Examkin

Design Secure Architectures

438 questions

All types438Multiple choice214Multiple select224
Question 321Question →

A healthcare technology provider manages patient portals across multiple AWS regions. To satisfy regulatory compliance, the provider must identify unauthorized configuration changes to security groups and detect whether any EC2 instances are communicating with known malicious IP addresses. The provider requires a solution that centralizes these security findings and automates threat detection without impacting application performance. Which combination of actions should the solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Amazon GuardDuty in the target regions to analyze VPC Flow Logs and DNS query logs for identifying communications with malicious IP addresses.; Enable AWS Config to continuously monitor and record configuration changes of VPC security groups to track compliance.

Answer

The solutions architect should recommend enabling Amazon GuardDuty to analyze VPC Flow Logs and DNS query logs, and enabling AWS Config to monitor and record changes to VPC security groups.
To detect unauthorized changes to security groups, AWS Config is the appropriate tool because it continuously monitors and records configuration details. To detect traffic to known malicious IPs without affecting performance, Amazon GuardDuty is the correct tool because it analyzes metadata from sources like VPC Flow Logs and DNS logs in an isolated plane.

Step-by-Step Solution

1
Address the requirement for configuration auditing.
AWS Config is configured to track security groups.
AWS Config tracks configuration history and compliance status of AWS resources, which directly satisfies the requirement to identify unauthorized security group changes.
2
Address the threat detection requirement for malicious IP communication.
Amazon GuardDuty is enabled to monitor VPC Flow Logs and DNS query logs.
Amazon GuardDuty analyzes logs in the background without affecting performance, matching traffic patterns against known threat feeds to identify communication with malicious hosts.

Key Concept

Continuous security monitoring using AWS Config for resource changes and Amazon GuardDuty for intelligent, out-of-band threat detection.
Estimated Time:2m 0s
Question 322Question →

A financial technology company wants to ensure that all Network Access Control Lists (Network ACLs) within their production VPC remain compliant with their security policy, which forbids any inbound rule allowing public access on port 22. The security team needs to detect any configuration changes to Network ACLs in real-time, log the compliance status, and automatically send alerts to an administrator. Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Use AWS Config to record configuration changes for Network ACLs. Create a managed AWS Config rule to evaluate compliance, and configure an Amazon EventBridge rule to trigger on non-compliant evaluation results to send notifications to an Amazon Simple Notification Service (Amazon SNS) topic.

Answer

The correct solution involves utilizing AWS Config to monitor Network ACL resource compliance combined with Amazon EventBridge and Amazon SNS for real-time alerting.
The correct solution leverages AWS Config to monitor resource configuration changes and evaluate compliance against rules. EventBridge triggers notifications via Amazon SNS on non-compliant events. This utilizes fully managed AWS services to achieve real-time monitoring and alerting with minimal operational effort.

Step-by-Step Solution

1
Record Network ACL configuration history using AWS Config.
AWS Config continuously tracks and stores configuration details of Network ACLs in the VPC.
Config tracking is required to detect changes and verify compliance against rules.
2
Create an AWS Config rule to check Network ACL compliance.
Changes that violate the rule (e.g. allowing ingress SSH traffic from 0.0.0.0/0) mark the Network ACL resource as non-compliant.
A compliance rule acts as the monitoring and threat detection mechanism.
3
Configure an Amazon EventBridge rule targeted at AWS Config compliance change events to trigger Amazon SNS.
An email or message is sent automatically to administrators in real-time when compliance changes occur.
This completes the threat detection and alerting pipeline with minimal operational overhead.

Key Concept

Continuous security compliance monitoring and automated alerting using AWS Config, EventBridge, and SNS.
Question 323Question →

A retail corporation manages multiple AWS accounts using AWS Organizations. The security team wants to establish a centralized security monitoring solution to detect threats, such as anomalous behavior or unauthorized API calls, and aggregate security compliance findings across all member accounts. The solution must align with the AWS Well-Architected Framework.

Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Amazon GuardDuty in all accounts, and designate a security account as the delegated administrator to centrally manage threat detection findings.; Enable AWS Security Hub in all accounts, and designate the security account as the delegated administrator to aggregate security and compliance alerts.

Answer

Enable Amazon GuardDuty in all accounts with a delegated administrator, and enable AWS Security Hub in all accounts with a delegated administrator.
The correct options are enabling Amazon GuardDuty and AWS Security Hub with delegated administrator accounts. GuardDuty leverages machine learning, anomaly detection, and threat intelligence to identify suspicious activities like unauthorized API calls. Security Hub acts as the single pane of glass to aggregate and prioritize compliance assessments and alerts across the AWS Organizations hierarchy.

