to the payment gateway IP range on port

443

and allow inbound traffic from the payment gateway IP range on ephemeral ports

1024

65535

Updating the private subnet route table to target the S3 prefix list via the S3 Gateway VPC Endpoint ensures S3 traffic is routed privately and cost-effectively. Furthermore, configuring the stateless Network ACL with an outbound rule for port

443

and an inbound rule for ephemeral ports (

1024

65535

) ensures that outbound API calls can be completed and responses can return.

Step-by-Step Solution

Determine the most cost-effective and secure route for Amazon S3 traffic.

A Gateway VPC Endpoint for S3 should be used, requiring an update to the private subnet route table targeting the S3 prefix list.

This keeps traffic within the AWS internal network, reducing NAT Gateway processing costs.

Analyze security group requirements for returning HTTPS traffic.

No inbound security group rule is needed for return traffic because security groups are stateful.

Security groups automatically allow return traffic for established outbound sessions.

Configure Network ACL rules for the stateless subnet boundary.

Add an outbound rule for port

443

and an inbound rule for ephemeral ports

1024

65535

for the payment gateway IP range.

Network ACLs are stateless, meaning return traffic must be explicitly allowed by specifying inbound rules for ephemeral ports.

Key Concept

VPC Network Security design balancing stateful security groups, stateless Network ACLs, and Gateway VPC Endpoint routing.

Estimated Time:2m 0s

Question 231Question →

A renewable energy company operates a web-based grid monitoring dashboard hosted on Amazon EC2 instances. The security team needs to implement a solution to monitor the environment for security threats, specifically targeting potential SSH brute-force attempts on the instances, while maintaining a comprehensive history of all management console activity and API calls for compliance auditing. Which combination of AWS services should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Enable Amazon GuardDuty to monitor VPC Flow Logs and analyze DNS query logs for anomalous behavior.

Enable AWS CloudTrail to log and retain account activity related to actions taken across the AWS infrastructure.

Deploy AWS Shield Standard to inspect network traffic at the application layer for unauthorized access attempts.

Configure stateless Network Access Control Lists (network ACLs) at the subnet level to dynamically track and block brute-force connections.

Configure AWS Cost Explorer to track real-time API call metrics and trigger alerts when usage spikes.

Show answer & explanation

Answer: Enable Amazon GuardDuty to monitor VPC Flow Logs and analyze DNS query logs for anomalous behavior.; Enable AWS CloudTrail to log and retain account activity related to actions taken across the AWS infrastructure.

Answer

The correct combination is to enable Amazon GuardDuty to monitor network and DNS activity for threats, and to enable AWS CloudTrail to capture and audit AWS API activities.

The correct approach is to combine threat detection and event auditing. The option to enable Amazon GuardDuty satisfies the requirement to identify brute-force attacks by analyzing network flows. The option to enable AWS CloudTrail fulfills the compliance requirement by logging all API operations and management activities.

Step-by-Step Solution

Analyze the threat detection requirement.

Identify that the system needs to detect active security threats like SSH brute-force attempts.

Amazon GuardDuty is designed for threat detection and can analyze network flow logs to find signature-based anomalies.

Analyze the auditing and compliance requirement.

Determine the need for a persistent audit trail of all API operations.

AWS CloudTrail captures all API events, console actions, and SDK requests, providing a historical record.

Key Concept

AWS security monitoring requires separating threat detection (using GuardDuty) from API and configuration audit logging (using CloudTrail).

Estimated Time:1m 30s

Question 232Question →

A real estate company is hosting its public property search portal on AWS. The company needs to protect the application from common web exploits and vulnerabilities, such as SQL injection and cross-site scripting (XSS), which are affecting database queries and user sessions. Which AWS service should a solutions architect recommend to meet this requirement?

AWS WAF

AWS Shield Standard

Network Access Control Lists (NACLs)

Security Groups

Show answer & explanation

Answer: AWS WAF

Answer

AWS WAF is the correct service because it functions at the application layer (Layer 7) and can inspect HTTP/HTTPS request bodies, headers, and query strings to block malicious payloads such as SQL injection and cross-site scripting (XSS) attacks.

