Examkin

Design Secure Architectures

438 questions

All types438Multiple choice214Multiple select224
Question 21Question →

A security architect is designing an access and credentials management solution for a multi-account AWS environment. An application running on Amazon EC2 instances in Account A (111122223333111122223333) must securely retrieve database credentials to connect to a PostgreSQL database in Account B (444455556666444455556666). The database credentials must be rotated every 3030 days without causing application downtime. The solution must adhere to the principle of least privilege, avoid long-term credentials, and ensure all data in transit and at rest is secured using customer-managed keys (CMKs). Which architecture represents the most secure and compliant design that meets these requirements?

Show answer & explanation

Answer: Store the credentials in AWS Secrets Manager in Account B, encrypted with a customer-managed KMS key. Attach an IAM role to the EC2 instances in Account A, and configure the Secrets Manager resource policy and the KMS key policy in Account B to permit the Account A role to retrieve the secret and decrypt using the KMS key. Configure automatic rotation in Secrets Manager using a Lambda function in Account B.

Answer

Store the credentials in AWS Secrets Manager in Account B, encrypted with a customer-managed KMS key. Attach an IAM role to the EC2 instances in Account A, and configure the Secrets Manager resource policy and the KMS key policy in Account B to permit the Account A role to retrieve the secret and decrypt using the KMS key. Configure automatic rotation in Secrets Manager using a Lambda function in Account B.
The correct architecture stores credentials securely in AWS Secrets Manager, which supports automated rotation using a Lambda function. Using resource-based policies on the secret and the KMS key in the database account (Account B) allows the IAM role attached to the EC2 instances in Account A to retrieve and decrypt the secret without needing long-term credentials. This adheres to the principles of least privilege and secure cross-account access.

Step-by-Step Solution

1
Evaluate credential storage and transmission requirements.
Determine that credentials must be stored securely using AWS Secrets Manager in the database account (Account B) rather than Systems Manager Parameter Store in plaintext, and access must be granted using IAM roles rather than long-term IAM user access keys.
This satisfies the requirements for encryption at rest/in transit, avoiding long-term credentials, and practicing least privilege.
2
Configure cross-account access policies for the EC2 instances.
Grant the EC2 instance role in Account A access to Secrets Manager and KMS in Account B. Ensure the Secrets Manager resource policy and the KMS key policy in Account B explicitly permit the role in Account A.
For cross-account access, resource-based policies (and KMS key policies) must trust the external account or role directly since identity-based policies in Account A alone are insufficient.
3
Configure the automated credential rotation mechanism.
Enable Secrets Manager automatic rotation, which uses a Lambda function to update the database password and the secret value.
AWS KMS key rotation only rotates KMS key material, not the actual secret value. Secrets Manager rotation is required to securely update database credentials.

Key Concept

Cross-account access and credentials rotation utilizing AWS Secrets Manager and AWS KMS with resource-based policies.
Estimated Time:3m 0s
Question 22Question →

An e-learning platform operates a multi-account AWS environment managed under AWS Organizations. The security team needs a solution to centralize the monitoring of security alerts and threat detections from Amazon GuardDuty, Amazon Macie, and AWS IAM Access Analyzer across all accounts. Additionally, they must continuously assess their resource configurations against the AWS Foundational Security Best Practices standard. Which solution will meet these requirements with the least operational overhead?

Show answer & explanation

Answer: Enable AWS Security Hub in a designated security administrator account, integrate it with AWS Organizations to aggregate findings across all member accounts, and enable the AWS Foundational Security Best Practices standard.

Answer

Enable AWS Security Hub in a designated security administrator account, integrate it with AWS Organizations to aggregate findings across all member accounts, and enable the AWS Foundational Security Best Practices standard.
The correct solution uses AWS Security Hub, which is designed to centralize and prioritize security findings from multiple AWS services (such as GuardDuty, Macie, and IAM Access Analyzer) across all accounts in an organization. It also runs automated compliance checks against standards like AWS Foundational Security Best Practices, minimizing operational overhead.

Step-by-Step Solution

1
Identify the primary requirement of centralizing threat detection and compliance checks across multiple AWS accounts.
AWS Security Hub is identified as the native service designed for centralizing findings and conducting automated compliance checks.
It natively integrates with AWS Organizations, GuardDuty, Macie, and IAM Access Analyzer to aggregate findings into a single pane of glass.
2
Address the requirement to run security posture assessments against the AWS Foundational Security Best Practices standard.
AWS Security Hub's compliance standards feature is selected.
Security Hub continuously runs automated checks against security standards to identify configuration drifts and compliance status.
3
Determine the configuration that minimizes operational overhead across the organization.
AWS Organizations integration is configured.
Setting up a designated security administrator account allows automatic enablement of Security Hub across all existing and future member accounts.

Key Concept

Centralized security monitoring and compliance tracking using AWS Security Hub and AWS Organizations.
Question 23Question →

A company is designing a security architecture to grant administrative access to its internal cloud operations team, whose identities are managed in an external corporate directory, and a group of external consultants. The administrators need to configure automatic KMS key rotation for sensitive logs, manage database credentials securely, and perform daily maintenance tasks. Which solution meets these requirements securely and with the least administrative overhead?

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate the internal cloud operations team, create a cross-account IAM role with an External ID for the external consultants, store the database credentials in Systems Manager Parameter Store as SecureString parameters, and enable automatic key rotation on the Customer Managed Key.

Answer

Configure AWS IAM Identity Center to federate the internal cloud operations team, create a cross-account IAM role with an External ID for the external consultants, store the database credentials in Systems Manager Parameter Store as SecureString parameters, and enable automatic key rotation on the Customer Managed Key.
The correct solution implements federation using AWS IAM Identity Center for internal users, which uses temporary credentials and reduces credential management overhead. It uses a cross-account IAM role with an External ID for third-party access, which aligns with security best practices. It securely stores database credentials in Parameter Store as SecureString parameters (which are encrypted using KMS), and enables automatic key rotation on the Customer Managed Key, preserving the old key material so that existing data remains readable.

Step-by-Step Solution

1
Evaluate the identity federation requirements for the internal cloud operations team.
AWS IAM Identity Center provides federated access using existing corporate directory credentials, eliminating the need to manage individual IAM users with long-term access keys.
Reduces operational overhead and improves security posture.
2
Determine the access model for the external consultants.
A cross-account IAM role with an External ID is created to grant the external consultants least-privilege, temporary access without creating IAM users in the primary account.
Prevents the 'confused deputy' problem and avoids managing long-term credentials for external entities.
3
Determine the secure storage mechanism for the database credentials.
Systems Manager Parameter Store with SecureString parameters is chosen to encrypt the credentials at rest using KMS.
Ensures sensitive configuration parameters are not stored in plaintext.
4
Determine the key rotation strategy for the Customer Managed Key (CMK).
Enable automatic key rotation on the Customer Managed Key.
AWS KMS automatically rotates the backing key material annually while retaining the old key material to decrypt historical data without manual intervention or key deletion.

Key Concept

AWS Identity and Access Management (IAM) best practices demand the use of temporary credentials via federation and cross-account roles, secure parameter storage, and proper KMS key rotation mechanics.
Question 24Question →

A financial services company is setting up a development AWS account. The company wants to allow the development team leads to create and manage IAM roles for their applications' Amazon EC2 instances. However, the security team must ensure that the team leads cannot create roles that grant access to sensitive S3 buckets, even though the team leads themselves have administrative permissions in the account. Which solution meets these security requirements with the least administrative overhead?

Show answer & explanation

Answer: Configure an IAM permissions boundary that defines the maximum allowed permissions, excluding access to the sensitive S3 buckets. Attach an IAM policy to the team leads that allows role creation only if this permissions boundary is applied to the new role.

Answer

Configure an IAM permissions boundary that defines the maximum allowed permissions, excluding access to the sensitive S3 buckets. Attach an IAM policy to the team leads that allows role creation only if this permissions boundary is applied to the new role.
The correct solution is to use an IAM permissions boundary. A permissions boundary is an advanced feature for using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity (user or role). When a permissions boundary is set on a role, the role can only perform actions that are allowed by both its identity-based policy and its permissions boundary. By requiring the team leads to specify this boundary when creating new roles (using the 'iam:PermissionsBoundary' condition key in their own IAM policy), the security team can safely delegate role creation without risking privilege escalation.

Step-by-Step Solution

1
Define the maximum allowable permissions for any application role by creating an IAM permissions boundary policy that denies access to the sensitive S3 buckets.
An IAM policy is created representing the boundary, which sets the maximum ceiling of permissions for roles created under it.
This establishes the hard security limit that delegated administrators cannot exceed.
2
Create an IAM policy for the team leads that allows the 'iam:CreateRole' and 'iam:PutRolePolicy' actions.
The team leads gain the permissions to create roles and attach policies locally within the development account.
This enables delegation of administrative tasks to the team leads.
3
Add a condition to the team leads' IAM policy that requires the 'iam:PermissionsBoundary' key to match the ARN of the permissions boundary policy created in step 1.
The team leads can only create roles if they specify the approved permissions boundary during creation.
This prevents privilege escalation by ensuring that any role they create is constrained by the security baseline.

Key Concept

IAM Permissions Boundary
Question 25Question →

An enterprise has a legacy payroll application running on physical servers in an on-premises data center. The application must securely upload daily transaction logs to an Amazon S3 bucket. The company's security policy strictly prohibits the storage of long-term AWS credentials on physical on-premises servers. The company already maintains an internal Public Key Infrastructure (PKI) and a private Certificate Authority (CA). Which solution meets these security requirements with the least administrative overhead?

Show answer & explanation

Answer: Configure AWS IAM Roles Anywhere by defining a trust anchor linked to the internal Certificate Authority. Configure the application to exchange its X.509 digital certificate for temporary AWS credentials using an IAM role.

Answer

Configure AWS IAM Roles Anywhere by defining a trust anchor linked to the internal Certificate Authority, and configure the application to exchange its X.509 digital certificate for temporary AWS credentials.
The correct solution involves configuring AWS IAM Roles Anywhere. Since the company already maintains a private Certificate Authority (CA), they can establish a trust anchor in IAM Roles Anywhere. The on-premises application can then use its X.509 digital certificate to authenticate and request short-lived, temporary AWS credentials from the AWS Security Token Service (STS) using an IAM role. This eliminates the need to store long-term AWS credentials on-premises, satisfying the security policy.

Step-by-Step Solution

1
Analyze the requirements for accessing the Amazon S3 bucket from an on-premises environment.
Identify that the application needs to upload logs to Amazon S3, but storing long-term credentials (like IAM access keys) on-premises is strictly prohibited.
This rules out solutions that rely on creating static IAM users and distributing access keys to physical servers.
2
Evaluate the available identity federation and credential management options.
Since the company has an established PKI with an internal Certificate Authority (CA), they can leverage AWS IAM Roles Anywhere.
AWS IAM Roles Anywhere uses X.509 digital certificates to establish trust between the on-premises environment and AWS, enabling workloads to obtain temporary credentials.
3
Select the option that conforms to security best practices and has the least administrative overhead.
Establishing a trust anchor with the CA and mapping certificates to an IAM role is the standard, secure pattern that avoids long-term credentials.
This satisfies the security policy without requiring complex custom identity brokering or storing keys in plain text.

Key Concept

AWS IAM Roles Anywhere allows workloads running outside of AWS, such as on-premises servers, to use digital certificates to exchange for temporary AWS credentials, avoiding the risk of long-term credentials.
Estimated Time:1m 30s
Question 26Question →

A solutions architect is designing the network security for a two-tier application in a VPC. The database tier runs on Amazon EC2 instances in a private subnet, and the web tier runs in a public subnet. The database instances must accept incoming database connections on TCP port 3306 from the web tier. Additionally, the database instances must be able to download software updates from the internet over HTTPS (TCP port 443) via a NAT Gateway. No other outbound connections from the database instances should be allowed. The architect wants to implement these controls using both Security Groups and Network Access Control Lists (Network ACLs) under the principle of least privilege. Which combination of configurations will satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the database security group with an inbound rule that allows TCP port 3306 from the web security group, and an outbound rule that allows TCP port 443 to 0.0.0.0/0.; Configure the database subnet Network ACL with inbound rules allowing TCP port 3306 from the web subnet CIDR and TCP ports 1024-65535 from 0.0.0.0/0, and outbound rules allowing TCP ports 1024-65535 to the web subnet CIDR and TCP port 443 to 0.0.0.0/0.

Answer

To secure the database tier, configure the database security group to statefully allow inbound TCP port 3306 from the web security group and outbound TCP port 443 to the internet. Additionally, configure the stateless Network ACL on the database subnet to allow inbound TCP port 3306 and ephemeral ports (1024-65535) for return traffic, and outbound TCP port 443 and ephemeral ports for return traffic.
The correct configurations properly apply stateful rules to the security group and stateless rules (including ephemeral ports) to the subnet Network ACL. The security group needs inbound port 3306 and outbound port 443, as it automatically tracks connections. The Network ACL requires inbound port 3306 and outbound port 443, along with outbound ephemeral ports (for database query responses) and inbound ephemeral ports (for software patch download responses).

Step-by-Step Solution

1
Determine the stateful security requirements at the instance level.
The database instances require a security group that allows inbound traffic on port 3306 from the web tier security group and outbound traffic on port 443 to the internet. Because security groups are stateful, return traffic is tracked and allowed automatically without requiring ephemeral port rules.
This satisfies the requirement to filter traffic at the instance level statefully.
2
Determine the stateless security requirements at the subnet level.
The database subnet Network ACL (NACL) must be configured to allow inbound queries (port 3306) and outbound patches (port 443). Because NACLs are stateless, we must also add rules to allow return traffic on ephemeral ports (1024-65535) for both directions.
This satisfies the requirement to filter traffic at the subnet level statelessly.

Key Concept

Stateful Security Groups vs Stateless Network ACLs
Question 27Question →

An enterprise architecture team is reviewing the security posture of an analytics application that processes sensitive financial data. The application requires access to a database password, and all associated Amazon EBS volumes must be encrypted. To comply with internal security policies, the database password must be rotated every 30 days without manual intervention, and the KMS keys used for EBS volume encryption must be automatically rotated annually. Which strategy should a solutions architect implement to meet these requirements with the least operational effort?

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function. Encrypt the EBS volumes using a Customer Managed Key (CMK) and enable automatic key rotation in AWS KMS.

Answer

Store the database password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function. Encrypt the EBS volumes using a Customer Managed Key (CMK) and enable automatic key rotation in AWS KMS.
The correct solution stores database passwords securely in AWS Secrets Manager, which natively orchestrates rotation using AWS Lambda. It also encrypts EBS volumes using a Customer Managed Key (CMK) and leverages AWS KMS's native automatic rotation feature. This ensures that new data is encrypted with the new key version, while the previous key versions are retained to decrypt existing data without manual re-encryption overhead.

Step-by-Step Solution

1
Identify the secure storage and rotation mechanism for database credentials.
AWS Secrets Manager is selected because it natively supports automated rotation of database credentials using AWS Lambda, unlike Systems Manager Parameter Store standard String parameters.
Securing database credentials requires encryption at rest and automated lifecycle management.
2
Identify the encryption and rotation mechanism for EBS volumes.
Use a Customer Managed Key (CMK) with automatic annual key rotation enabled.
AWS KMS supports automatic annual rotation for CMKs without requiring existing data to be re-encrypted.
3
Combine the components into a single architecture that minimizes operational overhead and adheres to best practices.
The database credentials are managed by Secrets Manager and the EBS volumes are encrypted using KMS CMKs with rotation enabled, without root account usage or manual re-encryption scripts.
This combination meets all compliance requirements with native AWS capabilities.

Key Concept

Database credential rotation using Secrets Manager and KMS Customer Managed Key automatic rotation mechanics.
Estimated Time:1m 30s
Question 28Question →

An insurance company manages a multi-account environment on AWS using AWS Organizations. The company wants to allow its on-premises Active Directory users to access resources across these accounts using their existing corporate credentials. The solution must minimize operational overhead, avoid user data replication, and allow central management of permissions. Which of the following actions should the solutions architect take to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector.; Create permission sets within AWS IAM Identity Center and associate them with the Active Directory groups mapping to the target AWS accounts.

Answer

Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector, then create permission sets within AWS IAM Identity Center and associate them with the Active Directory groups mapping to the target AWS accounts.
The correct solution involves configuring AWS IAM Identity Center with AWS Directory Service AD Connector to link the on-premises Active Directory to AWS without replicating credentials. Additionally, permission sets must be created in AWS IAM Identity Center and assigned to the AD groups to grant access to the member accounts in the organization. This fulfills all requirements of centralized management, zero data replication, and low operational overhead.

Step-by-Step Solution

1
Establish connectivity between AWS and the on-premises directory.
AWS Directory Service AD Connector is deployed, redirecting directory authentication requests to the on-premises Active Directory without copying credentials.
This establishes directory integration without user database replication and minimizes operational overhead.
2
Configure AWS IAM Identity Center to use the AD Connector as its identity source.
AWS IAM Identity Center points to the Active Directory, allowing it to read groups and users directly.
This enables centralized login portal access for Active Directory users.
3
Create permission sets and assign them to the mapped groups.
Permissions are centrally defined as permission sets and linked to the corresponding AD groups inside the target AWS accounts.
This satisfies the requirement for central management of permissions.

Key Concept

AWS IAM Identity Center federation with on-premises Active Directory via AD Connector enables seamless single sign-on while keeping user credentials within the local directory and allowing centralized permission control via permission sets.
Estimated Time:2m 0s
Question 29Question →

A manufacturing company is migrating its workloads to a multi-account environment on AWS managed by AWS Organizations. The company maintains an on-premises Microsoft Active Directory containing all employee accounts. The company wants to allow its security administrators to log in to the AWS Management Console and access the AWS CLI using their existing corporate credentials. The solution must minimize operational overhead, avoid replicating Active Directory passwords to the cloud, and support centralized permission management. Which combination of actions should the solutions architect recommend to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Enable AWS IAM Identity Center in the Organizations management account and connect it to the on-premises Active Directory using AWS Directory Service AD Connector.; Create permission sets in AWS IAM Identity Center and assign them to the mapped Active Directory groups to control access to AWS resources.

Answer

The correct configuration involves enabling AWS IAM Identity Center in the Organizations management account, connecting it to the on-premises directory via an AD Connector, and creating permission sets mapped to Active Directory groups.
Enabling AWS IAM Identity Center and using an AD Connector provides a secure, low-overhead gateway to redirect authentication requests to the on-premises directory without replicating passwords or credentials to AWS. Mapping permission sets centrally to Active Directory groups allows administrators to govern access across all member accounts from a single location.

Step-by-Step Solution

1
Identify the correct federation service for multi-account management.
AWS IAM Identity Center is selected over individual IAM configurations to provide single sign-on capabilities across the AWS Organization.
IAM Identity Center is the modern AWS recommendation for centralizing multi-account access.
2
Establish connectivity to the on-premises Active Directory without password replication.
Deploy an AWS Directory Service AD Connector to act as a directory gateway.
AD Connector redirects authentication requests directly to the on-premises Active Directory, ensuring no passwords or hashes are replicated to the cloud.
3
Map Active Directory groups to AWS permissions.
Create permission sets in AWS IAM Identity Center and associate them with mapped AD groups.
This allows group-based authorization, matching existing corporate governance structures.

Key Concept

Centralized multi-account access management using AWS IAM Identity Center integrated with an on-premises Active Directory via AD Connector.
Question 30Question →

A company runs an internal reporting application on Amazon EC2 instances in a private subnet. The application must connect to an external third-party API service on the internet to retrieve data daily over HTTPS (TCP port 443443). A solutions architect has already deployed a NAT Gateway in a public subnet and configured the private subnet's route table to route internet traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway. The company requires using a custom Network Access Control List (NACL) on the private subnet to restrict outbound traffic to only this API service, whose public IP address is 203.0.113.50203.0.113.50. Which two configurations must be added to the custom NACL to allow this communication while maintaining the principle of least privilege? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: An outbound rule allowing TCP port 443443 to destination 203.0.113.50/32203.0.113.50/32; An inbound rule allowing TCP ports 1024−655351024-65535 from source 203.0.113.50/32203.0.113.50/32

Answer

An outbound rule allowing TCP port 443443 to destination 203.0.113.50/32203.0.113.50/32 and an inbound rule allowing TCP ports 1024−655351024-65535 from source 203.0.113.50/32203.0.113.50/32
Because Network ACLs are stateless, they require explicit rules for both outbound request traffic and inbound response traffic. The outbound connection is initiated towards the external API's service port (TCP 443443), which requires an outbound rule allowing TCP port 443443 to the API's IP address 203.0.113.50/32203.0.113.50/32. The return traffic from the API is destined for the client's ephemeral port range (1024−655351024-65535), which requires an inbound rule allowing TCP ports 1024−655351024-65535 from the API's IP address 203.0.113.50/32203.0.113.50/32.

Step-by-Step Solution

1
Analyze the direction of traffic and connection initiation.
The EC2 instances initiate outbound traffic to the API service on destination port 443443 (HTTPS). Therefore, a custom outbound NACL rule is needed to allow TCP port 443443 to the specific IP address 203.0.113.50/32203.0.113.50/32.
Outbound NACL rules must explicitly permit any outgoing requests.
2
Determine the return traffic path for stateless network filtering.
Because Network ACLs are stateless, return traffic from the API must be explicitly permitted by an inbound rule. The EC2 instances use client-side ephemeral ports (range 1024−655351024-65535) to establish connections.
The incoming response packets from the API will be destined for the ephemeral ports of the EC2 instances, not port 443443.
3
Verify rule constraints and rule types.
Select the rules that specify the correct port directions and IP blocks. Avoid options using security groups, as Network ACL rules do not support them.
Security groups are stateful and work at the instance level, whereas Network ACLs are stateless and work at the subnet boundary using IP CIDRs only.

Key Concept

Stateless nature of Network ACLs requiring explicit ephemeral port inbound rules for outbound connections
Question 31Question →

A solutions architect is designing a secure architecture for a financial application. The application's database runs on Amazon EC2 instances with Amazon EBS volumes, and it accesses an external API using an API key. The company's security policy mandates that:

1. All EBS volumes must be encrypted at rest, and the encryption keys must rotate annually without requiring manual data re-encryption or causing downtime.
2. The external API key must be stored securely, rotate automatically every 30 days, and not be exposed in plaintext in any configuration files.

Which combination of actions should the solutions architect take to meet these security requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an AWS KMS customer managed key to encrypt the EBS volumes, and enable automatic key rotation to rotate the key material annually without re-encrypting existing data.; Store the external API key in AWS Secrets Manager and configure automatic rotation every 30 days using an AWS Lambda function.

Answer

Create an AWS KMS customer managed key to encrypt the EBS volumes and enable automatic rotation, and store the API key in AWS Secrets Manager with automatic rotation configured using an AWS Lambda function.
The correct combination requires using an AWS KMS customer managed key for EBS encryption with automatic key rotation enabled, which rotates keys annually without needing manual intervention or re-encrypting historical data. Additionally, storing the API key in AWS Secrets Manager and configuring automatic rotation via Lambda ensures the secret is rotated every 30 days securely without plaintext exposure.

Step-by-Step Solution

1
Select the correct encryption strategy for Amazon EBS volumes.
Use an AWS KMS customer managed key with automatic key rotation enabled.
AWS KMS customer managed keys support automatic annual rotation. When rotated, KMS keeps the historical key material to decrypt older data, preventing the need to manually re-encrypt existing snapshots or volumes, which minimizes overhead and avoids downtime.
2
Select the correct management strategy for the external API key.
Store the secret key in AWS Secrets Manager and configure automatic 30-day rotation.
AWS Secrets Manager is the standard service for storing sensitive secrets. It integrates directly with AWS Lambda to automatically execute custom or template-based rotation schedules, keeping the credentials secure and eliminating plaintext storage.

Key Concept

Data encryption at rest using AWS KMS with automatic key rotation, and secure secret storage using AWS Secrets Manager with automated rotation.
Question 32Question →

An application runs on Amazon EC2 instances within a private subnet (10.100.1.0/2410.100.1.0/24). The application must query an Amazon RDS PostgreSQL database located in a dedicated database subnet (10.100.2.0/2410.100.2.0/24). Additionally, the application must securely retrieve database credentials from AWS Secrets Manager without accessing the public internet. The solutions architect needs to configure network security controls to allow only the necessary traffic flows.

Which TWO configurations should the solutions architect implement to meet these requirements securely? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an interface VPC endpoint for AWS Secrets Manager in the private subnet, and configure the RDS database security group to allow inbound traffic on port 54325432 from the security group of the EC2 instances.; Associate a security group with the Secrets Manager interface VPC endpoint that allows inbound TCP traffic on port 443443 from the security group of the EC2 instances.

Answer

To securely allow this communication, the solutions architect must configure the RDS database security group to allow inbound traffic from the EC2 instances' security group on port 54325432, and configure a security group for the AWS Secrets Manager interface VPC endpoint that allows inbound HTTPS traffic on port 443443 from the EC2 instances' security group.
To establish secure, private connectivity, the solutions architect must configure the RDS database security group to allow inbound PostgreSQL traffic (port 54325432) directly from the EC2 instances' security group. For AWS Secrets Manager, an interface VPC endpoint must be created, and its associated security group must allow inbound HTTPS traffic (port 443443) from the EC2 instances' security group. These two settings ensure secure, least-privilege access.

Step-by-Step Solution

1
Configure the database security group rule.
The RDS database security group accepts traffic on port 54325432 from the EC2 security group.
Security groups are stateful and allow return traffic automatically, so only an inbound rule is required on the database side.
2
Deploy an interface VPC endpoint for Secrets Manager.
An elastic network interface (ENI) is created in the private subnet, mapping Secrets Manager traffic to private IP addresses.
Secrets Manager only supports interface endpoints (AWS PrivateLink), and this prevents traffic from traversing the internet.
3
Configure the VPC endpoint security group.
The interface endpoint allows inbound HTTPS traffic on port 443443 from the EC2 security group.
Interface endpoints are protected by security groups, which must explicitly permit traffic from the calling client instances.

Key Concept

VPC network security involves configuring stateful security groups and stateless network ACLs. Security groups operate at the instance level and support rules referencing other security groups. Network ACLs operate at the subnet level, are stateless, and only support IP CIDR ranges.
Estimated Time:2m 0s
Question 33Question →

A solutions architect is configuring security policies for a critical financial application. The application stores its transaction logs in an Amazon S3 bucket, encrypted at rest using an AWS KMS customer managed key. The solutions architect enables automatic key rotation for the customer managed key. Which two statements correctly describe the behavior of AWS KMS and the S3 bucket after the key is rotated? (Select two.)

Select all that apply

Show answer & explanation

Answer: New transaction logs uploaded to the Amazon S3 bucket will be encrypted using the newly generated key material.; AWS KMS automatically retains the older key material to transparently decrypt historical transaction logs when requested.

Answer

The correct statements are that new logs uploaded to the Amazon S3 bucket will be encrypted using the newly generated key material, and AWS KMS automatically retains the older key material to transparently decrypt historical logs when requested.
When automatic key rotation is enabled for a customer managed key, AWS KMS creates new key material and uses it for all future encryption operations (such as encrypting new S3 uploads). To allow historical data to be read, AWS KMS retains all older versions of the key material and automatically uses them when decrypting objects that were encrypted with those older versions.

Step-by-Step Solution

1
Understand the mechanism of AWS KMS automatic key rotation for customer managed keys.
Automatic key rotation creates a new version of the backing key material but leaves the Key ID and Key ARN unchanged.
This allows applications to continue using the same key identifier without configuration or policy updates.
2
Determine how existing and new data are handled after key rotation.
New encryption requests use the new key material. Existing data is not re-encrypted. Older key material is retained by AWS KMS.
KMS must keep older key material to decrypt historical data that was encrypted with previous versions of the key.

Key Concept

AWS KMS Automatic Key Rotation Mechanics
Question 34Question →

A financial services company is deploying a two-tier application inside a virtual private cloud (VPC). The application consists of backend processing Amazon EC2 instances running in Subnet A (172.16.1.0/24172.16.1.0/24) and a PostgreSQL database instance running in Subnet B (172.16.2.0/24172.16.2.0/24). The backend instances need to access the database on TCP port 54325432, but all other traffic between the subnets must be blocked. The company requires a defense-in-depth network security architecture using both Security Groups and Network ACLs (NACLs). Which TWO configuration steps should the solutions architect perform to meet these security requirements?

Select all that apply

Show answer & explanation

Answer: Configure the database security group to allow inbound TCP traffic on port 54325432 from the security group of the backend processing instances.; Configure the Network ACL for Subnet B to allow inbound TCP traffic on port 54325432 from Subnet A (172.16.1.0/24172.16.1.0/24) and allow outbound TCP traffic on ephemeral ports (1024−655351024-65535) to Subnet A (172.16.1.0/24172.16.1.0/24).

Answer

Configuring the database security group to allow inbound TCP traffic on port 54325432 from the backend processing instances' security group, and configuring the Network ACL for Subnet B to allow inbound TCP traffic on port 54325432 from Subnet A and outbound TCP traffic on ephemeral ports (1024−655351024-65535) to Subnet A.
The correct architecture uses a combination of a stateful security group on the database instance and a stateless Network ACL on Subnet B. The security group configuration must allow inbound traffic from the backend instances' security group on port 54325432, which automatically allows return traffic. The Network ACL configuration must allow inbound traffic from the backend subnet on port 54325432 and also explicitly allow outbound return traffic to the backend subnet on ephemeral ports because Network ACLs are stateless.

Step-by-Step Solution

1
Evaluate the Security Group configuration needed for the database instance.
Determine that the database security group must allow inbound TCP port 54325432 traffic from the backend instances' security group. No outbound rule is required since security groups are stateful.
This establishes least-privilege control at the instance layer using stateful firewalls.
2
Evaluate the Network ACL configuration required for Subnet B.
Determine that Subnet B's Network ACL must allow inbound TCP port 54325432 traffic from Subnet A's CIDR (172.16.1.0/24172.16.1.0/24). Because Network ACLs are stateless, return traffic must also be permitted by adding an outbound rule for ephemeral ports (1024−655351024-65535) targeting Subnet A's CIDR.
This establishes subnet-level security filtering using stateless firewalls.

Key Concept

Distinguishing between the stateful behavior of Security Groups and the stateless behavior of Network ACLs in Amazon VPC.
Estimated Time:2m 0s
Question 35Question →

An enterprise is migrating a legacy reporting system to AWS. The backend processing servers run on Amazon EC2 instances in a private subnet. These instances must securely fetch configuration files from a private Amazon S3 bucket and connect to a third-party payment gateway API on the public internet. The solutions architect needs to design the network security controls to satisfy these requirements with minimum exposure and without incurring NAT Gateway data transfer costs for Amazon S3 traffic. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route table of the private subnet.; Deploy a NAT Gateway in a public subnet, update the private subnet's route table to route 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway, and use a stateful security group on the EC2 instances to restrict outbound traffic to the payment gateway.

Answer

The correct combination of actions is to create a Gateway VPC Endpoint for Amazon S3 and associate it with the private subnet's route table, and to deploy a NAT Gateway in a public subnet, update the private subnet's route table to route outbound traffic to the NAT Gateway, and restrict outbound traffic using a stateful security group on the EC2 instances.
The correct solution combines a Gateway VPC Endpoint for Amazon S3 and a NAT Gateway with a stateful security group. A Gateway VPC Endpoint routes S3 traffic privately within AWS without using a NAT Gateway, avoiding data processing costs. A NAT Gateway is deployed in a public subnet to allow private subnet EC2 instances to reach the external payment gateway, and a stateful security group on the instances restricts outbound traffic to the target API. Because security groups are stateful, return traffic is automatically permitted.

Step-by-Step Solution

1
Identify a cost-effective method to privately connect to Amazon S3.
Determine that a Gateway VPC Endpoint for Amazon S3 is the optimal path since it does not incur NAT Gateway data processing charges.
This establishes private routing within the AWS network to S3, bypassing the internet.
2
Establish secure outbound internet egress for private EC2 instances.
Deploy a NAT Gateway in a public subnet and add a default route pointing to it in the private subnet's route table.
The EC2 instances must connect to a public payment gateway API, which requires NAT translation.
3
Apply firewall controls to restrict egress traffic to authorized endpoints.
Utilize stateful EC2 security groups to permit HTTPS outbound requests specifically to the payment gateway.
Security groups are stateful and operate at the instance level, securing the traffic without blocking the return packets.

Key Concept

VPC Network Security controls, specifically combining stateful security groups, stateless network ACLs, NAT Gateways for internet egress, and Gateway VPC Endpoints for secure, cost-effective S3 access.
Question 36Question →

A company runs a critical application on Amazon EC2 instances in a private subnet within a VPC. The subnet has no route to the internet. The application must access AWS Key Management Service (AWS KMS) to decrypt sensitive configuration files. To comply with security policies, the traffic must not traverse the public internet, and access must be restricted using the principle of least privilege. The solutions architect deploys an interface VPC endpoint for AWS KMS. Which combination of security group configurations will meet these requirements?

Show answer & explanation

Answer: Configure the security group attached to the EC2 instances to allow outbound HTTPS (port 443) traffic to the security group of the interface VPC endpoint. Configure the security group attached to the interface VPC endpoint to allow inbound HTTPS traffic from the security group of the EC2 instances.

Answer

Configure the security group attached to the EC2 instances to allow outbound HTTPS (port 443) traffic to the security group of the interface VPC endpoint, and configure the security group attached to the interface VPC endpoint to allow inbound HTTPS traffic from the security group of the EC2 instances.
The correct answer configuration relies on stateful security groups to establish a private connection. An Interface VPC Endpoint uses an Elastic Network Interface (ENI) within the VPC. To permit the EC2 instances to communicate with the endpoint, the instances' security group must allow outbound HTTPS (port 443) traffic targeting the endpoint's security group. Conversely, the endpoint's security group must allow inbound HTTPS traffic from the EC2 instances' security group.

Step-by-Step Solution

1
Identify the type of VPC endpoint required for the target AWS service.
AWS KMS only supports Interface VPC Endpoints, which deploy Elastic Network Interfaces (ENIs) with private IP addresses from the subnet.
Determines whether to configure route tables (for Gateway endpoints) or security groups (for Interface endpoints).
2
Determine the direction of traffic between the application instances and the endpoint.
The application on the EC2 instances must initiate outbound HTTPS (port 443) requests to the KMS Interface VPC Endpoint ENI.
Defines the required rules for the security groups attached to both resources.
3
Configure security group rules following the principle of least privilege.
The EC2 instances' security group is configured with an outbound rule allowing port 443 to the endpoint's security group. The endpoint's security group is configured with an inbound rule allowing port 443 from the instances' security group.
Ensures that only authorized traffic from the application instances can access the private KMS endpoint, while blocking unauthorized access.

Key Concept

Interface VPC Endpoints (AWS PrivateLink) require security groups on the endpoint's network interfaces to control inbound traffic. Security groups are stateful, so configuring outbound rules on the client and inbound rules on the server/endpoint is sufficient.
Estimated Time:1m 30s
Question 37Question →

An organization is deploying a microservices-based application where a backend service runs on Amazon EC2 instances in a private subnet. An integration proxy instance in the public subnet of the same VPC needs to forward incoming customer requests to these backend instances. The company's security policy requires that the backend instances must not be allowed to initiate any outbound connections to the internet or other subnets, but they must be able to receive requests from the integration proxy and return the responses. Which configuration should a solutions architect implement to meet these security requirements?

Show answer & explanation

Answer: Associate a security group with the backend EC2 instances that allows inbound traffic from the integration proxy's security group, and remove all outbound rules from this security group.

Answer

Associate a security group with the backend EC2 instances that allows inbound traffic from the integration proxy's security group, and remove all outbound rules from this security group.
The correct option correctly leverages the stateful nature of security groups. In a VPC, security groups are stateful, meaning any inbound traffic allowed by an inbound rule is automatically permitted to flow out as return traffic, bypassing outbound rules. By removing all outbound rules from the backend security group, the instances are blocked from initiating any outbound connections (e.g., to the internet or other resources), satisfying the security policy while still allowing the instances to respond to incoming requests from the integration proxy.

Step-by-Step Solution

1
Analyze the statefulness of security groups.
VPC security groups are stateful. This means that if an inbound request is permitted, the corresponding response is automatically allowed to flow out, regardless of any outbound security group rules.
To understand how return traffic will behave when outbound rules are modified.
2
Evaluate the requirement to prevent initiated outbound connections.
Removing all outbound rules from the security group ensures the EC2 instances cannot initiate any outbound sessions (e.g., to the internet or other internal resources).
To satisfy the least privilege security policy of preventing outbound-initiated connections.
3
Differentiate between security groups and Network ACLs (NACLs).
NACLs are stateless and apply at the subnet boundary. Restricting outbound traffic in a NACL (either completely or on ephemeral ports 10241024 to 6553565535) would block the response traffic of the allowed inbound connections, making it unsuitable for this scenario.
To rule out the incorrect NACL-based options.

Key Concept

Stateful vs Stateless VPC Security Controls
Question 38Question →

A company has two VPCs in the same AWS Region: VPC A with CIDR block 10.0.0.0/1610.0.0.0/16 hosting client applications in a private subnet, and VPC B with CIDR block 192.168.0.0/16192.168.0.0/16 hosting a centralized directory service in another private subnet. A VPC Peering connection is active between VPC A and VPC B. The client applications in VPC A must query the directory service in VPC B on TCP port 389389. The security team requires a multi-layered security approach: network ACLs must secure the subnets (stateless), and security groups must secure the instances (stateful) to permit only this specific traffic. Which combination of actions will meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the network ACL for the client subnets in VPC A to allow outbound TCP port 389389 to the VPC B CIDR block, and allow inbound TCP traffic on ephemeral ports (1024−655351024-65535) from the VPC B CIDR block.; Configure the security group for the directory service instances in VPC B to allow inbound TCP port 389389 from the security group of the client applications in VPC A.

Answer

Configure the network ACL for the client subnets in VPC A to allow outbound TCP port 389389 to the VPC B CIDR block, and allow inbound TCP traffic on ephemeral ports (1024−655351024-65535) from the VPC B CIDR block; and configure the security group for the directory service instances in VPC B to allow inbound TCP port 389389 from the security group of the client applications in VPC A.
The correct combination of actions consists of configuring the stateless network ACL in VPC A to permit outbound directory traffic on port 389389 and inbound return traffic on ephemeral ports (1024−655351024-65535), while setting the stateful security group on the destination instances in VPC B to accept inbound port 389389 connections from the clients.

Step-by-Step Solution

1
Analyze the stateful nature of security groups at the instance level.
The directory service instances in VPC B require an inbound security group rule to permit TCP port 389389 from the client security group in VPC A. Since security groups are stateful, return traffic is allowed automatically.
Security groups operate at the instance level and automatically track connection state, allowing response traffic without explicit outbound rules.
2
Analyze the stateless nature of network ACLs at the subnet level.
The subnets in VPC A require a network ACL outbound rule to allow TCP port 389389 to VPC B, and an inbound rule to allow return traffic on ephemeral ports (1024−655351024-65535) from VPC B.
Network ACLs operate at the subnet level and are stateless, meaning return traffic must be explicitly permitted in the opposite direction.

Key Concept

VPC network security involves configuring stateful security groups at the instance level and stateless network ACLs at the subnet level, ensuring both inbound and return path traffic are appropriately allowed or denied.
Question 39Question →

A company has configured an AWS Organizations environment with a production account and a security auditing account. A solutions architect is setting up secure, cross-account access for a containerized application running on Amazon Elastic Container Service (Amazon ECS) in the production account. The application must read compliance report files stored in a private Amazon S3 bucket within the security auditing account. The architect needs to implement a solution that adheres to the principle of least privilege and avoids the use of long-term credentials. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach an IAM policy to the ECS task role in the production account that allows the s3:GetObject action on the S3 bucket in the security auditing account.; Modify the bucket policy of the S3 bucket in the security auditing account to allow the s3:GetObject action for the Amazon Resource Name (ARN) of the ECS task role in the production account.

Answer

To securely implement cross-account access, the solutions architect should attach an IAM policy to the ECS task role in the production account allowing s3:GetObject, and modify the destination S3 bucket's resource policy in the auditing account to allow the s3:GetObject action for the production account's ECS task role ARN.
For cross-account access to Amazon S3, both the IAM identity policy (attached to the ECS task role in the source account) and the S3 bucket policy (resource policy in the destination account) must explicitly allow the operation. This avoids the use of long-term credentials by leveraging temporary credentials generated when the ECS task assumes its execution role.

Step-by-Step Solution

1
Configure the identity-based policy in the source account.
Attach an IAM policy to the ECS task role in the production account that allows the s3:GetObject action on the target S3 bucket.
The IAM principal in the production account must have outbound permission to access the destination resource.
2
Configure the resource-based policy in the destination account.
Add a bucket policy to the S3 bucket in the security auditing account that allows the s3:GetObject action, specifying the ECS task role ARN from the production account as the Principal.
Since S3 cross-account access is being set up, the resource-based policy in the destination account must explicitly permit the access from the external account's principal.

Key Concept

Cross-account access to S3 resources requires explicit permissions on both the identity-based policy in the source account and the resource-based bucket policy in the destination account, utilizing temporary security credentials.
Question 40Question →

A company has two AWS accounts: Account A for application workloads and Account B for centralized data storage. An application running on Amazon ECS tasks in Account A needs to write logs and data to an Amazon S3 bucket in Account B. The S3 bucket is encrypted using an AWS Key Management Service (AWS KMS) customer managed key also located in Account B. The company's security policy requires that all access must follow the principle of least privilege, and no long-term credentials can be stored. Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach an IAM policy to the ECS task role in Account A that allows the s3:PutObject action on the S3 bucket in Account B and the kms:GenerateDataKey action on the KMS key in Account B.; In Account B, configure the S3 bucket policy to allow the ECS task role from Account A to perform the s3:PutObject action, and update the KMS key policy to allow the same role to perform the kms:GenerateDataKey action.

Answer

Attach an IAM policy to the ECS task role in Account A that allows the required S3 and KMS actions, and in Account B, update the S3 bucket policy and KMS key policy to explicitly trust the ECS task role ARN from Account A.
To establish secure cross-account access without long-term credentials, the ECS task role in Account A must be granted permissions via an IAM policy to write to the S3 bucket and generate data keys. Simultaneously, the resource policies (the S3 bucket policy and the KMS customer managed key policy) in Account B must be configured to trust the specific ECS task role ARN and permit the same actions. This bi-directional permission setup allows direct cross-account access using temporary security credentials.

Step-by-Step Solution

1
Identify the proper IAM role for ECS containerized application runtime permissions.
Select the ECS task role as the identity to attach access permissions to.
The ECS task role is utilized by the application running inside the container, whereas the task execution role is used only by the ECS container agent for infrastructure tasks.
2
Configure the client-side IAM policy in Account A.
Attach a policy to the ECS task role in Account A permitting `s3:PutObject` on the S3 bucket in Account B and `kms:GenerateDataKey` on the Customer Managed Key (CMK) in Account B.
The initiating IAM identity must have explicit permission to access the target cross-account resources.
3
Configure the resource-based policies in Account B.
Modify the S3 bucket policy and the KMS key policy in Account B to allow the ECS task role ARN from Account A to write data and generate data keys.
Cross-account access requires authorization from both the identity policy in the source account and the resource policies in the destination account. AWS Managed Keys cannot be modified for cross-account access, necessitating a Customer Managed Key.

Key Concept

Cross-account access to S3 and KMS requires configuration of both the IAM identity policies in the source account and resource policies (bucket and key policies) in the destination account, using temporary role credentials instead of long-term credentials.
PreviousPage 2 / 22Next
Design Secure Architectures Practice Questions — AWS Certified Solutions Architect - Associate — Page 2 | Examkin