Examkin

Design Secure Architectures

438 questions

All types438Multiple choice214Multiple select224
Question 301Question →

A retail company wants to implement automated security monitoring and compliance tracking for its AWS infrastructure. The security team requires that all Amazon S3 buckets must have server-side encryption enabled, and Amazon EC2 security groups must not allow inbound SSH traffic from the public internet (0.0.0.0/0). Any non-compliant resources must be detected automatically, and the team must receive real-time alerts.

Which TWO solutions should a solutions architect implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Enable AWS Config and deploy the managed rules for S3 bucket encryption and restricted SSH ports.; Configure an Amazon EventBridge rule triggered by AWS Config compliance state changes to send alerts via Amazon Simple Notification Service (Amazon SNS).

Answer

Enable AWS Config with managed rules for S3 encryption and restricted SSH ports, and configure an Amazon EventBridge rule to route compliance change events to Amazon SNS.
The correct options involve enabling AWS Config to deploy managed rules for evaluating S3 encryption and restricted security group ports, alongside configuring Amazon EventBridge to route compliance change alerts via Amazon SNS. This aligns with AWS security monitoring best practices for automated compliance auditing and near real-time notification.

Step-by-Step Solution

1
Enable configuration recording in AWS Config for the required resources.
AWS Config begins tracking configuration history and changes for Amazon S3 and EC2 security groups.
This establishes the data source for compliance monitoring.
2
Deploy AWS Config managed rules for S3 bucket encryption verification and restricted SSH port checks.
AWS Config automatically evaluates resources against these rules and marks non-compliant resources.
Managed rules automate compliance auditing without writing custom logic.
3
Create an Amazon EventBridge rule that filters for AWS Config compliance change events.
Events are captured whenever a resource transitions from compliant to non-compliant status.
This triggers the notification workflow when compliance status changes.
4
Configure the EventBridge rule target to publish messages to an Amazon SNS topic.
Alerts are sent to subscribers of the SNS topic immediately upon compliance status changes.
This meets the real-time alerting requirement.

Key Concept

Continuous compliance monitoring and automated alerting using AWS Config, Amazon EventBridge, and Amazon SNS.
Question 302Question →

A company stores compliance reports in an Amazon S3 bucket. The reports must be encrypted at rest using an AWS KMS Customer Managed Key (CMK). The company's security policy requires that the encryption key be rotated every year. In addition, historical reports encrypted with older versions of the key must remain readable without requiring manual re-encryption of the S3 objects, and the key management actions must be restricted to a specific security team. Which combination of actions will meet these security requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable automatic key rotation for the Customer Managed Key (CMK) in AWS KMS.; Configure the key policy of the Customer Managed Key (CMK) to grant administrative permissions to the security team's IAM role and cryptographic permissions to the application's IAM role.

Answer

Enabling automatic key rotation for the Customer Managed Key (CMK) and configuring the key policy to grant administrative permissions to the security team while restricting cryptographic permissions to the application role.
Enabling automatic key rotation handles annual key rotation seamlessly because AWS KMS keeps previous backing key materials active to decrypt historical objects. Additionally, separating key administrative actions and cryptographic actions via key policies enforces separation of duties and least privilege.

Step-by-Step Solution

1
Evaluate key rotation mechanics.
Determine that automatic key rotation in AWS KMS generates new backing key material annually while retaining previous versions. This enables transparent decryption of historical S3 objects without manual re-encryption.
Meets the business requirement for annual key rotation while ensuring older data remains readable without manual intervention.
2
Enforce least privilege access control on the Customer Managed Key.
Configure a KMS key policy separating administrative privileges (given to the security team's role) from cryptographic privileges (given to the application's role).
Fulfills the security restriction that key management actions must be restricted to a specific security team.

Key Concept

AWS KMS key rotation behaviors and key policy design rules.
Question 303Question →

A global financial firm is designing a security monitoring architecture for its multi-account AWS environment managed via AWS Organizations. The firm needs to detect network anomalies, malicious activity, and unauthorized API calls across all accounts, and aggregate these findings into a single dashboard in a dedicated security account. Additionally, they must ensure that any unauthorized modifications of network security configurations, such as security groups and network ACLs, are automatically detected and flagged for compliance auditing. Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Amazon GuardDuty across all accounts, designate the dedicated security account as the GuardDuty delegated administrator, and integrate GuardDuty findings with AWS Security Hub in the security account.; Create AWS Config organizational rules to continuously monitor configuration changes of security groups and network ACLs, and aggregate compliance results in the dedicated security account.

Answer

Enable Amazon GuardDuty across all accounts, designating the security account as the delegated administrator and integrating with AWS Security Hub, while using AWS Config organizational rules to monitor security group and network ACL configurations.
Centralizing threat detection and compliance tracking in a multi-account organization involves using Amazon GuardDuty integrated with AWS Security Hub to monitor activities and logs, combined with AWS Config organizational rules to track changes to resources like security groups and network ACLs.

Step-by-Step Solution

1
Set up centralized threat monitoring using Amazon GuardDuty.
GuardDuty is enabled on all accounts, and the dedicated security account is designated as the delegated administrator, consolidating all security findings in Security Hub.
This establishes real-time network anomaly and malicious API activity detection using VPC Flow Logs, DNS logs, and CloudTrail events without agent deployment.
2
Deploy configuration compliance monitoring using AWS Config.
AWS Config organizational rules are deployed across the organization to monitor resources like Security Groups and Network ACLs.
This automatically tracks any configuration changes to network security resources and flags non-compliance, notifying the security account.

Key Concept

Centralized threat detection and resource configuration compliance auditing in multi-account environments.
Estimated Time:2m 0s
Question 304Question →

A company is migrating a legacy HR application to Amazon EC2 instances. The application requires access to a database password that must be rotated every 60 days to comply with internal security policies. The database is hosted on Amazon RDS. The security team mandates that the password must be encrypted at rest using a customer managed key, and that the rotation process must be automated with minimal operational effort.

Which solution should a solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and encrypt it using an AWS Key Management Service (AWS KMS) customer managed key. Configure Secrets Manager to automatically rotate the password every 60 days using a configured AWS Lambda function.

Answer

Store the database password in AWS Secrets Manager, encrypt it using an AWS KMS customer managed key, and configure automatic rotation every 60 days using an AWS Lambda function.
AWS Secrets Manager is designed for storing secrets such as database credentials and supports automated rotation through AWS Lambda. It allows encryption using customer managed AWS KMS keys, which satisfies all the compliance and operational requirements with minimal overhead.

Step-by-Step Solution

1
Select AWS Secrets Manager as the credential storage solution.
AWS Secrets Manager supports native integration with AWS Lambda to automatically rotate database credentials without requiring application downtime.
Systems Manager Parameter Store does not support out-of-the-box automated rotation of parameter values.
2
Configure AWS KMS customer managed key encryption.
Secrets Manager encrypts the secret value at rest using the specified customer managed key, satisfying the security team's encryption mandate.
This provides control over key policies and rotation of the key material independent of the secret itself.
3
Associate an AWS Lambda function for rotation and set the rotation schedule to 60 days.
The Lambda function updates the database credentials in RDS and the secret value in Secrets Manager automatically.
This removes the need to write and manage custom rotation cron scripts on the EC2 instances, achieving the least operational overhead.

Key Concept

AWS Secrets Manager supports automatic secrets rotation using AWS Lambda, whereas KMS key rotation only rotates encryption key material and not the stored secret values.
Estimated Time:1m 30s
Question 305Question →

A retail company operates a multi-tier web application on AWS. The application tier runs on Amazon EC2 instances in a private VPC subnet. A security audit requires the company to monitor network traffic for suspicious activities, such as communication with known malicious command-and-control (C2) servers. If a threat is detected, the company must automatically block all traffic to and from the malicious IP address at the subnet level in near real-time. Which TWO options should a solutions architect combine to meet these requirements with the least operational overhead?

Select all that apply

Show answer & explanation

Answer: Enable Amazon GuardDuty to analyze VPC Flow Logs and generate findings for malicious network activity.; Configure an Amazon EventBridge rule to match GuardDuty findings, triggering an AWS Lambda function that dynamically adds a stateless deny rule to the Network ACL associated with the subnet.

Answer

The solutions architect should enable Amazon GuardDuty to analyze VPC Flow Logs and generate findings, and configure an Amazon EventBridge rule to match those findings to trigger an AWS Lambda function that dynamically adds a stateless deny rule to the Network ACL associated with the subnet.
To monitor network traffic for threats such as communication with known malicious command-and-control (C2) servers, Amazon GuardDuty is the ideal service. GuardDuty continuously analyzes VPC Flow Logs, DNS logs, and CloudTrail events without impacting network performance or requiring manual logging infrastructure. To automatically block the malicious IP at the subnet level in near real-time, GuardDuty findings can be sent to Amazon EventBridge. An EventBridge rule detects the threat event and triggers an AWS Lambda function. This Lambda function can programmatically add a stateless deny rule to the Network ACL associated with the subnet, which successfully blocks traffic at the subnet boundary as required.

Step-by-Step Solution

1
Identify the monitoring service that can detect command-and-control (C2) network communications with the least operational overhead.
Amazon GuardDuty is selected because it continuously and automatically analyzes VPC Flow Logs, DNS logs, and CloudTrail events without requiring log storage configuration or performance impact.
Using native threat intelligence is highly efficient and aligns with the requirement for minimal operational overhead.
2
Choose the network security control to block traffic at the subnet level.
Network Access Control Lists (Network ACLs) are identified as the appropriate control.
Security Groups are applied at the instance level (network interface level) and are stateful, whereas Network ACLs operate at the subnet boundary and support both allow and deny rules.
3
Establish the near real-time automated remediation pipeline.
An Amazon EventBridge rule is configured to detect GuardDuty findings and trigger an AWS Lambda function.
EventBridge provides an event-driven mechanism to respond to GuardDuty findings in near real-time.
4
Implement the programmatic update to the network boundaries.
The AWS Lambda function invokes the Amazon EC2 API to insert a stateless deny rule into the subnet's Network ACL.
This dynamically blocks all traffic to and from the malicious IP address at the subnet level as soon as the threat is identified.

Key Concept

Automated threat detection and network boundary remediation using Amazon GuardDuty, Amazon EventBridge, AWS Lambda, and Network ACLs.
Question 306Question →

A gaming company needs to audit and record all API activity across its AWS account to determine who made specific configuration changes, such as modifying IAM policies or deleting resources. Which AWS service should the solutions architect recommend to continuously monitor and record these API actions?

Show answer & explanation

Answer: AWS CloudTrail

Answer

AWS CloudTrail
AWS CloudTrail records AWS API calls and management events for your AWS account. It logs details about the caller identity, the time of the action, the specific API requested, and the response. This directly enables tracking of actions like resource deletion and IAM policy changes.

Step-by-Step Solution

1
Identify the primary requirement from the scenario, which is to audit and record administrative API actions and resource changes in an AWS account.
The requirement is for API-level auditing and tracking of identity and actions.
This helps narrow down the services that record management events.
2
Evaluate AWS CloudTrail against this requirement.
AWS CloudTrail log files contain metadata about the API call, including the identity of the API caller, the time, the source IP address, and the request parameters.
CloudTrail is the native AWS service built specifically for auditing account activity.
3
Verify that alternative services like Amazon VPC Flow Logs, AWS Shield, and AWS Budgets do not meet this administrative API tracking requirement.
These alternative services serve different network, security, and cost management functions.
Eliminating distractors ensures the chosen solution is correct and aligned with best practices.

Key Concept

AWS CloudTrail is the primary service for monitoring, auditing, and recording API activity and actions taken across AWS infrastructure.

Alternative Method

Instead of checking CloudTrail logs manually in S3, you can query CloudTrail Event History directly in the console for the last 90 days of management events.
Estimated Time:45s
Question 307Question →

A company's security team needs to monitor network traffic entering and leaving their Amazon VPC. They want to identify potential security threats, detect anomalous traffic, and capture details about the IP traffic flowing through the network interfaces. Which two actions should the solutions architect recommend to implement this security monitoring? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable VPC Flow Logs on the target VPC to capture IP traffic details for network interfaces.; Publish the flow log data to an Amazon CloudWatch Logs log group to enable querying and analysis.

Answer

Enable VPC Flow Logs on the target VPC to capture IP traffic details for network interfaces, and publish the flow log data to an Amazon CloudWatch Logs log group to enable querying and analysis.
The correct combination of actions is to enable VPC Flow Logs on the target VPC to capture metadata about IP traffic, and to publish those logs to Amazon CloudWatch Logs (or Amazon S3) for querying and analysis. This aligned architectural approach captures network-level traffic data without agent overhead and allows direct querying to discover anomalous traffic.

Step-by-Step Solution

1
Identify the primary source of VPC network traffic metadata.
VPC Flow Logs captures packet metadata (source, destination, protocol, port, packets, bytes) at the network interface level.
This provides the underlying data needed to audit network flows and detect threats.
2
Determine where to store and analyze the captured network traffic flow data.
Publishing to Amazon CloudWatch Logs or Amazon S3 allows for query execution and integration with anomaly detection tools.
VPC Flow Logs must be exported to a destination like CloudWatch Logs or Amazon S3 to be queried and analyzed.

Key Concept

VPC Flow Logs capture network traffic metadata at the VPC, subnet, or elastic network interface level, and can be published to CloudWatch Logs or Amazon S3 for security monitoring.
Question 308Question →

A company is deploying a new web application using AWS App Runner. The application requires access to a database connection string containing sensitive credentials that must be automatically rotated every 30 days. The application also needs access to a database port configuration, which is non-sensitive and static. The company wants to implement a secure solution that minimizes cost and management overhead. Which configuration meets these requirements?

Show answer & explanation

Answer: Store the database connection string in AWS Secrets Manager and configure automatic rotation every 30 days using an AWS Lambda function. Store the database port as a String parameter in AWS Systems Manager Parameter Store.

Answer

Store the database connection string in AWS Secrets Manager with automatic rotation configured via an AWS Lambda function, and store the database port as a standard String parameter in AWS Systems Manager Parameter Store.
AWS Secrets Manager is designed for storing sensitive credentials and natively supports automatic rotation using AWS Lambda functions, which aligns with the security requirements. For non-sensitive configurations such as the database port, AWS Systems Manager Parameter Store standard String parameters are the most cost-effective choice since they are free of charge, thus minimizing overall cloud architecture costs.

Step-by-Step Solution

1
Identify the sensitivity and rotation requirements of the database connection string.
The connection string contains sensitive credentials and requires automatic rotation every 30 days.
This determines that AWS Secrets Manager is the appropriate service, as it natively supports scheduled credential rotation using AWS Lambda.
2
Identify the sensitivity and rotation requirements of the database port.
The port is static and non-sensitive.
This allows the port to be stored in AWS Systems Manager Parameter Store as a standard String parameter, which is free and avoids the cost of Secrets Manager.
3
Configure the web application on AWS App Runner to reference these configurations.
App Runner service is configured to retrieve the credentials from Secrets Manager and the port from Parameter Store.
This integration secures the secrets and configuration parameters during application startup without hardcoding values in the container.

Key Concept

Secrets and Parameter Management
Estimated Time:1m 30s
Question 309Question →

A company hosts its containerized microservices application on Amazon ECS using the AWS Fargate launch type. The company's security team requires a solution to detect runtime threats, such as execution of unauthorized binaries, malware, and credential theft, at the container level. Additionally, they must continuously audit all AWS resources in the environment against CIS benchmarks to ensure compliance. Which combination of AWS services should a solutions architect recommend to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Amazon GuardDuty and activate Amazon ECS Runtime Monitoring.; Enable AWS Security Hub and activate the CIS AWS Foundations Benchmark standard.

Answer

The correct architecture consists of enabling Amazon GuardDuty with ECS Runtime Monitoring to detect container-level threats, and enabling AWS Security Hub with the CIS AWS Foundations Benchmark standard to continuously audit configurations for compliance.
The correct solution uses GuardDuty ECS Runtime Monitoring, which analyzes system calls from the underlying host to identify indicators of compromise inside Fargate tasks. Combined with AWS Security Hub running CIS benchmark compliance checks, the organization meets both real-time threat detection and configuration governance requirements.

Step-by-Step Solution

1
Analyze the container runtime security requirement
Identify that Amazon GuardDuty ECS Runtime Monitoring is designed to monitor and detect threats inside ECS containers on AWS Fargate by monitoring system calls.
This directly satisfies the requirement to detect unauthorized binaries, malware, and credential theft at the container level.
2
Analyze the compliance auditing requirement
Identify that AWS Security Hub provides automated configuration checks against security standards and industry frameworks like the CIS AWS Foundations Benchmark.
This directly satisfies the requirement to continuously audit all resources against CIS benchmarks.
3
Evaluate the incorrect services and scopes
Determine that AWS WAF, AWS Shield Advanced, and Network ACLs are network-level or DDoS-focused solutions that do not have the visibility into container runtimes or resource configurations required to meet either objective.
Eliminating these options confirms that GuardDuty and Security Hub are the appropriate choices.

Key Concept

Centralized threat detection and automated configuration auditing are key components of a secure cloud architecture, achieved through GuardDuty Runtime Monitoring and Security Hub compliance checks.
Question 310Question →

A retail company wants to implement a solution to continuously monitor its AWS accounts and workloads for threat patterns, such as Amazon EC2 instances communicating with known malicious IP addresses or unexpected IAM activity. Which AWS service should the company use to meet this requirement?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is the correct choice because it is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. It uses threat intelligence feeds and machine learning to identify signatures such as cryptocurrency mining, communication with known command-and-control servers, and abnormal API patterns.

Step-by-Step Solution

1
Analyze the requirements for continuous threat detection across AWS accounts and workloads, specifically for malicious IP communication and unexpected account activity.
Identify that the solution requires a service capable of processing multiple log sources (VPC Flow Logs, DNS logs, and CloudTrail logs) and performing anomaly detection.
Understanding the security monitoring scope helps select the appropriate service.
2
Evaluate the capabilities of the available AWS security services against the requirements.
Determine that Amazon GuardDuty is designed for threat detection by analyzing these logs, while firewalls and DDoS protection services act as enforcement mechanisms rather than logging/detection engines.
This isolates the correct threat detection service from traffic filtering services.

Key Concept

Continuous threat detection and security monitoring across workloads and account activity using Amazon GuardDuty.
Estimated Time:45s
Question 311Question →

A company wants to continuously monitor its AWS resource configurations to ensure they comply with security standards. The company also needs a centralized dashboard to aggregate security alerts and evaluate compliance against the CIS AWS Foundations Benchmark. Which TWO services should the solutions architect recommend to meet these requirements?

Select all that apply

Show answer & explanation

Answer: AWS Config to track resource configuration changes and evaluate compliance against desired configurations; AWS Security Hub to aggregate security alerts from multiple AWS services and run automated compliance checks against industry standards

Answer

AWS Config and AWS Security Hub
AWS Config is the correct service for tracking, auditing, and evaluating configurations of AWS resources. AWS Security Hub is the correct service for aggregating security findings from multiple AWS services and evaluating compliance against security standards (such as the CIS AWS Foundations Benchmark). Together, they satisfy the requirement of continuous configuration compliance monitoring and centralized alert aggregation.

Step-by-Step Solution

1
Identify the requirement for tracking and auditing AWS resource configurations over time.
AWS Config is selected as the primary service for tracking configuration changes and evaluating compliance against rules.
AWS Config continuously monitors resource configurations and maintains a history of changes.
2
Identify the requirement for a centralized dashboard to aggregate security alerts and check compliance against security standards.
AWS Security Hub is selected to aggregate alerts and perform automated compliance checks.
AWS Security Hub consolidates security findings from various AWS services and conducts continuous compliance checks against standards like the CIS AWS Foundations Benchmark.

Key Concept

Continuous security monitoring, compliance checks, and centralized security posture management using AWS Config and AWS Security Hub.
Question 312Question →

A solutions architect is designing a configuration management strategy for a containerized application. The application requires access to two types of data: database credentials for an Amazon Aurora MySQL database, which must be rotated automatically every 30 days, and external API endpoints that must be encrypted at rest but do not change. To minimize monthly costs and administrative effort, which combination of actions should the solutions architect take? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in AWS Lambda function template.; Store the external API endpoints as SecureString parameters in AWS Systems Manager Parameter Store.

Answer

Store the database credentials in AWS Secrets Manager with automatic rotation using the built-in Lambda template, and store the external API endpoints as SecureString parameters in AWS Systems Manager Parameter Store.
The correct solution involves storing the database credentials in AWS Secrets Manager with automatic rotation enabled using the built-in Lambda function template, and storing the static API endpoints as SecureString parameters in AWS Systems Manager Parameter Store. Secrets Manager provides native, out-of-the-box automatic rotation for RDS and Aurora databases, which eliminates the need to build and maintain custom rotation code. For the static API endpoints, Parameter Store SecureString parameters provide encryption at rest via AWS KMS at no additional cost for standard parameters, representing the most cost-efficient option since Secrets Manager incurs a monthly cost per secret.

Step-by-Step Solution

1
Evaluate the database credential requirements.
The credentials require automatic rotation every 30 days. AWS Secrets Manager is the optimal service here because it offers native integration with RDS and Aurora to handle rotation automatically using built-in Lambda templates.
This minimizes administrative effort compared to writing custom rotation logic in Systems Manager Parameter Store.
2
Evaluate the static API endpoint configuration requirements.
The endpoints must be encrypted at rest but do not change frequently or require rotation. AWS Systems Manager Parameter Store using the SecureString parameter type is the most cost-effective choice.
Parameter Store standard parameters are free, whereas AWS Secrets Manager charges a monthly flat rate per secret.
3
Combine the evaluations to select the correct options.
Using AWS Secrets Manager for the rotating database credentials and Parameter Store SecureString parameters for the static API endpoints satisfies all security, rotation, cost, and administrative constraints.
This hybrid approach leverages the strengths of both services to optimize costs and minimize overhead.

Key Concept

Secrets and Parameter Management
Question 313Question →

A startup wants to implement a security solution that continuously monitors its AWS accounts for malicious activities, unauthorized access, and anomalous behavior. The solution must analyze AWS CloudTrail management logs, VPC Flow Logs, and DNS query logs with zero impact on resource performance. Which AWS service should a solutions architect recommend to satisfy these requirements?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
The correct answer is Amazon GuardDuty because it is a managed threat detection service that continuously monitors for malicious activity and unauthorized behavior. It does so by analyzing metadata from foundational sources such as AWS CloudTrail event logs, Amazon VPC Flow Logs, and DNS logs without affecting the performance of active EC2 instances.

Step-by-Step Solution

1
Identify the data sources to be analyzed
The requirement specifies AWS CloudTrail management logs, VPC Flow Logs, and DNS query logs.
Selecting a service that natively integrates with and ingests these specific log sources is necessary.
2
Evaluate the detection capability needed
The target service must detect malicious activity and unauthorized behavior.
This matches a threat detection service rather than a simple firewall or access control mechanism.
3
Select the service with minimal operational overhead
Amazon GuardDuty matches all requirements and runs completely independently of workloads.
GuardDuty uses machine learning and threat intelligence to process these data sources without requiring agent deployment.

Key Concept

Continuous security monitoring and threat detection using Amazon GuardDuty
Estimated Time:50s
Question 314Question →

An enterprise logistics company runs a fleet of Amazon EC2 instances in a private subnet to process shipping telemetry. The security team must design a threat detection and mitigation system to identify any EC2 instances that attempt to communicate with known malicious command-and-control (C&C) servers. When a threat is detected, the system must immediately block both inbound and outbound communication with the malicious IP address for the affected subnet. Which architectural design meets these requirements while adhering to the AWS Well-Architected Framework?

Show answer & explanation

Answer: Enable Amazon GuardDuty to analyze VPC Flow Logs. Configure an Amazon EventBridge rule that triggers on GuardDuty findings to invoke an AWS Lambda function that adds stateless inbound and outbound DENY rules for the remote IP address to the Network Access Control List (NACL) associated with the private subnet.

Answer

Enable Amazon GuardDuty to analyze VPC Flow Logs. Configure an Amazon EventBridge rule that triggers on GuardDuty findings to invoke an AWS Lambda function that adds stateless inbound and outbound DENY rules for the remote IP address to the Network Access Control List (NACL) associated with the private subnet.
The correct architecture uses Amazon GuardDuty to detect the malicious outbound C&C traffic by analyzing VPC Flow Logs. The event triggers an EventBridge rule that invokes an AWS Lambda function. The Lambda function adds inbound and outbound DENY rules to the stateless Network Access Control List (NACL) associated with the private subnet, which effectively blocks the communication at the subnet boundary as required.

Step-by-Step Solution

1
Select the appropriate security monitoring and threat detection service.
Amazon GuardDuty is enabled. It continuously monitors VPC Flow Logs, DNS logs, and CloudTrail management events to identify anomalous and malicious behaviors such as C&C communications.
Threat detection at the network layer for C&C server communication requires machine learning-based intelligence and signature matching, which GuardDuty provides out-of-the-box using VPC Flow Logs.
2
Configure real-time event routing for automated response.
An Amazon EventBridge rule is created to match GuardDuty findings (specifically those indicating outbound C&C communication) and target an AWS Lambda function.
EventBridge enables event-driven automation in response to security findings within seconds of detection.
3
Implement the blocking mechanism at the subnet level.
The AWS Lambda function modifies the Network Access Control List (NACL) of the target private subnet to add inbound and outbound DENY rules targeting the malicious IP address.
To block traffic at the subnet boundary, stateless NACLs must be used because Security Groups do not support DENY rules. Since NACLs are stateless, separate rules for both inbound and outbound traffic are required to fully isolate the subnet from the malicious destination.

Key Concept

Security Monitoring, Automated Threat Detection, and Subnet-Level Network Security Controls
Question 315Question →

A company is building a serverless ETL pipeline using AWS Glue. The pipeline runs multiple jobs that need to connect to an on-premises database. To establish this connection, the Glue jobs require a database password that is subject to a strict regulatory policy requiring rotation every 60 days. The jobs also require the database port number, which is static and does not contain sensitive information. The solutions architect must design a secure, cost-effective solution with minimal operational overhead.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.; Store the database port number in AWS Systems Manager Parameter Store as a String parameter.

Answer

Store the database password in AWS Secrets Manager with AWS Lambda-based automatic rotation, and store the database port number in AWS Systems Manager Parameter Store as a String parameter.
To securely manage the database password with automatic 60-day rotation, AWS Secrets Manager is the optimal choice because it integrates with AWS Lambda to orchestrate credential rotation on databases. For the non-sensitive and static database port number, AWS Systems Manager Parameter Store as a standard String parameter is the most cost-effective solution because Parameter Store does not charge for standard parameters.

Step-by-Step Solution

1
Analyze configuration requirements and separate sensitive data from non-sensitive data.
The database password is identified as sensitive and requires rotation; the database port is identified as static and non-sensitive.
This separation allows for a cost-effective design where expensive secrets management is only used for data that strictly requires it.
2
Select the appropriate storage service for the database password.
Choose AWS Secrets Manager, encrypt it with KMS, and configure an AWS Lambda function to rotate the password every 60 days.
Secrets Manager natively supports automatic rotation of credentials, which meets the 60-day rotation requirement with minimal operational overhead.
3
Select the appropriate storage service for the database port.
Choose AWS Systems Manager Parameter Store and store it as a standard String parameter.
Parameter Store standard parameters are free and ideal for non-sensitive, static parameters, avoiding unnecessary Secrets Manager costs.

Key Concept

Selecting the appropriate AWS service for secrets versus parameters based on security, rotation requirements, and cost-effectiveness.
Question 316Question →

A media streaming company hosts its transcoding fleet on Amazon EC2 instances inside a private subnet. The security team needs to ensure that all network interfaces adhere strictly to corporate security standards. Specifically, they must detect any modifications that open restricted ports to unauthorized CIDR blocks, automatically flag these instances as non-compliant, and immediately notify the security operations center. Which combination of AWS services should the solutions architect recommend to implement this security monitoring system? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable AWS Config and configure the restricted-common-ports managed rule to evaluate whether security groups are blocking restricted port traffic.; Create an Amazon EventBridge rule that detects AWS Config compliance status changes and triggers an Amazon Simple Notification Service (Amazon SNS) topic to alert the security operations center.

Answer

Enable AWS Config with the restricted-common-ports rule to monitor compliance, and create an Amazon EventBridge rule targeting an Amazon SNS topic to notify the security team when compliance status changes.
The correct solution uses AWS Config to monitor and record changes to security groups and evaluate them against compliance rules (such as restricted-common-ports). Amazon EventBridge receives state change events from AWS Config and triggers Amazon SNS to send immediate alerts to the security team.

Step-by-Step Solution

1
Select a tool to audit configurations.
Identify AWS Config as the appropriate service for auditing, recording, and evaluating AWS resource configurations.
AWS Config maintains a configuration history and evaluates compliance against managed or custom rules.
2
Determine the alerting mechanism.
Combine Amazon EventBridge and Amazon SNS.
AWS Config publishes compliance change events to Amazon EventBridge, which can target Amazon SNS to deliver real-time notifications.
3
Eliminate inappropriate services for configuration auditing.
Discard options suggesting AWS Shield, Network ACLs, or root user scripts.
Shield is for DDoS protection, Network ACLs are stateless subnet traffic filters, and using the root user violates the principle of least privilege.

Key Concept

Continuous security compliance monitoring and automated alerting using AWS Config, Amazon EventBridge, and Amazon SNS.
Question 317Question →

An application deployed on AWS needs to query a third-party weather forecasting service. The application requires access to two configuration settings: a sensitive API access token that must be rotated automatically every 30 days, and a non-sensitive API endpoint URL that does not change. To minimize costs while maintaining a secure architecture, which of the following configurations should a solutions architect recommend?

Show answer & explanation

Answer: Store the API access token in AWS Secrets Manager and configure a custom AWS Lambda function to rotate the token every 30 days. Store the API endpoint URL in AWS Systems Manager Parameter Store as a String parameter.

Answer

Store the API access token in AWS Secrets Manager and configure a custom AWS Lambda function to rotate the token every 30 days. Store the API endpoint URL in AWS Systems Manager Parameter Store as a String parameter.
The correct configuration uses AWS Secrets Manager for the sensitive API access token because it provides secure encryption and supports automated rotation through custom AWS Lambda functions. To minimize costs, the non-sensitive, static API endpoint URL is stored in AWS Systems Manager Parameter Store as a standard String parameter, which is free of charge.

Step-by-Step Solution

1
Evaluate the sensitivity and rotation requirements for each parameter.
The API access token is sensitive and requires automatic rotation every 30 days. The API endpoint URL is non-sensitive and static.
This determines which AWS service is best suited for each configuration setting based on security, features, and cost.
2
Select the appropriate storage service for the sensitive API token.
AWS Secrets Manager is selected because it encrypts secrets at rest and natively integrates with AWS Lambda to orchestrate custom rotation schedules (e.g., every 30 days) for third-party APIs.
Systems Manager Parameter Store does not natively support automatic rotation of parameters, and storing secrets in plaintext is insecure.
3
Select the appropriate storage service for the non-sensitive endpoint URL.
AWS Systems Manager Parameter Store (using a standard String parameter) is selected.
Standard parameters in Parameter Store are free of charge, making this the most cost-effective choice for non-sensitive, static configuration settings, whereas storing it in Secrets Manager would incur unnecessary costs.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on security, rotation requirements, and cost.
Question 318Question →

A healthcare technology company hosts its patient record management system on AWS. The security team needs to monitor the environment to ensure that Network Access Control Lists (NACLs) and Security Groups do not accidentally allow unrestricted inbound traffic on port 22 from the public internet. The solution must continuously audit configuration history, evaluate compliance, and send near-real-time alerts when a non-compliant change is detected. Which architectural solution meets these requirements with the least administrative effort?

Show answer & explanation

Answer: Enable AWS Config to record configuration changes for security groups and Network ACLs, and use the managed compliance rule for restricted SSH. Configure Amazon EventBridge to detect non-compliant states and send alerts through Amazon Simple Notification Service (Amazon SNS).

Answer

Enable AWS Config to record configuration changes for security groups and Network ACLs, and use the managed compliance rule for restricted SSH. Configure Amazon EventBridge to detect non-compliant states and send alerts through Amazon Simple Notification Service (Amazon SNS).
The correct solution uses AWS Config to monitor and record configuration history for security groups and Network ACLs. AWS Config features a managed rule (restricted-ssh) specifically designed to evaluate whether security groups permit unrestricted public access to port 22. Combining AWS Config with Amazon EventBridge and Amazon SNS provides a serverless, managed pipeline to send near-real-time alerts whenever a resource becomes non-compliant, satisfying all requirements with minimal administrative overhead.

Step-by-Step Solution

1
Enable AWS Config recording
AWS Config tracks and records all configuration changes for security groups and Network ACLs, establishing an audit history.
Auditing configuration history is a key requirement of the security team.
2
Deploy the AWS Config managed rule for restricted SSH
AWS Config continuously evaluates whether security groups or NACLs permit unrestricted inbound traffic on port 22 (SSH).
This automates the compliance evaluation without requiring custom script development.
3
Configure an EventBridge rule and Amazon SNS topic
Non-compliant evaluation states trigger an EventBridge event, which forwards a notification to an SNS topic for immediate alert dispatch.
This establishes near-real-time alerting with a fully serverless, low-maintenance design.

Key Concept

Continuous security monitoring, compliance auditing, and near-real-time alerting using AWS Config, Amazon EventBridge, and Amazon SNS.
Question 319Question →

An online gaming corporation hosts its multiplayer game servers on Amazon EC2 instances within public and private subnets. The security team wants to monitor network traffic for anomalous behaviors, such as unauthorized port scanning and communication with known malicious IP addresses. Additionally, they must ensure that any modifications to subnet-level network boundaries are recorded and audited for compliance. Which combination of actions should a solutions architect recommend to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Amazon GuardDuty to analyze VPC Flow Logs and detect network-layer threat patterns and traffic anomalies.; Use AWS Config to record configuration changes for Network Access Control Lists (NACLs) and evaluate them for compliance.

Answer

The correct options are enabling Amazon GuardDuty to analyze VPC Flow Logs for network-layer threat detection, and using AWS Config to record and evaluate Network Access Control List configuration changes for compliance.
Threat detection is achieved by enabling Amazon GuardDuty, which ingests VPC Flow Logs to analyze and alert on malicious network activity such as port scanning or communication with command-and-control servers. Auditing subnet boundaries requires AWS Config, which monitors configuration changes for Network ACLs to ensure compliance over time.

Step-by-Step Solution

1
Address the requirement to monitor network traffic for anomalous behaviors and malicious communication.
Enable Amazon GuardDuty, which automatically analyzes VPC Flow Logs to detect threats such as port scanning or known malicious IP communication.
VPC Flow Logs capture network traffic metadata, and GuardDuty applies threat intelligence and machine learning to identify security threats.
2
Address the requirement to audit subnet-level network boundary changes.
Use AWS Config to monitor and record modifications to Network Access Control Lists (NACLs), which act as subnet-level firewalls.
AWS Config tracks configuration changes and histories of resources like NACLs, allowing compliance auditing.

Key Concept

Using Amazon GuardDuty for intelligent threat detection via VPC Flow Logs and AWS Config for auditing resource compliance of Network ACLs.
Question 320Question →

A logistics firm hosts its order-processing application on Amazon EC2 instances within a private subnet. The security team must implement a solution to monitor the environment for network-layer threat activity, such as brute-force attacks or command-and-control (C2) communication, and receive alerts if any instances start communicating with known malicious IP addresses.

Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Enable Amazon GuardDuty to analyze VPC Flow Logs and DNS query logs for threat detection, and configure an Amazon EventBridge rule to send notifications through Amazon SNS when a finding is generated.

Answer

Enable Amazon GuardDuty to analyze VPC Flow Logs and DNS query logs for threat detection, and configure an Amazon EventBridge rule to send notifications through Amazon SNS when a finding is generated.
The correct solution uses Amazon GuardDuty, which natively integrates and analyzes VPC Flow Logs, DNS query logs, and CloudTrail events. It detects threat patterns such as command-and-control (C2) communication and brute-force attempts without requiring any software agents. By routing GuardDuty findings through Amazon EventBridge to an Amazon SNS topic, the security team receives automated, real-time alerts with minimal operational effort.

Step-by-Step Solution

1
Enable Amazon GuardDuty in the AWS account.
GuardDuty automatically begins consuming metadata streams from VPC Flow Logs, DNS logs, and AWS CloudTrail events without requiring additional agent installation or infrastructure setup.
This establishes the core intelligent threat detection engine, which uses threat intelligence feeds and machine learning to identify brute-force attacks and C2 activity.
2
Configure an Amazon EventBridge rule with a pattern matching GuardDuty finding events.
EventBridge detects when GuardDuty publishes a threat finding and triggers the configured target.
This allows for real-time orchestration of alerting pathways based on security findings.
3
Target the EventBridge rule to an Amazon Simple Notification Service (Amazon SNS) topic with subscriber endpoints (such as email or Slack webhook).
Notifications are automatically dispatched to the security team whenever a matching threat is detected.
This satisfies the requirement for proactive alerting with minimal operational overhead.

Key Concept

Continuous security monitoring and threat detection at the network layer using managed AWS services.
Estimated Time:2m 0s
PreviousPage 16 / 22Next