AWS WAF is the appropriate service because it inspects incoming HTTP/HTTPS requests at the application layer (Layer 7) and blocks threats like SQL injection and cross-site scripting based on customizable rules.

Step-by-Step Solution

Identify the target threat layer and exploit types described in the scenario.

The target threats are SQL injection and cross-site scripting (XSS), which are application-layer (Layer 7) exploits.

Understanding the OSI model layer of the threat helps eliminate services that only operate at lower layers.

Evaluate the capabilities of the available security services relative to Layer 7 inspection.

AWS WAF is the only service listed that operates at Layer 7 and is capable of inspecting HTTP/HTTPS request components like query parameters and request bodies.

Security Groups and Network ACLs filter traffic based on IP addresses and ports (Layer 3 and 4), while AWS Shield Standard mitigates infrastructure-layer DDoS attacks (Layer 3 and 4).

Select the service designed specifically for mitigating Layer 7 application exploits.

AWS WAF is recommended for web application-layer exploit protection.

Deploying AWS WAF allows the application of rules to inspect and block malicious web requests before they reach the backend application.

Key Concept

AWS WAF operates at Layer 7 to protect web applications against common web exploits, whereas AWS Shield, Security Groups, and NACLs operate at Layers 3 and 4.

Estimated Time:45s

Question 233Question →

An enterprise is building an internal human resources application on AWS. The application consists of a front-end server tier and a backend payroll database. The solutions architect needs to isolate the payroll database so that it has no direct route to or from the public internet, and it must only accept incoming traffic on port $5432$ from the front-end servers.

Which of the following configurations should the solutions architect implement to achieve this security posture? (Select TWO.)

Select all that apply

Associate the payroll database instances with private subnets that do not contain a route to an Internet Gateway in their route tables.

Add a rule to the payroll database security group that allows inbound traffic on port

5432

from the security group of the front-end servers.

Add an outbound rule to the database security group that explicitly denies all traffic to

0.0.0.0/0

Configure a Network ACL on the database subnet that allows inbound traffic on port

5432

but has no outbound rules, relying on the stateful response tracking of the subnet boundary.

Associate an AWS WAF Web ACL directly with the database subnet to inspect and filter incoming SQL traffic.

Show answer & explanation

Answer: Associate the payroll database instances with private subnets that do not contain a route to an Internet Gateway in their route tables.; Add a rule to the payroll database security group that allows inbound traffic on port $5432$ from the security group of the front-end servers.

Answer

To secure the payroll database, place the database instances in private subnets that do not route to an Internet Gateway, and configure the database security group to allow inbound traffic on port

5432

from the front-end server security group.

Placing the database in private subnets with no route to an Internet Gateway blocks all direct internet access. Configuring the database security group to reference the front-end server security group ensures that only the web tier can connect to the database on the database port, implementing secure least-privilege access.

Step-by-Step Solution

Isolate the network layer by deploying the database instances in private subnets.

Database instances have no direct route to the public internet.

This satisfies the requirement that the database must have no direct route to or from the public internet.

Configure the database security group with an inbound rule allowing port

5432

traffic sourcing from the front-end security group.

Only front-end instances can establish connections to the database.

This restricts access to only the authorized application tier, adhering to security best practices.

Key Concept

VPC Network Security Isolation using Private Subnets and Stateful Security Group Rules

Question 234Question →

A financial services application runs on Amazon EC2 instances with attached Amazon EBS volumes that contain highly sensitive transaction records. The security officer requires that all EBS volumes are encrypted using AWS KMS customer managed keys, and that the encryption key material is automatically rotated every year. The application must not experience any downtime, and existing volumes must remain accessible and decrypted transparently.

Which actions should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Turn on automatic key rotation within the configuration of the customer managed key.

Allow AWS KMS to keep the legacy key material versions active to decrypt data that was encrypted before the rotation.

Manually generate a new customer managed key every year and reconfigure the EC2 instance launch templates with the new key identifier.

Re-encrypt all existing EBS volumes and snapshots immediately using a script once the new key material is generated.

Save the cryptographic key values as standard plaintext string parameters in Systems Manager Parameter Store.

Show answer & explanation

Answer: Turn on automatic key rotation within the configuration of the customer managed key.; Allow AWS KMS to keep the legacy key material versions active to decrypt data that was encrypted before the rotation.

Answer

Turn on automatic key rotation within the customer managed key configuration, and allow AWS KMS to keep legacy key material versions active to decrypt older data.

To satisfy the rotation requirement without modification or downtime, automatic key rotation must be enabled. AWS KMS will automatically rotate the underlying cryptographic key material annually while retaining the original key ARN. This ensures that the EBS volume configuration remains unchanged. AWS KMS also automatically preserves older versions of the key material, allowing the system to decrypt existing volumes and snapshots transparently.

Step-by-Step Solution

Enable automatic key rotation for the customer managed key in AWS KMS.

The backing key material will be rotated automatically every year, while keeping the same key ARN.

This avoids having to modify any EC2 launch configurations or volume attachments since the key identifier remains unchanged.

Ensure backward compatibility for existing EBS volumes.

AWS KMS retains the older versions of the key material to decrypt data encrypted under those versions.

This allows older backups and active volumes to continue working seamlessly without requiring immediate re-encryption.

Key Concept

AWS KMS automatic key rotation retains older key material versions for decryption while preserving the same key ARN.

Question 235Question →

A global online gaming company hosts its multiplayer matchmaking API on Amazon ECS container instances behind an Application Load Balancer (ALB). The company recently suffered a major distributed denial of service (DDoS) attack in the form of an HTTP flood, which overwhelmed the ALB and caused matchmaking services to fail. Additionally, the security team has identified SQL injection attempts in the request payloads. The company wants to implement a solution to mitigate these Layer 7 attacks, minimize latency for global players, and restrict direct access to the ALB, allowing traffic only from the edge security layer. Which two actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL with the distribution that includes a rate-based rule and SQL injection protection rules.

Configure the security group of the Application Load Balancer to allow inbound HTTP/HTTPS traffic only from the Amazon CloudFront managed prefix list.

Enable AWS Shield Advanced on the Application Load Balancer to automatically inspect HTTP request payloads and mitigate SQL injection attempts.

Configure a stateless Network Access Control List (NACL) on the Application Load Balancer's subnets to inspect incoming request bodies for SQL injection patterns and block them.

Deploy an AWS WAF web ACL and associate it directly with the Amazon ECS service to filter malicious payloads before they reach the containers.

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL with the distribution that includes a rate-based rule and SQL injection protection rules.; Configure the security group of the Application Load Balancer to allow inbound HTTP/HTTPS traffic only from the Amazon CloudFront managed prefix list.

Answer

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer with AWS WAF associated, and restrict the load balancer's security group to allow inbound traffic only from the CloudFront managed prefix list.

Deploying CloudFront in front of the ALB caches content globally to reduce latency. Associating AWS WAF with CloudFront allows filtering of Layer 7 exploits like SQL injection and mitigating HTTP flood attacks using rate-based rules at the edge. Restricting the ALB security group to the CloudFront managed prefix list ensures that all public traffic must pass through the CloudFront and WAF edge security layer before reaching the backend.

Step-by-Step Solution

Introduce Amazon CloudFront to cache content globally, reducing latency, and provide a point of integration for AWS WAF at the AWS edge network.

Latency is reduced for global users, and the attack surface is shifted to the AWS edge.

CloudFront routes traffic through the AWS global network and integrates directly with AWS WAF.

Configure an AWS WAF Web ACL containing rate-based rules to block HTTP flood attacks and custom/managed rules to inspect payloads and block SQL injection exploits.

Layer 7 attacks (HTTP floods and SQL injection) are blocked at the edge.

AWS WAF inspects HTTP/HTTPS traffic at Layer 7 and can enforce rate limits and payload inspections.

Modify the Application Load Balancer's security group to restrict inbound traffic to the Amazon CloudFront managed prefix list, ensuring direct access to the origin is blocked.

Direct public access to the load balancer is prevented, forcing all traffic through CloudFront.

Securing the origin ensures attackers cannot bypass AWS WAF by sending requests directly to the ALB's public IP address.

Key Concept

Implementing Layer 7 DDoS and exploit mitigation at the edge using Amazon CloudFront and AWS WAF while securing the origin ALB.

Question 236Question →

An online auction platform experiences intermittent performance degradation during high-traffic bidding events due to sophisticated Layer 7 HTTP flood attacks and cross-site scripting (XSS) attempts. The application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). Which solution should a solutions architect implement to mitigate these attacks at the AWS network edge before they reach the application?

Enable AWS Shield Standard on the Application Load Balancer, and configure stateless Network Access Control Lists (NACLs) to inspect incoming HTTP requests for XSS payloads.

Deploy Amazon CloudFront in front of the Application Load Balancer. Associate an AWS WAF web ACL with the CloudFront distribution, and configure a rate-based rule and a cross-site scripting (XSS) match rule.

Configure EC2 security groups on the Application Load Balancer to inspect HTTP requests for XSS strings, and configure a Network Access Control List (NACL) to rate-limit traffic at the subnet level.

Associate an AWS WAF web ACL directly with the Application Load Balancer, and configure AWS Shield Standard to automatically block Layer 7 XSS exploits and rate-limit incoming HTTP traffic.

Show answer & explanation

Answer: Deploy Amazon CloudFront in front of the Application Load Balancer. Associate an AWS WAF web ACL with the CloudFront distribution, and configure a rate-based rule and a cross-site scripting (XSS) match rule.

Answer

Deploy Amazon CloudFront in front of the Application Load Balancer, associate an AWS WAF web ACL with the CloudFront distribution, and configure a rate-based rule and a cross-site scripting (XSS) match rule.

Deploying Amazon CloudFront in front of the Application Load Balancer puts the entry point at the AWS network edge. Associating AWS WAF with the CloudFront distribution allows traffic to be inspected and filtered at edge locations. Rate-based rules in AWS WAF mitigate Layer 7 HTTP floods, and XSS match conditions block exploit attempts before they reach the Application Load Balancer and the backend instances.

Step-by-Step Solution

Identify where edge mitigation must occur.

Determine that Amazon CloudFront is the content delivery network that operates at global AWS edge locations, providing an entry point outside the primary AWS region.

Deploying CloudFront ensures that incoming traffic is intercepted and inspected at the network edge before reaching regional infrastructure.

Select the appropriate tool for Layer 7 inspection and rate limiting.

Choose AWS WAF to create Web ACLs with rate-limiting rules (for HTTP floods) and custom inspection rules (for XSS).

Layer 4 components like Security Groups and Network ACLs cannot inspect HTTP request payloads or selectively block based on application signatures.

Integrate AWS WAF at the edge layer.

Associate the AWS WAF Web ACL with the Amazon CloudFront distribution.

This configuration filters malicious traffic at the CloudFront edge locations, blocking attacks before they travel to the Application Load Balancer and the backend EC2 instances.

Key Concept

Using Amazon CloudFront in combination with AWS WAF protects web applications against Layer 7 DDoS (HTTP floods) and application exploits at the AWS network edge, preventing malicious traffic from reaching regional load balancers.

Estimated Time:1m 30s

Question 237Question →

A company is setting up a secure multi-tier application in a VPC. The database tier runs on Amazon EC2 instances located in a private subnet ( $10.0.2.0/24$ ). The database instances need to periodically initiate outbound connections to download software patches from an external repository on the public internet over HTTPS (TCP port $443$ ). A NAT Gateway is deployed in the public subnet ( $10.0.1.0/24$ ) to facilitate egress, and the private subnet's route table contains a default route ( $0.0.0.0/0$ ) pointing to the NAT Gateway. The database subnet uses a custom Network Access Control List (NACL) that currently denies all traffic. The database instances are associated with a custom security group. Which configuration of security group and NACL rules must the solutions architect implement to allow the database instances to download patches while maintaining the principle of least privilege?

Security Group: Outbound rule allowing TCP port

443

0.0.0.0/0

. No inbound rules. Subnet NACL: Outbound rule allowing TCP port

443

0.0.0.0/0

; Inbound rule allowing TCP ports

1024-65535

from

0.0.0.0/0

Security Group: Outbound rule allowing TCP port

443

0.0.0.0/0

. Inbound rule allowing TCP ports

1024-65535

from

0.0.0.0/0

. Subnet NACL: Outbound rule allowing TCP port

443

0.0.0.0/0

. No inbound rules.

Security Group: Outbound rule allowing TCP port

443

to the NAT Gateway's private IP address. No inbound rules. Subnet NACL: Outbound rule allowing TCP port

443

to the NAT Gateway's private IP address; Inbound rule allowing TCP ports

1024-65535

from the NAT Gateway's private IP address.

Security Group: Outbound rule allowing TCP port

443

0.0.0.0/0

. No inbound rules. Subnet NACL: Outbound rule allowing TCP port

443

0.0.0.0/0

; Inbound rule allowing TCP port

443

from

0.0.0.0/0

Show answer & explanation

Answer: Security Group: Outbound rule allowing TCP port $443$ to $0.0.0.0/0$ . No inbound rules. Subnet NACL: Outbound rule allowing TCP port $443$ to $0.0.0.0/0$ ; Inbound rule allowing TCP ports $1024-65535$ from $0.0.0.0/0$ .

Answer

Security Group: Outbound rule allowing TCP port

443

0.0.0.0/0

. No inbound rules. Subnet NACL: Outbound rule allowing TCP port

443

0.0.0.0/0

; Inbound rule allowing TCP ports

1024-65535

from

0.0.0.0/0

The correct configuration uses the stateful nature of Security Groups and the stateless nature of NACLs. For the Security Group, an outbound rule for TCP port

443

allows the connection to be established, and the stateful tracking automatically allows the return traffic back in. For the NACL, an outbound rule allows the outbound request on TCP port

443

, and an inbound rule allows return traffic to enter the subnet on the ephemeral ports (

1024-65535

) used by the initiating client instances.

Step-by-Step Solution

Analyze the statefulness of the Security Group.

Since Security Groups are stateful, any outbound request allowed on TCP port

443

automatically permits the return response to enter. No inbound rules are required.

To maintain the principle of least privilege, we should only define the outbound rule.

Analyze the statelessness of the Network ACL (NACL) outbound flow.

NACLs are stateless, meaning return traffic is not tracked. An outbound rule allowing TCP port

443

0.0.0.0/0

is required for the outbound patch request to leave the subnet.

The packet destination IP is the external repository, so the rule must target

0.0.0.0/0

rather than the NAT Gateway's IP.

Analyze the statelessness of the NACL inbound flow.

Because the client establishes a connection using an ephemeral source port, the return traffic from the repository will target that ephemeral port range (

1024-65535

). An inbound rule allowing TCP ports

1024-65535

from

0.0.0.0/0

is required.

Without this inbound rule, the stateless NACL will drop the returning packets from the repository.

Key Concept

Understanding the functional differences between stateful Security Groups (operating at the instance level) and stateless Network ACLs (operating at the subnet level), including ephemeral port requirements and destination IP evaluation.

Estimated Time:2m 0s

Question 238Question →

An enterprise architecture team is reviewing the security posture of a document management system. The application stores sensitive PDF contracts in an Amazon S3 bucket. The S3 bucket currently uses Server-Side Encryption with AWS KMS (SSE-KMS) with the default AWS managed key ('aws/s3'). A new compliance mandate requires that the encryption key used for these contracts must be rotated every year. Additionally, to mitigate the risk of key exposure, all existing documents in the bucket must be immediately re-encrypted using the new key version upon rotation. Database credentials for the application must also be securely rotated every 30 days. Which combination of actions will meet these security and compliance requirements?

Create a customer managed KMS key and enable automatic key rotation. Configure the S3 bucket to use this customer managed key. To re-encrypt historical documents after key rotation, execute an Amazon S3 Batch Operations job to copy the objects in-place. Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.

Enable automatic key rotation on the default AWS managed key ('aws/s3'). Rely on S3 automatic server-side encryption to automatically re-encrypt all existing objects with the new key version. Store the database credentials as a String parameter in AWS Systems Manager Parameter Store, and configure a scheduled AWS Lambda function to rotate the parameter value every 30 days.

Create a customer managed KMS key and enable automatic key rotation. Configure the S3 bucket to use this customer managed key. Rely on AWS KMS automatic key rotation to automatically re-encrypt all historical documents stored in the S3 bucket. Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.

Create a customer managed KMS key and enable automatic key rotation. Configure the S3 bucket to use this customer managed key. To re-encrypt historical documents after key rotation, execute an Amazon S3 Batch Operations job to copy the objects in-place. Store the database credentials as a String parameter in AWS Systems Manager Parameter Store, and configure AWS Systems Manager Run Command to update the parameter every 30 days.

Show answer & explanation

Answer: Create a customer managed KMS key and enable automatic key rotation. Configure the S3 bucket to use this customer managed key. To re-encrypt historical documents after key rotation, execute an Amazon S3 Batch Operations job to copy the objects in-place. Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.

Answer

To meet the compliance requirements, a customer managed KMS key must be used because the rotation frequency of AWS managed keys (like 'aws/s3') cannot be customized. When a customer managed key is rotated, KMS creates a new backing key version for new encryption requests. However, KMS does not automatically re-encrypt existing ciphertext. To re-encrypt historical documents, an S3 Batch Operations job must perform an in-place copy, which decrypts the objects using the old backing key version and re-encrypts them using the new active backing key version. For the credentials, AWS Secrets Manager should be used as it supports automatic rotation every 30 days, unlike Parameter Store plain String parameters which lack native rotation capabilities and store sensitive data in plaintext.

Step-by-Step Solution

Address key rotation requirements by choosing between AWS managed keys and customer managed keys.

Identify that AWS managed keys ('aws/s3') do not support custom rotation intervals and cannot be customized. A customer managed key must be created, which supports automatic rotation every year.

Compliance requires annual key rotation, which is only configurable on customer managed KMS keys.

Determine the mechanism for re-encrypting historical data in the S3 bucket.

Establish that enabling automatic rotation in AWS KMS does not touch existing S3 objects. To re-encrypt existing objects under the new backing key version immediately, an S3 Batch Operations job must be run to copy the objects in-place (copying them to themselves).

AWS KMS automatic rotation only encrypts new data. Existing data remains encrypted under the older backing key versions until explicitly rewritten or copied.

Evaluate the secure secret storage and rotation strategy.

Select AWS Secrets Manager over Systems Manager Parameter Store plain String parameters.

AWS Secrets Manager natively supports 30-day automatic credential rotation and integrates with databases securely, whereas plain String parameters in Parameter Store store credentials in plaintext and lack native automatic rotation.

Key Concept

AWS KMS key rotation behavior, customer managed vs. AWS managed keys, and secure secret storage using AWS Secrets Manager.

Question 239Question →

An enterprise has a security account (Account B) that hosts an AWS KMS Customer Managed Key (CMK). This CMK is used to encrypt sensitive telemetry data stored in Amazon S3 buckets located in a production account (Account A). The processing application in Account A runs on Amazon EC2 instances and requires access to decrypt these S3 objects. A security requirement states that the CMK must be rotated annually. The security team wants to ensure that key rotation does not disrupt the application's ability to read older archived S3 objects encrypted with previous versions of the key, and that the configuration strictly adheres to the principle of least privilege without exposing access credentials. Which of the following architectural configurations meets these requirements?

Enable automatic key rotation on the CMK in Account B. To ensure decryption capability is maintained for older objects, schedule a monthly AWS Lambda function to decrypt and re-encrypt all historical S3 data in Account A under the newly rotated key version before the previous key material is retired.

Enable automatic key rotation on the CMK in Account B. Store the CMK ARN and the security account's IAM cross-account access keys as a plain String parameter in AWS Systems Manager Parameter Store to allow the EC2 instances in Account A to programmatically authenticate and bypass cross-account IAM role mapping.

Enable automatic key rotation on the CMK in Account B. In Account B, edit the CMK key policy to grant the EC2 IAM role in Account A permissions for the kms:Decrypt and kms:GenerateDataKey actions. In Account A, attach an IAM policy to the EC2 IAM role allowing these same KMS actions on the CMK ARN.

Enable automatic key rotation on the CMK in Account B. To simplify cross-account permissions, configure the key policy in Account B to allow access to the AWS account root user of Account A, and use the root credentials of Account A within the processing application to perform all S3 decryption tasks.

Show answer & explanation

Answer: Enable automatic key rotation on the CMK in Account B. In Account B, edit the CMK key policy to grant the EC2 IAM role in Account A permissions for the kms:Decrypt and kms:GenerateDataKey actions. In Account A, attach an IAM policy to the EC2 IAM role allowing these same KMS actions on the CMK ARN.

Answer

Enable automatic key rotation on the CMK in the security account, configure the CMK's key policy to trust the production account's IAM role, and attach a matching IAM policy to the role in the production account allowing decryption and data key generation.

The correct configuration enables automatic key rotation, which naturally preserves all historical backing keys to decrypt older objects without requiring re-encryption. Cross-account access is correctly configured by editing the KMS key policy in Account B to trust the EC2 IAM role in Account A, and attaching an IAM policy to that role in Account A to permit the necessary KMS actions.

Step-by-Step Solution

Evaluate key rotation behavior

Automatic key rotation preserves the historical backing keys automatically. Older S3 objects can still be decrypted without any manual re-encryption workflow.

Understanding KMS automatic rotation mechanics prevents unnecessary data re-encryption operations.

Establish trust on the KMS key

Edit the KMS key policy in Account B to allow the specific IAM role in Account A to perform kms:Decrypt and kms:GenerateDataKey.

For cross-account access, the key policy itself must explicitly authorize the external identity or account.

Authorize the IAM identity in the production account

Attach an IAM policy to the EC2 execution role in Account A allowing kms:Decrypt and kms:GenerateDataKey on the Account B CMK ARN.

Cross-account access requires explicit permission in both the resource policy (key policy) and the identity policy (IAM policy).

Enforce credentials best practices

Verify that no root credentials or plain text parameters are used to store access keys.

This guarantees compliance with AWS security best practices and the principle of least privilege.

Key Concept

Cross-account AWS KMS key access and automatic key rotation behavior

Question 240Question →

A company's security policy requires that all Customer Managed Keys (CMKs) in AWS Key Management Service (AWS KMS) used for encrypting database backups must be rotated annually. Additionally, all historical database backups must remain decryptable without administrative effort.

Which actions should a solutions architect recommend to meet these security requirements? (Select TWO.)

Select all that apply

Enable automatic key rotation for the Customer Managed Key in AWS KMS.

Retain the older key material, as AWS KMS automatically manages the mapping of older key versions to decrypt historical backups.

Manually create a new Customer Managed Key each year and re-encrypt all historical database backups with the new key.

Disable the older versions of the Customer Managed Key after rotation to prevent unauthorized decryption of historical backups.

Store the decryption keys as plaintext String parameters in AWS Systems Manager Parameter Store for easy access by the backup utility.

Show answer & explanation

Answer: Enable automatic key rotation for the Customer Managed Key in AWS KMS.; Retain the older key material, as AWS KMS automatically manages the mapping of older key versions to decrypt historical backups.

Answer

Enable automatic key rotation for the Customer Managed Key in AWS KMS and retain the older key material, as AWS KMS automatically manages the mapping of older key versions to decrypt historical backups.

To meet the requirements, the solutions architect should enable automatic key rotation for the Customer Managed Key in AWS KMS, which rotates the key material automatically on an annual schedule. Additionally, the older key material must be retained because AWS KMS automatically tracks and uses the correct historical key material version to decrypt older backups, eliminating the need for administrative effort or manual data re-encryption.

Step-by-Step Solution

Enable automatic key rotation on the Customer Managed Key.

AWS KMS will automatically rotate the backing key material every year.

To satisfy the requirement of rotating the key material annually without manual overhead.

Retain older key material and let AWS KMS handle decryption.

AWS KMS maintains the metadata mapping older ciphertexts to the corresponding older key versions.

To satisfy the requirement that historical backups remain decryptable without administrative effort or data re-encryption.

Key Concept

AWS KMS automatic key rotation generates new key material annually for Customer Managed Keys while retaining old key material to automatically decrypt older data without requiring manual data re-encryption.

PreviousPage 12 / 22Next

Design Secure Architectures

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept