Design Secure Architectures

438 questions

All types438 Multiple choice214 Multiple select224

A company hosts a backend processing application on Amazon EC2 instances in a private VPC subnet with the CIDR block $10.0.2.0/24$ . The instances receive incoming requests on TCP port $8080$ from an Elastic Load Balancer (ELB) situated in a public subnet with the CIDR block $10.0.1.0/24$ . Additionally, the EC2 instances must make outbound HTTPS calls (TCP port $443$ ) to a third-party vendor's API gateway at the public IP address $203.0.113.50/32$ . The private subnet is associated with a custom Network Access Control List (NACL), and the EC2 instances are associated with a stateful security group. To implement the principle of least privilege, the security team requires the custom NACL to be hardened to permit only these specific traffic flows. Which of the following configurations meets these requirements while ensuring successful bidirectional communication?

Inbound Rules: Allow TCP from

10.0.1.0/24

on Port Range

8080

, and allow TCP from

203.0.113.50/32

on Port Range

1024-65535

. Outbound Rules: Allow TCP to

10.0.1.0/24

on Port Range

1024-65535

, and allow TCP to

203.0.113.50/32

on Port Range

443

Inbound Rules: Allow TCP from

10.0.1.0/24

on Port Range

1024-65535

, and allow TCP from

203.0.113.50/32

on Port Range

443

. Outbound Rules: Allow TCP to

10.0.1.0/24

on Port Range

8080

, and allow TCP to

203.0.113.50/32

on Port Range

1024-65535

Inbound Rules: Allow TCP from

10.0.1.0/24

on Port Range

8080

, and allow TCP from

203.0.113.50/32

on Port Range

443

. Outbound Rules: Allow TCP to

10.0.1.0/24

on Port Range

8080

, and allow TCP to

203.0.113.50/32

on Port Range

443

Inbound Rules: Allow TCP from

10.0.1.0/24

on Port Range

8080

, and allow TCP from

203.0.113.50/32

on Port Range

1024-65535

. Outbound Rules: Allow TCP to

203.0.113.50/32

on Port Range

443

, relying on the security group's statefulness to automatically permit the return traffic to the Elastic Load Balancer.

Show answer & explanation

Answer: Inbound Rules: Allow TCP from $10.0.1.0/24$ on Port Range $8080$ , and allow TCP from $203.0.113.50/32$ on Port Range $1024-65535$ . Outbound Rules: Allow TCP to $10.0.1.0/24$ on Port Range $1024-65535$ , and allow TCP to $203.0.113.50/32$ on Port Range $443$ .

Answer

The configuration that allows inbound TCP from the load balancer subnet on port

8080

and from the vendor API on the ephemeral range (

1024-65535

), while allowing outbound TCP to the load balancer subnet on the ephemeral range (

1024-65535

) and to the vendor API on port

443

The correct configuration properly implements stateless NACL rules by defining the destination ports for both request and response traffic. For inbound connections from the load balancer, the destination port is

8080

, and the return traffic to the load balancer uses the destination ephemeral ports (

1024-65535

). For outbound connections initiated by the EC2 instances, the destination port is

443

, and the return traffic from the API gateway uses the destination ephemeral ports (

1024-65535

) on the EC2 instances.

Step-by-Step Solution

Analyze the inbound flow from the Elastic Load Balancer (ELB) to the EC2 instances.

Incoming packets from

10.0.1.0/24

target destination port

8080

on the EC2 instances. This requires an inbound NACL rule allowing TCP port

8080

from

10.0.1.0/24

NACL rules evaluate the destination port of incoming packets to determine if they are allowed into the subnet.

Analyze the outbound response flow from the EC2 instances back to the ELB.

Response packets sent from the EC2 instances target the ELB's ephemeral source ports. This requires an outbound NACL rule allowing TCP destination port range

1024-65535

10.0.1.0/24

Because NACLs are stateless, outbound response traffic must be explicitly allowed. The destination port of the response packet is the source port used by the client (ELB), which falls in the ephemeral port range.

Analyze the outbound initiation flow from the EC2 instances to the vendor's API gateway.

Outbound requests sent to

203.0.113.50/32

target destination port

443

. This requires an outbound NACL rule allowing TCP port

443

203.0.113.50/32

Outbound NACL rules inspect the destination IP and port of traffic leaving the subnet.

Analyze the inbound response flow from the vendor's API gateway back to the EC2 instances.

Response packets from

203.0.113.50/32

target the ephemeral source ports assigned to the EC2 instances' connections. This requires an inbound NACL rule allowing TCP destination port range

1024-65535

from

203.0.113.50/32

Because NACLs are stateless, return packets from external destinations must be allowed through the inbound rules. The destination of these packets is the ephemeral port allocated by the EC2 host for the connection.

Key Concept

AWS Network Access Control Lists (NACLs) are stateless firewall rules evaluated at the subnet boundary. They evaluate traffic based on the destination port of the packet. For bidirectional communication to succeed, rules must explicitly allow both the request flow (targeting the listener port) and the response flow (targeting the client's ephemeral port range:

1024-65535

Estimated Time:3m 0s

Question 242Question →

A collaborative document editing SaaS platform uses an Application Load Balancer (ALB) to distribute traffic to Amazon EC2 instances. During a high-profile product release, the platform experiences a distributed HTTP flood attack (Layer 7 DDoS) consisting of rapid, repeating requests from thousands of unique, dynamically changing IP addresses. This attack is bypassing standard network-level protections and exhausting EC2 CPU resources. The platform's operations team needs to mitigate this attack immediately and ensure the ALB only accepts traffic routed through their edge protection layer. Which combination of actions will meet these requirements with the least administrative effort?

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer. Associate an AWS WAF web ACL containing a rate-based rule with the CloudFront distribution. Configure the Application Load Balancer's security group to restrict inbound traffic using the CloudFront managed prefix list.

Enable AWS Shield Standard on the Application Load Balancer. Configure AWS Shield Standard to rate-limit incoming HTTP requests. Restrict the Application Load Balancer's security group to only accept traffic from the Amazon Route 53 IP ranges.

Create a stateless Network Access Control List (NACL) at the subnet level for the Application Load Balancer. Add rules to block the IP addresses originating the HTTP flood. Restrict the EC2 instance security groups to allow traffic only from the ALB.

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer. Enable AWS Shield Advanced on the CloudFront distribution. Rely on the default AWS Shield Advanced infrastructure protection to automatically drop all Layer 7 HTTP flood requests without configuring AWS WAF.

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer. Associate an AWS WAF web ACL containing a rate-based rule with the CloudFront distribution. Configure the Application Load Balancer's security group to restrict inbound traffic using the CloudFront managed prefix list.

Answer

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, associate an AWS WAF web ACL with a rate-based rule to the distribution, and configure the ALB's security group to restrict inbound traffic to the CloudFront managed prefix list.

The correct option outlines a secure architecture by placing Amazon CloudFront at the edge, leveraging AWS WAF rate-based rules to dynamically block the high-volume HTTP flood at the application layer, and securing the Application Load Balancer origin using the CloudFront managed prefix list to ensure no traffic bypasses the edge defense.

Step-by-Step Solution

Introduce Amazon CloudFront as the entry point.

Legitimate and malicious traffic is routed through CloudFront's global edge locations instead of directly hitting the Application Load Balancer.

This establishes an edge network layer capable of handling massive volumes of traffic and caching static content.

Deploy AWS WAF with a rate-based rule associated with the CloudFront distribution.

IP addresses that send more requests than the defined threshold within a 5-minute window are automatically blocked at the edge.

