Design Secure Architectures

438 questions

All types438 Multiple choice214 Multiple select224

An organization is deploying an auditing application on Amazon ECS tasks running on AWS Fargate. The Fargate tasks are located in private subnets with a CIDR block of $172.16.10.0/24$ within a VPC. The tasks must access an Amazon Aurora PostgreSQL database in a dedicated database subnet with a CIDR block of $172.16.20.0/24$ , download compliance data securely from Amazon S3, and occasionally connect to an external auditing API hosted on the public internet.

To align with security policies:
1. Data transfers to Amazon S3 must remain within the AWS network and must not incur data processing charges.
2. Direct outbound internet access is prohibited; instead, internet traffic must go through NAT Gateways located in public subnets.
3. Network Access Control Lists (Network ACLs) on the Fargate private subnets must implement a least-privilege configuration.

Which combination of configurations will meet these requirements? (Select TWO.)

Select all that apply

Create an Amazon S3 Gateway VPC Endpoint and associate it with the Fargate private subnet route tables. Add a route for

0.0.0.0/0

pointing to the NAT Gateways in the public subnets.

In the Fargate subnet Network ACL, configure an outbound rule allowing traffic to

0.0.0.0/0

on TCP port

443

, and an inbound rule allowing traffic from

0.0.0.0/0

on TCP ports

1024-65535

Create an Amazon S3 Interface VPC Endpoint in the Fargate subnets, and configure the Fargate subnet route table to target the endpoint's elastic network interfaces for all S3 traffic.

In the Fargate subnet Network ACL, configure an outbound rule allowing TCP port

443

with a destination of the Amazon S3 prefix list.

In the Fargate Security Group, configure an inbound rule allowing TCP port

443

from the NAT Gateway public IP addresses to permit return traffic from the external compliance API.

Show answer & explanation

Answer: Create an Amazon S3 Gateway VPC Endpoint and associate it with the Fargate private subnet route tables. Add a route for $0.0.0.0/0$ pointing to the NAT Gateways in the public subnets.; In the Fargate subnet Network ACL, configure an outbound rule allowing traffic to $0.0.0.0/0$ on TCP port $443$ , and an inbound rule allowing traffic from $0.0.0.0/0$ on TCP ports $1024-65535$ .

Answer

To meet the requirements, the solutions architect should create an Amazon S3 Gateway VPC Endpoint and associate it with the Fargate private subnet route tables, routing other internet traffic to the NAT Gateways. Additionally, the Fargate subnet Network ACL must be configured to allow outbound traffic to all destinations on TCP port

443

and inbound return traffic from all destinations on TCP ports

1024-65535

Creating a Gateway VPC Endpoint for S3 and associating it with the Fargate private subnet route tables ensures that S3 data transfer is routed within the AWS network without incurring data processing fees. The route table also successfully routes all other external internet traffic to the NAT Gateways via the default route. Because Network ACLs are stateless, they require both an outbound rule (allowing HTTPS traffic on port

443

to establish the connection) and an inbound rule (allowing response traffic on ephemeral ports

1024-65535

from the destination) to work correctly.

Step-by-Step Solution

Select the correct endpoint type for Amazon S3.

Identify that Gateway VPC Endpoints are free of data processing charges, whereas Interface VPC Endpoints (PrivateLink) incur both hourly and data processing charges.

This fulfills the cost requirement that S3 transfers must not incur data processing charges.

Configure the route table for the Fargate subnets.

Associate the Gateway VPC Endpoint with the private subnet route tables (which adds the S3 prefix list route) and configure a default route (

0.0.0.0/0

) pointing to the NAT Gateways in the public subnets.

This establishes path-routing for S3 traffic directly to the endpoint and external internet traffic to the NAT Gateways.

Design stateless Network ACL rules for Fargate tasks.

Allow outbound HTTPS traffic (port

443

) to

0.0.0.0/0

to cover both S3 and the external compliance API, and allow inbound traffic from

0.0.0.0/0

on ephemeral ports (

1024-65535

) to allow return packets.

Because Network ACLs are stateless, return traffic must be explicitly allowed. Since S3 and the external API use public IP addresses,

0.0.0.0/0

must be used (especially because Network ACLs do not support prefix lists).

Key Concept

VPC Network Security using NAT Gateways, Gateway VPC Endpoints, stateful Security Groups, and stateless Network ACLs.

Question 382Question →

An enterprise has migrated its identity management to an external SAML-based identity provider (IdP). The security team wants to implement a dynamic access control mechanism for developers who access AWS resources through federated roles. Developers should only be allowed to manage (start, stop, and terminate) Amazon EC2 instances that are tagged with a `Project` tag value matching their department's project assignment in the IdP. The solution must scale automatically without requiring IAM policy updates when new projects are created.

Which TWO actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Configure AWS IAM Identity Center to map the project attribute from the identity provider as a principal tag in the AWS federated session.

Attach an IAM policy to the developers' permission set that allows EC2 actions only when the `aws:ResourceTag/Project` condition key matches the `aws:PrincipalTag/Project` key.

Create individual IAM users for each developer, organize them into IAM groups named after each project, and attach inline policies to each group restricting access to specific EC2 instance IDs.

Store project tag mappings and developer usernames as plaintext in Systems Manager Parameter Store, and configure a cron job to update IAM group memberships accordingly.

Use the AWS account root user credentials to run a scheduled Lambda function that periodically checks if EC2 instances have the correct project tags and deletes non-compliant resources.

Show answer & explanation

Answer: Configure AWS IAM Identity Center to map the project attribute from the identity provider as a principal tag in the AWS federated session.; Attach an IAM policy to the developers' permission set that allows EC2 actions only when the `aws:ResourceTag/Project` condition key matches the `aws:PrincipalTag/Project` key.

Answer

Configure AWS IAM Identity Center to map the project attribute from the identity provider as a principal tag, and attach an IAM policy that allows EC2 actions only when the `aws:ResourceTag/Project` key matches the `aws:PrincipalTag/Project` key.

Mapping the project attribute to a principal tag via IAM Identity Center enables Attribute-Based Access Control (ABAC). When combined with an IAM policy that requires the instance's `Project` tag to match the user's principal tag, access is granted dynamically. This eliminates the need to update policies for new projects.

Step-by-Step Solution

Enable attribute mapping in AWS IAM Identity Center.

User attributes from the SAML IdP are mapped to AWS session tags (principal tags), making them available in the AWS authorization context.

This establishes the identity attribute (project assignment) on the federated user session dynamically.

Create an Attribute-Based Access Control (ABAC) IAM policy.

An IAM policy is created using the condition key `aws:ResourceTag/Project` compared with `${aws:PrincipalTag/Project}`.

This enforces that a user can only perform actions on resources that share the same project value as their identity.

Attach the ABAC policy to the permission set assigned to the developers.

Developers receive dynamic permissions based on their IdP attributes when federating into the AWS console or CLI.

This ensures the security policy is applied to all developer federated sessions without manually updating policies for new projects.

Key Concept

Attribute-Based Access Control (ABAC) and Identity Federation with IAM Identity Center

Estimated Time:2m 0s

Question 383Question →

An application running on Amazon EC2 instances in Account A ( $111122223333$ ) must write daily transaction records to an Amazon S3 bucket located in Account B ( $444455556666$ ). The security policy mandates that all data in the S3 bucket must be encrypted at rest using a Customer Managed Key (CMK) stored in Account B's AWS Key Management Service (AWS KMS). The company requires that cross-account access is configured using the principle of least privilege. Which combination of actions must the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Configure the key policy of the Customer Managed Key in Account B to grant the EC2 IAM role in Account A permissions for the kms:GenerateDataKey and kms:Decrypt actions.

Attach an IAM policy to the EC2 role in Account A that allows the s3:PutObject action on the S3 bucket in Account B and the kms:GenerateDataKey action on the KMS key in Account B.

Enable automatic key rotation on the KMS key in Account B, which will automatically re-encrypt all previously uploaded historical transaction records in the S3 bucket with the new key version.

Store the database credentials and the KMS key ARN as a plaintext String parameter in AWS Systems Manager Parameter Store in Account A to allow the application to retrieve them programmatically.

Configure the S3 bucket policy in Account B to allow the root account of Account A full access, and use the default AWS managed key aws/s3 in Account B for the cross-account encryption.

Show answer & explanation

Answer: Configure the key policy of the Customer Managed Key in Account B to grant the EC2 IAM role in Account A permissions for the kms:GenerateDataKey and kms:Decrypt actions.; Attach an IAM policy to the EC2 role in Account A that allows the s3:PutObject action on the S3 bucket in Account B and the kms:GenerateDataKey action on the KMS key in Account B.

Answer

To configure secure cross-account S3 uploads with KMS encryption, the solutions architect must configure the Customer Managed Key's policy in Account B to grant access to the EC2 IAM role in Account A, and attach an IAM policy to the EC2 IAM role in Account A that permits writing to the bucket and generating data keys using the cross-account KMS key.

The correct combination of actions consists of configuring the key policy in Account B to grant key usage permissions to the external IAM role in Account A, and attaching an IAM policy to the EC2 IAM role in Account A to authorize access to both the target S3 bucket and the KMS key. Because AWS managed keys cannot be edited, a Customer Managed Key (CMK) must be used. Additionally, for cross-account resource access, both the resource-based policy (the KMS key policy in Account B) and the identity-based policy (the IAM policy in Account A) must explicitly permit the operations.

Step-by-Step Solution

Analyze the requirements for cross-account KMS and S3 permissions.

Identify that for Account A's IAM role to write to Account B's KMS-encrypted S3 bucket, permissions must be granted on both the KMS key policy (in Account B) and the IAM policy (in Account A).

In AWS, cross-account access requires explicit permission from both the resource owner (via resource-based policies) and the trust delegation from the principal's account (via identity-based policies).

Determine the specific KMS permissions required for writing encrypted data to S3.

The IAM role needs kms:GenerateDataKey to generate the encryption key for new objects and kms:Decrypt for multipart uploads or reading.

Amazon S3 uses envelope encryption via KMS where the uploader needs permissions to generate the data key from the master key.

Configure the identity-based policy in Account A.

Attach an IAM policy to the EC2 role allowing s3:PutObject on the S3 bucket in Account B and kms:GenerateDataKey on the KMS key in Account B.

The EC2 role needs local IAM permission to target the external resources in Account B.

Key Concept

Cross-account access to KMS-encrypted S3 buckets requires resource policies on the destination side (S3 bucket policy and KMS key policy) to trust the source principal, and an identity-based IAM policy on the source side to authorize the actions.

Question 384Question →

A global food delivery marketplace hosts its customer-facing application on AWS. The architecture uses an Amazon CloudFront distribution to serve static and dynamic content, which is backed by an Application Load Balancer (ALB) and Amazon EC2 instances in an Auto Scaling group. The company needs to protect the application from Layer 3 and Layer 4 Distributed Denial of Service (DDoS) attacks and mitigate application-layer (Layer 7) HTTP flood attacks that target the API endpoints. Which combination of actions will meet these requirements? (Select TWO.)

Select all that apply

Associate an AWS WAF web ACL with the Amazon CloudFront distribution and configure a rate-based rule to limit requests from individual client IP addresses.

Enable AWS Shield Advanced on the Amazon CloudFront distribution to protect against Layer 3 and Layer 4 infrastructure-level attacks.

Configure custom rate-limiting rules within AWS Shield Standard to inspect incoming request headers and block HTTP flood attacks.

Deploy a stateless Network Access Control List (Network ACL) on the subnets containing the Application Load Balancer to dynamically inspect and block malicious Layer 7 HTTP request headers.

Attach a stateful security group to the Amazon CloudFront distribution that blocks all traffic except from known malicious IP addresses.

Show answer & explanation

Answer: Associate an AWS WAF web ACL with the Amazon CloudFront distribution and configure a rate-based rule to limit requests from individual client IP addresses.; Enable AWS Shield Advanced on the Amazon CloudFront distribution to protect against Layer 3 and Layer 4 infrastructure-level attacks.

Answer

Associate an AWS WAF web ACL with the Amazon CloudFront distribution and configure a rate-based rule to limit requests from individual client IP addresses, and enable AWS Shield Advanced on the Amazon CloudFront distribution to protect against Layer 3 and Layer 4 infrastructure-level attacks.

The solution requires protecting the application at both the infrastructure (Layer 3/4) and application (Layer 7) levels. Associating an AWS WAF web ACL with the Amazon CloudFront distribution and configuring a rate-based rule successfully mitigates HTTP floods by counting requests from specific client IP addresses and blocking them if they exceed limits. Enabling AWS Shield Advanced on the CloudFront distribution provides specialized protection against infrastructure-level (Layer 3 and 4) DDoS attacks at the AWS edge.

Step-by-Step Solution

Analyze the threat types and required defense layers.

Identified Layer 3/4 infrastructure DDoS threats and Layer 7 application-level HTTP flood threats targeting dynamic APIs.

This determines which security services are appropriate for each threat vector.

Select the edge services designed for application-layer (Layer 7) filtering and rate limiting.

Selected AWS WAF associated with CloudFront to enforce rate-limiting rules.

AWS WAF is designed to inspect Layer 7 traffic and enforce rate limits, whereas lower-layer tools cannot parse HTTP headers or track request rates.

Select the service for Layer 3/4 infrastructure-level DDoS mitigation.

Selected AWS Shield Advanced on the CloudFront distribution.

AWS Shield Advanced offers robust Layer 3/4 protection at the AWS edge network (CloudFront) and provides advanced mitigation capabilities.

Key Concept

AWS edge security architecture relies on combining AWS WAF for application-layer filtering/rate-limiting and AWS Shield Advanced for comprehensive infrastructure DDoS protection.

Estimated Time:2m 0s

Question 385Question →

A startup is deploying a new application that integrates with a third-party payment provider. The application needs to retrieve a payment gateway API key. The startup's security policy requires the API key to be encrypted at rest, and all decryption events must be audited. Which solution meets these requirements securely?

Store the API key as a SecureString parameter in AWS Systems Manager Parameter Store, using a Customer Managed Key in AWS Key Management Service (AWS KMS).

Store the API key as a plain text String parameter in AWS Systems Manager Parameter Store, and restrict access using IAM policies.

Store the API key on the application's root EBS volume, using the AWS account root user credentials to encrypt the volume.

Store the API key in an Amazon S3 bucket using default encryption with a KMS Customer Managed Key, and rely on automatic key rotation to immediately re-encrypt the stored files.

Show answer & explanation

Answer: Store the API key as a SecureString parameter in AWS Systems Manager Parameter Store, using a Customer Managed Key in AWS Key Management Service (AWS KMS).

Answer

Store the API key as a SecureString parameter in AWS Systems Manager Parameter Store, using a Customer Managed Key in AWS Key Management Service (AWS KMS).

Storing the API key as a SecureString parameter in AWS Systems Manager Parameter Store ensures that the data is encrypted at rest using AWS KMS. In addition, AWS KMS logs all decryption requests to AWS CloudTrail, satisfying the auditing requirement.

Step-by-Step Solution

Determine the storage service that supports encryption of sensitive variables.

AWS Systems Manager Parameter Store with the SecureString parameter type is selected because it integrates with AWS KMS for encryption.

This meets the requirement of encrypting the sensitive API key at rest.

Configure encryption with a Customer Managed Key (CMK) in AWS KMS.

The API key is encrypted using the CMK, and access permissions are managed via key policies and IAM.

Using a CMK allows fine-grained access control and key rotation management.

Verify that auditing requirements are met.

AWS KMS logs all key usage, including Decrypt API calls, to AWS CloudTrail.

This provides a complete audit trail of when and by whom the API key was decrypted.

Key Concept

Storing sensitive information securely using Systems Manager Parameter Store SecureString parameters and KMS encryption with auditing.

Question 386Question →

A company stores financial records in an Amazon S3 bucket. The records are encrypted using an AWS KMS Customer Managed Key (CMK). Compliance guidelines require the company to rotate the encryption key annually. Furthermore, to adhere to a security policy regarding legacy key retirement, any data encrypted with a retired key version must be re-encrypted using the new key version within 30 days of rotation, allowing the old key version to be safely disabled. Which strategy should the solutions architect recommend to satisfy these requirements?

Enable automatic key rotation for the existing Customer Managed Key. Once rotated, initiate a re-encryption job by specifying the newly generated backing key version ID in the KMS API calls for all historical S3 objects.

Store the database encryption key in AWS Systems Manager Parameter Store as a plaintext String parameter. Configure a scheduled AWS Lambda function to rotate this key parameter annually and use the plaintext parameter to re-encrypt the S3 objects.

Create a new Customer Managed Key (CMK) annually, update the S3 bucket default encryption settings to use the new CMK, and use Amazon S3 Batch Operations to copy the existing objects in place to re-encrypt them with the new key. Disable the old CMK after 30 days.

Enable automatic key rotation for the existing Customer Managed Key. AWS KMS will automatically re-encrypt all historical S3 objects with the new backing key version, allowing the old backing key version to be safely deleted after 30 days.

Show answer & explanation

Answer: Create a new Customer Managed Key (CMK) annually, update the S3 bucket default encryption settings to use the new CMK, and use Amazon S3 Batch Operations to copy the existing objects in place to re-encrypt them with the new key. Disable the old CMK after 30 days.

Answer

The correct strategy requires manual key rotation (creating a new Customer Managed Key) because automatic KMS key rotation keeps old backing keys active to decrypt existing ciphertexts, making it impossible to disable or retire the old version. By creating a new CMK and updating S3 default encryption, new objects are secured with the new key. Running Amazon S3 Batch Operations with a copy job in-place re-encrypts historical objects under the new key, which permits safely disabling the legacy key after the 30-day period.

Step-by-Step Solution

Differentiate key rotation behaviors

Automatic rotation keeps older backing keys active for decryption, which prevents deletion or disabling of old versions. Manual rotation is needed.

The scenario requires retiring and disabling the old key version within 30 days, which cannot be achieved if the old version must remain active transparently for decryption under the same key ARN.

Plan rotation and configure new key defaults

Create a new Customer Managed Key (CMK) annually and update the Amazon S3 bucket default encryption settings.

This ensures that all new write operations to the S3 bucket automatically use the new CMK.

Address historical objects

Run an Amazon S3 Batch Operations copy job on the existing objects in the bucket.

S3 Batch Operations copy jobs can copy objects in-place, triggering S3 to encrypt them with the new default KMS key, thereby performing the necessary re-encryption.

Retire the legacy key

Disable the old Customer Managed Key after 30 days.

Once all historical objects are re-encrypted with the new key, the old key is no longer needed for decryption and can be safely disabled to satisfy the compliance requirement.

Key Concept

Manual KMS key rotation vs. automatic rotation and bulk object re-encryption via S3 Batch Operations

Estimated Time:2m 0s

Question 387Question →

A company is developing a serverless application that processes highly sensitive client records stored in an Amazon S3 bucket. The records must be encrypted at rest using an AWS KMS customer managed key. The company's compliance policy requires that the encryption key be rotated every 90 days. Additionally, legacy records encrypted with older versions of the key must remain accessible for read operations without manual administrative intervention. The security team also requires that access to the KMS key be restricted using the principle of least privilege, ensuring that even the AWS account root user cannot access the key unless explicitly permitted.

Which two actions should a solutions architect take to meet these requirements?

Select all that apply

Enable automatic key rotation on the customer managed key and configure the rotation period to 90 days.

Create a new customer managed key every 90 days, update the S3 bucket configuration to use the new key, and run an S3 Batch Operations job to re-encrypt all historical records.

Modify the KMS key policy to remove the default policy statement that grants the AWS account root user access to the key, and explicitly list the authorized IAM roles.

Enable automatic key rotation on the customer managed key, and configure a Lambda function to decrypt and re-encrypt all existing S3 objects under the new key version immediately after rotation.

Store the KMS key credentials as a plaintext String parameter in AWS Systems Manager Parameter Store to allow administrative access while bypassing the key policy.

Show answer & explanation

Answer: Enable automatic key rotation on the customer managed key and configure the rotation period to 90 days.; Modify the KMS key policy to remove the default policy statement that grants the AWS account root user access to the key, and explicitly list the authorized IAM roles.

Answer

Enable automatic key rotation on the customer managed key with a 90-day rotation period, and modify the KMS key policy to remove the default statement that delegates access to the account root user while explicitly defining authorized IAM roles.

Enabling automatic key rotation with a 90-day period meets the compliance timeline while keeping older key material available for automatic decryption. Removing the default root statement from the KMS key policy ensures that access is governed strictly by the key policy itself and cannot be bypassed via IAM policies.

Step-by-Step Solution

Configure the rotation parameters of the AWS KMS customer managed key.

Enable automatic key rotation and customize the rotation period to 90 days.

This satisfies the 90-day rotation compliance rule. AWS KMS keeps all historical key versions, so S3 can automatically decrypt older objects without administrative effort.

Analyze the default KMS key policy structure.

Identify the default statement that grants root account permissions (arn:aws:iam::account-id:root).

By default, KMS keys delegate access control to the account's IAM policies through this root statement.

Modify the key policy to implement least privilege.

Remove the default root user permission statement and define explicit IAM roles that are allowed to perform decryption and encryption operations.

Removing the default statement ensures that IAM policies alone cannot grant access to the KMS key, thereby preventing the root user or unauthorized administrators from using the key unless explicitly permitted by the key policy.

Key Concept

AWS KMS Key Policies and Automatic Rotation Mechanics

Question 388Question →

An enterprise project management SaaS platform hosts its application on AWS. The frontend is served via an Amazon S3 bucket behind an Amazon CloudFront distribution, and the backend APIs run on Amazon EC2 instances behind an Application Load Balancer (ALB). The platform recently suffered from a HTTP flood attack targeting the backend APIs, which degraded performance for users, as well as a series of SQL injection attempts.

The solutions architect must design a secure architecture that provides comprehensive DDoS protection and mitigates application-layer exploits. The solution must minimize origin exposure and block unauthorized HTTP traffic before it reaches the backend.

Which combination of actions should the solutions architect take? (Select TWO.)

Select all that apply

Associate an AWS WAF web ACL with the Amazon CloudFront distribution, and configure a rate-based rule along with AWS Managed Rules for SQL injection.

Configure the Application Load Balancer's security group to only accept inbound traffic from the Amazon CloudFront distribution using the CloudFront managed prefix list.

Enable AWS Shield Advanced on the Application Load Balancer to inspect and block application-layer SQL injection attempts before they reach the backend EC2 instances.

Apply a stateful Network ACL to the subnets of the Application Load Balancer to restrict inbound traffic to the IP address ranges of the Amazon CloudFront distribution.

Configure a rate-limiting rule within AWS Shield Standard to automatically drop traffic from IP addresses that exceed request thresholds.

Show answer & explanation

Answer: Associate an AWS WAF web ACL with the Amazon CloudFront distribution, and configure a rate-based rule along with AWS Managed Rules for SQL injection.; Configure the Application Load Balancer's security group to only accept inbound traffic from the Amazon CloudFront distribution using the CloudFront managed prefix list.

Answer

Associate an AWS WAF web ACL with the Amazon CloudFront distribution, and configure the Application Load Balancer's security group to only accept inbound traffic from the CloudFront managed prefix list.

Associating an AWS WAF web ACL with the Amazon CloudFront distribution provides application-layer protection directly at the edge, allowing the system to inspect and filter out HTTP floods and SQL injection attempts before they reach the backend. Combining this with an Application Load Balancer security group configured to only accept traffic from the CloudFront managed prefix list prevents users from bypassing CloudFront to access the origin directly.

Step-by-Step Solution

Analyze the security requirements for the application.

The application requires protection against Layer 7 exploits (SQL injection), HTTP flood attacks (Layer 7 DDoS), and origin protection (minimizing direct exposure of the Application Load Balancer).

This establishes the scope of security controls needed at the edge and resource level.

Select the appropriate service for Layer 7 mitigation.

AWS WAF associated with Amazon CloudFront provides rate limiting to block HTTP floods and managed rule sets to block SQL injection at the edge.

AWS WAF is designed for application-layer (Layer 7) filtering and protection, whereas AWS Shield Standard/Advanced primarily protects Layers 3 and 4.

Restrict access to the Application Load Balancer.

Configure the security group of the ALB to permit traffic only from the Amazon CloudFront distribution by referencing the CloudFront managed prefix list.

This prevents attackers from bypassing the CloudFront distribution and AWS WAF to hit the origin directly, while leveraging stateful security groups.

Key Concept

Mitigating web application-layer attacks (Layer 7) using AWS WAF on CloudFront and securing origin resources using security groups with managed prefix lists.

Question 389Question →

A company is designing the security architecture for a new financial application. The application stores sensitive transaction records in an Amazon S3 bucket and connects to an Amazon RDS database. The company's compliance policy mandates the following security controls:
1. The database credentials must be rotated automatically every 30 days.
2. The S3 bucket objects must be encrypted at rest using a KMS Customer Managed Key (CMK) that is rotated annually.
3. Historical S3 objects must remain decryptable without manual intervention or data re-encryption.

Which combination of configurations will meet these security requirements with the least operational overhead?

Store the database credentials in AWS Secrets Manager and configure automatic rotation. For the S3 bucket, configure default encryption using a Customer Managed Key (CMK) and enable automatic key rotation.

Store the database credentials as a standard String parameter in AWS Systems Manager Parameter Store. For the S3 bucket, configure default encryption using a Customer Managed Key (CMK) and enable automatic key rotation.

Store the database credentials in AWS Secrets Manager and configure automatic rotation. For the S3 bucket, configure default encryption using a Customer Managed Key (CMK), manually rotate the key annually by creating a new CMK, and delete the previous CMK.

Store the database credentials in AWS Secrets Manager. Use the AWS account root user credentials to configure a custom script that rotates the database credentials. For the S3 bucket, configure default encryption using the AWS managed key (aws/s3) and enable automatic key rotation.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation. For the S3 bucket, configure default encryption using a Customer Managed Key (CMK) and enable automatic key rotation.

Answer

The correct solution stores the database credentials in AWS Secrets Manager, which natively manages automatic rotation. For S3, utilizing an AWS KMS Customer Managed Key (CMK) with automatic rotation enabled satisfies the annual rotation requirement. When automatic key rotation is enabled, AWS KMS rotates the backing key material annually while keeping the same key ARN. Crucially, AWS KMS retains older backing key material to decrypt historical objects, ensuring that older files remain decryptable without manual intervention or data re-encryption.

Step-by-Step Solution

Evaluate database credentials security and rotation requirements.

AWS Secrets Manager is chosen to store the database credentials, enabling native automatic rotation (e.g., every 30 days) using an integrated AWS Lambda function.

This meets the automatic credential rotation requirement securely and with low operational overhead compared to custom scripts or plaintext parameters.

Select the encryption method and key management approach for the Amazon S3 bucket.

Configure default S3 bucket encryption using an AWS KMS Customer Managed Key (CMK) and enable automatic key rotation.

Automatic key rotation satisfies the annual rotation mandate. It maintains the same key ARN and key policies, while AWS KMS automatically retains old key material to decrypt historical S3 objects without manual intervention.

Avoid security practices that violate least privilege or compromise key recoverability.

Ensure that the root user is not used for configuration scripts, and that manual key deletion is avoided to prevent permanent loss of decryption capabilities for historical data.

This guarantees compliance with AWS security best practices and the requirement to keep historical backups readable.

Key Concept

AWS KMS Customer Managed Key automatic rotation mechanics and AWS Secrets Manager integration for database credentials rotation.

Question 390Question →

A SaaS company hosts an online learning platform on AWS. The application uses Amazon EC2 instances behind an Application Load Balancer (ALB). During peak registration periods, the platform experiences HTTP flood attacks targeting the user login URI, which causes application downtime. The company wants to implement a scalable, cost-effective solution to mitigate these Layer 7 attacks without impacting legitimate users. Which two actions should the solutions architect take to meet these requirements? (Select TWO).

Select all that apply

Configure an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL with the CloudFront distribution.

Create an AWS WAF rate-based rule targeting the login URI to block requests from clients exceeding a request threshold.

Associate an AWS Shield Standard subscription with the Application Load Balancer to automatically mitigate application-layer (Layer 7) HTTP flood attacks.

Configure a stateless Network Access Control List (NACL) at the subnet level to dynamically filter and inspect the payloads of incoming HTTP requests.

Add rules to the Application Load Balancer's security group to track client connection rates and drop traffic from offending IP addresses.

Show answer & explanation

Answer: Configure an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL with the CloudFront distribution.; Create an AWS WAF rate-based rule targeting the login URI to block requests from clients exceeding a request threshold.

Answer

To protect the application from Layer 7 HTTP flood attacks targeting a specific login URI, the solutions architect should deploy Amazon CloudFront in front of the Application Load Balancer and associate an AWS WAF web ACL. Within the web ACL, a rate-based rule should be configured targeting the specific login URI path to limit the rate of requests from any single IP address.

Deploying Amazon CloudFront in front of the Application Load Balancer allows traffic to be distributed across AWS edge locations. By attaching AWS WAF to the CloudFront distribution, requests are inspected before they reach the ALB origin. Designing a rate-based rule within AWS WAF that targets the login path allows the system to block traffic from IP addresses that exceed a specified threshold of requests within a five-minute window, effectively mitigating the HTTP flood.

Step-by-Step Solution

Deploy edge protection by placing Amazon CloudFront in front of the Application Load Balancer.

This distributes incoming traffic across edge locations and absorbs bulk traffic at the AWS perimeter.

DDoS protection should be handled as close to the user as possible to avoid overloading origin resources.

Associate AWS WAF with the CloudFront distribution.

Enables Layer 7 application-layer inspection and security rule enforcement at AWS edge locations.

HTTP flood attacks operate at Layer 7, requiring AWS WAF to inspect specific HTTP headers, methods, and paths.

Create a rate-based rule in AWS WAF targeting the login URI.

Monitors the frequency of incoming requests to the login endpoint and blocks or challenges clients exceeding the threshold.

This mitigates the attack at the targeted endpoint while allowing legitimate traffic to other parts of the application.

Key Concept

Implementing Layer 7 DDoS mitigation at the edge using Amazon CloudFront and AWS WAF rate-based rules.

Estimated Time:2m 0s

Question 391Question →

A financial services company is migrating its Microsoft SQL Server databases and SharePoint servers to AWS. The company maintains an on-premises Microsoft Active Directory domain containing all employee user accounts. The company deploys AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) in a new AWS VPC. The solutions architect must configure a solution that allows employees to access the AWS-hosted SharePoint servers using their existing on-premises credentials.

Which combination of actions should the solutions architect take to meet these requirements? (Select two.)

Select all that apply

Establish network connectivity between the VPC and the on-premises network, and configure conditional DNS forwarders on both the on-premises DNS servers and the AWS Managed Microsoft AD domain controllers.

Configure a forest trust relationship between the on-premises Active Directory domain and the AWS Managed Microsoft AD domain.

Create individual IAM users in the AWS account for each on-premises employee to enable console and API access.

Use the AWS account root user credentials to manage the Active Directory domain controllers and delegate access rights.

Store the on-premises Active Directory domain administrator credentials as a plaintext parameter in Systems Manager Parameter Store to automate trust verification.

Show answer & explanation

Answer: Establish network connectivity between the VPC and the on-premises network, and configure conditional DNS forwarders on both the on-premises DNS servers and the AWS Managed Microsoft AD domain controllers.; Configure a forest trust relationship between the on-premises Active Directory domain and the AWS Managed Microsoft AD domain.

Answer

Establishing network connectivity and DNS forwarders between the networks, and configuring a forest trust relationship between the on-premises Active Directory domain and the AWS Managed Microsoft AD domain.

To integrate an on-premises Active Directory with AWS Managed Microsoft AD using a forest trust, you must first establish network connectivity (via Site-to-Site VPN or AWS Direct Connect) and configure conditional DNS forwarders on both sides so that the domains can resolve each other. After these prerequisites are satisfied, configuring a forest trust allows authentication requests to be securely routed from AWS Managed Microsoft AD to the on-premises domain controllers, enabling on-premises users to access the AWS-hosted resources with their current credentials.

Step-by-Step Solution

Configure network routing and DNS resolution.

Domain controllers in both the on-premises network and the AWS VPC can communicate over the network and resolve each other's fully qualified domain names.

A trust relationship requires DNS resolution of the partner domain name and active network pathways (such as VPN or Direct Connect) to route LDAP traffic.

Establish the forest trust relationship.

A secure trust relationship is configured on both sides to allow users in the on-premises domain to authenticate to services joined to the AWS Managed Microsoft AD domain.

This trust enables AWS Managed Microsoft AD to delegate user authentication back to the on-premises Active Directory without needing to replicate passwords.

Key Concept

Establishing a hybrid identity model using AWS Managed Microsoft AD forest trust relationships.

Estimated Time:2m 0s

Question 392Question →

A company runs a data processing application on Amazon EC2 instances in a private subnet (CIDR $10.0.2.0/24$ ) of a VPC. The application needs to download datasets from an Amazon S3 bucket in the same AWS Region using an S3 Gateway Endpoint. Additionally, the application must upload logs to an external partner's HTTPS service hosted at the static IP address $198.51.100.50$ . The EC2 instances initiate all connections using ephemeral ports ( $1024-65535$ ).

A solutions architect must configure the VPC security groups and Network Access Control Lists (NACLs) to enforce the principle of least privilege.

Which combination of actions will allow the required traffic while restricting all other access? (Select TWO.)

Select all that apply

Configure the security group attached to the EC2 instances with outbound rules that allow TCP traffic on port 443 to the Amazon S3 prefix list and to

198.51.100.50/32

Configure the security group attached to the EC2 instances with outbound rules allowing TCP traffic on port 443 to the Amazon S3 prefix list and

198.51.100.50/32

, and inbound rules allowing TCP traffic on ports

1024-65535

from both destinations.

Configure the subnet NACL with outbound rules allowing TCP traffic on port 443 to

198.51.100.50/32

and

0.0.0.0/0

, and inbound rules allowing TCP traffic on ports

1024-65535

from

198.51.100.50/32

and

0.0.0.0/0

Configure the subnet NACL with outbound rules allowing TCP traffic on port 443 to

198.51.100.50/32

and the Amazon S3 prefix list, and inbound rules allowing TCP traffic on ports

1024-65535

from both destinations.

Configure the private subnet's route table with a default route (

0.0.0.0/0

) pointing to the S3 Gateway Endpoint to route both S3 and external HTTPS traffic.

Show answer & explanation

Answer: Configure the security group attached to the EC2 instances with outbound rules that allow TCP traffic on port 443 to the Amazon S3 prefix list and to $198.51.100.50/32$ .; Configure the subnet NACL with outbound rules allowing TCP traffic on port 443 to $198.51.100.50/32$ and $0.0.0.0/0$ , and inbound rules allowing TCP traffic on ports $1024-65535$ from $198.51.100.50/32$ and $0.0.0.0/0$ .

Answer

Configure the security group with outbound rules allowing TCP traffic on port 443 to the S3 prefix list and the partner's IP, and configure the subnet NACL with outbound rules to those destinations on port 443 and inbound rules allowing return traffic on ephemeral ports (using

0.0.0.0/0

for S3 since NACLs do not support prefix lists).

The correct combination requires understanding stateful vs. stateless traffic filtering and the platform limitations of NACLs and Security Groups. First, the option configuring the security group with outbound rules to the S3 prefix list and the partner's IP on port 443 is correct because security groups are stateful and automatically allow return traffic on ephemeral ports. Second, the option configuring the subnet NACL with outbound rules on port 443 to the partner IP and

0.0.0.0/0

, along with inbound rules on ephemeral ports, is correct because NACLs are stateless and do not support VPC prefix lists.

Step-by-Step Solution

Analyze security group requirements for stateful evaluation.

Since security groups are stateful, only outbound rules to the target destinations (the S3 prefix list and the partner IP address) on port 443 are needed. Inbound rules for ephemeral return ports are not required.

This establishes least-privilege egress access at the instance level.

Determine NACL capabilities and rule requirements.

NACLs are stateless and evaluate traffic in both directions. Inbound rules must be created to allow return traffic on ephemeral ports (

1024-65535

). Additionally, NACLs do not support referencing VPC prefix lists, so a CIDR block of

0.0.0.0/0

must be used to cover Amazon S3 IP addresses.

This ensures the stateless subnet boundary allows the return traffic for initiated connections.

Verify route table configuration constraints.

Gateway Endpoints modify route tables with specific prefix list routes but cannot be used as a target for a default route (

0.0.0.0/0

) to route external API traffic.

This confirms that route tables must be configured with a NAT Gateway or similar virtual private gateway route for the partner API.

Key Concept

Stateful vs. Stateless network filtering and resource limitations within VPC security structures.

Estimated Time:2m 0s

Question 393Question →

A company is deploying a secure database tier on Amazon EC2 instances in a private subnet (Subnet B: $10.0.2.0/24$ ) of a VPC. The database instances run PostgreSQL. The application tier runs on EC2 instances in a different private subnet (Subnet A: $10.0.1.0/24$ ). The database instances must only allow inbound database traffic from the application instances. The database instances must be blocked from initiating any outbound connections to the internet, but they must be able to securely connect to AWS Systems Manager (SSM) via interface VPC endpoints to download software updates.

Which TWO configurations must a solutions architect implement to meet these requirements with least privilege? (Select TWO.)

Select all that apply

Configure the database security group to allow inbound TCP port 5432 from the application security group, and outbound TCP port 443 to the SSM VPC endpoint security group, removing the default outbound rule that allows all traffic.

Configure the VPC endpoint security group to allow inbound TCP port 443 from the database security group.

Associate the database security group with Subnet B to enforce traffic filtering at the subnet boundary, ensuring no outbound traffic is allowed to route to the internet.

Configure the Network ACL for Subnet B to allow inbound TCP port 5432 from Subnet A, relying on the stateful nature of Network ACLs to automatically permit return traffic to the application tier.

Configure the database security group to allow outbound TCP port 443 to

0.0.0.0/0

so that the patch requests can be inspected by AWS WAF before being routed to AWS Systems Manager.

Show answer & explanation

Answer: Configure the database security group to allow inbound TCP port 5432 from the application security group, and outbound TCP port 443 to the SSM VPC endpoint security group, removing the default outbound rule that allows all traffic.; Configure the VPC endpoint security group to allow inbound TCP port 443 from the database security group.

Answer

To meet the requirements, the database security group must be configured to allow inbound TCP port 5432 from the application security group and outbound TCP port 443 to the SSM VPC endpoint security group (with the default outbound rule removed). Additionally, the VPC endpoint security group must allow inbound TCP port 443 from the database security group.

The database security group must allow inbound database traffic on port 5432 from the application security group and outbound HTTPS traffic on port 443 to the security group of the SSM VPC endpoint, with the default outbound rule removed to prevent any other outbound traffic. The VPC endpoint security group must allow inbound HTTPS traffic on port 443 from the database security group. Since security groups are stateful, return traffic for both connections is automatically permitted.

Step-by-Step Solution

Analyze the communication flow and stateful nature of security groups.

Database instances must receive inbound connections from application instances on port 5432. Since security groups are stateful, allowing inbound port 5432 from the application security group automatically allows the return database traffic. To block database instances from initiating general internet traffic while allowing them to connect to Systems Manager, we must remove the default 'allow all outbound' rule and add a specific outbound rule for TCP port 443 pointing to the target SSM VPC endpoint.

This implements the principle of least privilege at the instance level.

Configure the interface VPC endpoint security group.

Interface endpoints use Elastic Network Interfaces (ENIs) which are protected by security groups. To allow the database instances to successfully connect, the endpoint's security group must permit inbound HTTPS (TCP 443) traffic from the database security group.

VPC interface endpoints require explicit inbound security group rules to accept incoming traffic from VPC clients.

Evaluate subnet-level versus instance-level security controls.

Confirm that Network ACLs are stateless and apply at the subnet level, meaning they would require both inbound and outbound rules, whereas security groups are stateful and apply to network interfaces. This rules out options that confuse Network ACL statelessness or associate security groups directly with subnets.

Avoiding common configuration errors ensures a secure and functional network architecture.

Key Concept

VPC Network Security using stateful Security Groups and Interface VPC Endpoints

Estimated Time:2m 0s

Question 394Question →

An organization is deploying a microservices-based application on Amazon ECS. The services require access to a third-party payment gateway API token. The security policy dictates that the API token must be stored securely, encrypted at rest, and automatically rotated every 30 days to mitigate credential exposure risks.

Which solution should a solutions architect recommend to satisfy these requirements with the least operational overhead?

Store the API token in AWS Secrets Manager. Configure automatic rotation using a custom or template AWS Lambda function on a 30-day schedule, and update the ECS tasks to retrieve the token dynamically.

Store the API token in AWS Systems Manager Parameter Store as a standard String parameter. Configure an Amazon EventBridge rule and an AWS Lambda function to update the parameter value every 30 days.

Store the API token in AWS Systems Manager Parameter Store as a SecureString parameter, and enable the native automatic 30-day key rotation option directly in the Parameter Store console.

Store the API token in an Amazon S3 bucket encrypted with an AWS KMS Customer Managed Key. Enable automatic annual rotation on the KMS key to rotate the API token every 30 days.

Show answer & explanation

Answer: Store the API token in AWS Secrets Manager. Configure automatic rotation using a custom or template AWS Lambda function on a 30-day schedule, and update the ECS tasks to retrieve the token dynamically.

Answer

Store the API token in AWS Secrets Manager, configure automatic rotation using an AWS Lambda function, and retrieve it dynamically within the ECS tasks.

Storing the API token in AWS Secrets Manager is the correct approach because Secrets Manager is designed specifically for managing secrets and natively integrates with AWS Lambda to rotate credentials automatically. It encrypts secrets at rest using AWS KMS and allows ECS tasks to retrieve the values dynamically via IAM roles, ensuring security and low operational overhead.

Step-by-Step Solution

Identify the primary requirement for storing sensitive data (an API token) securely with automatic rotation and minimal operational overhead.

Secrets must be encrypted at rest, and the storage service should ideally have built-in support for scheduled rotation.

This narrows down the service choices to those supporting encryption and rotation, such as AWS Secrets Manager.

Compare AWS Secrets Manager and AWS Systems Manager Parameter Store.

AWS Secrets Manager natively supports automatic rotation using AWS Lambda out-of-the-box. Systems Manager Parameter Store supports encryption (SecureString) but does not have a built-in rotation scheduler or lifecycle management for parameters.

Using Secrets Manager minimizes operational overhead since you do not need to build and maintain custom orchestrators for rotation.

Evaluate the S3 and KMS key rotation options.

KMS key rotation only rotates the KMS key material; it does not rotate application-level secrets or files stored in S3.

This eliminates options that confuse KMS key rotation with secret credential rotation.

Key Concept

AWS Secrets Manager vs Systems Manager Parameter Store for Secret Rotation

Question 395Question →

A company has an application running on Amazon EC2 instances in a private subnet. The application must communicate with an external third-party service over HTTPS (port 443). The network security team requires that no traffic is allowed to exit or enter the VPC except what is strictly required for this application to communicate with the external service's public IP range ( $203.0.113.0/24$ ). The subnets use a custom Network ACL (NACL) and the EC2 instances use a custom Security Group.

Which configuration of Security Groups and Network ACLs will securely allow this communication while maintaining the principle of least privilege?

Configure the Security Group with an outbound rule allowing HTTPS (port 443) to

203.0.113.0/24

, and no inbound rules. Configure the Network ACL with an outbound rule allowing HTTPS (port 443) to

203.0.113.0/24

, and an inbound rule allowing TCP traffic on ephemeral ports (

1024-65535

) from

203.0.113.0/24

Configure the Security Group with an outbound rule allowing HTTPS (port 443) to

203.0.113.0/24

, and an inbound rule allowing TCP traffic on ephemeral ports (

1024-65535

) from

203.0.113.0/24

. Configure the Network ACL with an outbound rule allowing HTTPS (port 443) to

203.0.113.0/24

, and no inbound rules.

Configure the Security Group with an outbound rule allowing HTTPS (port 443) to

203.0.113.0/24

, and no inbound rules. Configure the Network ACL with an outbound rule allowing HTTPS (port 443) to

203.0.113.0/24

, and an inbound rule allowing HTTPS (port 443) from

203.0.113.0/24

Configure the Security Group with an outbound rule allowing HTTPS (port 443) to

203.0.113.0/24

, and no inbound rules. Configure the Network ACL with an outbound rule allowing all traffic (

0.0.0.0/0

) and configure AWS WAF on the subnet to restrict outbound traffic destinations to

203.0.113.0/24

Show answer & explanation

Answer: Configure the Security Group with an outbound rule allowing HTTPS (port 443) to $203.0.113.0/24$ , and no inbound rules. Configure the Network ACL with an outbound rule allowing HTTPS (port 443) to $203.0.113.0/24$ , and an inbound rule allowing TCP traffic on ephemeral ports ( $1024-65535$ ) from $203.0.113.0/24$ .

Answer

Configure the Security Group with an outbound rule allowing HTTPS (port 443) to the destination IP range, and configure the Network ACL with an outbound rule allowing HTTPS (port 443) to the destination IP range and an inbound rule allowing TCP traffic on ephemeral ports from the destination IP range.

The correct option correctly applies the stateful nature of Security Groups and the stateless nature of Network ACLs. Security Groups only require an outbound rule for port 443 because they are stateful and automatically track and allow the return traffic. Network ACLs, being stateless, require rules in both directions: an outbound rule to allow traffic to the service on port 443, and an inbound rule to allow the return traffic from the service back to the client's ephemeral ports (

1024-65535

Step-by-Step Solution

Determine the required Security Group configuration for the EC2 instances.

Since Security Groups are stateful, configuring an outbound rule to allow HTTPS (port 443) to

203.0.113.0/24

is sufficient. Return traffic is tracked and permitted automatically, so no inbound rules are required.

To grant outbound-only access while minimizing the attack surface by leaving inbound rules empty.

Determine the required Network ACL outbound configuration for the subnet.

Since Network ACLs are stateless, configure an outbound rule allowing TCP port 443 traffic to

203.0.113.0/24

To allow the outbound connection request to reach the external service.

Determine the required Network ACL inbound configuration for the subnet.

Configure an inbound rule allowing TCP traffic from

203.0.113.0/24

on ephemeral ports (

1024-65535

Since Network ACLs are stateless, the return traffic sent by the external service to the client's ephemeral ports must be explicitly allowed.

Key Concept

Stateful vs. Stateless Filtering in VPC Network Security

Estimated Time:1m 30s

Question 396Question →

A company stores financial records in an Amazon S3 bucket. The objects are encrypted at rest using Server-Side Encryption with AWS KMS keys (SSE-KMS) and a Customer Managed Key (CMK). To comply with new regulatory requirements, the security team mandates that the KMS key must be rotated every 90 days. Furthermore, all existing historical records in the S3 bucket must be immediately re-encrypted using the new key material as soon as the key is rotated. Which combination of actions will meet these requirements with the least operational overhead?

Enable automatic key rotation for the Customer Managed Key with a 90-day interval. Rely on AWS KMS to automatically and immediately re-encrypt all historical S3 objects in the background once the key rotation completes.

Manually generate a new Customer Managed Key every 90 days and store the new key ARN as a plaintext String parameter in Systems Manager Parameter Store. Write an AWS Lambda function to update the default bucket encryption settings and re-encrypt the historical objects using the Parameter Store value.

Configure the Customer Managed Key with automatic key rotation set to a 90-day interval. Execute an Amazon S3 Batch Operations job using a copy operation to duplicate the existing objects in-place under the same key.

Log in to the AWS account root user every 90 days. Disable the active Customer Managed Key, create a new Customer Managed Key, and use the root user credentials to run an S3 Batch Operations copy job to re-encrypt all historical objects.

Show answer & explanation

Answer: Configure the Customer Managed Key with automatic key rotation set to a 90-day interval. Execute an Amazon S3 Batch Operations job using a copy operation to duplicate the existing objects in-place under the same key.

Answer

Configuring the Customer Managed Key with automatic key rotation set to a 90-day interval and executing an Amazon S3 Batch Operations job to copy the objects in-place under the same key is the most operationally efficient solution.

Configuring automatic key rotation with a 90-day interval on the Customer Managed Key (CMK) allows AWS KMS to handle the rotation of key material natively. To address the requirement of re-encrypting historical objects in S3, running an S3 Batch Operations job with a copy operation to copy the objects onto themselves (in-place) forces S3 to decrypt the objects using the old key material and re-encrypt them with the newly rotated key material under the same key ID. This approach completely avoids manual key management, credential exposure, or the need to update bucket policies or application configurations.

Step-by-Step Solution

Enable automatic key rotation on the Customer Managed Key with a rotation period of 90 days.

AWS KMS will automatically rotate the key material every 90 days, retaining older key material for decryption.

To meet the regulatory requirement of rotating keys every 90 days natively without manual rotation script overhead.

Create and execute an Amazon S3 Batch Operations copy job targeting the bucket's objects, specifying the destination as the same bucket and key.

Objects are read (decrypted with the old key material) and written back (encrypted with the newly rotated key material).

To force the immediate re-encryption of all historical objects in the bucket using the new key version with minimal manual effort.

Key Concept

KMS Key Rotation Mechanics and S3 Batch Re-encryption

Question 397Question →

A company stores audit reports in an Amazon S3 bucket. The reports are encrypted at rest using an AWS KMS customer managed key. The company's compliance policy requires that the encryption keys must be rotated annually. A solutions architect needs to configure the rotation while ensuring that all previously encrypted reports remain accessible for decryption without administrative intervention or manual key version tracking. Which two actions should the solutions architect take to meet these requirements?

Select all that apply

Enable automatic key rotation for the customer managed key in AWS KMS.

Retain the original customer managed key in an active state without deleting it.

Run an Amazon S3 Batch Operations job to re-encrypt all historical reports with the new key version immediately after rotation.

Create a new customer managed key each year, delete the old key, and update the S3 bucket's default encryption configuration.

Store the rotated KMS key material as a plaintext parameter in AWS Systems Manager Parameter Store to allow S3 access.

Show answer & explanation

Answer: Enable automatic key rotation for the customer managed key in AWS KMS.; Retain the original customer managed key in an active state without deleting it.

Answer

Enable automatic key rotation for the customer managed key and retain the original key without deleting it.

Enabling automatic key rotation allows AWS KMS to create new key material annually under the same key ARN. AWS KMS automatically retains all historical backing key material associated with the key, enabling seamless decryption of older reports without requiring any modifications to S3 or manual key management.

Step-by-Step Solution

Enable automatic key rotation on the customer managed key used for the S3 bucket's encryption.

AWS KMS will generate a new backing key version annually.

This automates the rotation process without changing the key ARN or configuration.

Keep the customer managed key active and do not delete any older versions of the key material.

The old backing key material remains available in AWS KMS.

AWS KMS requires the historical backing key material to decrypt S3 objects that were encrypted before the rotation occurred.

Key Concept

AWS KMS customer managed key rotation mechanics and backing key preservation.

Question 398Question →

An organization stores sensitive compliance logs in an Amazon S3 bucket encrypted using an AWS KMS Customer Managed Key. Compliance policies mandate that all new logs must be encrypted with key material that is rotated annually. Additionally, any logs older than one year must be re-encrypted using a completely new Customer Managed Key to comply with a cryptographic obsolescence policy. Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Enable automatic key rotation for the existing Customer Managed Key.

Create a new Customer Managed Key, configure the application to use it, and use Amazon S3 Batch Operations to copy and re-encrypt the historical logs older than one year under the new key.

Enable automatic key rotation on the existing Customer Managed Key to trigger AWS KMS to automatically decrypt and re-encrypt all historical logs in the S3 bucket using the new key version.

Deploy an AWS Lambda function running under AWS root account credentials to programmatically decrypt and re-encrypt historical logs to prevent key policy access errors.

Store the KMS key configuration and the database access passwords as a plain String parameter in AWS Systems Manager Parameter Store to allow the rotation script to easily retrieve them.

Show answer & explanation

Answer: Enable automatic key rotation for the existing Customer Managed Key.; Create a new Customer Managed Key, configure the application to use it, and use Amazon S3 Batch Operations to copy and re-encrypt the historical logs older than one year under the new key.

Answer

The correct actions are to enable automatic key rotation for the existing Customer Managed Key and to use Amazon S3 Batch Operations to re-encrypt historical logs. Automatic key rotation manages the rotation of backing key material for new writes, while historical data re-encryption must be executed manually or via S3 Batch Operations, as AWS KMS does not retroactively re-encrypt existing S3 objects. Managing credentials via IAM roles instead of the root account and securing parameters as SecureString are fundamental AWS security best practices.

Step-by-Step Solution

Enable automatic key rotation for the Customer Managed Key used for encrypting new logs.

AWS KMS will automatically rotate the backing key material every 365 days. Existing logs remain decryptable, and new logs will be encrypted using the rotated key material under the same key ARN.

This satisfies the requirement to rotate the key material used for new logs annually without breaking access to old logs.

Identify logs older than one year and prepare an Amazon S3 Batch Operations Copy job using a new Customer Managed Key.

The old logs are copied in-place or to a target prefix, decrypting them using the old key and re-encrypting them using the new key.

Because KMS key rotation does not retroactively re-encrypt existing objects, a new write operation (like S3 Batch Operations Copy) is required to re-encrypt historical data under a new key.

Key Concept

AWS KMS Key Rotation and Historical Data Re-encryption

Question 399Question →

A logistics and supply chain enterprise is migrating its core applications to a multi-account AWS environment managed by AWS Organizations. The company's corporate identity store is located on-premises in a Microsoft Active Directory (AD) domain. The security policy requires that users authenticate using their existing corporate credentials, without duplicating any user credentials in the cloud. The solution must also minimize administrative overhead.

Which combination of actions should a Solutions Architect recommend to meet these requirements? (Select two.)

Select all that apply

Deploy an Active Directory Connector (AD Connector) in the AWS VPC with network connectivity to the on-premises directory.

Configure AWS IAM Identity Center to use AWS Directory Service as its identity source to enable single sign-on access to the AWS accounts.

Create individual IAM users with long-term credentials in each member account for every enterprise directory user.

Deploy AWS Managed Microsoft Active Directory in the cloud and configure a two-way forest trust with the on-premises directory, then create matching IAM users.

Configure AWS IAM Identity Center to map administrative Active Directory groups directly to the AWS account root user credentials for daily administrative operations.

Show answer & explanation

Answer: Deploy an Active Directory Connector (AD Connector) in the AWS VPC with network connectivity to the on-premises directory.; Configure AWS IAM Identity Center to use AWS Directory Service as its identity source to enable single sign-on access to the AWS accounts.

Answer

Deploy an Active Directory Connector (AD Connector) in the AWS VPC with network connectivity to the on-premises directory, and configure AWS IAM Identity Center to use AWS Directory Service as its identity source.

Deploying an Active Directory Connector (AD Connector) redirecting requests to the on-premises Active Directory avoids credential caching or replication in the cloud. Configuring AWS IAM Identity Center to use AWS Directory Service connects this proxy gateway to your AWS Organizations structure, enabling centralized single sign-on access to all member accounts with minimal management effort.

Step-by-Step Solution

Establish secure network connectivity between the AWS VPC and the on-premises network.

A Site-to-Site VPN or AWS Direct Connect connection is configured, allowing low-latency secure IP communication.

This setup allows the AD Connector in AWS to reach the on-premises Active Directory domain controllers.

Deploy an AD Connector using AWS Directory Service.

The AD Connector acts as a directory gateway, proxying authentication requests without replicating AD data in the cloud.

This satisfies the business requirement of not duplicating user credentials in the cloud.

Configure AWS IAM Identity Center to use AWS Directory Service as the identity source.

IAM Identity Center integrates with the AD Connector, enabling centralized single sign-on (SSO) and permissions assignment to AWS Organizations accounts.

This minimizes administrative overhead by allowing group-based AWS access assignment using existing AD identities.

Key Concept

Federating an on-premises Microsoft Active Directory with AWS IAM Identity Center using AD Connector to enable centralized SSO without credential replication.

Question 400Question →

A company is hosting a database application on Amazon EC2 instances. The database data is stored on attached Amazon EBS volumes, which are encrypted using an AWS Key Management Service (AWS KMS) customer managed key. Due to updated corporate compliance policies, the company must now rotate this encryption key annually. A solutions architect needs to configure the rotation while ensuring that the application suffers no downtime and that existing data remains accessible. How will enabling automatic key rotation for this customer managed key satisfy these requirements?

AWS KMS generates new backing key material annually and retains the old key material to decrypt existing data, keeping the same Key ARN so that no application or resource configurations need to be updated.

AWS KMS generates new key material and immediately triggers a background service to re-encrypt all existing blocks on the EBS volumes under the new key version to ensure compliance.

AWS KMS creates a completely new customer managed key with a different Key ARN, requiring the solutions architect to update the EC2 launch templates and manually re-encrypt the EBS volumes.

AWS KMS deletes the older backing key material during rotation to enforce security boundaries, which requires the databases to be stopped so that the volumes can be decrypted using cached data keys before the rotation finishes.

Show answer & explanation

Answer: AWS KMS generates new backing key material annually and retains the old key material to decrypt existing data, keeping the same Key ARN so that no application or resource configurations need to be updated.

Answer

The correct option correctly describes AWS KMS key rotation behavior. When automatic key rotation is enabled for a customer managed key, KMS creates a new version of the backing key material every year. It retains all historical versions of the backing key material to decrypt any data previously encrypted with them. Because the Key ID and Key ARN do not change, applications and resources (like EBS volumes) continue to function without any configuration updates or downtime.

Step-by-Step Solution

Analyze how AWS KMS handles automatic key rotation for Customer Managed Keys.

Automatic rotation creates a new version of the backing key material annually, while keeping the Key ARN and key properties identical.

This avoids having to modify any resource policies, IAM policies, or application references pointing to the Key ARN.

Determine how KMS decrypts historical data after a rotation event occurs.

AWS KMS retains the older versions of the backing key material.

This allows KMS to automatically select the correct historical key version when decrypting existing data, removing the need to re-encrypt existing storage volumes or objects.

Key Concept

AWS KMS Automatic Key Rotation Mechanics

Estimated Time:1m 30s

PreviousPage 20 / 22Next

Design Secure Architectures

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept