Design Secure Architectures

438 questions

All types438 Multiple choice214 Multiple select224

An enterprise is designing a secure network architecture for a sensitive payment processing workload running on Amazon EC2 instances inside a dedicated private subnet. The workload needs to securely access Amazon DynamoDB for database operations and a third-party compliance API hosted on the public internet. The architecture must satisfy the following requirements:
1. The EC2 instances must not have a direct route to an Internet Gateway or have public IP addresses.
2. Access to DynamoDB must remain entirely within the AWS network and must not incur data processing or hourly usage fees.
3. Network access control must be enforced statelessly at the subnet boundary and statefully at the instance level.

Which combination of steps should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the private subnet's route table.

Configure the private subnet's Network ACL with an outbound rule allowing TCP port

443

to the NAT Gateway's subnet, and an inbound rule allowing TCP ports

1024

65535

from the NAT Gateway's subnet.

Create an Interface VPC Endpoint (AWS PrivateLink) for Amazon DynamoDB and configure the private subnet's route table to route DynamoDB traffic through the endpoint.

Configure the EC2 instances' Security Group with an inbound rule allowing TCP ports

1024

65535

from the NAT Gateway subnet to permit return traffic from the third-party API.

Deploy an AWS WAF web ACL and associate it directly with the private subnet's Network ACL to inspect Layer 7 payloads sent to the third-party compliance API.

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the private subnet's route table.; Configure the private subnet's Network ACL with an outbound rule allowing TCP port $443$ to the NAT Gateway's subnet, and an inbound rule allowing TCP ports $1024$ - $65535$ from the NAT Gateway's subnet.

Answer

Create a Gateway VPC Endpoint for Amazon DynamoDB associated with the private subnet's route table, and configure the private subnet's Network ACL to allow outbound TCP port

443

to the NAT Gateway's subnet and inbound TCP ports

1024

65535

from the NAT Gateway's subnet.

To satisfy the requirements, the Solutions Architect must configure a Gateway VPC Endpoint for Amazon DynamoDB to enable secure, direct, and cost-free communication. Additionally, because Network ACLs are stateless, the private subnet's Network ACL must explicitly allow both the outbound traffic on HTTPS port

443

to the NAT Gateway subnet and the inbound return traffic on ephemeral ports

1024

65535

from the NAT Gateway subnet. Security groups, being stateful, do not require corresponding inbound ephemeral rule configurations.

Step-by-Step Solution

Address the DynamoDB connectivity and cost requirements by selecting a Gateway VPC Endpoint.

DynamoDB traffic is routed privately through the AWS network without traversing the NAT Gateway, preventing data processing fees since Gateway endpoints are free of charge.

Interface VPC endpoints (PrivateLink) incur usage and data processing charges, making them incorrect for a requirement to avoid fees.

Address the stateless network access control requirements at the subnet boundary for the third-party compliance API.

The Network ACL must be updated with an outbound rule for port

443

and an inbound rule for ephemeral ports (

1024

65535

) to allow return traffic.

Network ACLs are stateless, meaning return traffic must be explicitly permitted, unlike stateful security groups which track connection states automatically.

Confirm stateful behavior at the instance level.

Ensure security groups only require outbound rules for HTTPS (

443

) to the NAT Gateway, with no inbound ephemeral port rules required.

Security groups track connections statefully, rendering inbound ephemeral rules unnecessary and insecure.

Key Concept

VPC Network Security requires combining stateful Security Groups (acting at the instance ENI level) with stateless Network ACLs (acting at the subnet boundary), along with proper VPC endpoint routing (Gateway vs. Interface) to balance security, performance, and cost.

Question 362Question →

A medical device company is designing a multi-Region, multi-account architecture to store and protect patient telemetry data. The raw data is stored in Amazon S3 buckets in Account A (ingestion account) located in the `us-east-1` Region and encrypted using an AWS Key Management Service (AWS KMS) customer managed key ( $K_1$ ). To comply with regulatory requirements, the data must be replicated to Account B (compliance archive account) in the `us-west-2` Region. The replicated data must be encrypted at rest using a customer managed key ( $K_2$ ) owned by Account B. The database credentials for accessing the data warehouse must be rotated every $15$ days automatically, and no plaintext sensitive configuration parameters should be stored in source code or plain parameter fields. Additionally, the security team requires that the encryption keys ( $K_1$ and $K_2$ ) are rotated annually, but they are concerned about whether historical backups will remain readable after rotation. Which two actions should a solutions architect recommend to implement these security requirements? (Select TWO.)

Select all that apply

Enable automatic key rotation for the customer managed keys in AWS KMS, as KMS automatically retains historical backing key material to decrypt data encrypted under previous versions.

Store the database credentials in AWS Secrets Manager and configure automatic rotation every 15 days using a custom AWS Lambda function, referencing the secret Amazon Resource Name (ARN) in the application configuration.

Enable automatic key rotation in AWS KMS, and schedule an Amazon S3 Batch Operations job to re-encrypt all historical data in Account B with the new key material immediately after rotation.

Store the database credentials as standard String parameters in AWS Systems Manager Parameter Store to minimize costs, and configure an Amazon EventBridge rule to execute an API call that rotates the parameter value every 15 days.

Configure manual key rotation by creating new KMS keys annually, update the application to use the new key ARNs, and delete the old KMS keys to avoid key storage fees.

Show answer & explanation

Answer: Enable automatic key rotation for the customer managed keys in AWS KMS, as KMS automatically retains historical backing key material to decrypt data encrypted under previous versions.; Store the database credentials in AWS Secrets Manager and configure automatic rotation every 15 days using a custom AWS Lambda function, referencing the secret Amazon Resource Name (ARN) in the application configuration.

Answer

Enable automatic key rotation for the customer managed keys in AWS KMS, as KMS automatically retains historical backing key material to decrypt data encrypted under previous versions; and store the database credentials in AWS Secrets Manager and configure automatic rotation every 15 days using a custom AWS Lambda function, referencing the secret Amazon Resource Name (ARN) in the application configuration.

The correct options recommend enabling automatic key rotation for the customer managed keys in AWS KMS and using AWS Secrets Manager for credential storage and rotation. Automatic key rotation ensures that KMS keeps old backing keys to decrypt older data, meaning that historical backups remain readable without any re-encryption tasks. Storing credentials in AWS Secrets Manager allows automatic rotation every 15 days using a custom Lambda function, while referencing the credentials via their ARN avoids exposing them in plaintext.

Step-by-Step Solution

Evaluate the database credential management requirements.

Determine that Secrets Manager is the optimal service because it natively supports automatic rotation of credentials (via AWS Lambda) every 15 days and integrates with VPCs and IAM policies for secure, non-plaintext referencing.

This satisfies the constraint that database credentials must be rotated automatically and cannot be stored in plaintext parameter fields or source code.

Analyze KMS key rotation behavior for compliance and disaster recovery.

Confirm that when automatic key rotation is enabled for Customer Managed Keys, KMS handles the creation of new backing keys while keeping old ones intact.

This guarantees that older ciphertexts (historical backups/replicated data) can still be decrypted by KMS automatically without manual overhead or data re-encryption.

Assess the risk of manual key rotation and deletion.

Recognize that deleting old keys renders any historical data encrypted under those keys permanently unrecoverable, making manual rotation with deletion highly dangerous.

This rules out solutions that suggest deleting the old keys or manual management schemes that introduce operational overhead and risk data loss.

Key Concept

AWS KMS key rotation maintains older key versions to allow decryption of historical ciphertexts, while AWS Secrets Manager provides secure, automated credential rotation without exposing plaintext variables.

Question 363Question →

A municipal transit agency hosts its online ticketing application on AWS using an Application Load Balancer (ALB) to distribute traffic to Amazon EC2 instances. Recently, the application has experienced intermittent outages caused by HTTP flood attacks that mimic legitimate user login requests. The agency needs to implement a solution that mitigates these Layer 7 attacks at the AWS edge before they reach the ALB, without requiring changes to the application code. Which architecture should a solutions architect recommend to meet these requirements?

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL with the distribution using a rate-based rule.

Enable AWS Shield Standard on the Application Load Balancer and configure a custom protection group to automatically block HTTP floods.

Configure the Application Load Balancer security group with a custom rule to rate-limit incoming traffic from untrusted public IP addresses.

Apply a stateless Network Access Control List (NACL) to the load balancer subnets to dynamically inspect and rate-limit HTTP requests.

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL with the distribution using a rate-based rule.

Answer

Deploying an Amazon CloudFront distribution in front of the Application Load Balancer, and associating an AWS WAF web ACL with the distribution using a rate-based rule.

The correct solution uses Amazon CloudFront to cache and distribute traffic, and integrates it with AWS WAF at the AWS edge. A rate-based rule in the WAF web ACL automatically counts requests from individual IP addresses and blocks them when they exceed the defined limit, mitigating Layer 7 HTTP flood attacks before they reach the Application Load Balancer.

Step-by-Step Solution

Analyze the attack vector and mitigation requirements.

Identify that the attack is a Layer 7 (HTTP flood) attack causing outages at the application layer, requiring a solution that operates at the AWS edge and offers rate-limiting.

Layer 7 attacks cannot be mitigated by standard network-level firewalls alone and must be inspected for request patterns.

Select the correct edge and application security services.

Amazon CloudFront distributes traffic via edge locations globally, and AWS WAF integrates with CloudFront to block malicious Layer 7 traffic before it reaches the backend infrastructure.

Filtering traffic at the edge reduces the load on the Application Load Balancer and downstream application servers.

Configure AWS WAF rules for request control.

Implement an AWS WAF rate-based rule to automatically track request rates from individual client IPs and temporarily block IPs exceeding the threshold.

Rate-limiting is the standard, code-free method to protect against HTTP flood attacks that mimic legitimate login requests.

Key Concept

Mitigating Layer 7 DDoS attacks using Amazon CloudFront and AWS WAF rate-based rules at the AWS edge.

Estimated Time:1m 30s

Question 364Question →

A global event ticketing platform hosts its high-traffic booking application on AWS using Amazon EC2 instances behind an Application Load Balancer (ALB). During major ticket releases, the platform experiences sudden spikes in malicious traffic, including Layer 7 HTTP flood attacks that exhaust web server resources, and periodic SQL injection attempts. The solutions architect needs to secure the architecture to mitigate these threats at the network edge while minimizing administrative overhead and ensuring only legitimate users can complete purchases. Which combination of steps should the solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL containing rate-based rules and SQL injection matching conditions with the CloudFront distribution.

Subscribe to AWS Shield Advanced, associate it with the Amazon CloudFront distribution, and enable automatic application-layer DDoS mitigation.

Configure stateless Network Access Control Lists (NACLs) at the subnet level to dynamically identify and block the source IP addresses of the HTTP flood attacks.

Enable AWS Shield Standard on the Application Load Balancer and configure security groups to inspect HTTP payloads and rate-limit requests.

Associate an AWS WAF web ACL directly with the Amazon EC2 instances in the private subnets to block malicious traffic before it runs database queries.

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL containing rate-based rules and SQL injection matching conditions with the CloudFront distribution.; Subscribe to AWS Shield Advanced, associate it with the Amazon CloudFront distribution, and enable automatic application-layer DDoS mitigation.

Answer

Deploy an Amazon CloudFront distribution in front of the ALB and associate it with an AWS WAF web ACL containing rate-based and SQL injection rules, while subscribing to AWS Shield Advanced and enabling automatic application-layer DDoS mitigation on the distribution.

The combination of deploying Amazon CloudFront with AWS WAF and subscribing to AWS Shield Advanced with automatic application-layer DDoS mitigation represents the AWS-recommended best practice for edge protection. CloudFront moves the application perimeter to the edge, AWS WAF provides Layer 7 payload filtering (such as SQL injection patterns and rate limiting), and Shield Advanced automates WAF rule creation and mitigation during an active DDoS attack, thereby reducing operational overhead.

Step-by-Step Solution

Shift the application entry point to the edge by deploying an Amazon CloudFront distribution in front of the Application Load Balancer.

Dynamic and static traffic is routed through AWS edge locations, caching static content and providing a global scale capable of absorbing Layer 3 and Layer 4 infrastructure DDoS attacks.

Protecting the Application Load Balancer from direct internet exposure ensures that attacks are inspected and mitigated before reaching the core infrastructure.

Associate an AWS WAF web ACL with the Amazon CloudFront distribution and define rate-based rules along with SQL injection protection rules.

Layer 7 traffic is inspected at the edge. Request rates per IP are monitored to block HTTP floods, and payloads are analyzed to filter SQL injection attempts before forwarding traffic to the ALB.

AWS WAF provides application-layer visibility and control, preventing malicious payloads and resource exhaustion at the edge.

Enable AWS Shield Advanced on the Amazon CloudFront distribution and turn on automatic application-layer DDoS mitigation.

AWS Shield Advanced analyzes historical traffic baselines and automatically deploys custom WAF rules when an application-layer DDoS attack is detected.

This automates the mitigation process, minimizing administrative overhead and reducing the time to respond to complex, changing attack vectors.

Key Concept

Mitigating Layer 7 application attacks and DDoS at the edge using Amazon CloudFront, AWS WAF, and AWS Shield Advanced.

Estimated Time:2m 30s

Question 365Question →

A company wants to encrypt sensitive documents stored in an Amazon S3 bucket using AWS Key Management Service (AWS KMS). The security team requires the use of a customer managed key that must be rotated automatically every year. The solutions architect must ensure that previously uploaded documents can still be decrypted after key rotation without any manual re-encryption. Which TWO actions should the solutions architect take to meet these requirements?

Select all that apply

Enable automatic key rotation on the AWS KMS customer managed key.

Configure the Amazon S3 bucket to use server-side encryption with AWS KMS keys (SSE-KMS) using the customer managed key.

Re-encrypt all existing S3 objects with the new key version immediately after rotation.

Store the key policy administrative credentials as a plaintext parameter in Systems Manager Parameter Store.

Configure the key rotation task to run under the AWS account root user credentials.

Show answer & explanation

Answer: Enable automatic key rotation on the AWS KMS customer managed key.; Configure the Amazon S3 bucket to use server-side encryption with AWS KMS keys (SSE-KMS) using the customer managed key.

Answer

Enable automatic key rotation on the customer managed key and configure the S3 bucket to use server-side encryption with AWS KMS keys (SSE-KMS).

Enabling automatic key rotation on the customer managed key ensures that the key material is rotated annually without manual configuration. Configuring the S3 bucket to use SSE-KMS with the customer managed key ensures all documents uploaded to the bucket are secure. When KMS key rotation occurs, AWS KMS retains the historical key material so that older files can still be decrypted seamlessly.

Step-by-Step Solution

Enable automatic key rotation on the customer managed key.

AWS KMS will automatically rotate the key material annually without manual action.

To satisfy the security requirement of rotating keys on a yearly schedule.

Configure server-side encryption with AWS KMS (SSE-KMS) on the S3 bucket.

Objects uploaded to the bucket are automatically encrypted using the specified key.

To ensure that S3 objects are encrypted at rest with the designated customer managed key.

Understand the retention behavior of historical key material in AWS KMS.

AWS KMS keeps older key material active to decrypt previously encrypted data.

To ensure that previously uploaded documents remain decryptable without manual re-encryption.

Key Concept

AWS KMS automatic key rotation updates the backing key material annually, while retaining older versions of the key material to allow the seamless decryption of historical data.

Estimated Time:1m 0s

Question 366Question →

A global pharmaceutical company hosts a clinical trial portal on AWS. The portal consists of static media assets stored in an Amazon S3 bucket served via Amazon CloudFront, and a dynamic telemetry ingestion API hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). During a recent test, the portal was targeted by a distributed HTTP flood (Layer 7 DDoS attack) that degraded the API's performance. A solutions architect must design a secure architecture that protects both the static assets and the API from Layer 7 attacks, and ensures that the EC2 instances only accept traffic originating from CloudFront. Which combination of security controls should the solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Associate AWS WAF with the Amazon CloudFront distribution, and configure a rate-based rule to block IP addresses that exceed a request threshold.

Configure the Application Load Balancer's security group to only allow traffic from the Amazon CloudFront IP ranges using the AWS-managed prefix list.

Configure stateless Network Access Control Lists (NACLs) at the subnet level to block incoming traffic on port 80 and port 443 during an active attack.

Rely on AWS Shield Standard to automatically detect and block the Layer 7 HTTP flood at the Application Load Balancer.

Associate AWS WAF directly with the Amazon S3 bucket, and configure a Geo Match rule to block requests from unauthorized regions.

Show answer & explanation

Answer: Associate AWS WAF with the Amazon CloudFront distribution, and configure a rate-based rule to block IP addresses that exceed a request threshold.; Configure the Application Load Balancer's security group to only allow traffic from the Amazon CloudFront IP ranges using the AWS-managed prefix list.

Answer

The correct combination of security controls is to associate AWS WAF with the Amazon CloudFront distribution and configure a rate-based rule to block IPs exceeding a threshold, and to configure the Application Load Balancer's security group to only allow traffic from the Amazon CloudFront IP ranges using the AWS-managed prefix list.

The correct response implements a multi-layered defense. First, attaching AWS WAF to CloudFront with rate-based rules mitigates Layer 7 HTTP floods at the edge. Second, configuring the load balancer's security group to only accept traffic from CloudFront's IP ranges (using the AWS-managed prefix list) prevents attackers from bypassing CloudFront and attacking the Application Load Balancer directly.

Step-by-Step Solution

Protect the application layer (Layer 7) at the edge from HTTP flood attacks.

AWS WAF is associated with the Amazon CloudFront distribution, and a rate-based rule is configured to block IPs exceeding request limits.

This blocks malicious Layer 7 traffic at the CloudFront edge locations before it reaches the backend origin, mitigating resource exhaustion.

Prevent attackers from bypassing edge protections by attacking the origin directly.

The Application Load Balancer's security group is restricted to inbound traffic from the Amazon CloudFront AWS-managed prefix list.

This ensures that all incoming HTTP/HTTPS traffic must pass through CloudFront and AWS WAF, preventing direct attacks on the load balancer.

Key Concept

Layer 7 DDoS protection using AWS WAF rate-based rules combined with origin shielding by restricting Application Load Balancer access to CloudFront IP ranges using the AWS-managed prefix list.

Question 367Question →

A systems administrator is configuring a security group for an Amazon EC2 instance hosting a web server. The administrator adds an inbound rule to allow HTTP traffic on port 80 from any source. What additional configuration is required in the security group to allow the web server to send outbound HTTP responses back to the clients?

An outbound rule must be added to allow HTTP traffic on port 80 to the client's destination IP address.

An outbound rule must be added to allow traffic on ephemeral ports (1024-65535) back to the clients.

No additional configuration is required because security groups are stateful, meaning return traffic is automatically allowed.

AWS WAF must be associated with the security group to allow outbound HTTP responses to the clients.

Show answer & explanation

Answer: No additional configuration is required because security groups are stateful, meaning return traffic is automatically allowed.

Answer

No additional configuration is required because security groups are stateful, meaning return traffic is automatically allowed.

The correct answer is correct because AWS security groups are stateful. When an inbound rule allows traffic on port 80, the security group tracks the connection and automatically allows the web server to send outbound responses back to the client, requiring no outbound security group rules for this communication.

Step-by-Step Solution

Analyze the resource type and rule requirements.

The resource is a security group, which operates at the instance level.

Security groups are stateful firewalls in AWS VPC networking.

Determine the behavior of stateful firewalls regarding return traffic.

Since security groups are stateful, any inbound traffic that is allowed will automatically have its return traffic allowed outbound.

Stateful connection tracking permits return packets without checking outbound rules.

Key Concept

VPC Security Group Statefulness

Question 368Question →

A company is hiring an external consulting firm to perform a compliance audit of data stored in an Amazon S3 bucket. The consulting firm has its own AWS account. The solutions architect must grant the consultants read-only access to the S3 bucket for the duration of the audit. The security team specifies that no long-term IAM credentials or new IAM users can be created, and the consultants must access the resources securely using temporary credentials. Which solution should the solutions architect implement to meet these requirements?

Generate access keys for the company's AWS account root user, and share them securely with the lead auditor of the consulting firm to perform the necessary audit tasks.

Create an IAM role in the company's AWS account with a trust policy that allows the consulting firm's AWS account to assume the role. Attach an IAM policy to the role that grants read-only permissions to the S3 bucket. Instruct the consultants to assume this role using AWS Security Token Service (AWS STS).

Create individual IAM users in the company's AWS account for each consultant from the firm. Attach a read-only S3 permission policy to each user and generate access keys for them to use during the audit.

Store the credentials of an administrative IAM user in AWS Systems Manager Parameter Store as a plaintext String parameter, and configure a public parameter policy allowing the consultants to retrieve it.

Show answer & explanation

Answer: Create an IAM role in the company's AWS account with a trust policy that allows the consulting firm's AWS account to assume the role. Attach an IAM policy to the role that grants read-only permissions to the S3 bucket. Instruct the consultants to assume this role using AWS Security Token Service (AWS STS).

Answer

Create an IAM role in the company's AWS account with a trust policy that allows the consulting firm's AWS account to assume the role, attaching a read-only S3 policy, and having the consultants assume the role using AWS STS.

The correct answer is correct because defining an IAM role with a trust policy that trusts the external consulting firm's AWS account allows the consultants to assume the role via AWS STS. This gives them temporary security credentials to access the target Amazon S3 bucket, meeting the security criteria of avoiding long-term access keys or the creation of local IAM users.

Step-by-Step Solution

Analyze the access requirements, identifying that cross-account access is needed between two distinct AWS accounts (the company's account and the consulting firm's account).

Identified the need for secure delegation of access across accounts.

Establishing cross-account boundaries helps define where trust policies and permission policies must be applied.

Configure an IAM role with a trust policy that specifies the principal as the consulting firm's AWS account ID, allowing users in that account to call the AssumeRole API.

Created a trusted relationship between the two accounts without creating local IAM users.

Trust policies govern which external entities are allowed to assume the role and obtain temporary credentials.

Attach a permissions policy to the IAM role that limits access to read-only actions (such as s3:GetObject and s3:ListBucket) on the target S3 bucket.

Enforced the principle of least privilege for the external auditors.

Permissions policies define what actions the trusted entity can perform once they assume the role.

Instruct the external consultants to use AWS Security Token Service (AWS STS) to assume the role, which provides them with short-lived, temporary security credentials.

Provided access to the resources without generating long-term IAM access keys.

AWS STS facilitates the secure exchange of cross-account trust into temporary session credentials.

Key Concept

Cross-Account IAM Roles and AWS STS Federation

Question 369Question →

A financial technology company runs a payment validation service on Amazon EC2 instances within a private subnet. The instances must make outbound HTTPS requests to an external credit bureau API on port $443$ to verify transaction details. The security group associated with the EC2 instances allows outbound traffic to $0.0.0.0/0$ on port $443$ and has no inbound rules. To comply with security audits, the solutions architect must configure the private subnet's Network Access Control List (Network ACL) with the most restrictive rules possible to support this traffic. Which Network ACL configuration should the solutions architect apply to the private subnet to allow the validation traffic to flow successfully?

Outbound rule: Allow TCP port

443

0.0.0.0/0

. Inbound rule: Allow TCP ports

1024 - 65535

from

0.0.0.0/0

Outbound rule: Allow TCP port

443

0.0.0.0/0

. Inbound rule: No inbound rules are required because the Network ACL automatically tracks return traffic.

Outbound rule: Allow TCP port

443

0.0.0.0/0

. Inbound rule: Allow TCP port

443

from

0.0.0.0/0

Outbound rule: Allow TCP ports

1024 - 65535

0.0.0.0/0

. Inbound rule: Allow TCP port

443

from

0.0.0.0/0

Show answer & explanation

Answer: Outbound rule: Allow TCP port $443$ to $0.0.0.0/0$ . Inbound rule: Allow TCP ports $1024 - 65535$ from $0.0.0.0/0$ .

Answer

Configure an outbound Network ACL rule allowing TCP port 443 to anywhere, and an inbound Network ACL rule allowing TCP ports 1024 to 65535 from anywhere.

The correct configuration requires allowing outbound traffic to port 443 because the EC2 instances are initiating HTTPS requests to the external API. Because Network ACLs are stateless, they do not track connection state; therefore, a separate inbound rule must be configured to allow the return traffic. The return traffic is sent from the external API back to the ephemeral ports (TCP 1024 - 65535) allocated by the EC2 client instances.

Step-by-Step Solution

Analyze the stateful nature of Security Groups.

The security group is stateful, so allowing outbound port 443 traffic automatically permits the corresponding inbound response traffic at the instance level.

Security groups track connections and permit response traffic regardless of inbound rules.

Analyze the stateless nature of Network ACLs (NACLs).

NACLs operate at the subnet boundary and are stateless. Outbound requests and inbound responses must be explicitly allowed.

Unlike security groups, NACLs do not track connection state and evaluate every packet independently.

Identify the ports utilized by the outbound request and its response.

The outbound request goes to destination port 443 (HTTPS). The returning traffic from the external server is sent to the ephemeral source ports (typically 1024 - 65535) allocated by the client EC2 instances.

Client OS TCP/IP stacks allocate ephemeral ports for outbound connections to receive returning responses.

Synthesize the correct NACL rules.

An outbound rule allowing destination port 443 to anywhere, and an inbound rule allowing destination ephemeral ports (1024 - 65535) from anywhere.

This matches the traffic direction and port requirements for both components of the TCP handshake and data transfer.

Key Concept

Stateless Network ACLs require explicit inbound rules for response traffic on ephemeral ports.

Question 370Question →

A company is deploying an application on Amazon EC2 instances in a private subnet (CIDR: $10.10.2.0/24$ ) of a VPC. The application must securely query a PostgreSQL database ( $TCP$ port $5432$ ) hosted by a partner vendor. The partner has exposed their database service using an AWS PrivateLink VPC endpoint service. A solutions architect creates an Interface VPC endpoint in the private subnet to connect to the partner service. Which configuration of security groups will allow the application to query the database while maintaining the principle of least privilege?

Associate a security group with the EC2 instances that allows outbound TCP traffic on port

5432

to the CIDR of the private subnet. Associate a security group with the Interface VPC endpoint that allows inbound TCP traffic on port

5432

from

0.0.0.0/0

Associate a security group with the EC2 instances that allows outbound TCP traffic on port

5432

to the security group of the Interface VPC endpoint, and inbound TCP traffic on port

5432

from the Interface VPC endpoint. Associate a security group with the Interface VPC endpoint that allows inbound and outbound TCP traffic on port

5432

Associate a security group with the EC2 instances that allows outbound TCP traffic on port

5432

to the security group of the Interface VPC endpoint. Associate a security group with the Interface VPC endpoint that allows inbound TCP traffic on port

5432

from the security group of the EC2 instances.

Configure the Network ACL of the private subnet to allow outbound TCP traffic on port

5432

to the VPC endpoint and inbound TCP traffic on port

5432

from the VPC endpoint. Do not associate security groups with either the EC2 instances or the Interface VPC endpoint.

Show answer & explanation

Answer: Associate a security group with the EC2 instances that allows outbound TCP traffic on port $5432$ to the security group of the Interface VPC endpoint. Associate a security group with the Interface VPC endpoint that allows inbound TCP traffic on port $5432$ from the security group of the EC2 instances.

Answer

Associate a security group with the EC2 instances that allows outbound TCP traffic on port

5432

to the security group of the Interface VPC endpoint. Associate a security group with the Interface VPC endpoint that allows inbound TCP traffic on port

5432

from the security group of the EC2 instances.

The correct option establishes the most secure, least-privilege connection by allowing outbound traffic from the EC2 instances specifically to the VPC endpoint's security group, and inbound traffic to the VPC endpoint specifically from the EC2 instances' security group. Because security groups are stateful, the return traffic does not require additional rules.

Step-by-Step Solution

Analyze the traffic initiation path and destination port.

The EC2 instances initiate a TCP connection on port

5432

to the Interface VPC endpoint.

To allow the initial connection, the security group of the EC2 instances must have an outbound rule allowing TCP port

5432

destined for the Interface VPC endpoint's security group.

Determine the required inbound rules at the destination network interface.

The Interface VPC endpoint's security group must allow inbound TCP port

5432

from the EC2 instances' security group.

This allows the incoming request to reach the endpoint network interface.

Evaluate the stateful nature of security groups for return traffic.

No inbound rules on the EC2 instances or outbound rules on the VPC endpoint are needed.

Security groups are stateful; once a connection is allowed outbound from the EC2 instance or inbound to the VPC endpoint, the corresponding return traffic is automatically allowed.

Key Concept

VPC Interface Endpoints and Stateful Security Groups

Question 371Question →

A company runs a financial analytics application on Amazon ECS that queries an Amazon Aurora PostgreSQL database. The application encrypts generated PDF reports using an AWS KMS customer managed key (CMK) and stores them in an Amazon S3 bucket. The security policy mandates that the database credentials must be rotated every 15 days, and the KMS CMK used to encrypt the S3 bucket must be rotated automatically every year. The security team is concerned that rotating the CMK will make the older PDF reports in the S3 bucket unreadable.

Which configuration will meet these security requirements with the LEAST operational overhead?

Store the database credentials in AWS Secrets Manager with automatic rotation configured for every 15 days. Enable automatic key rotation for the customer managed key in AWS KMS.

Store the database credentials in AWS Systems Manager Parameter Store as a String parameter. Enable automatic key rotation on the customer managed key, and configure an AWS Lambda function to update the Parameter Store value every 15 days.

Store the database credentials in AWS Secrets Manager with automatic rotation configured for every 15 days. Manually rotate the customer managed key annually by creating a new key, updating the S3 bucket policy with the new key ARN, and running an S3 Batch Operations job to re-encrypt all older PDF reports.

Store the database credentials in AWS Secrets Manager with automatic rotation configured for every 15 days. Use a stateless Network ACL on the ECS subnet to restrict access to the KMS endpoint, and configure a custom script to rotate the database credentials and manually re-encrypt the S3 bucket objects annually.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager with automatic rotation configured for every 15 days. Enable automatic key rotation for the customer managed key in AWS KMS.

Answer

Store the database credentials in AWS Secrets Manager with automatic rotation configured for every 15 days. Enable automatic key rotation for the customer managed key in AWS KMS.

The correct solution uses AWS Secrets Manager to handle the 15-day database credential rotation natively and securely. For the KMS Customer Managed Key (CMK), enabling automatic rotation is the most operationally efficient choice because it retains the same key ARN and automatically preserves older key versions. When applications request decryption of older PDF reports, AWS KMS automatically uses the corresponding older key version, eliminating the need to re-encrypt historical reports.

Step-by-Step Solution

Select AWS Secrets Manager to store and rotate the database credentials.

Database credentials are rotated automatically every 15 days using a built-in or custom Lambda function, ensuring security without manual script maintenance.

AWS Secrets Manager is specifically designed to store secrets and integrate with Amazon RDS and Aurora to handle automatic credential rotation natively.

Enable automatic key rotation on the AWS KMS customer managed key (CMK).

The CMK will have its backing key material automatically rotated once per year by AWS KMS, keeping the same key ARN.

Automatic key rotation eliminates the operational overhead of manually updating key ARNs in application code, IAM policies, and bucket policies.

Leave historical PDF reports in the S3 bucket as-is.

Historical PDF reports remain readable because AWS KMS preserves older key versions to decrypt data encrypted by those versions.

AWS KMS automatically manages the mapping between the encrypted ciphertext and the key version used to encrypt it, so no data re-encryption is required when automatic key rotation is enabled.

Key Concept

AWS KMS automatic key rotation retains older key versions to decrypt historical data without changing the key ARN, while AWS Secrets Manager manages DB credential rotation.

Question 372Question →

An application deployed on Amazon EC2 instances in a private VPC subnet must upload large datasets to Amazon S3. The application must also connect to an external payment gateway API over the internet to process transactions. A solutions architect needs to design a secure and cost-effective network architecture that satisfies these requirements.

Which TWO configurations should the solutions architect implement? (Select TWO.)

Select all that apply

Create a gateway VPC endpoint for Amazon S3 and associate it with the route table of the private subnet.

Deploy a NAT gateway in a public subnet, and configure the private subnet's route table to route outbound traffic destined for the internet (

0.0.0.0/0

) to the NAT gateway.

Route all outbound traffic from the private subnet, including both Amazon S3 data transfers and the external API calls, through a public NAT gateway.

Configure the Network ACL of the private subnet to allow outbound TCP port

443

traffic, and rely on the stateful tracking of Network ACLs to permit the inbound response traffic.

Associate an AWS WAF web ACL directly with the private subnet to inspect and filter all outbound HTTP and HTTPS requests.

Show answer & explanation

Answer: Create a gateway VPC endpoint for Amazon S3 and associate it with the route table of the private subnet.; Deploy a NAT gateway in a public subnet, and configure the private subnet's route table to route outbound traffic destined for the internet ( $0.0.0.0/0$ ) to the NAT gateway.

Answer

Create a gateway VPC endpoint for Amazon S3 and associate it with the route table of the private subnet, and deploy a NAT gateway in a public subnet, configuring the private subnet's route table to route outbound internet traffic (

0.0.0.0/0

) to the NAT gateway.

Establishing a gateway VPC endpoint for Amazon S3 provides direct, private connectivity to S3 without traversing the public internet or incurring NAT Gateway data processing charges, making it highly secure and cost-effective. For the external payment gateway API, deploying a NAT gateway in a public subnet allows the private instances to safely route outbound internet traffic without exposing them to inbound connections.

Step-by-Step Solution

Analyze the destinations required by the application.

The application needs access to Amazon S3 (an AWS service) and an external payment gateway (a public internet API).

Different network path options exist for AWS services versus public internet destinations.

Evaluate the most cost-effective and secure way to access Amazon S3.

Create a Gateway VPC Endpoint for Amazon S3, which routes traffic directly and privately to S3 without data processing costs.

A Gateway endpoint is free of charge and keeps traffic within the AWS network.

Evaluate the secure way to access the external payment gateway API.

Deploy a NAT Gateway in a public subnet and route outbound internet traffic (

0.0.0.0/0

) from the private subnet to it.

NAT Gateways allow private instances to initiate outbound connections to the internet while blocking inbound traffic from the internet.

Key Concept

Combining S3 Gateway Endpoints for internal AWS traffic and NAT Gateways for external internet egress to optimize VPC security and data transfer costs.

Estimated Time:2m 0s

Question 373Question →

A security architect is designing a multi-account reporting pipeline. A business application running on Amazon EC2 instances in Account A must write encrypted transactional logs to an Amazon S3 bucket located in Account B. The database credentials used by the application must be rotated every 30 days, and under no circumstances should they be stored in plaintext. Furthermore, the encryption key used for S3 objects must be rotated automatically every year without requiring administrative overhead to re-encrypt existing objects or manually track key versions.

Which two actions should the solutions architect take to meet these security requirements? (Select TWO.)

Select all that apply

Store the database credentials in AWS Secrets Manager in Account A, configure automatic rotation every 30 days using an AWS Lambda function, and grant the EC2 instance role permissions to retrieve the secret.

Create a Customer Managed Key (CMK) in Account B, configure its key policy to allow the IAM role of the EC2 instances in Account A to perform kms:GenerateDataKey and kms:Decrypt operations, enable automatic key rotation, and write the logs using this CMK.

Store the database credentials as a String parameter in the Systems Manager Parameter Store, configure a scheduled Amazon EventBridge rule to trigger an AWS Lambda function that updates the parameter value every 30 days, and retrieve it using the EC2 instance profile.

Create a Customer Managed Key (CMK) in Account B, enable automatic key rotation, and configure an AWS Glue job to run annually immediately after rotation to re-encrypt all existing objects in the S3 bucket with the newly generated key material.

Create a Customer Managed Key (CMK) in Account B, and write a custom Lambda script that runs annually to manually create a new CMK, update the S3 bucket policy to allow access to the new key, and deprecate the old key to prevent data loss since automatic KMS rotation overwrites the active key material.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager in Account A, configure automatic rotation every 30 days using an AWS Lambda function, and grant the EC2 instance role permissions to retrieve the secret.; Create a Customer Managed Key (CMK) in Account B, configure its key policy to allow the IAM role of the EC2 instances in Account A to perform kms:GenerateDataKey and kms:Decrypt operations, enable automatic key rotation, and write the logs using this CMK.

Answer

Store the database credentials in AWS Secrets Manager with automatic 30-day rotation, and create a Customer Managed Key in Account B with a cross-account key policy allowing the Account A EC2 role access while enabling automatic annual key rotation.

Storing database credentials in AWS Secrets Manager and enabling automatic rotation every 30 days meets the credential security requirements. To secure S3 objects across accounts, using a Customer Managed Key in Account B with a key policy allowing the application's IAM role in Account A to use the key ensures the destination account retains ownership of the encrypted objects. Enabling automatic rotation on this CMK rotates the key material annually without needing to re-encrypt old objects, as AWS KMS retains previous key material for decryption.

Step-by-Step Solution

Evaluate secret storage requirements.

Database credentials cannot be stored in plaintext. AWS Secrets Manager is selected because it encrypts secrets at rest and natively supports automatic rotation every 30 days via Lambda.

This meets the security requirement for rotating database credentials without storing them as plaintext parameters.

Determine key location for cross-account S3 writing.

The Customer Managed Key (CMK) must be created in Account B (the destination account) so that Account B retains ownership of the encrypted objects written by Account A.

Creating the key in Account B ensures the bucket owner can manage access to the encrypted data.

Configure the key policy for cross-account access.

The key policy in Account B must be updated to grant the IAM role of the EC2 instances in Account A permissions to perform 'kms:GenerateDataKey' and 'kms:Decrypt' operations.

This allows the application in Account A to perform envelope encryption on S3 uploads.

Address key rotation requirements.

Enable automatic key rotation on the CMK in Account B. AWS KMS rotates the backing key material every year and retains historical backing keys to decrypt older logs.

This satisfies the requirement to rotate keys annually without re-encrypting older data or incurring administrative overhead.

Key Concept

AWS KMS key rotation and cross-account key policies allow for seamless annual rotation of key material without re-encrypting historical data, while AWS Secrets Manager provides secure storage and rotation of credentials.

Estimated Time:3m 0s

Question 374Question →

A company has on-premises servers that need to securely upload log files to an Amazon S3 bucket. The company's security policy strictly prohibits the storage or use of long-term AWS security credentials, such as IAM user access keys, on the on-premises servers. A solutions architect must design an authorization solution that enables these servers to dynamically request temporary AWS security credentials.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Create a trust anchor in AWS IAM Roles Anywhere by establishing trust with a supported private or public Certificate Authority (CA).

Install and configure the AWS IAM Roles Anywhere credential helper tool on the on-premises servers to retrieve credentials from AWS Security Token Service (STS).

Generate IAM access keys for the AWS account root user, and configure annual rotation of the root user keys using AWS KMS customer managed keys.

Store the IAM user access keys as plain text parameters in AWS Systems Manager Parameter Store so the servers can fetch them via simple API calls.

Manually create individual IAM users with long-term security credentials for the on-premises servers to authenticate via IAM identity federation.

Show answer & explanation

Answer: Create a trust anchor in AWS IAM Roles Anywhere by establishing trust with a supported private or public Certificate Authority (CA).; Install and configure the AWS IAM Roles Anywhere credential helper tool on the on-premises servers to retrieve credentials from AWS Security Token Service (STS).

Answer

The solutions architect should create a trust anchor in AWS IAM Roles Anywhere by establishing trust with a supported Certificate Authority (CA), and install and configure the AWS IAM Roles Anywhere credential helper tool on the on-premises servers to retrieve credentials from AWS Security Token Service (STS).

To secure communications from on-premises workloads without managing long-term AWS credentials, AWS IAM Roles Anywhere is the recommended service. Implementing this requires creating a trust anchor in AWS IAM Roles Anywhere linked to a Certificate Authority (CA) and running the IAM Roles Anywhere credential helper on the server to handle certificate exchange for temporary security credentials.

Step-by-Step Solution

Identify the service suited for assigning temporary AWS credentials to workloads running outside of AWS.

AWS IAM Roles Anywhere is identified as the correct service to establish trust and issue temporary credentials using X.509 digital certificates.

The security policy forbids long-term credentials, meaning standard IAM user access keys cannot be used on-premises.

Establish the root of trust on the AWS side.

Create a trust anchor in AWS IAM Roles Anywhere that points to the organization's existing Certificate Authority (CA) or AWS Private CA.

A trust anchor defines the CA that IAM Roles Anywhere trusts to sign client certificates presented by the servers.

Configure the client-side authentication on the on-premises servers.

Deploy the IAM Roles Anywhere credential helper on the servers to manage certificate-based requests to the AWS Security Token Service (STS) endpoint.

The credential helper integrates with the AWS CLI and SDKs, handling the signature generation and credential retrieval transparently without hardcoding keys.

Key Concept

AWS IAM Roles Anywhere allows workloads outside of AWS (like physical or virtual servers on-premises) to use X.509 certificates to obtain temporary AWS security credentials, removing the need to manage long-term IAM access keys.

Question 375Question →

A global smart home IoT provider receives telemetry data from millions of connected devices. The ingestion endpoint is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). Recently, the ingestion endpoint experienced a sudden influx of malicious Layer 4 TCP SYN flood attacks, along with a distributed Layer 7 HTTP POST flood attack that simulates device telemetry uploads. The provider needs a solution that automatically mitigates the infrastructure-layer attacks and allows them to rate-limit and filter the malicious HTTP POST requests. Which solution meets these requirements with the least administrative effort?

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer (ALB). Associate an AWS WAF Web ACL with the CloudFront distribution, and configure a rate-based rule targeting the HTTP POST telemetry endpoint.

Configure stateless Network Access Control Lists (NACLs) at the subnet level to dynamically block the TCP SYN flood attacks, and apply Security Groups to rate-limit the Layer 7 HTTP POST requests.

Subscribe to AWS Shield Standard on the Application Load Balancer (ALB) and configure it to automatically block the Layer 7 HTTP POST flood attacks using deep packet inspection.

Enable AWS Shield Advanced on the Application Load Balancer (ALB) to handle the Layer 3/4 attacks, and use AWS Shield Standard to define custom URI-matching rules that block the malicious HTTP POST requests.

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer (ALB). Associate an AWS WAF Web ACL with the CloudFront distribution, and configure a rate-based rule targeting the HTTP POST telemetry endpoint.

Answer

The correct solution uses Amazon CloudFront to absorb Layer 3/4 TCP SYN flood attacks at the edge locations using AWS Shield Standard. It then attaches AWS WAF to the CloudFront distribution to inspect Layer 7 traffic and enforce rate-limiting rules on HTTP POST requests, protecting the origin ALB and EC2 instances from resource exhaustion.

Step-by-Step Solution

Analyze the attack vectors targeting the IoT provider's endpoints.

Identified a Layer 4 TCP SYN flood (infrastructure layer) and a Layer 7 HTTP POST flood (application layer).

Different layers of the OSI model require different mitigation strategies under the AWS Shared Responsibility Model.

Address the Layer 4 infrastructure attacks at the network edge.

Place Amazon CloudFront in front of the Application Load Balancer (ALB) to leverage AWS Shield Standard.

CloudFront locations absorb Layer 3 and 4 attacks automatically, keeping the load from reaching the origin ALB.

Mitigate the Layer 7 HTTP POST flood attacks.

Associate AWS WAF with CloudFront and configure a rate-based rule targeting the POST endpoint.

AWS WAF inspects application-layer HTTP requests and applies rate-limiting rules to block IP addresses exceeding the defined threshold.

Key Concept

AWS Edge services (Amazon CloudFront and AWS Shield Standard) automatically mitigate Layer 3/4 infrastructure attacks, while AWS WAF provides Layer 7 application-layer filtering and rate-limiting.

Estimated Time:1m 30s

Question 376Question →

A company is developing a new application that stores customer data in an Amazon S3 bucket. The security policy requires that all data stored in the S3 bucket must be encrypted at rest using server-side encryption with AWS Key Management Service (SSE-KMS) keys. Additionally, database credentials used by the application must be securely stored and automatically rotated every 30 days. Which TWO actions should a solutions architect take to meet these requirements?

Select all that apply

Configure the Amazon S3 bucket to use server-side encryption with AWS Key Management Service (SSE-KMS) using a customer managed key.

Store the database credentials in AWS Secrets Manager and configure a rotation schedule.

Store the database credentials as a String parameter type in AWS Systems Manager Parameter Store.

Configure automatic key rotation on the customer managed key to immediately re-encrypt all existing historical objects in the S3 bucket.

Use the AWS account root user credentials to create the customer managed key and manage key policies.

Show answer & explanation

Answer: Configure the Amazon S3 bucket to use server-side encryption with AWS Key Management Service (SSE-KMS) using a customer managed key.; Store the database credentials in AWS Secrets Manager and configure a rotation schedule.

Answer

Configure the Amazon S3 bucket to use server-side encryption with AWS Key Management Service (SSE-KMS) using a customer managed key, and store the database credentials in AWS Secrets Manager with a rotation schedule configured.

The correct solution involves configuring S3 server-side encryption using a customer managed key (SSE-KMS) to protect stored files, and using AWS Secrets Manager to store database credentials securely with automatic rotation configured. These actions meet the encryption and automated credentials management requirements following AWS best practices.

Step-by-Step Solution

Address S3 bucket encryption at rest.

Configure server-side encryption with AWS Key Management Service (SSE-KMS) on the S3 bucket using a customer managed key.

This satisfies the requirement to encrypt all stored data at rest using KMS keys while keeping control over the key policies.

Address database credential storage and rotation.

Store database credentials in AWS Secrets Manager and enable automatic rotation.

AWS Secrets Manager natively supports the secure storage of sensitive secrets and provides built-in rotation functionality for database credentials.

Key Concept

AWS KMS key management and secure secrets storage with automated rotation.

Estimated Time:1m 0s

Question 377Question →

A global financial services company is deploying a real-time trading API on AWS. The API must be deployed across multiple AWS Regions to ensure low latency for users worldwide. The architecture uses Application Load Balancers (ALBs) in each Region to distribute traffic to Amazon EC2 instances. The company needs a secure edge routing solution that provides static IP addresses, routes traffic over the AWS global network, protects against Layer 3 and Layer 4 DDoS attacks, and mitigates Layer 7 HTTP flood attacks.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Create an accelerator using AWS Global Accelerator, register the Application Load Balancers in each Region as endpoints, and enable AWS Shield Advanced on the accelerator.

Associate an AWS WAF web ACL containing a rate-based rule with the Application Load Balancer in each Region.

Associate an AWS WAF web ACL directly with the AWS Global Accelerator to inspect and block Layer 7 HTTP flood attacks.

Configure stateless Network Access Control Lists (NACLs) at the subnet level to dynamically detect and drop traffic from IP addresses initiating Layer 7 HTTP flood attacks.

Configure AWS Shield Standard to monitor security groups and automatically add inbound deny rules for offending IP addresses.

Show answer & explanation

Answer: Create an accelerator using AWS Global Accelerator, register the Application Load Balancers in each Region as endpoints, and enable AWS Shield Advanced on the accelerator.; Associate an AWS WAF web ACL containing a rate-based rule with the Application Load Balancer in each Region.

Answer

To meet the requirements, the solutions architect should create an accelerator using AWS Global Accelerator, register the Application Load Balancers in each Region as endpoints, enable AWS Shield Advanced on the accelerator, and associate an AWS WAF web ACL containing a rate-based rule with the Application Load Balancer in each Region.

The correct actions are to deploy AWS Global Accelerator with AWS Shield Advanced enabled and to associate AWS WAF web ACLs with the Application Load Balancers. AWS Global Accelerator provides static IP addresses and routes traffic over the AWS global network to endpoints (such as ALBs) in multiple Regions, and Shield Advanced can be applied to the accelerator to defend against Layer 3 and Layer 4 DDoS attacks. To protect against Layer 7 HTTP flood attacks, AWS WAF web ACLs with rate-based rules must be associated with the regional ALBs.

Step-by-Step Solution

Identify the routing and network-layer protection requirements.

Determine that AWS Global Accelerator satisfies the requirement for multi-region routing with static IP addresses over the AWS global backbone. AWS Shield Advanced is then enabled on the accelerator to defend against Layer 3 and Layer 4 DDoS attacks.

This establishes a secure, low-latency entry point into the AWS network while protecting the infrastructure layer.

Identify the application-layer (Layer 7) protection requirements.

Determine that AWS WAF web ACLs with rate-based rules must be associated with the Application Load Balancers in each Region.

This inspects application traffic at the load balancing tier and mitigates HTTP flood attacks before they impact the backend EC2 instances.

Key Concept

Integrating AWS Global Accelerator, AWS Shield Advanced, and AWS WAF to secure multi-region web applications at both the infrastructure (Layer 3/4) and application (Layer 7) layers.

Question 378Question →

A company is developing a new mobile application that allows users to upload profile pictures directly to an Amazon S3 bucket. The application developers need to establish a mechanism to authenticate users and authorize S3 write access without embedding long-term credentials in the mobile application package. Which solution meets these security requirements with the least administrative overhead?

Configure Amazon Cognito Identity Pools to authenticate users through public identity providers and exchange the identity tokens for temporary AWS credentials using an IAM role.

Generate AWS Account Root User access keys and embed them in the mobile application configuration file to sign all S3 API requests.

Create a dedicated IAM user for each mobile application user, generate long-term access keys, and distribute them to the mobile devices during registration.

Store a single administrative IAM user's credentials in AWS Systems Manager Parameter Store as a plaintext String parameter and configure the mobile app to fetch it via a public API.

Show answer & explanation

Answer: Configure Amazon Cognito Identity Pools to authenticate users through public identity providers and exchange the identity tokens for temporary AWS credentials using an IAM role.

Answer

Configure Amazon Cognito Identity Pools to authenticate users through public identity providers and exchange the identity tokens for temporary AWS credentials using an IAM role.

The correct solution uses Amazon Cognito Identity Pools to exchange tokens from public identity providers for temporary, scoped AWS credentials. This approach allows the mobile application to upload profile pictures directly to S3 by assuming an IAM role with limited permissions, eliminating the need to distribute or store long-term keys on the devices.

Step-by-Step Solution

Analyze the requirements for external mobile application users requesting write access to Amazon S3.

Identify that the solution must avoid using long-term credentials, scale dynamically for external users, and run with the least administrative overhead.

Storing static IAM credentials on untrusted client devices violates the principle of least privilege and introduces security risks.

Evaluate identity federation mechanisms to delegate access to AWS resources.

Determine that Amazon Cognito Identity Pools (Federated Identities) is the native AWS service built to authenticate external users and issue temporary AWS Security Token Service (STS) credentials.

This allows the application to assume a specific IAM role containing a policy that grants permission only to write to the S3 bucket.

Key Concept

Temporary Security Credentials and Mobile Client Identity Federation

Estimated Time:1m 30s

Question 379Question →

A company stores database backups in an Amazon S3 bucket. The backups are encrypted at rest using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS). The company's security policy requires that the encryption keys be rotated annually. Which of the following actions should the solutions architect take to meet these requirements with the least operational overhead?

Enable automatic key rotation for the Customer Managed Key in AWS KMS, which automatically generates new key material annually while preserving the older key material for decryption.

Enable automatic key rotation for the Customer Managed Key in AWS KMS, and schedule an AWS Batch job to immediately decrypt and re-encrypt all existing database backups in the S3 bucket under the new key version.

Manually create a new Customer Managed Key each year, configure the S3 bucket default encryption to use the new key, and delete the previous key immediately to prevent unauthorized access.

Store the encryption key material as a plaintext string parameter in AWS Systems Manager Parameter Store, and configure an AWS Lambda function to update and rotate the parameter annually.

Show answer & explanation

Answer: Enable automatic key rotation for the Customer Managed Key in AWS KMS, which automatically generates new key material annually while preserving the older key material for decryption.

Answer

Enable automatic key rotation for the Customer Managed Key in AWS KMS, which automatically generates new key material annually while preserving the older key material for decryption.

Enabling automatic key rotation on an AWS KMS Customer Managed Key (CMK) is the most operationally efficient method to meet annual rotation requirements. When enabled, AWS KMS automatically generates new key material for the CMK every year. It keeps all older versions of the key material active so that AWS KMS can decrypt any data previously encrypted with those versions. The key ID remains unchanged, meaning application code and S3 bucket configurations do not need to be updated.

Step-by-Step Solution

Analyze the requirement for annual encryption key rotation with minimal operational overhead for S3 backups.

Identify that AWS KMS Customer Managed Keys support native, automated annual rotation.

Using native managed features minimizes operational overhead compared to manual key creation and rotation scripts.

Evaluate the behavior of AWS KMS key rotation concerning existing data decryption.

Recall that KMS preserves the older key material backing the same key ID to automatically decrypt older objects without requiring re-encryption.

This behavior eliminates the need to run data migration or re-encryption tasks on existing S3 backups.

Discard insecure options that store secrets in plaintext or delete key material needed for historical decryption.

Eliminate the options that advocate deleting old keys or storing secrets as plaintext parameters.

Deleting older key material causes data loss for older backups, and storing keys in plaintext violates basic AWS security best practices.

Key Concept

AWS KMS Automatic Key Rotation

Question 380Question →

A media streaming platform serves static content and an interactive API via an Amazon CloudFront distribution. The API traffic is routed to an Application Load Balancer (ALB) acting as the origin. During a recent event, the platform experienced a massive distributed HTTP flood attack targeting the login endpoint (/login), which overwhelmed the backend EC2 instances. The security team needs a solution to automatically detect and block these application-layer attacks at the edge with minimal administrative overhead. Which solution meets these requirements?

Create an AWS WAF web ACL, define a rate-based rule that targets the /login path, and associate the web ACL with the CloudFront distribution.

Enable AWS Shield Standard to automatically detect and mitigate the application-layer HTTP flood attacks targeting the /login path.

Configure a stateless Network Access Control List (NACL) rule on the ALB's subnets to block the incoming traffic from the attacker IP addresses.

Configure the CloudFront cache behavior for the /login path with a Time to Live (TTL) of zero to block the unauthorized requests at the edge.

Show answer & explanation

Answer: Create an AWS WAF web ACL, define a rate-based rule that targets the /login path, and associate the web ACL with the CloudFront distribution.

Answer

Create an AWS WAF web ACL, define a rate-based rule that targets the /login path, and associate the web ACL with the CloudFront distribution.

AWS WAF provides Layer 7 protection and allows you to create rate-based rules. When associated with an Amazon CloudFront distribution, AWS WAF inspects requests at the edge and automatically blocks IP addresses that exceed a defined threshold of requests within a rolling 5-minute window. This stops the HTTP flood from reaching the origin Application Load Balancer and the backend instances.

Step-by-Step Solution

Analyze the attack type and target layer.

The attack is a distributed HTTP flood targeting a specific application path (/login), which is a Layer 7 (application-layer) attack.

Correct security tools must operate at the application layer to inspect URI paths and request rates.

Select the appropriate AWS security service for Layer 7 mitigation.

AWS WAF is chosen because it allows inspection of HTTP/HTTPS parameters and supports rate-limiting rules.

AWS Shield Standard is restricted to Layer 3/4 protection, and Network ACLs lack application-layer visibility and automated rate detection.

Deploy the protection at the edge to protect the origin.

Associate the AWS WAF web ACL with the Amazon CloudFront distribution.

Blocking malicious traffic at the edge prevents it from traversing the AWS network and consuming ALB and EC2 resources.

Key Concept

Mitigating Layer 7 HTTP flood attacks at the edge using AWS WAF rate-based rules associated with Amazon CloudFront.

PreviousPage 19 / 22Next

Design Secure Architectures

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept