Examkin

Design Secure Architectures

438 questions

All types438Multiple choice214Multiple select224
Question 281Question →

An enterprise is deploying a high-volume payment processing application on Amazon ECS using the AWS Fargate launch type. The application requires access to a sensitive API key for a third-party payment gateway. The API key must be encrypted at rest using a customer managed key (CMK) in AWS Key Management Service (AWS KMS) and must be rotated every 90 days. The application tasks scale dynamically, launching and terminating thousands of containers daily, and the application queries the third-party gateway frequently, which requires reading the API key multiple times per minute. The solutions architect must design a secure, cost-effective secrets management solution that automates key rotation with zero downtime. Which combination of actions should the solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the API key as a secret in AWS Secrets Manager, and configure a custom AWS Lambda function to rotate the API key every 90 days.; Use the AWS Secrets Manager client-side caching library in the ECS application containers to retrieve and cache the API key.

Answer

Store the API key as a secret in AWS Secrets Manager with a custom AWS Lambda function for rotation, and implement the client-side caching library in the ECS application containers to minimize API call costs.
The correct solution uses AWS Secrets Manager to store the secret and a custom AWS Lambda function to orchestrate rotation because Secrets Manager lacks a built-in template for custom third-party APIs. To optimize API costs and latency under high container scaling and frequent API requests, client-side caching should be implemented in the ECS container code, allowing the container to fetch the secret from a local memory cache rather than querying the AWS Secrets Manager API and KMS decrypt operation on every request.

Step-by-Step Solution

1
Store the sensitive API key securely using AWS Secrets Manager.
The secret is encrypted at rest using the specified AWS KMS Customer Managed Key (CMK).
Secrets Manager provides secure storage and native integration with KMS for encrypting secrets.
2
Implement a custom AWS Lambda function to manage secret rotation.
The API key is rotated every 90 days by calling the third-party payment gateway's API and updating the secret value in Secrets Manager.
Since the API key belongs to a third-party gateway, there is no built-in Secrets Manager rotation template, necessitating custom Lambda code.
3
Implement client-side caching within the ECS container application using the AWS Secrets Manager caching library.
Frequent lookups of the secret are served from the local cache instead of making remote API calls to Secrets Manager and AWS KMS.
Caching drastically reduces API invocation costs and database latency under high query volumes and dynamic scaling conditions.

Key Concept

Secrets management and key rotation for third-party integrations with cost optimization.
Question 282Question →

A financial services company hosts a multi-tier application in a VPC and must comply with a strict security policy requiring all subnet-level Network Access Control Lists (NACLs) to block unrestricted inbound SSH (port 22) and RDP (port 3389) traffic. The security team needs a solution that continuously monitors the NACL configurations, automatically alerts on any non-compliant changes, and reverts the non-compliant configurations to their secure state in near-real-time. Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Configure AWS Config to monitor Network ACL configurations using the nacl-no-unrestricted-ssh-rdp managed rule. Set up an AWS Systems Manager Automation document as the remediation action to revert any non-compliant NACL rules when a change is detected.

Answer

Configure AWS Config to monitor Network ACL configurations using the nacl-no-unrestricted-ssh-rdp managed rule. Set up an AWS Systems Manager Automation document as the remediation action to revert any non-compliant NACL rules when a change is detected.
AWS Config is designed for configuration monitoring and compliance tracking. The managed rule 'nacl-no-unrestricted-ssh-rdp' automatically checks if any Network ACLs allow unrestricted inbound SSH or RDP traffic. When a non-compliant resource is detected, AWS Config can trigger a remediation action using AWS Systems Manager Automation to automatically modify the NACL and revert it to a secure state, providing a native, low-overhead solution.

Step-by-Step Solution

1
Enable AWS Config in the target region and record the AWS::EC2::NetworkAcl resource type.
AWS Config tracks the configuration states and changes of all Network ACLs in the VPC.
This establishes the monitoring foundation needed to detect configuration changes.
2
Deploy the nacl-no-unrestricted-ssh-rdp AWS Config managed rule.
The rule automatically evaluates all Network ACL configurations for compliance against the policy prohibiting unrestricted SSH/RDP access.
This provides automated compliance detection without requiring custom detection logic or script development.
3
Configure an AWS Systems Manager Automation document as a remediation action for the managed rule.
When a non-compliant NACL configuration is detected, the Systems Manager Automation document executes in near-real-time to modify the NACL back to its compliant state.
This accomplishes automated remediation and recovery of the resources with minimal operational overhead.

Key Concept

Automated configuration monitoring and remediation using AWS Config and Systems Manager Automation
Estimated Time:2m 0s
Question 283Question →

An organization runs a containerized payment processing service on Amazon ECS that requires credentials to access an Amazon RDS for MySQL database. The organization's security policy requires the database credentials to be rotated every 30 days. Additionally, the AWS Key Management Service (AWS KMS) customer managed key used to encrypt the credentials must be rotated annually. The policy also specifies that once the KMS key is rotated, the stored credentials must be immediately re-encrypted with the new key material to ensure that the retired key material is no longer used to protect the active credentials. Which solution should a solutions architect recommend to satisfy these security requirements?

Show answer & explanation

Answer: Store the credentials in AWS Secrets Manager with automatic rotation enabled on a 30-day schedule. Enable automatic key rotation on the KMS customer managed key. Configure an AWS Lambda function triggered by AWS CloudTrail events for KMS key rotation to programmatically update the secret value, forcing Secrets Manager to re-encrypt the credentials using the new key material.

Answer

Store the credentials in AWS Secrets Manager with 30-day automatic rotation, enable automatic key rotation on the KMS customer managed key, and use a Lambda function triggered by CloudTrail key rotation events to programmatically update and re-encrypt the secret.
The correct solution uses AWS Secrets Manager for database credentials because it provides built-in 30-day automatic rotation for RDS databases. Since automatic KMS customer managed key rotation does not retroactively re-encrypt existing ciphertexts, a custom workflow using AWS CloudTrail, EventBridge, and AWS Lambda is required to detect the key rotation event, retrieve the secret, and update it. This update action forces Secrets Manager to request a new encryption operation from KMS, which will use the newly rotated key material to encrypt the active credentials immediately.

Step-by-Step Solution

1
Store database credentials in AWS Secrets Manager and enable built-in automatic rotation.
Automatic rotation of the RDS MySQL credentials occurs every 30 days without custom orchestration code.
Secrets Manager natively supports scheduled rotation for RDS databases, reducing operational overhead.
2
Enable automatic key rotation for the KMS Customer Managed Key (CMK) used to encrypt the secret.
The KMS key material is rotated automatically every year.
This satisfies the requirement for annual encryption key rotation without manual intervention.
3
Implement an AWS Lambda function triggered by EventBridge when a CloudTrail API call logs the KMS key rotation event to update the secret.
The active credentials in Secrets Manager are retrieved and re-saved, resulting in immediate re-encryption with the new key material.
Since automatic KMS key rotation does not retroactively re-encrypt existing ciphertexts, re-saving the secret programmatically forces the use of the new key version.

Key Concept

AWS KMS key rotation mechanics do not retroactively re-encrypt existing ciphertexts; dynamic re-encryption requires a re-save or manual re-encryption operation.
Estimated Time:2m 30s
Question 284Question →

A telemetry data processing system runs on Amazon Elastic Container Service (Amazon ECS) tasks inside a private subnet. The system requires secure access to three configuration items: database credentials for an Amazon RDS for MySQL DB instance that must be rotated every 30 days, a static API key for an external mapping provider, and the database endpoint host address along with the application logging verbosity level. The solutions architect needs to design a secure storage and rotation solution that minimizes costs and operational overhead. Which two options should the solutions architect select to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager, and configure automatic rotation using the built-in Amazon RDS rotation template.; Store the database endpoint, logging verbosity level, and the external API key in AWS Systems Manager Parameter Store, using String parameters for non-sensitive data and a SecureString parameter for the API key.

Answer

Store the database credentials in AWS Secrets Manager with automatic RDS rotation enabled, and store the non-sensitive parameters as String parameters and the API key as a SecureString parameter in AWS Systems Manager Parameter Store.
To satisfy the requirements securely and cost-effectively, the database credentials should be stored in AWS Secrets Manager, which natively supports automatic 30-day rotation for Amazon RDS DB instances. Non-sensitive settings (database endpoint and logging level) and the static API key should be stored in AWS Systems Manager Parameter Store. Using String parameters for the non-sensitive configuration and a SecureString parameter for the API key ensures both security and cost efficiency.

Step-by-Step Solution

1
Analyze the security and rotation requirements for each configuration item.
The database credentials require rotation every 30 days, which makes AWS Secrets Manager the ideal service due to its built-in RDS rotation templates. The external API key is static and does not require automatic rotation, meaning it can be securely stored in AWS Systems Manager Parameter Store.
Evaluating rotation needs determines the proper secrets management service, aligning with security requirements while optimizing for simplicity.
2
Select the most cost-effective parameters for non-sensitive data.
The database endpoint and logging verbosity are non-sensitive configuration items and should be stored as free standard String parameters in Parameter Store.
Using Parameter Store for non-sensitive parameters avoids the monthly per-secret cost of AWS Secrets Manager.
3
Evaluate the encryption requirements for static sensitive data.
The static API key is sensitive and must be encrypted at rest. It should be stored as a SecureString parameter in Systems Manager Parameter Store, which is backed by AWS KMS.
SecureString parameters provide free storage (with standard parameters limit) and secure KMS-based encryption for sensitive, non-rotating values.

Key Concept

AWS Secrets Manager provides native support for rotating active credentials such as database passwords, while AWS Systems Manager Parameter Store is a cost-effective service for static secrets (using SecureString) and non-sensitive configuration data (using String parameters).
Question 285Question →

An enterprise is designing a secure architecture for a microservices application. The application's compute resources run in an Amazon ECS cluster hosted in AWS Account A, while the backend Amazon Aurora PostgreSQL database is hosted in AWS Account B. The security architecture must satisfy the following constraints:
1. The database credentials must be encrypted at rest and automatically rotated every 30 days without manual intervention.
2. The application requires access to a third-party payment API token that must be encrypted at rest and rotated every 90 days.
3. Non-sensitive configurations (such as the database endpoint and port) must be stored in a cost-optimized manner and accessible without decryption overhead.
4. The ECS tasks in Account A must access these resources securely with minimal operational complexity.

Which two options should the solutions architect choose to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager in Account B, encrypted with a customer managed KMS key. Enable automatic rotation using the built-in Aurora PostgreSQL rotation template, and attach a resource-based policy to the secret to grant read access to the ECS task execution role in Account A.; Store the non-sensitive database configurations as standard String parameters in AWS Systems Manager Parameter Store in Account A, and store the third-party API token in AWS Secrets Manager in Account A with a custom AWS Lambda function configured for its 90-day rotation.

Answer

Store the database credentials in AWS Secrets Manager in Account B with a resource-based policy and built-in rotation template. Store the non-sensitive configurations in AWS Systems Manager Parameter Store in Account A as standard String parameters, and store the third-party API token in AWS Secrets Manager in Account A using a custom Lambda function for rotation.
For the database credentials in Account B, AWS Secrets Manager is the optimal choice because it supports native database password rotation and resource-based policies, allowing direct cross-account access from Account A's ECS task role. For the non-sensitive parameters, Systems Manager Parameter Store standard String parameters provide a free, no-decryption-overhead solution within Account A. For the third-party API key, Secrets Manager in Account A allows custom 90-day rotation via AWS Lambda while maintaining encryption at rest.

Step-by-Step Solution

1
Select the database credentials storage and cross-account access strategy.
Database credentials should be stored in AWS Secrets Manager in Account B.
Secrets Manager natively supports automatic 30-day rotation for RDS/Aurora using built-in Lambda templates. It also supports resource-based policies, which allow ECS tasks in Account A to read the secret directly across accounts.
2
Select the storage strategy for non-sensitive configurations to minimize cost and latency.
Store non-sensitive configurations as standard String parameters in Systems Manager Parameter Store in Account A.
Standard String parameters in Parameter Store do not incur storage or decryption costs, and since they are stored in the same account as the ECS tasks, no cross-account access overhead is introduced.
3
Select the storage and rotation strategy for the third-party API token.
Store the third-party API token in AWS Secrets Manager in Account A, using a custom AWS Lambda function for rotation.
The API token requires encryption at rest (achieved via Secrets Manager) and a custom rotation mechanism since it is an external third-party API. Secrets Manager integrates directly with Lambda to schedule and execute this rotation logic.

Key Concept

Cross-account access and automated lifecycle management of sensitive credentials and non-sensitive configurations using AWS Secrets Manager and Systems Manager Parameter Store.
Estimated Time:3m 0s
Question 286Question →

A solutions architect needs to store a database password for a web application. The password must be encrypted at rest, but the application does not require automatic password rotation. The solutions architect wants to choose the most cost-effective storage option. Which AWS service should be used to meet these requirements?

Show answer & explanation

Answer: AWS Systems Manager Parameter Store with a SecureString parameter

Answer

AWS Systems Manager Parameter Store with a SecureString parameter
Using AWS Systems Manager Parameter Store with a SecureString parameter satisfies the requirement to encrypt the database password at rest using AWS KMS. Since the application does not require automatic credential rotation, standard Parameter Store parameters are the most cost-effective choice as they are offered at no additional cost.

Step-by-Step Solution

1
Analyze the requirements for the secret database password.
The secret must be stored with encryption at rest, but automatic rotation is not required.
This rules out the necessity of AWS Secrets Manager's automatic rotation, allowing the use of simpler, free alternatives like Systems Manager Parameter Store.
2
Compare Systems Manager Parameter Store parameter types.
Parameter Store standard parameters are free of charge. A SecureString parameter type integrates with AWS KMS to encrypt the value at rest.
This securely encrypts the secret at rest without incurring the monthly secret hosting fees associated with AWS Secrets Manager.

Key Concept

AWS Systems Manager Parameter Store SecureString parameters provide a free and secure storage mechanism for sensitive configuration data and passwords when automated rotation is not needed.
Estimated Time:45s
Question 287Question →

A company is developing a web application that runs on Amazon EC2 instances and connects to an Amazon RDS for PostgreSQL database. The database credentials must be encrypted at rest and rotated every 30 days. The solutions architect needs to design a secure solution to manage these credentials with minimal administrative overhead. Which two actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials as a secret in AWS Secrets Manager.; Enable automatic rotation for the secret and configure it to use a pre-configured AWS Lambda function designed for Amazon RDS.

Answer

To securely manage database credentials, the solutions architect should store the credentials in AWS Secrets Manager and enable automatic rotation using a pre-configured AWS Lambda function tailored for Amazon RDS.
AWS Secrets Manager secures database credentials at rest using KMS encryption. By combining it with a pre-configured AWS Lambda function, Secrets Manager can safely update the database credentials on a schedule (such as every 30 days) and update the secret store automatically, satisfying all requirements with minimal administrative effort.

Step-by-Step Solution

1
Select a secure storage service for the credentials that supports automatic rotation.
AWS Secrets Manager is chosen because it encrypts secrets at rest and natively supports automatic rotation for Amazon RDS databases.
Systems Manager Parameter Store does not offer native, out-of-the-box automatic rotation for RDS databases without custom Lambda functions, which increases administrative overhead.
2
Configure the rotation mechanism for the database credentials.
Enable automatic rotation on the secret, electing to use the RDS rotation template which deploys a pre-configured AWS Lambda function.
The Lambda function executes the rotation lifecycle (updating credentials in RDS and the secret value in Secrets Manager) without modifying application code.

Key Concept

AWS Secrets Manager vs Systems Manager Parameter Store rotation and encryption capabilities.
Question 288Question →

A financial services company hosts a compliance reporting application on Amazon EC2 instances. The application requires access to a static third-party API token. The security team mandates that the token must be encrypted at rest using a customer managed key that undergoes automatic annual rotation. However, to maintain data integrity, historical records encrypted with older versions of the key must remain decryptable without being re-encrypted. Which solution meets these requirements with the lowest operational overhead and cost?

Show answer & explanation

Answer: Store the API token in AWS Systems Manager Parameter Store as a SecureString parameter. Encrypt the parameter using an AWS KMS customer managed key with automatic key rotation enabled.

Answer

Store the API token in AWS Systems Manager Parameter Store as a SecureString parameter, encrypting it with a customer managed KMS key that has automatic rotation enabled.
Storing the token as a SecureString in Systems Manager Parameter Store provides secure encryption at rest without the cost overhead of AWS Secrets Manager. Utilizing a customer managed KMS key with automatic rotation enabled satisfies the annual key rotation requirement, and because KMS natively manages historical key versions to decrypt old data, no manual re-encryption of historical records is needed.

Step-by-Step Solution

1
Determine the cost-effective secrets storage service.
AWS Systems Manager Parameter Store is chosen because standard parameters are free, and the API token is static and does not require automatic rotation (which is a primary feature of the costlier AWS Secrets Manager).
Choosing the service that minimizes cost and operational overhead while meeting technical requirements.
2
Select the correct parameter type for encryption.
A SecureString parameter type is selected, referencing a customer managed AWS KMS key.
String parameters are plaintext, whereas SecureString parameters encrypt data at rest using AWS KMS.
3
Configure KMS key rotation mechanics.
Enable automatic annual rotation on the customer managed KMS key.
AWS KMS automatically retains historical key material to decrypt previously encrypted values, allowing decryption of old records without requiring manual re-encryption.

Key Concept

Secrets vs Parameter Management and KMS Key Rotation Mechanics
Question 289Question →

A software developer is configuring a deployment pipeline on AWS and needs to store database connection details. The database hostname is public information, but the database password must be encrypted at rest to comply with company security policies. The password is static and does not need automatic rotation. Which configuration should the developer use to meet these requirements securely and with the lowest cost?

Show answer & explanation

Answer: Store the database hostname as a String parameter and the database password as a SecureString parameter in AWS Systems Manager Parameter Store.

Answer

Store the database hostname as a String parameter and the database password as a SecureString parameter in AWS Systems Manager Parameter Store.
The correct option proposes storing the hostname as a String parameter and the password as a SecureString parameter in AWS Systems Manager Parameter Store. This configuration is secure because the password is encrypted at rest using AWS KMS, and it is cost-effective because standard parameters in Systems Manager Parameter Store are free of charge, unlike AWS Secrets Manager which incurs a monthly hosting fee.

Step-by-Step Solution

1
Identify the security requirements for the database credentials and hostnames.
The database password must be encrypted at rest, whereas the database hostname is public and does not require encryption.
This helps determine which configuration values must be protected and which can be stored in plaintext.
2
Analyze the operational requirements and cost constraints.
The password is static, does not require automatic rotation, and the solution must minimize operational costs.
Since automatic rotation is not needed, Systems Manager Parameter Store is a more cost-effective choice than AWS Secrets Manager.
3
Select the appropriate parameter types for Parameter Store.
Use a String parameter for the hostname and a SecureString parameter for the database password.
This satisfies the security requirement for the password while keeping storage costs free by using standard parameters.

Key Concept

Distinguishing between sensitive and non-sensitive configuration data and using appropriate Parameter Store parameter types (String vs. SecureString) to optimize cost and security.
Question 290Question →

A company is deploying a retail application on Amazon EC2 instances. The application requires access to database credentials for an Amazon RDS for MySQL database, which must be rotated automatically every 30 days to comply with security standards. Additionally, the application requires access to a static API key for an external payment gateway provider. This API key must be encrypted at rest but does not require rotation. The company wants to minimize ongoing management costs for storing these credentials. Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager, and configure automatic rotation using a built-in rotation template with an AWS Lambda function.; Store the payment gateway API key as a SecureString parameter in AWS Systems Manager Parameter Store.

Answer

Store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function, and store the payment gateway API key as a SecureString parameter in AWS Systems Manager Parameter Store.
The database credentials require automatic rotation, which is natively supported by AWS Secrets Manager using Lambda functions. The payment gateway API key is static, so it does not need rotation, and storing it as a SecureString parameter in AWS Systems Manager Parameter Store encrypts the data at rest using AWS KMS while avoiding the monthly per-secret cost of AWS Secrets Manager.

Step-by-Step Solution

1
Identify the rotation and encryption requirements for each sensitive data item.
The database credentials require regular 30-day rotation, while the payment gateway API key is static but must be encrypted.
This determines which AWS service features are necessary (e.g., automatic rotation capabilities vs. static secure storage).
2
Select the appropriate storage service for the database credentials.
Choose AWS Secrets Manager with a Lambda rotation function.
AWS Secrets Manager provides built-in integration with Lambda to automatically rotate database credentials without manual intervention.
3
Select the cost-optimized secure storage service for the static API key.
Choose AWS Systems Manager Parameter Store with the SecureString parameter type.
Parameter Store SecureString provides KMS-encrypted storage with no additional storage fees for standard parameters, making it highly cost-effective for static secrets that do not require rotation.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on credential rotation and cost-optimization requirements.
Estimated Time:2m 0s
Question 291Question →

An enterprise-grade media streaming platform is deploying a new content analytics service. The service consists of containerized microservices running on AWS Fargate in a private subnet. The application requires access to two distinct items: a non-sensitive database configuration string that changes per environment, and a highly sensitive API token used to authenticate with an external content delivery network (CDN) partner. The database configuration must be retrieved with low latency and without incurring additional request fees. The CDN API token must be encrypted at rest, rotated automatically every 30 days via a custom rotation schedule, and must never be exposed as plaintext in the Fargate task definition or console.

Which combination of actions should a solutions architect take to meet these requirements securely and cost-effectively? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database configuration string as a standard String parameter in AWS Systems Manager Parameter Store, and reference its Amazon Resource Name (ARN) in the ECS container definition using the valueFrom parameter to inject it as an environment variable.; Store the CDN API token in AWS Secrets Manager, configure a rotation schedule that runs a custom AWS Lambda function every 30 days, and grant the ECS task execution role permission to decrypt the secret using a Customer Managed Key.

Answer

To securely and cost-effectively manage these parameters, the solutions architect should store the non-sensitive database configuration string as a standard String parameter in Systems Manager Parameter Store and reference it in the task definition, while storing the sensitive CDN API token in Secrets Manager with automatic Lambda-based rotation and KMS decryption permissions granted to the task execution role.
The correct solution uses AWS Systems Manager Parameter Store Standard parameters for non-sensitive data (database configuration) because standard parameters are free and have no request costs. For sensitive credentials that require automatic rotation (CDN API token), the solution uses AWS Secrets Manager. Secrets Manager integrates directly with AWS Lambda for custom rotation functions. The containerized Fargate task securely accesses both via environment variables injected at runtime, using the task execution role with appropriate decrypt permissions.

Step-by-Step Solution

1
Analyze credential security and rotation requirements.
Identify that the CDN API token is highly sensitive and requires automatic rotation every 30 days, which aligns with AWS Secrets Manager capabilities.
Secrets Manager provides native lifecycle management and Lambda integration for custom rotation schedules.
2
Analyze configuration cost and latency requirements.
Identify that the database configuration string is non-sensitive and must be retrieved without request fees.
Systems Manager Parameter Store Standard parameters are free and ideal for non-sensitive configuration data.
3
Configure integration with AWS Fargate tasks.
Reference the Parameter Store parameter and Secrets Manager secret in the ECS container definition using the task execution role.
This prevents hardcoding credentials or configurations inside the container image or task definitions.

Key Concept

Distinguishing between AWS Secrets Manager for automated secret lifecycle management and AWS Systems Manager Parameter Store for cost-effective configuration management, while understanding the limits of KMS key rotation versus secret rotation.
Question 292Question →

A company is moving an on-premises application to Amazon EC2. The application needs to retrieve a sensitive API credential for an external payment service and a non-sensitive API endpoint URL for a weather forecasting service. A solutions architect needs to design a configuration storage strategy that is secure, cost-effective, and minimizes administrative overhead.

Which combination of steps should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the payment service API credential as a SecureString parameter in AWS Systems Manager Parameter Store.; Store the weather forecasting service API endpoint URL as a String parameter in AWS Systems Manager Parameter Store.

Answer

Store the payment service API credential as a SecureString parameter in AWS Systems Manager Parameter Store, and store the weather forecasting service API endpoint URL as a String parameter in AWS Systems Manager Parameter Store.
Storing the sensitive payment service API credential as a SecureString parameter in Systems Manager Parameter Store provides automatic encryption at rest using AWS KMS. Storing the non-sensitive weather forecasting service API endpoint URL as a standard String parameter in Parameter Store is the most secure and cost-effective approach, avoiding unnecessary KMS costs while utilizing a centralized parameter management solution.

Step-by-Step Solution

1
Identify the sensitivity of the configuration data.
The payment service API credential is sensitive and requires encryption, while the weather forecasting service API endpoint is non-sensitive.
This determines which storage parameters require encryption and which can be stored in plaintext.
2
Select the appropriate parameter type in AWS Systems Manager Parameter Store.
Use a SecureString parameter for the sensitive credential to encrypt it at rest using AWS KMS, and use a standard String parameter for the non-sensitive URL endpoint to save on overhead and encryption resource costs.
This implements the principle of least privilege and optimizes cost and management overhead.

Key Concept

AWS Systems Manager Parameter Store supports String parameters for plaintext configurations and SecureString parameters for sensitive configuration data encrypted by AWS KMS.
Question 293Question →

A solutions architect is designing a batch data processing workload running on Amazon ECS using the AWS Fargate launch type. The application requires access to a database connection string containing sensitive credentials that must be rotated every 30 days, and a non-sensitive configuration endpoint URL that remains static. The solutions architect needs to design a secure, cost-effective storage and retrieval strategy with minimal operational overhead.

Which combination of services should the solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Store the database connection string in AWS Secrets Manager and configure automatic rotation. Store the configuration endpoint URL as a String parameter in Systems Manager Parameter Store.

Answer

The most secure and cost-effective approach is to store the database connection string in AWS Secrets Manager with automatic rotation enabled, and store the non-sensitive configuration endpoint URL as a String parameter in AWS Systems Manager Parameter Store.
AWS Secrets Manager is designed for storing sensitive data such as database credentials and supports built-in automatic rotation using AWS Lambda. For non-sensitive application configurations, AWS Systems Manager Parameter Store is a cost-effective and low-overhead solution when using standard String parameters. Combining both services optimizes cost while meeting security and operational requirements.

Step-by-Step Solution

1
Analyze security and rotation requirements for the sensitive database credentials.
The database connection string is highly sensitive and requires automatic rotation every 30 days. AWS Secrets Manager is the optimal choice as it natively integrates database credential rotation using AWS Lambda.
Secrets Manager provides built-in lifecycle management and rotation features, whereas Systems Manager Parameter Store does not natively orchestrate database-side rotation out of the box.
2
Evaluate storage and cost requirements for the non-sensitive configuration URL.
The configuration endpoint URL is non-sensitive and static. AWS Systems Manager Parameter Store using standard String parameters is free of charge and requires minimal overhead.
Using Secrets Manager for non-sensitive, static configs adds unnecessary monthly costs ($0.40 per secret) and API call overhead, which violates cost-optimization principles.
3
Combine the storage choices into a unified architecture.
Integrate AWS Secrets Manager (for connection strings) and Systems Manager Parameter Store (for static URLs) with the ECS task definition.
This hybrid approach leverages the strength of each service, securing sensitive resources while minimizing AWS expenditure.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on data sensitivity, rotation needs, and cost efficiency.
Question 294Question →

A retail company wants to continuously monitor its AWS accounts and workloads for malicious activity, including potential cryptocurrency mining and unauthorized API usage. The solution must require minimal operational overhead and provide automated threat intelligence. Which AWS service should a solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty is the correct AWS service to recommend because it provides intelligent threat detection and continuous monitoring for malicious activities like cryptocurrency mining and unauthorized API usage.
Amazon GuardDuty continuously monitors AWS accounts and workloads using data sources like VPC Flow Logs, CloudTrail management events, and DNS logs. It uses machine learning, anomaly detection, and threat intelligence to identify malicious activities like cryptocurrency mining or unauthorized access, satisfying the requirements with minimal operational overhead.

Step-by-Step Solution

1
Analyze the requirement for continuous, automated, account-wide monitoring for threats like cryptocurrency mining and unauthorized API activity.
Determine that the required service must perform threat detection and behavioral analysis, rather than simple network traffic filtering.
Understanding the monitoring scope helps eliminate basic firewalls and network security controls.
2
Evaluate AWS security services to find one designed for continuous intelligence monitoring and automated detection.
Identify Amazon GuardDuty as the dedicated managed service that uses machine learning and threat intelligence feeds to monitor AWS logs for anomalous and malicious behavior.
Matching the specific business need to the specialized AWS security service ensures compliance with the AWS Well-Architected framework.

Key Concept

Continuous security monitoring and threat detection using Amazon GuardDuty
Question 295Question →

A company is developing a high-throughput financial ledger application running on Amazon EKS across multiple AWS accounts. The containerized application pods need access to:
1. A third-party payment gateway API password that must be encrypted at rest and rotated automatically every 45 days.
2. Regional service endpoint URLs (non-sensitive) that must be retrieved with minimal latency and zero additional storage cost.
Additionally, the security team requires that the AWS KMS customer managed key (CMK) used to encrypt the credentials must be rotated annually. The operations team incorrectly believes that this annual rotation will automatically decrypt and re-encrypt all historical database backups and secrets logs using the new key version.

Which combination of configurations should a solutions architect recommend to satisfy these requirements?

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager with automatic rotation configured for 45 days, and retrieve it using the AWS Secrets Manager CSI provider. Store the endpoint URLs as String parameters in AWS Systems Manager Parameter Store. Enable automatic key rotation for the KMS CMK, and clarify to the team that key rotation does not re-encrypt historical data, which remains decryptable using the archived key version.

Answer

Store the database password in AWS Secrets Manager with automatic rotation, store the endpoint URLs in AWS Systems Manager Parameter Store as String parameters, and enable KMS key rotation while clarifying that historical data is not automatically re-encrypted.
The correct configuration uses AWS Secrets Manager for the database password to leverage automatic 45-day rotation and secure EKS integration. Non-sensitive endpoint URLs are stored as String parameters in Parameter Store for zero storage cost. Enabling KMS key rotation is recommended, but the solutions architect must clarify that KMS does not automatically re-encrypt historical data; instead, it retains the old key version to allow decryption of existing data.

Step-by-Step Solution

1
Determine the storage for sensitive credentials requiring automatic rotation.
AWS Secrets Manager is chosen for the database password because it natively supports automatic rotation (e.g., using AWS Lambda) and integrates with EKS via the CSI provider.
Parameter Store does not natively manage secrets rotation lifecycles, and Secrets Manager is designed specifically for securing and rotating credentials.
2
Determine the storage for non-sensitive regional endpoints.
AWS Systems Manager Parameter Store with the String data type is selected.
String parameters in Parameter Store are free of charge for standard parameters and provide low-latency configuration retrieval, minimizing costs for non-sensitive data.
3
Analyze KMS Key Rotation behavior for customer managed keys (CMKs).
Explain that enabling automatic key rotation creates a new backing key version for new encryption operations, but does not re-encrypt existing historical data.
Historical data remains encrypted with the previous backing key version, which AWS KMS automatically retains to decrypt older data when requested.

Key Concept

AWS Secrets Manager is preferred for credentials requiring automated rotation. AWS Systems Manager Parameter Store offers a cost-effective solution for non-sensitive configurations. AWS KMS key rotation creates a new key version for future operations but does not re-encrypt existing data.
Estimated Time:2m 30s
Question 296Question →

A digital health platform hosts its microservices on Amazon ECS with AWS Fargate. The platform must comply with healthcare regulations that require continuous security auditing, real-time threat detection for container environments, and centralized tracking of security posture across multiple AWS accounts. The security team needs a solution that monitors API calls, detects runtime container anomalies, and compiles all findings into a unified security dashboard. Which combination of actions should a solutions architect recommend to satisfy these monitoring and detection requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Amazon GuardDuty with ECS Runtime Monitoring to analyze VPC Flow Logs, DNS logs, CloudTrail events, and container runtime activity for threats.; Configure AWS Security Hub to centrally aggregate and prioritize compliance findings and security alerts from GuardDuty and other integrated AWS services.

Answer

The platform should enable Amazon GuardDuty with ECS Runtime Monitoring to analyze log sources and container runtime activities, and configure AWS Security Hub to centrally aggregate compliance findings and security alerts.
The solution requires a service that detects threats within the container environment and a centralized security dashboard. Enabling Amazon GuardDuty with ECS Runtime Monitoring meets the threat detection requirement by analyzing VPC flow logs, DNS logs, CloudTrail, and Fargate runtime activities. Enabling AWS Security Hub meets the aggregation requirement by consolidating findings from GuardDuty and compliance standards into a single pane of glass.

Step-by-Step Solution

1
Select the correct threat detection service for the container environment.
Identify Amazon GuardDuty with ECS Runtime Monitoring.
GuardDuty monitors logs and Fargate runtime activity to detect container threat patterns.
2
Select the correct service to consolidate security findings and track compliance posture.
Identify AWS Security Hub.
AWS Security Hub consolidates security alerts and compliance statuses from multiple AWS services and accounts into a centralized dashboard.
3
Evaluate and eliminate incorrect options.
Eliminate options involving AWS Shield and stateless security groups at the subnet level.
AWS Shield is for DDoS protection (not Layer 7 exploits or container runtime anomalies), and Security Groups are stateful firewall rules applied to ENIs rather than subnets.

Key Concept

AWS Security Monitoring and Threat Detection architectures rely on GuardDuty for intelligent threat detection (including runtime container monitoring) and AWS Security Hub for centralized findings aggregation and compliance standards monitoring.
Question 297Question →

A financial technology firm hosts a payment processing application on Amazon ECS inside a private VPC subnet. Public traffic is received via an Application Load Balancer (ALB). The compliance team dictates that the architecture must satisfy three main security requirements: continuously monitor all network interfaces and DNS queries for potential data exfiltration or threat patterns; audit any configurations to security groups and automatically revert unauthorized changes within minutes; and aggregate security status globally across multiple AWS accounts. Which two actions should the solutions architect take to meet these security monitoring and compliance requirements?

Select all that apply

Show answer & explanation

Answer: Enable Amazon GuardDuty to analyze VPC Flow Logs and Route 53 resolver query logs across all accounts to detect network-level anomalies and threat patterns.; Create an AWS Config rule to evaluate security group rule compliance and associate it with an AWS Systems Manager Automation runbook to automatically remediate unauthorized rules.

Answer

Enable Amazon GuardDuty to analyze VPC Flow Logs and Route 53 query logs, and create an AWS Config rule to evaluate security groups with an AWS Systems Manager Automation runbook for remediation.
The correct architecture uses Amazon GuardDuty to process VPC Flow Logs and Route 53 query logs across all accounts to detect anomalies, and AWS Config rules to monitor security group modifications with Systems Manager Automation runbooks to immediately revert non-compliant configurations.

Step-by-Step Solution

1
Select the threat detection service that natively ingests VPC Flow Logs and Route 53 query logs.
Amazon GuardDuty is selected to meet the requirement for network anomaly and threat detection.
GuardDuty uses machine learning and threat intelligence to analyze flow logs and DNS query logs without introducing performance overhead.
2
Identify the auditing and automated remediation tool for security groups.
AWS Config is chosen to monitor security group rules, paired with AWS Systems Manager Automation for automated remediation.
This combination audits resource configurations and triggers runbooks to revoke unauthorized ingress rules automatically.
3
Evaluate and rule out AWS Shield Advanced for application payload filtering.
AWS Shield Advanced is disqualified because payload filtering for SQL injection requires AWS WAF.
Shield is a DDoS mitigation service, not an application payload inspection firewall.
4
Evaluate and rule out stateless Network ACL configurations and WAF log analysis.
Stateless Network ACLs and WAF monitoring of VPC Flow Logs are disqualified due to stateless/stateful limitations and service scope mismatches.
Network ACLs cannot dynamically track connection state, and WAF cannot analyze flow logs.

Key Concept

Continuous security monitoring, threat detection, and automated compliance auditing using Amazon GuardDuty, AWS Config, and Systems Manager.
Question 298Question →

A software-as-a-service (SaaS) company hosts a multi-tier web application on AWS using an Application Load Balancer (ALB) and Amazon EC2 instances. The security team needs to monitor the environment for Layer 7 web exploits, detect anomalous network activity or potential credential compromise at the host level, and continuously audit changes to network access controls. Which combination of AWS services should a solutions architect recommend to meet these monitoring and threat detection requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy AWS WAF on the ALB to protect against Layer 7 web exploits, and enable AWS Config to track and audit configuration history for security groups.; Enable Amazon GuardDuty to monitor VPC Flow Logs and CloudTrail events to identify anomalous network activity and unauthorized API actions.

Answer

Deploy AWS WAF on the ALB to protect against Layer 7 web exploits, enable AWS Config to track and audit configuration history for security groups, and enable Amazon GuardDuty to monitor VPC Flow Logs and CloudTrail events to identify anomalous network activity and unauthorized API actions.
The correct combination uses AWS WAF for inspecting and blocking Layer 7 web exploits, AWS Config to record configuration changes for security groups to audit network access controls, and Amazon GuardDuty to analyze VPC Flow Logs and CloudTrail events to identify network anomalies and potential compromises.

Step-by-Step Solution

1
Address the requirement for Layer 7 web exploit mitigation.
Identify AWS WAF as the correct service to deploy on the ALB, as it filters and blocks Layer 7 application-specific attacks.
AWS WAF provides deep inspection of HTTP/HTTPS requests, which is required to prevent common web exploits.
2
Address the requirement for host-level anomalous network activity and threat detection.
Identify Amazon GuardDuty as the appropriate service, which uses intelligent threat detection to analyze VPC Flow Logs and CloudTrail events.
GuardDuty monitors logs in the background without affecting performance to detect anomalies, brute-force attempts, and credential misuse.
3
Address the requirement for auditing network access configuration modifications.
Identify AWS Config to continuously track, record, and evaluate configuration changes to security groups.
AWS Config is the primary service for resource configuration history and compliance auditing.

Key Concept

Selecting the appropriate AWS services for Layer 7 security (WAF), threat detection (GuardDuty), and compliance tracking (AWS Config) according to the AWS Well-Architected Framework.
Question 299Question →

A company wants to continuously monitor its AWS environment for unauthorized activity and threat behavior, such as EC2 instances communicating with known malicious IP addresses or performing cryptocurrency mining. Which strategy should a solutions architect recommend to detect these security threats?

Show answer & explanation

Answer: Enable Amazon GuardDuty to analyze metadata from sources such as AWS CloudTrail logs, VPC Flow Logs, and DNS query logs.

Answer

Enable Amazon GuardDuty to analyze metadata from sources such as AWS CloudTrail logs, VPC Flow Logs, and DNS query logs.
Amazon GuardDuty is a continuous threat detection service that monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, Kubernetes clusters, and data stored in Amazon S3. It analyzes metadata from sources such as AWS CloudTrail events, Amazon VPC Flow Logs, and DNS query logs to identify threats like communication with command-and-control servers or cryptocurrency mining.

Step-by-Step Solution

1
Identify the core security requirement, which is to detect unauthorized behavior and malicious activities like cryptocurrency mining and command-and-control communication across the AWS environment.
The requirement is dynamic threat detection and behavior monitoring rather than static packet filtering or DDoS prevention.
This establishes that a continuous threat monitoring service is needed.
2
Evaluate the AWS services capable of analyzing logs and metadata to detect security anomalies.
Amazon GuardDuty is built specifically for this purpose and integrates out-of-the-box with CloudTrail, VPC Flow Logs, and DNS logs.
This identifies the correct service aligned with AWS best practices.

Key Concept

Continuous Threat Detection and Security Monitoring using Amazon GuardDuty
Question 300Question →

A logistics company's security operations team suspects that an Amazon EC2 instance in a private subnet is compromised and communicating with a malicious command-and-control server. The team must capture network flow details, including source and destination IP addresses, ports, and protocols, to confirm this activity and analyze the connection patterns. The logging solution must capture all traffic without altering the existing network architecture or impacting network performance. Which strategy should the solutions architect recommend to monitor this network traffic?

Show answer & explanation

Answer: Enable VPC Flow Logs on the subnet, publishing the logs to an Amazon S3 bucket, and use Amazon Athena to query and analyze the traffic details.

Answer

Enable VPC Flow Logs on the subnet, publishing the logs to an Amazon S3 bucket, and use Amazon Athena to query and analyze the traffic details.
Enabling VPC Flow Logs at the subnet level allows the security team to capture metadata about the IP traffic going to and from network interfaces in the subnet. Since VPC Flow Logs is an out-of-band feature, it has no impact on network latency or throughput. Storing these logs in Amazon S3 and querying them using Amazon Athena provides a highly scalable and cost-effective method to analyze the network flow data, locate the destination IP addresses, and verify whether the connections were accepted or rejected.

Step-by-Step Solution

1
Identify the requirement to monitor and analyze all traffic going to and from network interfaces in a VPC subnet without affecting latency or performance.
Determine that VPC Flow Logs is the native AWS feature designed to capture IP traffic metadata without impacting performance, as it operates out-of-band.
Allows the security team to collect metadata about network connections (source, destination, protocol, ports) without deploying agents or inline appliances.
2
Determine the appropriate log destination and analysis tool for querying the captured flow metadata.
Select Amazon S3 as the cost-effective storage target, and Amazon Athena to query the log files directly using standard SQL.
Aligns with AWS security and storage best practices, enabling ad-hoc forensic queries without the overhead of indexing or running a continuous search cluster.

Key Concept

VPC Flow Logs for network threat detection and monitoring
Estimated Time:2m 0s
PreviousPage 15 / 22Next
Design Secure Architectures Practice Questions — AWS Certified Solutions Architect - Associate — Page 15 | Examkin