Step-by-Step Solution

1
Analyze the requirement for centralized threat detection.
Amazon GuardDuty monitors threat patterns and anomalies across all accounts using a delegated administrator architecture.
This provides the required near-real-time threat detection for anomalous behavior and unauthorized API calls.
2
Analyze the requirement for aggregating compliance findings.
AWS Security Hub centrally aggregates compliance and security posture findings from GuardDuty, Config, and other security services.
This meets the requirement to centrally aggregate and prioritize security alerts and compliance checks.

Key Concept

Centralized threat detection and security aggregation in multi-account organizations.
Estimated Time:2m 0s
Question 324Question →

A logistics company hosts a web application on Amazon EC2 instances within a public subnet of a VPC. The security team needs a solution to detect potential SSH brute-force attempts and malicious port scans from the internet. Additionally, they want to ensure that any unauthorized modifications to the VPC subnets' Network Access Control Lists (NACLs) are automatically detected and flagged as non-compliant. Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Amazon GuardDuty to monitor and analyze VPC Flow Logs for anomalous network behaviors, such as SSH brute-force attacks and port scanning.; Deploy an AWS Config rule to track configuration changes of Network ACLs and evaluate compliance against the company's security baseline.

Answer

Enable Amazon GuardDuty to monitor and analyze VPC Flow Logs, and deploy an AWS Config rule to track configuration changes of Network ACLs.
Enabling Amazon GuardDuty allows the logistics company to leverage intelligent threat detection that automatically monitors VPC Flow Logs to identify malicious activities like SSH brute-force attempts and port scans. Concurrently, deploying an AWS Config rule enables continuous compliance tracking by monitoring configuration changes to resource types like Network ACLs and flagging any unauthorized changes that deviate from the defined baseline, aligning with the AWS Well-Architected Framework's security pillar.

Step-by-Step Solution

1
Enable Amazon GuardDuty to detect threat patterns in network traffic.
GuardDuty will continuously ingest VPC Flow Logs and use threat intelligence to identify anomalies, such as brute-force attacks and port scans.
This provides real-time detection of network anomalies and threats without requiring manual log analysis.
2
Deploy AWS Config and set up a rule for Network ACLs.
AWS Config will record configuration changes to Network ACLs and automatically evaluate them against compliance baselines.
This implements automated compliance tracking and drift detection for critical network boundary configurations.

Key Concept

Continuous security monitoring using AWS GuardDuty for network threats and AWS Config for configuration compliance.
Estimated Time:1m 30s
Question 325Question →

A financial services company needs to ensure that all Amazon EC2 security groups in its production environment are continuously audited for security compliance. Specifically, any rule that allows inbound traffic from the public internet (0.0.0.0/0) on port 22 must be flagged, and the security team must be notified immediately. Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Enable AWS Config, configure the managed rule to check for restricted SSH access, and use Amazon EventBridge to route non-compliant compliance change events to an Amazon Simple Notification Service (Amazon SNS) topic.

Answer

The correct solution is to enable AWS Config, configure the managed rule to check for restricted SSH access, and use Amazon EventBridge to route non-compliant compliance change events to an Amazon SNS topic.
AWS Config is designed specifically for tracking resource configuration changes and auditing compliance against rules. The managed rule for restricted SSH access checks security group ingress rules, and EventBridge can publish non-compliant states directly to SNS. This native integration requires no code and minimizes operational overhead.

Step-by-Step Solution

1
Enable AWS Config to record resource configurations.
AWS Config starts tracking configuration changes for resources including EC2 security groups.
This establishes the foundation for monitoring configuration changes and evaluating compliance rules.
2
Deploy the managed rule for restricted SSH access.
AWS Config automatically evaluates security groups against the rule to identify unrestricted port 22 access.
Managed rules provide built-in, low-effort checks for common compliance requirements like securing administrative ports.
3
Configure an EventBridge rule with an SNS target.
Compliance status changes (from compliant to non-compliant) trigger real-time email or SMS alerts to the security team.
This automates notifications to the security operations center without the need to write custom monitoring scripts or Lambda functions.

Key Concept

AWS Config is the primary tool for resource configuration compliance auditing and drift detection, whereas GuardDuty is for active threat detection and Shield is for DDoS mitigation.
Estimated Time:1m 30s
Question 326Question →

A financial company stores sensitive customer data in Amazon S3 buckets. The company's security team needs to implement a solution to monitor the AWS environment. The solution must detect anomalous data access patterns and potential data exfiltration attempts on the S3 buckets in near-real-time. Additionally, the solution must continuously audit and record configuration changes to the S3 buckets to evaluate compliance against security baselines. Which combination of AWS services should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon GuardDuty with S3 Protection enabled to analyze S3 data events and identify anomalous access patterns.; AWS Config to track configuration history and continuously evaluate bucket settings against security rules.

Answer

The correct architecture uses Amazon GuardDuty with S3 Protection enabled to monitor data access patterns and detect potential exfiltration, along with AWS Config to record S3 configuration history and continuously audit compliance against baseline rules.
Amazon GuardDuty with S3 Protection is the native AWS threat detection service that monitors S3 data events (e.g. access patterns) using anomaly detection to identify data exfiltration. AWS Config tracks resource configuration changes (like S3 bucket policies) and automatically assesses them against rules for compliance auditing.

Step-by-Step Solution

1
Identify the service for threat detection on S3 data plane activity.
Amazon GuardDuty with S3 Protection is selected.
GuardDuty monitors S3 API data events using machine learning to detect anomalies and threat signatures, satisfying the exfiltration detection requirement.
2
Identify the service for configuration history and compliance evaluation.
AWS Config is selected.
AWS Config records resource configurations and assesses them against rules to ensure compliance, satisfying the auditing requirement.
3
Evaluate and eliminate incorrect distractors based on security architecture principles.
Discard options proposing AWS Shield Advanced, subnet-level security groups, and long-term IAM user credentials.
These services either address different problems (DDoS mitigation), do not apply to S3/subnets directly, or violate the principle of least privilege.

Key Concept

Continuous compliance auditing combined with near-real-time threat detection on object storage allows architects to satisfy both monitoring and threat detection goals for sensitive data stores.
Question 327Question →

A software-as-a-service (SaaS) company wants to detect potential threats within its AWS account, including compromised IAM credentials and EC2 instances communicating with command-and-control servers. When a threat is detected, the security team must be notified via a webhook to their external security operations center (SOC). The webhook URL requires an API key for authentication, which must be stored securely. Which architecture meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Enable Amazon GuardDuty to monitor for threats and compromised credentials. Create an Amazon EventBridge rule that triggers an AWS Lambda function when GuardDuty generates a finding. Store the webhook API key in AWS Secrets Manager, and configure the Lambda function to retrieve the secret and call the webhook.

Answer

Enable Amazon GuardDuty to monitor for threats and compromised credentials. Create an Amazon EventBridge rule that triggers an AWS Lambda function when GuardDuty generates a finding. Store the webhook API key in AWS Secrets Manager, and configure the Lambda function to retrieve the secret and call the webhook.
Amazon GuardDuty is the AWS native threat detection service that continuously monitors VPC Flow Logs, CloudTrail logs, and DNS queries for potential security issues, including compromised IAM credentials and external command-and-control servers. Setting up an EventBridge rule to trigger an AWS Lambda function allows for real-time alerting to the external security operations center (SOC). Webhook API keys are sensitive credentials and must be stored securely using AWS Secrets Manager to prevent exposure.

Step-by-Step Solution

1
Enable GuardDuty threat detection
Amazon GuardDuty automatically analyzes VPC Flow Logs, DNS logs, and CloudTrail events to detect malicious activities and unauthorized access patterns (e.g., C2 server communication, compromised IAM keys).
This establishes threat detection capabilities with no agent setup or network overhead.
2
Configure event-driven alerting
An Amazon EventBridge rule matches GuardDuty finding events and routes them to an AWS Lambda function.
This automates the alert pipeline in real-time.
3
Securely retrieve credentials and notify the SOC
The Lambda function retrieves the API key from AWS Secrets Manager and sends the authenticated alert payload to the SOC webhook.
Storing the key in AWS Secrets Manager ensures sensitive credentials are encrypted and stored according to security best practices.

Key Concept

Amazon GuardDuty is the managed threat detection service that monitors account activity and network behavior in AWS, which can trigger EventBridge rules to automate remediation or notification tasks. Sensitive credentials like API keys must be securely stored in AWS Secrets Manager or Parameter Store (SecureString) rather than in plaintext.
Estimated Time:1m 30s
Question 328Question →

A company's security team needs to monitor network traffic for a multi-tier web application. They suspect that a compromised Amazon EC2 instance in a private subnet is attempting to perform unauthorized network scans on other resources within the same Virtual Private Cloud (VPC). The team needs to capture the source IP, destination IP, source port, destination port, and protocol for all network traffic at the subnet level without installing any host-based software. Which solution will meet these requirements?

Show answer & explanation

Answer: Enable VPC Flow Logs on the private subnet and publish the logs to an Amazon S3 bucket.

Answer

Enable VPC Flow Logs on the private subnet and publish the logs to an Amazon S3 bucket.
The correct solution is to enable VPC Flow Logs on the private subnet and publish the logs to an Amazon S3 bucket. VPC Flow Logs captures IP traffic metadata (source/destination IPs, ports, and protocol) at the Elastic Network Interface (ENI) level without needing any agents. It can deliver these logs to Amazon S3 or CloudWatch Logs.

Step-by-Step Solution

1
Identify the requirement to capture network flow data (source/destination IPs, ports, and protocols) at the subnet level.
Determined that network traffic metadata monitoring is required.
This establishes the scope of traffic metadata that needs to be collected.
2
Evaluate native AWS logging capabilities that operate agentlessly at the network boundary.
Identified VPC Flow Logs as the native feature designed to capture flow information for subnets, network interfaces, or VPCs without requiring host-based software.
The business scenario forbids host-based software, ruling out agent-based monitoring utilities.
3
Select a valid destination for the captured log data.
Configured the flow logs to publish to Amazon S3, which supports durable, secure, and cost-effective log storage.
VPC Flow Logs natively supports publishing to Amazon S3 or Amazon CloudWatch Logs.

Key Concept

Agentless network traffic metadata logging via VPC Flow Logs
Question 329Question →

A company is establishing its security baseline on AWS. The company needs to grant daily administrative access to its IT team and federate access for hundreds of workforce users managed in an external identity provider. Additionally, they must secure the AWS account owner identity. Which TWO actions should the solutions architect recommend to meet these requirements securely?

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate the external identity provider and manage user permissions using IAM roles.; Enable multi-factor authentication (MFA) on the AWS account root user and restrict its use to actions that specifically require root credentials.

Answer

Configure AWS IAM Identity Center to federate the external identity provider and manage user permissions using IAM roles, and enable multi-factor authentication (MFA) on the AWS account root user while restricting its use to actions that specifically require root credentials.
Securing the AWS infrastructure requires following best practices for user access and account security. The recommended approach is to federate workforce users from the external identity provider using AWS IAM Identity Center, allowing them to assume IAM roles for daily operations. Additionally, the AWS account root user should be secured with multi-factor authentication (MFA) and reserved strictly for tasks that require root credentials, rather than daily operations.

Step-by-Step Solution

1
Evaluate identity management requirements for workforce users.
Identify that using federated access via AWS IAM Identity Center avoids managing individual IAM users with long-term keys.
Aligns with AWS security best practices for centralized identity management.
2
Evaluate security requirements for the account owner identity.
Identify that the AWS account root user should be protected with multi-factor authentication (MFA) and not used for daily administrative work.
Ensures root credentials are secure and adheres to the principle of least privilege.

Key Concept

AWS Identity and Access Management (IAM) security best practices, including federating workforce identities with AWS IAM Identity Center and securing the root user account.
Estimated Time:1m 30s
Question 330Question →

A solutions architect is reviewing the security of a web application running on Amazon EC2 instances. The solutions architect finds that a database password is currently stored as a plaintext string parameter in Systems Manager Parameter Store. The company requires the database credentials to be encrypted at rest and rotated automatically every 30 days. Which solution should the solutions architect implement to meet these requirements?

Show answer & explanation

Answer: Store the credentials in AWS Secrets Manager, enable automatic rotation, and configure the application to retrieve the credentials from Secrets Manager.

Answer

Store the credentials in AWS Secrets Manager, enable automatic rotation, and configure the application to retrieve the credentials from Secrets Manager.
AWS Secrets Manager natively supports both encryption at rest and automatic credential rotation (such as for Amazon RDS databases) without requiring custom code or infrastructure. The application can securely query Secrets Manager at runtime to retrieve the current password.

Step-by-Step Solution

1
Identify the secure storage service that natively supports automatic credential rotation.
AWS Secrets Manager is chosen because it integrates directly with database services to handle password rotation automatically.
This avoids custom scripting overhead and satisfies the security requirements.
2
Configure the application to dynamically fetch the credentials at runtime using the AWS SDK.
The application is updated to call the Secrets Manager API instead of hardcoding or querying plaintext parameters.
Ensures the application always uses the active, rotated credentials securely.

Key Concept

Secure secrets storage and lifecycle management using AWS Secrets Manager
Question 331Question →

A company is migrating an on-premises database client application to AWS. The application runs on Amazon EC2 instances and requires access to a database on Amazon RDS. Corporate users must be authenticated via their enterprise directory to access the application. The application also needs to retrieve database credentials securely. Which TWO steps should a solutions architect take to implement a secure access and credential management strategy? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM role with the required permissions for database access, and associate it with the EC2 instances as an instance profile.; Store the database credentials in AWS Secrets Manager and enable automatic rotation of the secrets.

Answer

The solutions architect should associate an IAM role with the EC2 instances as an instance profile and store the database credentials in AWS Secrets Manager with automatic rotation enabled.
Associating an IAM role via an instance profile allows applications running on EC2 instances to securely access database resources using temporary credentials. AWS Secrets Manager securely stores database credentials, encrypts them at rest, and provides native rotation features to automatically update the credentials without manual intervention.

Step-by-Step Solution

1
Determine the secure method for EC2 instances to access other AWS services.
Identify that using an IAM role via an instance profile allows applications running on EC2 instances to acquire temporary credentials.
This avoids the need to distribute and manage long-term AWS credentials on the EC2 instances, adhering to the principle of least privilege.
2
Select a secure mechanism for storing and rotating database credentials.
Identify AWS Secrets Manager as the appropriate service for storing database credentials, which supports encryption at rest and automated credential rotation.
Secrets Manager helps meet compliance requirements by rotating secrets automatically without service interruption.

Key Concept

AWS IAM roles for EC2 instances (instance profiles) and AWS Secrets Manager for secure, encrypted credentials storage and automated rotation.
Question 332Question →

A company is onboarding a new team of systems engineers who need access to administrative and monitoring resources in the AWS Management Console. The solutions architect wants to configure access to the AWS environment in alignment with AWS security best practices.

Which TWO actions should the solutions architect take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate the developers' corporate identities and manage permissions using permission sets.; Enable multi-factor authentication (MFA) on all accounts, secure the AWS account root user credentials, and restrict its usage to root-only tasks.

Answer

The correct actions are to configure AWS IAM Identity Center for federated identity access, and to enable multi-factor authentication (MFA) while securing the AWS account root user credentials.
Federating user identities via AWS IAM Identity Center eliminates the need to manage individual long-term IAM user credentials, which aligns with AWS best practices for human access. Additionally, protecting the AWS account root user by enabling MFA and avoiding its use for daily administrative tasks ensures secure foundation access.

Step-by-Step Solution

1
Determine the best practice for user identity management.
Identify that AWS recommends identity federation via AWS IAM Identity Center for human users rather than creating individual IAM users with long-term credentials.
This reduces the risk of credential exposure and simplifies user management.
2
Determine the best practice for securing administrative access.
Identify that AWS recommends enabling multi-factor authentication (MFA) on all accounts, securing the AWS account root user credentials, and restricting root user usage.
This protects the AWS environment from unauthorized administrative operations.

Key Concept

AWS IAM Security Best Practices including identity federation and root account protection
Estimated Time:1m 0s
Question 333Question →

A financial services company is designing a secure multi-account environment using AWS Organizations. The architecture requires that all member accounts enforce continuous security auditing. Specifically, administrators of the member accounts must be blocked from stopping, modifying, or deleting the organizational AWS CloudTrail. Additionally, the company must centralize access control for its 5,000 corporate identities currently managed in an external Okta directory, ensuring they do not use local IAM credentials. The security controls must not restrict administrative or billing operations within the Organizations management account.

Which two actions should a solutions architect take to meet these governance requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an SCP that denies the `cloudtrail:StopLogging`, `cloudtrail:UpdateTrail`, and `cloudtrail:DeleteTrail` actions, and attach the SCP to the root of the organization.; Enable AWS IAM Identity Center in the management account, connect it to the Okta directory using SAML 2.0 and SCIM, and assign permission sets to corporate groups to manage target member accounts.

Answer

Create an SCP that denies the CloudTrail modification actions and attach it to the root of the organization, and enable AWS IAM Identity Center integrated with Okta to manage access.
Attaching the SCP to the root of the organization restricts CloudTrail modification actions on all member accounts by inheritance, but because SCPs do not apply to the management account, administrative operations in the management account remain unrestricted. Integrating AWS IAM Identity Center with Okta using SAML 2.0 and SCIM ensures centralized identity federation and dynamic access provisioning to member accounts without creating individual local IAM users or long-term credentials.

Step-by-Step Solution

1
Evaluate the CloudTrail protection requirement.
Identify that a Service Control Policy (SCP) denying delete, stop, and update actions is required to prevent member account administrators from altering CloudTrail.
SCPs allow organization-wide control over actions that member account administrators can perform.
2
Determine where to attach the SCP to meet the management account exemption.
Attach the SCP to the organization root. The policy will inherit down to all member accounts but will not restrict the management account itself.
SCPs do not apply to the Organizations management account.
3
Address the centralized identity requirement for Okta users.
Use AWS IAM Identity Center to federate with the external Okta directory using SAML 2.0 and SCIM.
This avoids creating local IAM users with long-term keys and automates user provisioning.
4
Configure permissions for the federated users.
Map Okta groups to IAM permission sets in the target member accounts.
This enforces centralized access control in a multi-account environment.

Key Concept

Applying Service Control Policies (SCPs) in AWS Organizations and configuring AWS IAM Identity Center for external identity provider integration.
Estimated Time:3m 0s
Question 334Question →

A company is migrating its operations to AWS and wants to grant its employees access to the AWS Management Console. The employees' identities are currently managed in an on-premises Microsoft Active Directory. The company's security policy requires that employees sign in using their existing corporate credentials and that administrative overhead related to credential management in AWS be minimized. Which combination of actions should a solutions architect recommend to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Enable AWS IAM Identity Center and configure it to use the corporate Active Directory as its identity source.; Create permission sets in AWS IAM Identity Center and assign them to the corporate Active Directory groups.

Answer

To meet the requirements, the solutions architect should configure AWS IAM Identity Center with the corporate Active Directory as the identity source, and then map AWS permission sets to the existing Active Directory groups.
Connecting AWS IAM Identity Center to the on-premises Active Directory establishes federation, which supports using existing corporate credentials. Mapping permission sets to corporate Active Directory groups ensures administrative overhead is kept to a minimum by leveraging existing group memberships for access control.

Step-by-Step Solution

1
Connect the corporate directory to AWS.
AWS IAM Identity Center is enabled and integrated with the on-premises Active Directory.
This establishes identity federation, allowing employees to sign in with their existing credentials without creating local AWS IAM user accounts.
2
Define AWS access levels and assign them to groups.
Permission sets are created in AWS IAM Identity Center and assigned to Active Directory groups.
This maps corporate group memberships directly to AWS permissions, minimizing administrative overhead by automating access provisioning.

Key Concept

Using AWS IAM Identity Center to federate on-premises Microsoft Active Directory identities for single sign-on (SSO) to AWS accounts, reducing overhead and maintaining centralized credential management.
Question 335Question →

A company is designing a secure identity and access management architecture. The company has a multi-account AWS environment managed under AWS Organizations. The engineering team consists of 150 developers whose identities are managed in an on-premises Active Directory (AD). Additionally, an on-premises application server requires access to an Amazon S3 bucket located in a production AWS account to write daily backup files. The security team mandates that no long-term AWS credentials should be stored on-premises, and administrative overhead must be minimized.

Which combination of actions will meet these requirements securely? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center (successor to AWS Single Sign-On) to federate with the on-premises Active Directory, and map AD groups to permission sets in the AWS accounts.; Set up AWS IAM Roles Anywhere, establish trust with the company's private Certificate Authority (CA), and configure the on-premises application server to exchange its X.509 certificate for temporary IAM credentials.

Answer

Configure AWS IAM Identity Center to federate with the on-premises Active Directory and map groups to permission sets, and set up AWS IAM Roles Anywhere to allow the on-premises application server to exchange its X.509 certificate for temporary credentials.
The correct solution uses AWS IAM Identity Center to federate on-premises Active Directory identities, enabling centralized single sign-on access to multiple AWS accounts. For the on-premises application server, AWS IAM Roles Anywhere is the secure and modern architectural pattern to obtain temporary IAM credentials using X.509 certificates, completely eliminating the need to configure or store long-term access keys on-premises.

Step-by-Step Solution

1
Establish centralized federation for the developer accounts.
AWS IAM Identity Center is configured to federate with the on-premises Active Directory, mapping AD groups directly to target permission sets in the member accounts.
This centralizes user management, minimizes administrative overhead, and avoids creating individual IAM users in each target AWS account.
2
Secure programmatic access for the on-premises workload without long-term credentials.
AWS IAM Roles Anywhere is configured to trust the company's private Certificate Authority (CA) and maps the server's certificate to an IAM role with S3 write permissions.
This allows the server to authenticate via an X.509 certificate and receive short-term session credentials, avoiding the risk of stored access keys.

Key Concept

AWS Identity and Access Management best practices dictate using federation via AWS IAM Identity Center for human access, and AWS IAM Roles Anywhere for secure machine access from outside AWS without long-term credentials.
Estimated Time:2m 0s
Question 336Question →

A solutions architect is explaining basic VPC security concepts to a new team member. The team is configuring security groups and Network Access Control Lists (NACLs) to secure a standard two-tier web application. Which TWO statements correctly describe the behavior or scope of these security resources?

Select all that apply

Show answer & explanation

Answer: Security groups are stateful, meaning return traffic is automatically allowed regardless of inbound rules.; Network ACLs are stateless, meaning return traffic must be explicitly allowed by outbound rules.

Answer

Security groups are stateful, meaning return traffic is automatically allowed, and Network ACLs are stateless, meaning return traffic must be explicitly allowed.
The correct statements are that security groups are stateful and network ACLs are stateless. Security groups automatically allow return traffic for any established connection they permit. Conversely, network ACLs do not track session state, which means both inbound and outbound paths must have explicit rule coverage to allow communications.

Step-by-Step Solution

1
Analyze the stateful behavior of Security Groups.
Confirm that Security Groups track connection state, allowing response traffic automatically.
This is a fundamental property of security groups in VPC network security.
2
Analyze the stateless behavior of Network ACLs.
Confirm that Network ACLs do not track connection state, requiring explicit inbound and outbound rules for a complete flow.
This contrasts with security groups and requires careful rule writing to prevent blocked return traffic.
3
Evaluate the incorrect options regarding scope and inspection capabilities.
Identify that security groups do not apply to subnets and cannot perform Layer 7 packet inspection.
Security groups operate at the network interface level (Layer 4), whereas Network ACLs operate at the subnet level, and Layer 7 protection is provided by AWS WAF.

Key Concept

Statefulness and boundaries of VPC Security Groups versus Network ACLs
Question 337Question →

A solutions architect is designing the network security for a new application hosted on Amazon EC2 instances in a VPC. The architect needs to implement a stateful firewall at the instance level that automatically allows return traffic for any allowed inbound request. Which VPC security feature should the solutions architect use to meet this requirement?

Show answer & explanation

Answer: Security Groups

Answer

Security Groups
The correct option is the one specifying Security Groups. Security Groups act as a stateful firewall for Amazon EC2 instances, meaning any allowed inbound connection automatically allows the outbound response traffic to flow back to the client.

Step-by-Step Solution

1
Identify the level of security control required by the scenario.
The requirement specifies an instance-level firewall.
Security Groups operate at the instance or elastic network interface (ENI) level, whereas Network ACLs operate at the subnet level.
2
Determine the statefulness requirement.
The requirement specifies a stateful firewall that automatically allows return traffic.
Security Groups are stateful (automatically allowing return traffic), while Network ACLs are stateless (requiring explicit inbound and outbound rules).

Key Concept

Security Groups function as stateful firewalls at the Amazon EC2 instance level, automatically allowing response traffic for allowed requests.
Question 338Question →

An organization runs order processing microservices on Amazon EC2 instances in a private subnet (10.10.2.0/2410.10.2.0/24) within an Amazon VPC. These instances must securely query a database in a dedicated database subnet (10.10.3.0/2410.10.3.0/24). They must also access a third-party payment processing API through an Interface VPC Endpoint hosted in a utility subnet (10.10.4.0/2410.10.4.0/24) within the same VPC.

Custom Network ACLs (NACLs) are configured as follows:
- The private subnet NACL allows outbound TCP traffic to the database subnet on port 54325432 and outbound TCP traffic to the utility subnet on port 443443.
- The database subnet NACL allows inbound TCP traffic on port 54325432 and outbound TCP traffic to the private subnet on ephemeral ports (1024−655351024-65535).
- The utility subnet NACL allows inbound TCP traffic on port 443443 from the private subnet and outbound TCP traffic to the private subnet on ephemeral ports (1024−655351024-65535).

Currently, the EC2 instances successfully connect to the database, but all HTTPS connection attempts to the third-party API via the Interface VPC Endpoint fail.

Which two actions should the solutions architect take to resolve this connectivity issue while maintaining least privilege? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add an inbound rule to the private subnet Network ACL that allows TCP traffic from the utility subnet (10.10.4.0/2410.10.4.0/24) on ephemeral ports (1024−655351024-65535).; Configure the security group associated with the Interface VPC Endpoint to allow inbound TCP traffic on port 443443 from the security group associated with the EC2 instances.

Answer

To resolve the connectivity issue, the solutions architect must add an inbound rule to the private subnet Network ACL allowing TCP traffic from the utility subnet on ephemeral ports, and configure the Interface VPC Endpoint's security group to allow inbound TCP traffic on port 443443 from the EC2 instances' security group.
The correct options are the actions to add an inbound rule to the private subnet Network ACL allowing TCP traffic from the utility subnet on ephemeral ports, and to configure the Interface VPC Endpoint's security group to allow inbound TCP traffic on port 443443 from the security group of the EC2 instances. Network ACLs are stateless firewalls. Although outbound traffic from the private subnet to the utility subnet is allowed on port 443443, the return traffic returning from the utility subnet uses ephemeral ports (1024−655351024-65535) and is blocked because the private subnet NACL does not have a rule allowing it. Adding the inbound rule resolves this. Additionally, since security groups are stateful, the security group for the Interface VPC Endpoint only needs to permit inbound traffic on port 443443 from the EC2 instances. The response traffic is allowed automatically.

Step-by-Step Solution

1
Analyze the state of existing Network ACLs and connection flow.
The connection fails because Network ACLs are stateless. While outbound traffic from the private subnet to the utility subnet on port 443443 is allowed, the return traffic from the utility subnet on ephemeral ports (1024−655351024-65535) is blocked at the private subnet boundary.
For stateless firewalls like NACLs, return traffic must be explicitly permitted by configuring an inbound rule with ephemeral port ranges.
2
Formulate the required Network ACL rule.
Add an inbound rule to the private subnet NACL that permits TCP traffic from the utility subnet (10.10.4.0/2410.10.4.0/24) on destination ports 1024−655351024-65535.
This allows return packets from the Interface VPC Endpoint to reach the initiating client instances in the private subnet.
3
Evaluate the stateful security group requirements.
The Interface VPC Endpoint must have a security group that permits inbound HTTPS traffic (TCP port 443443) from the EC2 instances' security group.
Since security groups are stateful, return traffic is automatically tracked and allowed outbound, making any outbound security group rules for ephemeral ports unnecessary.

Key Concept

Understanding the stateless behavior of Network ACLs compared to the stateful behavior of Security Groups, and configuring ephemeral ports correctly for return traffic.
Question 339Question →

A global manufacturing enterprise is migrating its legacy ERP and supply chain applications to a multi-account AWS environment managed by AWS Organizations. The company's identity provider (IdP) is an on-premises Microsoft Active Directory domain. The enterprise security policy requires that all employee authentication must occur against the on-premises Active Directory, and users must be able to access the AWS Management Console with their corporate credentials without duplicating identities in the cloud. The solution must minimize operational overhead. Which two actions should the solutions architect take to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Enable AWS IAM Identity Center and configure it to use the AD Connector as the identity source for user authentication.; Deploy an Active Directory Connector (AD Connector) in the AWS VPC to proxy authentication requests to the on-premises Active Directory.

Answer

Deploy an Active Directory Connector (AD Connector) in the AWS VPC to proxy authentication requests, and enable AWS IAM Identity Center configured to use the AD Connector as the identity source.
Deploying an Active Directory Connector (AD Connector) provides a directory gateway that redirects authentication requests to the on-premises Active Directory domain controllers, ensuring no credentials are cached or stored in AWS. Enabling AWS IAM Identity Center and configuring it to use the AD Connector as its identity source allows users to authenticate centrally and access resources across multiple accounts in AWS Organizations using their existing corporate credentials with minimum operational complexity.

Step-by-Step Solution

1
Set up network connectivity between the AWS VPC and the on-premises network, then deploy an Active Directory Connector (AD Connector).
The AD Connector acts as a directory gateway that proxies authentication requests directly to the on-premises Active Directory without caching credentials in AWS.
This meets the requirement of using corporate credentials without duplicating identities or credentials in the cloud.
2
Enable AWS IAM Identity Center in the AWS Organizations management account.
Centralized single sign-on access is established for the multi-account environment.
AWS IAM Identity Center simplifies multi-account access management and reduces operational overhead.
3
Configure AWS IAM Identity Center to use the deployed AD Connector as the identity source.
On-premises Active Directory users are mapped to AWS permissions and can log in to the console using their corporate credentials.
This completes the integration with minimal operational overhead.

Key Concept

AWS IAM Identity Center integration with on-premises Active Directory using Active Directory Connector (AD Connector) for federated multi-account access.
Question 340Question →

A company wants to secure its web servers running on Amazon EC2 instances within a VPC. The security team requires that inbound traffic to the instances be restricted to port 443443 (HTTPS) from a specific office IP address. Additionally, the configuration must allow return traffic back to the office clients without requiring any explicit outbound rules. Which VPC feature should the solutions architect configure to implement this access control?

Show answer & explanation

Answer: Security groups

Answer

Security groups
Security groups are stateful. When an inbound rule allows traffic on port 443443 from a specific IP address, the security group automatically permits the corresponding outbound return traffic to the client, satisfying the requirement to avoid explicit outbound rules.

Step-by-Step Solution

1
Analyze the requirement for stateful behavior where return traffic is allowed automatically.
Identify that a stateful firewall resource is required to handle the traffic without explicit outbound rules.
Security groups are stateful and allow return traffic automatically, whereas Network ACLs are stateless and require explicit rules in both directions.
2
Evaluate the options based on their placement in the VPC architecture.
Security groups operate at the instance level and support rules based on IP address and port.
This matches the requirement to restrict access to port 443443 from a specific office IP address at the EC2 instance layer.

Key Concept

VPC Security Groups are stateful firewalls that operate at the instance level.
Estimated Time:45s
PreviousPage 17 / 22Next
Design Secure Architectures Practice Questions — AWS Certified Solutions Architect - Associate — Page 17 | Examkin