Layer 7 HTTP floods must be mitigated dynamically at the application layer before reaching the backend application origin.

Restrict backend access to the Application Load Balancer.

The ALB security group is modified to allow inbound traffic only from the CloudFront managed prefix list.

This prevents malicious users from bypassing CloudFront and AWS WAF by directly targeting the ALB's public IP address or DNS name.

Key Concept

AWS WAF rate-based rules combined with Amazon CloudFront and ALB security group restrictions provide comprehensive Layer 7 DDoS mitigation and origin cloaking.

Question 243Question →

A global telematics provider hosts an API on AWS for smart vehicles to upload telemetry data. The API is hosted on Amazon Elastic Container Service (Amazon ECS) tasks behind an Application Load Balancer (ALB). The provider is experiencing sophisticated Layer 7 HTTP flood attacks that mimic legitimate telemetry traffic, causing database resource exhaustion and high latency. Additionally, the infrastructure has been targeted by massive UDP reflection attacks at Layers 3 and 4. The provider wants to block these attacks at the AWS network edge before they reach the VPC, while ensuring minimal latency for legitimate vehicle traffic worldwide. Which two configurations should a solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and enable AWS Shield Advanced on the CloudFront distribution.

Associate an AWS WAF web ACL with the Amazon CloudFront distribution, and configure a rate-based rule with a custom threshold to block abusive IP addresses.

Enable AWS Shield Standard on the Application Load Balancer, and write custom AWS WAF rules on the ALB to automatically inspect and drop Layer 3/4 UDP reflection traffic.

Configure the Application Load Balancer's security groups to dynamically block source IP addresses identified by AWS Shield Standard.

Implement stateless Network Access Control Lists (NACLs) on the subnets containing the Application Load Balancer to dynamically block traffic from UDP ports and rate-limit HTTP requests.

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and enable AWS Shield Advanced on the CloudFront distribution.; Associate an AWS WAF web ACL with the Amazon CloudFront distribution, and configure a rate-based rule with a custom threshold to block abusive IP addresses.

Answer

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer with AWS Shield Advanced enabled, and associate an AWS WAF web ACL with the CloudFront distribution containing a custom rate-based rule.

To block attacks at the network edge and minimize latency, Amazon CloudFront must be deployed in front of the Application Load Balancer. CloudFront buffers and distributes traffic across AWS edge locations. Enabling AWS Shield Advanced on CloudFront provides managed Layer 3/4 DDoS protection against attacks such as UDP reflection. Additionally, associating an AWS WAF web ACL with the CloudFront distribution and configuring a rate-based rule prevents Layer 7 HTTP floods by automatically blocking IP addresses that exceed a set threshold of requests within a rolling window.

Step-by-Step Solution

Analyze the attack vectors and network boundary requirements.

Identify that the solution requires protecting against Layer 3/4 UDP reflection attacks and Layer 7 HTTP floods at the AWS network edge, before traffic reaches the VPC/ALB.

This establishes the need to use edge services like Amazon CloudFront rather than relying solely on VPC-level controls like ALB security groups or subnets.

Evaluate Edge and Layer 3/4 DDoS protection options.

Determine that deploying Amazon CloudFront automatically provides inline Layer 3/4 protection at the AWS edge. Enabling AWS Shield Advanced on the CloudFront distribution offers comprehensive protection against large-scale DDoS attacks, including UDP reflection.

CloudFront routes traffic through global Edge locations, absorbing DDoS attacks before they reach the origin, and Shield Advanced provides specialized mitigation capabilities.

Evaluate Layer 7 HTTP flood mitigation options.

Determine that AWS WAF associated with CloudFront is the best practice for application-layer (Layer 7) protection. Implementing a rate-based rule allows the system to track request rates per IP and temporarily block clients that exceed the configured threshold.

This directly targets HTTP floods mimicking legitimate telemetry traffic without impacting authorized clients that stay within normal usage limits.

Key Concept

Multi-layered edge security and DDoS mitigation using Amazon CloudFront, AWS Shield Advanced, and AWS WAF.

Question 244Question →

A cloud-native healthcare platform is deploying an analytics processing engine on AWS. The analytics instances reside in a private Analytics Engine Subnet ( $172.20.10.0/24$ ). These instances must run SQL queries against an Amazon RDS PostgreSQL database located in a private Data Warehouse Subnet ( $172.20.20.0/24$ ). Additionally, the analytics instances must fetch hourly compliance updates from an external API endpoint over HTTPS (port $443$ ) via a NAT Gateway located in a public subnet ( $172.20.100.0/24$ ). Strict compliance standards require that Network ACLs at the subnet boundaries enforce the principle of least privilege. Assuming the Security Groups are already configured correctly, which combination of Network ACL configurations for the Analytics Engine Subnet ( $172.20.10.0/24$ ) must be implemented to support this traffic? (Select TWO.)

Select all that apply

An outbound Network ACL rule allowing TCP traffic to destination

172.20.20.0/24

on port

5432

, and an outbound Network ACL rule allowing TCP traffic to destination

0.0.0.0/0

on port

443

An inbound Network ACL rule allowing TCP traffic from source

172.20.20.0/24

on source port

5432

to destination ports

1024-65535

, and an inbound Network ACL rule allowing TCP traffic from source

0.0.0.0/0

on source port

443

to destination ports

1024-65535

An inbound Network ACL rule allowing TCP traffic from source

172.20.20.0/24

on destination port

5432

, and an inbound Network ACL rule allowing TCP traffic from source

0.0.0.0/0

on destination port

443

No inbound Network ACL rules are required to allow response traffic from the database or the internet, because Network ACLs are stateful and automatically track connection states.

An outbound Network ACL rule allowing TCP traffic to destination

172.20.20.0/24

on ephemeral ports

1024-65535

, and an outbound Network ACL rule allowing TCP traffic to destination

0.0.0.0/0

on ephemeral ports

1024-65535

Show answer & explanation

Answer: An outbound Network ACL rule allowing TCP traffic to destination $172.20.20.0/24$ on port $5432$ , and an outbound Network ACL rule allowing TCP traffic to destination $0.0.0.0/0$ on port $443$ .; An inbound Network ACL rule allowing TCP traffic from source $172.20.20.0/24$ on source port $5432$ to destination ports $1024-65535$ , and an inbound Network ACL rule allowing TCP traffic from source $0.0.0.0/0$ on source port $443$ to destination ports $1024-65535$ .

Answer

To support this traffic, the Network ACL for the Analytics Engine Subnet must have outbound rules allowing TCP to the database subnet on port

5432

and to the internet on port

443

. It must also have inbound rules allowing TCP from the database subnet on source port

5432

and the internet on source port

443

to destination ephemeral ports

1024-65535

The correct answer combines the outbound rules that allow the initial requests to reach their targets (destination port

5432

for the database and destination port

443

for the internet) with the inbound rules that allow return traffic. Because Network ACLs are stateless, inbound rules must be created to allow response traffic back into the subnet. Since the database and external API act as servers, their response packets will have source ports

5432

and

443

, respectively, and will target the ephemeral port range (

1024-65535

) on the client instances inside the analytics subnet.

Step-by-Step Solution

Determine the destination ports for outbound requests initiated by the analytics instances.

The analytics instances initiate outbound connections to the database on port

5432

(PostgreSQL) and to the internet on port

443

(HTTPS).

This establishes that the outbound Network ACL rules must target destination ports

5432

and

443

respectively.

Analyze how return traffic behaves across the stateless subnet boundary.

Network ACLs are stateless, meaning return traffic is not automatically tracked or allowed. The response packets coming back from the database have a source port of

5432

, and response packets from the internet have a source port of

443

This dictates that inbound rules must be explicitly created to handle the returning traffic.

Identify the destination ports for the inbound return traffic on the client instances.

The returning packets target the ephemeral port range (

1024-65535

) on the analytics instances.

This means the inbound rules must permit traffic from source ports

5432

and

443

to destination ports

1024-65535

Key Concept

Statelessness of Network ACLs and the necessity of configuring ephemeral port ranges for return traffic.

Question 245Question →

A financial services corporation uses AWS Organizations to manage a multi-account environment. A security audit reveals that several development teams have temporarily modified Network Access Control Lists (NACLs) to allow public inbound traffic ( $0.0.0.0/0$ ) on database ports (such as $3306$ and $5432$ ), violating compliance mandates. The security team requires a solution that continuously monitors all accounts, automatically reverts any unauthorized public NACL rules within minutes of creation, and aggregates these compliance findings into a central security account for audit reporting. Which solution meets these security and compliance requirements with the lowest operational overhead?

Configure AWS CloudTrail across all accounts to log API events. Create an Amazon EventBridge rule that detects CreateNetworkAclEntry calls and invokes an AWS Lambda function. The function retrieves the compliance baseline configurations stored as plaintext parameters in AWS Systems Manager Parameter Store, compares them, and reverts unauthorized changes.

Configure AWS Config in all member accounts and deploy an AWS Organizations conformance pack containing a custom Config rule that checks NACL rules. Link the Config rule to an AWS Systems Manager (SSM) Automation runbook as a remediation action to delete non-compliant inbound entries. Direct the Config findings to a delegated administrator AWS Security Hub account.

Enable VPC Flow Logs in all accounts and stream them to a centralized Amazon CloudWatch Logs log group. Set up a metric filter that triggers an AWS Lambda function to modify the Security Groups at the subnet level to block database ports, and send alerts to AWS Security Hub.

Deploy AWS Shield Advanced on all VPC routers and configure AWS WAF rules to inspect all subnet-level traffic. Configure a WAF rule to block unauthorized public inbound database connections at the subnet boundary and trigger an AWS Lambda function to update the route tables.

Show answer & explanation

Answer: Configure AWS Config in all member accounts and deploy an AWS Organizations conformance pack containing a custom Config rule that checks NACL rules. Link the Config rule to an AWS Systems Manager (SSM) Automation runbook as a remediation action to delete non-compliant inbound entries. Direct the Config findings to a delegated administrator AWS Security Hub account.

Answer

The correct solution uses AWS Config in all member accounts, deployed via an AWS Organizations conformance pack, to run a Config rule evaluating NACL configurations. When non-compliant resources are found, an AWS Systems Manager Automation runbook is natively invoked as a remediation action to revert the NACL rule, and all findings are consolidated into the delegated administrator AWS Security Hub account.

The correct solution leverages AWS Config to monitor configuration changes in near real-time. By deploying an AWS Organizations conformance pack, the security rule and its remediation configuration are uniformly distributed across all member accounts. The AWS Systems Manager Automation runbook provides a low-overhead, native method to automatically revert unauthorized changes to Network Access Control Lists (NACLs). Aggregating findings into a delegated administrator account for AWS Security Hub allows the security team to centralize and visualize compliance violations without managing complex custom code.

Step-by-Step Solution

Analyze the compliance monitoring and remediation requirements.

The solution must detect configuration modifications to Network Access Control Lists (NACLs), revert them automatically with minimal delay, and centralize the logs/alerts across a multi-account environment.

Understanding the requirement defines the tools: AWS Config is designed for configuration history and compliance checks, whereas CloudTrail logs APIs and Flow Logs track network traffic.

Evaluate remediation mechanism and operational overhead.

Using AWS Config rules combined with AWS Systems Manager (SSM) Automation runbooks allows for agentless, automated, and native remediation of non-compliant resources without writing custom Lambda code.

Minimizing operational overhead involves using built-in platform capabilities rather than developing and maintaining custom code.

Ensure secure baseline storage and multi-account visibility.

Deploying conformance packs via AWS Organizations ensures consistent enforcement across accounts, and AWS Security Hub centralizes compliance findings.

This complies with AWS Well-Architected Framework guidelines for centralized security operations and auditing.

Key Concept

AWS Config Rule Remediation and Multi-Account Security Centralization

Estimated Time:3m 0s

Question 246Question →

A company is deploying an IoT data processing application on Amazon ECS using the Fargate launch type. The application needs to retrieve two configuration values: a database endpoint address that does not contain sensitive information, and an API password for an external service that must be rotated every 60 days. The solutions architect wants to implement a secure solution that minimizes ongoing operational costs.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Store the database endpoint address as a String parameter in AWS Systems Manager Parameter Store.

Store the API password in AWS Secrets Manager and configure an AWS Lambda function to rotate the secret every 60 days.

Store the database endpoint address in AWS Secrets Manager and enable the default automatic rotation feature.

Store the API password as a String parameter in AWS Systems Manager Parameter Store.

Configure automatic key rotation on the AWS Key Management Service (AWS KMS) customer managed key to automatically rotate the API password value every 60 days.

Show answer & explanation

Answer: Store the database endpoint address as a String parameter in AWS Systems Manager Parameter Store.; Store the API password in AWS Secrets Manager and configure an AWS Lambda function to rotate the secret every 60 days.

Answer

Store the database endpoint address as a String parameter in AWS Systems Manager Parameter Store, and store the API password in AWS Secrets Manager and configure an AWS Lambda function to rotate the secret every 60 days.

The database endpoint is non-sensitive configuration data, meaning it can be stored cost-effectively as a String parameter in AWS Systems Manager Parameter Store without incurring extra charges. The API password, being sensitive and requiring automated rotation every 60 days, must be stored in AWS Secrets Manager. Secrets Manager natively supports automated rotation schedules and can trigger a custom AWS Lambda function to update the credential on the third-party service.

Step-by-Step Solution

Evaluate the sensitivity of the database endpoint and the API password.

Identify that the database endpoint is non-sensitive configuration data, while the API password is a highly sensitive credential.

Determining data sensitivity helps choose the most cost-effective and secure storage service.

Select the storage service for the non-sensitive database endpoint.

Store the endpoint in AWS Systems Manager Parameter Store as a String parameter.

Parameter Store standard parameters are free of charge, which satisfies the cost minimization requirement for non-sensitive configuration.

Select the storage service and rotation method for the sensitive API password.

Store the API password in AWS Secrets Manager and configure a custom AWS Lambda function for rotation.

AWS Secrets Manager supports encrypted storage and automated rotation, using Lambda to run custom rotation code for third-party APIs.

Key Concept

Secrets and Parameter Management

Question 247Question →

An organization is deploying an internal processing application on Amazon EC2 instances in a private subnet (CIDR $10.0.2.0/24$ ). The application must securely consume a proprietary database API hosted by a third-party vendor in another AWS account using an Interface VPC Endpoint. The endpoint network interfaces are located in a separate dedicated subnet (CIDR $10.0.3.0/24$ ) within the same VPC. Traffic is restricted to TCP port $443$ . The VPC uses custom Network Access Control Lists (NACLs) associated with each subnet, both of which are currently configured with a default deny-all rule. To meet security compliance, the EC2 instances must only be allowed to initiate outbound connections to the Interface VPC Endpoint, and no other external traffic is permitted. Which combination of NACL and Security Group configurations will allow this private connection while adhering to the principle of least privilege?

For the application subnet NACL, add an outbound rule allowing TCP port

443

10.0.3.0/24

and an inbound rule allowing TCP ports

1024

65535

from

10.0.3.0/24

. For the endpoint subnet NACL, add an inbound rule allowing TCP port

443

from

10.0.2.0/24

and an outbound rule allowing TCP ports

1024

65535

10.0.2.0/24

. Associate a Security Group with the EC2 instances allowing outbound TCP port

443

to the endpoint Security Group, and associate a Security Group with the Interface Endpoint allowing inbound TCP port

443

from the EC2 Security Group.

For the application subnet NACL, add an outbound rule allowing TCP port

443

10.0.3.0/24

and an inbound rule allowing TCP port

443

from

10.0.3.0/24

. For the endpoint subnet NACL, add an inbound rule allowing TCP port

443

from

10.0.2.0/24

and an outbound rule allowing TCP port

443

10.0.2.0/24

. Associate a Security Group with the EC2 instances allowing outbound TCP port

443

to the endpoint Security Group, and associate a Security Group with the Interface Endpoint allowing inbound TCP port

443

from the EC2 Security Group.

For the application subnet NACL, add an outbound rule allowing TCP port

443

10.0.3.0/24

and an inbound rule allowing TCP ports

1024

65535

from

10.0.3.0/24

. For the endpoint subnet NACL, add an inbound rule allowing TCP port

443

from

10.0.2.0/24

and an outbound rule allowing TCP ports

1024

65535

10.0.2.0/24

. Associate a Security Group with the EC2 instances allowing outbound TCP port

443

and inbound TCP ports

1024

65535

, and associate a Security Group with the Interface Endpoint allowing inbound TCP port

443

and outbound TCP ports

1024

65535

For the application subnet NACL, add an outbound rule allowing TCP port

443

10.0.3.0/24

. For the endpoint subnet NACL, add an inbound rule allowing TCP port

443

from

10.0.2.0/24

. Do not configure inbound application NACL rules or outbound endpoint NACL rules. Associate a Security Group with the EC2 instances allowing outbound TCP port

443

to the endpoint Security Group, and associate a Security Group with the Interface Endpoint allowing inbound TCP port

443

from the EC2 Security Group.

Show answer & explanation

Answer: For the application subnet NACL, add an outbound rule allowing TCP port $443$ to $10.0.3.0/24$ and an inbound rule allowing TCP ports $1024$ - $65535$ from $10.0.3.0/24$ . For the endpoint subnet NACL, add an inbound rule allowing TCP port $443$ from $10.0.2.0/24$ and an outbound rule allowing TCP ports $1024$ - $65535$ to $10.0.2.0/24$ . Associate a Security Group with the EC2 instances allowing outbound TCP port $443$ to the endpoint Security Group, and associate a Security Group with the Interface Endpoint allowing inbound TCP port $443$ from the EC2 Security Group.

Answer

The correct configuration requires setting up stateless NACL rules that permit outbound traffic on port

443

and inbound return traffic on the ephemeral port range (

1024

65535

) for the application subnet, and the inverse rules for the endpoint subnet (inbound on port

443

and outbound on ephemeral ports). The stateful security groups require only the outbound rule from the application instances to the endpoint on port

443

, and the inbound rule on the endpoint from the application instances on port

443

The correct configuration combines stateful security group rules with stateless NACL rules. For the stateful security groups, only a one-way allowance is required: the EC2 instances need outbound access to the endpoint, and the endpoint needs inbound access from the instances. The return traffic is handled automatically by the stateful firewall. For the stateless NACLs, rules must be explicitly created for both request and response traffic. The application subnet NACL must allow outbound traffic on destination port

443

and inbound return traffic on ephemeral ports (

1024

65535

). The endpoint subnet NACL must allow inbound traffic on port

443

and outbound return traffic on ephemeral ports (

1024

65535

Step-by-Step Solution

Analyze the stateful security group requirements for both the client (EC2 instances) and the destination (Interface VPC Endpoint).

Since security groups are stateful, the client security group only needs an outbound rule to allow TCP port

443

to the endpoint's security group. The endpoint's security group only needs an inbound rule to allow TCP port

443

from the client's security group. Return traffic is tracked and allowed automatically.

Establishing stateful rules prevents unnecessary port exposure, minimizing security risk and following the principle of least privilege.

Determine the stateless Network ACL (NACL) requirements for the application subnet.

The application subnet NACL must allow outbound TCP traffic to the endpoint subnet (

10.0.3.0/24

) on destination port

443

. Additionally, it must allow inbound return traffic from the endpoint subnet (

10.0.3.0/24

) on the client's ephemeral port range (

1024

65535

NACLs are stateless and evaluate traffic in both directions independently; without allowing return traffic on ephemeral ports, TCP handshakes cannot complete.

Determine the stateless Network ACL (NACL) requirements for the endpoint subnet.

The endpoint subnet NACL must allow inbound TCP traffic from the application subnet (

10.0.2.0/24

) on port

443

. It must also allow outbound return traffic to the application subnet (

10.0.2.0/24

) on ephemeral ports (

1024

65535

This matches the counterpart stateless flow, ensuring that incoming packets can be received by the endpoint network interfaces and the responses can leave the subnet.

Key Concept

Stateless vs Stateful Network Security in AWS VPCs

Question 248Question →

An organization stores database backups in an Amazon S3 bucket. The backups are encrypted using an AWS KMS customer managed key. A new regulatory standard mandates that the encryption keys must be rotated annually. Additionally, any historical backups must be immediately re-encrypted with the new key material so that the old key material can be decommissioned and permanently deleted. Which strategy should a solutions architect recommend to meet these requirements?

Create a new customer managed key, configure the backup system to use the new key, copy and re-encrypt the existing historical backups in Amazon S3 using the new key, and delete the old customer managed key.

Enable automatic key rotation on the existing customer managed key, and delete the old key material version from the AWS KMS console.

Enable automatic key rotation on the existing customer managed key, which automatically re-encrypts all historical S3 backups with the new key version, allowing the old key version to be deleted.

Store the encryption key ARN as a plaintext String parameter in AWS Systems Manager Parameter Store, configure the backup application to fetch this parameter, and deploy an AWS Lambda function to update the parameter value with a new key ARN annually.

Show answer & explanation

Answer: Create a new customer managed key, configure the backup system to use the new key, copy and re-encrypt the existing historical backups in Amazon S3 using the new key, and delete the old customer managed key.

Answer

The correct strategy is to create a new customer managed key, update the backup system configuration to point to it, copy and re-encrypt all existing historical backups in S3 using the new key, and then delete the old customer managed key. Since AWS KMS automatic key rotation keeps old key material to decrypt historical data and does not support deleting old key versions or automatically re-encrypting existing objects, manual rotation with active re-encryption is required to decommission the old key material.

Step-by-Step Solution

Analyze the requirements for rotating KMS keys, re-encrypting existing backups, and deleting/decommissioning the old key material.

Identified that automatic rotation keeps old key material active and does not re-encrypt historical data, whereas manual rotation (creating a new key) allows re-encryption and subsequent deletion of the old key.

Required to determine if manual or automatic rotation fits the constraint of deleting the old key material.

Determine the necessary steps for manual rotation.

A new customer managed key must be created, and the backup system configuration must be updated to use the new key's Amazon Resource Name (ARN).

Ensures that future backups are encrypted with the new key.

Address the historical backups currently encrypted with the old key.

Copy/re-encrypt existing objects in S3 to use the new key. Once all historical objects are encrypted with the new key, the old key can be safely deleted.

Fulfills the requirement that the old key material be decommissioned and permanently deleted.

Key Concept

Manual KMS Key Rotation and Re-encryption

Question 249Question →

A municipal utility company wants to audit its AWS accounts for compliance and threat detection. The security team needs to monitor the environment for unauthorized IAM policy modifications and changes to VPC security groups. Additionally, the team requires near real-time alerts whenever a configuration deviates from the company's security baseline. Which combination of actions should the Solutions Architect recommend to achieve this? (Select TWO.)

Select all that apply

Configure AWS Config to continuously record and evaluate configurations of IAM roles, policies, and security groups, and enable AWS CloudTrail in all regions to capture management events.

Create an Amazon EventBridge rule that detects AWS Config non-compliant status changes and specific CloudTrail API calls, and configure it to send notifications to an Amazon Simple Notification Service (Amazon SNS) topic.

Deploy AWS Shield Advanced to monitor network traffic to the AWS Management Console and block unauthorized configuration changes made to the console.

Implement stateless Network ACLs at the subnet level to intercept, inspect, and block unauthorized IAM API call requests.

Deploy AWS WAF to inspect console traffic and block API calls destined for the IAM service endpoints if they originate from outside the corporate subnet.

Show answer & explanation

Answer: Configure AWS Config to continuously record and evaluate configurations of IAM roles, policies, and security groups, and enable AWS CloudTrail in all regions to capture management events.; Create an Amazon EventBridge rule that detects AWS Config non-compliant status changes and specific CloudTrail API calls, and configure it to send notifications to an Amazon Simple Notification Service (Amazon SNS) topic.

Answer

Configuring AWS Config to continuously record and evaluate IAM and security group resource configurations, enabling AWS CloudTrail in all regions to log management events, and creating an Amazon EventBridge rule to route compliance changes and API alerts to an Amazon SNS topic.

To monitor unauthorized changes and ensure compliance, AWS Config tracks configuration modifications of AWS resources (like IAM policies and security groups) and evaluates them against rules. AWS CloudTrail records API calls and management events across all regions. An Amazon EventBridge rule can ingest these events and trigger actions (like sending an SNS notification) in near real-time when changes are detected.

Step-by-Step Solution

Enable AWS CloudTrail across all regions to capture management events and API calls, and enable AWS Config to record resource configurations and evaluate compliance.

Comprehensive log files of all administrative API calls are created, and configuration baselines for IAM resources and security groups are established.

CloudTrail captures the metadata of API calls, while AWS Config tracks how resource configurations change over time.

Configure an Amazon EventBridge rule that filters for AWS Config compliance status transitions and CloudTrail API patterns representing unauthorized changes.

Events are captured in real-time and mapped to an event target.

EventBridge enables automated, event-driven responses to system changes.

Set the target of the EventBridge rule to an Amazon Simple Notification Service (Amazon SNS) topic subscribed to by the security team.

The security team receives push notifications immediately when security configurations drift or unauthorized changes are made.

Amazon SNS provides scalable pub/sub messaging to deliver notifications via email, SMS, or HTTPS webhooks.

Key Concept

Centralized configuration compliance auditing and real-time event-driven alerting using AWS Config, AWS CloudTrail, Amazon EventBridge, and Amazon SNS.

Question 250Question →

A gaming company hosts a real-time multiplayer application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application recently experienced service degradation due to a large-scale UDP flood attack targeting the ALB. The company needs to implement a solution that automatically mitigates these Layer 3 and Layer 4 DDoS attacks at the edge before they reach the ALB, while ensuring low-latency access for legitimate players. Which solution should a solutions architect recommend?

Deploy Amazon CloudFront in front of the Application Load Balancer. CloudFront provides inherent protection against Layer 3 and Layer 4 attacks at the AWS edge network through integrated AWS Shield Standard.

Create stateless Network Access Control Lists (NACLs) at the subnet level of the ALB to dynamically monitor and block the traffic signatures of the UDP flood.

Deploy AWS WAF and associate it with the Application Load Balancer. Configure an AWS WAF Web ACL with rate-based rules to block the incoming UDP flood traffic.

Configure the security groups associated with the Application Load Balancer to allow only TCP traffic, and configure AWS Route 53 latency routing to distribute UDP traffic across multiple AWS Regions.

Show answer & explanation

Answer: Deploy Amazon CloudFront in front of the Application Load Balancer. CloudFront provides inherent protection against Layer 3 and Layer 4 attacks at the AWS edge network through integrated AWS Shield Standard.

Answer

Deploy Amazon CloudFront in front of the Application Load Balancer to leverage the built-in DDoS protection provided by AWS Shield Standard at the AWS edge network.

Deploying Amazon CloudFront in front of the Application Load Balancer utilizes AWS's global edge locations to absorb and mitigate Layer 3 and Layer 4 DDoS attacks automatically using AWS Shield Standard. This ensures that malicious UDP flood traffic is blocked before reaching the VPC or the ALB, preserving system availability and latency.

Step-by-Step Solution

Identify the network layer of the DDoS attack.

The UDP flood represents a Layer 3/4 network and transport layer attack.

Classifying the attack layer allows the selection of the correct AWS protection tools, separating infrastructure shielding from web application filtering.

Evaluate perimeter edge services versus internal VPC controls.

Amazon CloudFront intercepts traffic at global edge locations and natively integrates with AWS Shield Standard.

Mitigating attacks at the edge isolates the origin resources and scales horizontally before traffic hits the Application Load Balancer.

Review the inadequacy of Layer 7, DNS, or stateful instance protections.

AWS WAF (Layer 7), security groups, and NACLs are unsuited to drop high-volume UDP floods efficiently at scale.

Discarding incorrect options reinforces why edge infrastructure proxying is the architecturally sound design.

Key Concept

Edge protection against Layer 3 and Layer 4 DDoS attacks is best achieved using Amazon CloudFront integrated with AWS Shield Standard.

Question 251Question →

A company has an on-premises reporting application that must query an Amazon RDS database and write output reports to an Amazon S3 bucket. The application requires database credentials that must be rotated every 30 days. The company's security policy prohibits the use of long-term AWS credentials on-premises and mandates that database passwords must not be stored in plaintext.

Which solution meets these security requirements?

Configure IAM Roles Anywhere to allow the on-premises application to exchange its X.509 certificate for temporary AWS credentials with permissions to write to the S3 bucket. Store the database credentials in AWS Secrets Manager, configure automatic rotation every 30 days, and retrieve the credentials dynamically using the temporary session.

Configure IAM Roles Anywhere to allow the on-premises application to exchange its X.509 certificate for temporary AWS credentials. Store the database credentials as a standard String parameter in AWS Systems Manager Parameter Store, and run an on-premises scheduled script to rotate the database password and update the parameter value in plaintext every 30 days.

Create an IAM user with a policy that allows writing to the S3 bucket. Generate long-term access keys for this IAM user, store them on the on-premises server, and store the database credentials in an encrypted local configuration file that is updated manually every 30 days.

Use the AWS account root user credentials to configure the AWS CLI on the on-premises server to ensure uninterrupted access. Store the database credentials in AWS Secrets Manager, enable automatic rotation every 30 days, and retrieve the database credentials using the root credentials.

Show answer & explanation

Answer: Configure IAM Roles Anywhere to allow the on-premises application to exchange its X.509 certificate for temporary AWS credentials with permissions to write to the S3 bucket. Store the database credentials in AWS Secrets Manager, configure automatic rotation every 30 days, and retrieve the credentials dynamically using the temporary session.

Answer

The solution using IAM Roles Anywhere with X.509 certificates and AWS Secrets Manager with automatic rotation.

The correct solution uses IAM Roles Anywhere, which allows workloads outside of AWS (such as on-premises servers) to use local digital certificates (X.509) to obtain temporary AWS credentials, thus avoiding long-term IAM user access keys. It also uses AWS Secrets Manager, which securely encrypts secrets at rest and supports automatic rotation of database credentials out-of-the-box.

Step-by-Step Solution

Establish secure, temporary authentication for the on-premises application.

IAM Roles Anywhere exchanges the application's X.509 certificates issued by a trusted Certificate Authority (CA) for temporary, short-lived AWS IAM credentials.

This eliminates the need to store long-term AWS access keys on-premises, satisfying the corporate security policy.

Store and secure the RDS database connection credentials.

The database password is saved securely as an encrypted secret within AWS Secrets Manager.

Secrets Manager integrates with AWS KMS to encrypt the secret at rest and ensures passwords are not stored in plaintext.

Automate credential rotation.

Secrets Manager uses an AWS Lambda function to automatically rotate the database password and update both the database and the secret every 30 days.

This satisfies the requirement for 30-day automated rotation without requiring manual script maintenance or storing plaintext secrets.

Key Concept

Securing hybrid cloud access using IAM Roles Anywhere to provide temporary credentials to on-premises workloads, combined with AWS Secrets Manager for encrypted secret storage and automated rotation.

Question 252Question →

A media streaming provider needs to implement a security monitoring strategy across its AWS environment. The provider wants to detect compromised IAM credentials and anomalous API requests made from unauthorized IP addresses. Additionally, they must track configurations and record resource changes over time for compliance auditing. Which combination of AWS services should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Enable Amazon GuardDuty to continuously analyze AWS CloudTrail management events and detect credential misuse or unauthorized API patterns.

Implement AWS Config to record configurations of AWS resources and evaluate them against compliance rules.

Configure stateless Network ACLs at the subnet level to automatically track and inspect returning IAM API traffic.

Deploy AWS Shield Standard on the front-end load balancers to block Layer 7 application exploits and malicious access key patterns.

Enable AWS Shield Advanced to analyze and filter out SQL injection attacks on the EC2 backend instances.

Show answer & explanation

Answer: Enable Amazon GuardDuty to continuously analyze AWS CloudTrail management events and detect credential misuse or unauthorized API patterns.; Implement AWS Config to record configurations of AWS resources and evaluate them against compliance rules.

Answer

The correct options are enabling Amazon GuardDuty to analyze AWS CloudTrail management events and implementing AWS Config to record and track configurations of resources.

The correct architecture uses Amazon GuardDuty to monitor IAM credential security and API anomalies by digesting AWS CloudTrail logs, and AWS Config to track configuration history and ensure compliance baseline rules are met.

Step-by-Step Solution

Address credential compromise and anomalous API monitoring requirements.

Identify that Amazon GuardDuty analyses AWS CloudTrail management events to identify anomalous patterns of activity indicative of credential misuse or compromise.

GuardDuty has built-in threat intelligence and machine learning to identify credential abuse.

Address compliance and auditing requirements for configuration history.

Identify that AWS Config records the history of configurations and automatically evaluates changes against desired security baselines.

AWS Config is designed for auditing and compliance tracking of configuration history.

Key Concept

AWS Security Monitoring and Threat Detection using GuardDuty and AWS Config

Question 253Question →

A solutions architect is designing a secure architecture for a microservice-based payment application. The application must securely store API keys for a third-party payment gateway. Additionally, the application requires encrypting customer profiles stored in an Amazon DynamoDB table using a customer managed key (CMK) that is automatically rotated. The company requires that historical data encrypted under the CMK remains readable after rotation without manual intervention or data re-encryption. Which TWO actions should the solutions architect take to meet these security requirements? (Select TWO.)

Select all that apply

Store the payment gateway API keys in AWS Secrets Manager and configure automatic rotation for the secrets.

Create a symmetric customer managed key (CMK) in AWS KMS, enable automatic key rotation, and configure the DynamoDB table to use this key.

Store the payment gateway API keys in AWS Systems Manager Parameter Store as a parameter of type String.

Create an asymmetric customer managed key (CMK) in AWS KMS, enable automatic key rotation, and configure the DynamoDB table to use this key.

Create a symmetric customer managed key (CMK) in AWS KMS, enable automatic key rotation, and execute a custom script to decrypt and re-encrypt all historical DynamoDB items under the new key version.

Show answer & explanation

Answer: Store the payment gateway API keys in AWS Secrets Manager and configure automatic rotation for the secrets.; Create a symmetric customer managed key (CMK) in AWS KMS, enable automatic key rotation, and configure the DynamoDB table to use this key.

Answer

Store the API keys in AWS Secrets Manager with automatic rotation, and use a symmetric customer managed key in AWS KMS with automatic key rotation enabled for the DynamoDB table.

The correct options are to store the API keys in AWS Secrets Manager and to use a symmetric customer managed KMS key with automatic key rotation enabled for DynamoDB. Secrets Manager securely stores and automatically rotates API keys. A symmetric customer managed KMS key is the correct key type for DynamoDB encryption and supports automatic key rotation. Since KMS transparently keeps the older key versions to decrypt historical data, no manual re-encryption is required.

Step-by-Step Solution

Select a secure storage solution for third-party API keys.

AWS Secrets Manager is chosen because it securely encrypts secrets at rest and supports built-in automatic rotation.

Storing credentials in plaintext (like SSM Parameter Store String type) is insecure, while Secrets Manager provides secure lifecycle management for API keys.

Select the correct KMS key type and rotation policy for DynamoDB.

A symmetric customer managed KMS key with automatic rotation enabled is configured.

DynamoDB supports encryption at rest with KMS keys. Symmetrical KMS keys support automatic annual rotation, whereas asymmetric keys do not support automatic rotation.

Evaluate decryption requirements for historical data.

Verify that no manual re-encryption is needed.

AWS KMS automatically retains the older backing key material to decrypt historical data encrypted under previous versions of the key.

Key Concept

AWS KMS automatic rotation for symmetric keys automatically retains older key versions to decrypt historical data, and AWS Secrets Manager provides secure storage and rotation for API credentials.

Question 254Question →

A company stores large volumes of sensitive transactional data in an Amazon S3 bucket. The data is encrypted at rest using Server-Side Encryption with AWS KMS Customer Managed Keys (SSE-KMS). Due to high read and write request volumes, the company is experiencing high AWS KMS costs and is occasionally throttled by AWS KMS API limits. Which action should the solutions architect take to resolve this issue with minimal changes to the application?

Enable automatic key rotation on the KMS Customer Managed Key to distribute the cryptographic workload.

Configure SSE-S3 encryption for the S3 bucket, and store the plaintext encryption keys as String parameters in Systems Manager Parameter Store to perform client-side encryption.

Configure the Amazon S3 bucket to use an S3 Bucket Key for server-side encryption.

Deploy an S3 Gateway Endpoint in the VPC and route all AWS KMS API traffic through it to eliminate KMS request charges.

Show answer & explanation

Answer: Configure the Amazon S3 bucket to use an S3 Bucket Key for server-side encryption.

Answer

Configure the Amazon S3 bucket to use an S3 Bucket Key for server-side encryption.

Configuring an Amazon S3 Bucket Key for server-side encryption allows S3 to use a bucket-level key derived from AWS KMS. This key is used to encrypt new objects in the bucket, significantly reducing the volume of calls S3 makes to AWS KMS (by up to 99%). This reduces costs and mitigates API throttling without any modifications to the application.

Step-by-Step Solution

Analyze the cause of high AWS KMS costs and throttling.

The issue is caused by the high volume of direct API requests from Amazon S3 to AWS KMS for encrypting and decrypting individual objects.

Each S3 read/write operation under standard SSE-KMS generates a call to AWS KMS to decrypt or generate a data key.

Evaluate solutions that reduce the frequency of direct KMS API calls.

Amazon S3 Bucket Keys reduce KMS request traffic by deriving key material at the bucket level instead of making a KMS call per object.

An S3 Bucket Key serves as a temporary, bucket-level key cached by S3, minimizing KMS API interactions.

Implement the S3 Bucket Key configuration.

AWS KMS request traffic is reduced by up to 99%, resolving both the high costs and throttling limits.

This is a configuration change on the S3 bucket level and requires zero changes to application code.

Key Concept

Amazon S3 Bucket Keys for SSE-KMS

Question 255Question →

A company runs a data processing application on Amazon EC2 instances located in the private subnets of a VPC. The application must regularly download software updates from an external repository on the public internet and upload large processed datasets to an Amazon S3 bucket. The company wants to minimize data transfer costs and ensure that the network configuration follows security best practices. Which TWO configurations should a solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route tables of the private subnets.

Deploy a NAT Gateway in a public subnet, and configure the route tables of the private subnets to route outbound traffic destined for

0.0.0.0/0

to the NAT Gateway.

Route all Amazon S3 traffic through the NAT Gateway to the public S3 endpoints to simplify routing and avoid creating additional VPC endpoints.

Add an inbound rule to the security group of the Amazon EC2 instances to allow return traffic on ephemeral ports (

1024 - 65535

) from the NAT Gateway.

Configure the private subnet Network ACL with an outbound rule allowing traffic to the external repository, and rely on the Network ACL's stateful packet inspection to automatically permit response traffic.

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route tables of the private subnets.; Deploy a NAT Gateway in a public subnet, and configure the route tables of the private subnets to route outbound traffic destined for $0.0.0.0/0$ to the NAT Gateway.

Answer

The correct configurations are to create a Gateway VPC Endpoint for Amazon S3 associated with the private subnet route tables, and to deploy a NAT Gateway in a public subnet with a route for outbound internet traffic in the private subnet route tables.

Creating a Gateway VPC Endpoint for Amazon S3 allows instances in the private subnets to securely transfer data to S3 without using a NAT Gateway, avoiding data processing charges. Deploying a NAT Gateway in a public subnet and routing

0.0.0.0/0

traffic from the private subnets through it allows the private instances to download updates from the public internet safely.

Step-by-Step Solution

Analyze the requirements for internet egress and AWS service access.

The application needs access to the public internet for software updates and access to Amazon S3 for data uploads.

This establishes the routing paths needed: one for public internet traffic and one for Amazon S3 traffic.

Identify the most secure and cost-effective method to access Amazon S3 from private subnets.

A Gateway VPC Endpoint for Amazon S3 is selected.

Gateway VPC Endpoints are free and allow private subnets to communicate with Amazon S3 without traversing the internet or incurring NAT Gateway data transfer charges.

Identify the mechanism for private instances to safely download updates from the internet.

A NAT Gateway is deployed in a public subnet, and the private subnet route table is updated to route outbound internet traffic (

0.0.0.0/0

) through it.

This allows instances in the private subnets to initiate outbound connections to the internet for updates while blocking unsolicited inbound connections from the internet.

Key Concept

VPC Network Security and VPC Endpoint Routing

Estimated Time:2m 0s

Question 256Question →

A media company hosts a microservices application across two different virtual private clouds (VPCs) in the same AWS Region: VPC A ( $10.10.0.0/16$ ) and VPC B ( $10.20.0.0/16$ ). The VPCs are connected using a VPC peering connection. The web microservice in VPC A needs to query a PostgreSQL database cluster running on Amazon EC2 instances in VPC B.

Which configuration should a solutions architect implement to secure network access to the database using the principle of least privilege?

Configure the database security group in VPC B to allow inbound TCP port

5432

traffic from the security group of the web microservice in VPC A.

Configure the database security group in VPC B to allow inbound TCP port

5432

traffic from the CIDR block of VPC A (

10.10.0.0/16

Configure the Network ACL of the database subnet in VPC B to allow inbound TCP port

5432

traffic from the security group of the web microservice in VPC A.

Configure the database security group in VPC B to allow inbound TCP port

5432

traffic from the public IP addresses of the web microservice instances in VPC A.

Show answer & explanation

Answer: Configure the database security group in VPC B to allow inbound TCP port $5432$ traffic from the security group of the web microservice in VPC A.

Answer

Configure the database security group in VPC B to allow inbound TCP port

5432

traffic from the security group of the web microservice in VPC A.

Referencing the security group ID of the web microservice in the database's security group rule is the recommended AWS best practice for peered VPCs. This ensures that only the instances explicitly associated with the web microservice security group can access the PostgreSQL database on port

5432

, maintaining strict isolation.

Step-by-Step Solution

Identify the network connection type.

The VPCs are peered via a VPC peering connection, meaning traffic routes privately using private IP addresses.

This rules out solutions using public IP addresses or public network gateways.

Determine the capabilities of security groups across peered VPCs.

AWS security groups can reference other security groups in peered VPCs as traffic sources or destinations.

This allows for fine-grained access control based on resource membership rather than broad CIDR blocks.

Evaluate the stateful vs. stateless resource control mechanisms.

Security groups are stateful and can filter traffic based on security group IDs, while Network ACLs are stateless and can only filter by CIDR blocks.

This confirms that referencing the web microservice security group within the database's security group is the only way to achieve least-privilege security.

Key Concept

Security Group Referencing across VPC Peering

Estimated Time:1m 30s

Question 257Question →

An enterprise is deploying a microservice application on Amazon ECS. The application requires access to a Microsoft SQL Server database running on Amazon RDS. The security team mandates that the database credentials must be encrypted at rest and rotated every 30 days without downtime or manual intervention. Which strategy should a solutions architect recommend to meet these requirements with the least operational overhead?

Store the database credentials in AWS Secrets Manager. Configure automatic rotation using the built-in Secrets Manager rotation template integrated with a helper AWS Lambda function.

Store the credentials as a plaintext String parameter in AWS Systems Manager Parameter Store. Write a scheduled Amazon EventBridge rule that triggers an AWS Lambda function to update the database password.

Store the credentials in AWS Systems Manager Parameter Store as a SecureString parameter. Enable AWS KMS automatic key rotation on the customer managed key used for encryption to automatically rotate the underlying credentials.

Store the credentials as a plaintext String parameter in AWS Systems Manager Parameter Store, and configure an IAM policy that allows only the application's ECS task execution role to decrypt the parameter.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager. Configure automatic rotation using the built-in Secrets Manager rotation template integrated with a helper AWS Lambda function.

Answer

Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in Secrets Manager rotation template integrated with a helper AWS Lambda function.

AWS Secrets Manager is specifically designed for database credential management. It encrypts secrets at rest using AWS Key Management Service (KMS) and provides built-in integration with AWS Lambda to rotate credentials automatically. By using the provided rotation templates for Amazon RDS databases, a solutions architect can achieve automatic rotation with minimal operational effort.

Step-by-Step Solution

Select a secure, encrypted storage service that supports automatic credential rotation.

AWS Secrets Manager is selected because it integrates directly with AWS KMS for encryption at rest and natively supports secret rotation.

Systems Manager Parameter Store SecureString parameters support encryption but do not have built-in, out-of-the-box automatic rotation for database credentials.

Configure the rotation mechanism for the database credentials.

Use the native integration in AWS Secrets Manager to configure a Lambda function based on the standard rotation template for RDS.

This configuration automatically updates the database password on both the database instance and the stored secret, avoiding manual intervention and minimizing operational overhead.

Key Concept

AWS Secrets Manager provides native support for the lifecycle management, encryption, and automatic rotation of sensitive credentials like database passwords.

Estimated Time:1m 30s

Question 258Question →

A company needs to grant an external compliance audit firm temporary access to audit logs stored in a private Amazon S3 bucket. The audit firm has its own AWS account. The company wants to ensure that the audit firm can access the logs securely without sharing long-term AWS credentials, adhering to the principle of least privilege. Which solution should a solutions architect recommend to meet these requirements?

Create a dedicated IAM user in the company's account for the audit firm. Attach a policy allowing read-only access to the S3 bucket, generate long-term access keys, and share these credentials with the audit firm.

Generate a pre-signed S3 URL using the company's AWS account root user credentials, and provide the URL to the audit firm to download the logs directly.

Create an IAM role in the company's account with a trust policy that allows the audit firm's AWS account to assume the role. Attach an IAM policy to the role that allows read-only access to the specific S3 bucket. Provide the IAM role ARN to the audit firm.

Store the S3 access credentials as a plaintext parameter in AWS Systems Manager Parameter Store, and configure the S3 bucket policy to allow public access filtered by the audit firm's IP address range.

Show answer & explanation

Answer: Create an IAM role in the company's account with a trust policy that allows the audit firm's AWS account to assume the role. Attach an IAM policy to the role that allows read-only access to the specific S3 bucket. Provide the IAM role ARN to the audit firm.

Answer

Create an IAM role in the company's account with a trust policy that allows the audit firm's AWS account to assume the role, attach a read-only policy to the S3 bucket, and provide the role ARN.

The correct solution uses an IAM role with a trust policy allowing cross-account access. By using IAM roles, the audit firm can assume the role to obtain temporary security credentials, avoiding the need to share long-term credentials. Applying a read-only policy to the specific S3 bucket ensures the principle of least privilege is maintained.

Step-by-Step Solution

Determine the credential requirement for third-party cross-account access.

Identify that temporary credentials via IAM roles are preferred over long-term IAM user credentials to meet security best practices.

IAM roles allow users or services from another AWS account to obtain temporary security credentials via the AWS Security Token Service (STS).

Configure the IAM role trust policy and permission policy.

Define a trust policy pointing to the third party's AWS account and a permission policy granting read-only access to the target S3 bucket.

This establishes trust between accounts while enforcing the principle of least privilege on the destination resource.

Provide the role ARN to the third party.

The third-party audit firm can now configure their applications or CLI to assume the role.

This allows the external entity to retrieve temporary credentials and perform the audit tasks without storing long-term credentials.

Key Concept

Cross-Account IAM Roles and Temporary Credentials

Question 259Question →

A company is migrating a multi-tier application to AWS. The application consists of microservices running on AWS Fargate that require access to two different credentials: a database password for an Amazon RDS for PostgreSQL database that must be automatically rotated every 14 days, and a third-party API key that rarely changes but must be encrypted at rest using a customer managed key (CMK) with minimum retrieval cost. Which combination of actions should a solutions architect take to meet these requirements securely and cost-effectively? (Select TWO.)

Select all that apply

Store the PostgreSQL database credentials in AWS Secrets Manager, and configure the secret to rotate automatically using the database's built-in RDS rotation function.

Store the API key in AWS Systems Manager Parameter Store as a SecureString parameter, specifying the customer managed KMS key for encryption.

Store the database credentials in Systems Manager Parameter Store as a String parameter, and create a custom AWS Lambda function to update the database password every 14 days.

Store the database credentials in Systems Manager Parameter Store as a SecureString parameter, and configure AWS KMS customer managed key automatic rotation to rotate the database password every 14 days.

Store the API key in Systems Manager Parameter Store as a String parameter, and enable the default KMS automatic annual rotation for the parameter storage.

Show answer & explanation

Answer: Store the PostgreSQL database credentials in AWS Secrets Manager, and configure the secret to rotate automatically using the database's built-in RDS rotation function.; Store the API key in AWS Systems Manager Parameter Store as a SecureString parameter, specifying the customer managed KMS key for encryption.

Answer

Store the database credentials in AWS Secrets Manager with built-in RDS PostgreSQL automatic rotation, and store the API key in Systems Manager Parameter Store as a SecureString parameter encrypted with the customer managed KMS key.

For the database credentials, AWS Secrets Manager is the correct choice because it natively manages database secrets and supports automatic rotation for RDS databases out-of-the-box. For the static API key, storing it as a SecureString in Systems Manager Parameter Store is the most secure and cost-effective approach since it supports encryption with customer managed KMS keys and has no storage costs for standard parameters.

Step-by-Step Solution

Analyze rotation requirements for database credentials.

The database credentials require automatic rotation every 14 days. Secrets Manager supports native, automatic rotation templates for Amazon RDS databases.

Using AWS Secrets Manager satisfies the automatic rotation requirement without building custom logic.

Analyze encryption and cost requirements for static secrets.

The third-party API key is static but must be encrypted at rest using a customer managed KMS key. Parameter Store with SecureString parameters supports customer managed KMS keys and provides standard parameter storage at no cost.

Using Systems Manager Parameter Store SecureString parameters for static secrets is more cost-effective than using Secrets Manager, which incurs a monthly cost per secret and additional retrieval fees.

Key Concept

Selecting the appropriate secrets management service based on rotation needs, encryption requirements, and cost-efficiency.

Estimated Time:2m 0s

Question 260Question →

A company is migrating a web application to Amazon EC2 instances. The application requires access to an Amazon RDS for PostgreSQL database. To comply with security policies, the database credentials must be encrypted at rest and automatically rotated every 30 days without causing application downtime. Which combination of actions should a solutions architect perform to meet these requirements? (Select TWO.)

Select all that apply

Store the database credentials in AWS Secrets Manager.

Configure AWS Secrets Manager to rotate the database credentials automatically using an AWS Lambda function.

Store the database credentials as a standard String parameter in AWS Systems Manager Parameter Store.

Store the database credentials as a SecureString parameter in AWS Systems Manager Parameter Store and enable automatic annual rotation of the customer managed AWS KMS key.

Store the database credentials in a plaintext environment variable within the EC2 instance launch template.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager.; Configure AWS Secrets Manager to rotate the database credentials automatically using an AWS Lambda function.

Answer

Store the database credentials in AWS Secrets Manager, and configure AWS Secrets Manager to rotate the database credentials automatically using an AWS Lambda function.

AWS Secrets Manager is designed specifically to secure database credentials. Storing credentials in Secrets Manager ensures encryption at rest, and configuring Secrets Manager automatic rotation via an AWS Lambda function updates both the secret and the Amazon RDS database, fulfilling all requirements securely without downtime.

Step-by-Step Solution

Identify the service that supports secure secret storage and native automatic rotation.

AWS Secrets Manager is chosen over Systems Manager Parameter Store because Secrets Manager natively supports automatic rotation of database credentials.

Parameter Store does not have built-in support for rotating credentials on a schedule.

Enable automatic rotation for the secret.

Configure AWS Secrets Manager with a rotation schedule and an AWS Lambda function to update the database credentials.

Secrets Manager uses a Lambda function to update the credentials in both Secrets Manager and the target Amazon RDS database concurrently without downtime.

Key Concept

AWS Secrets Manager is the standard service for storing, encrypting, and automatically rotating database credentials.

PreviousPage 13 / 22Next

Design Secure Architectures

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept