Examkin

Design Secure Architectures

438 questions

All types438Multiple choice214Multiple select224
Question 41Question →

A company is setting up a new multi-account AWS environment using AWS Organizations. The company wants to implement centralized user authentication that integrates with their existing corporate identity provider. Additionally, they need to enforce a security policy that prevents any administrator in the member accounts from deleting Amazon S3 buckets that store access logs.

Which combination of AWS services or features will meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS IAM Identity Center federated with the corporate identity provider for centralized user access; Service Control Policies (SCPs) in AWS Organizations to deny the deletion of the log buckets across member accounts

Answer

Configure AWS IAM Identity Center federated with the corporate identity provider for centralized user access, and apply Service Control Policies (SCPs) in AWS Organizations to deny the deletion of the log buckets across member accounts.
Centralized user access across multiple AWS accounts should be implemented using AWS IAM Identity Center federated with the external identity provider. To enforce administrative compliance and prevent critical resource deletion (such as S3 access log buckets) across member accounts, Service Control Policies (SCPs) must be attached to the appropriate Organizational Units (OUs) or accounts in AWS Organizations.

Step-by-Step Solution

1
Identify the requirement for centralized identity management and federation.
Determine that AWS IAM Identity Center is the standard service for federating an external identity provider with multiple AWS accounts.
This centralizes authentication control and avoids the need to manage individual credentials in each account.
2
Identify the requirement to restrict actions (bucket deletion) across all member accounts, including for administrators.
Determine that Service Control Policies (SCPs) in AWS Organizations can enforce maximum permission limits (guardrails) across accounts.
SCPs apply to all users and roles in the member accounts, including the root user, ensuring administrative compliance.

Key Concept

Centralized multi-account governance is achieved by combining federated access management via AWS IAM Identity Center with Organization-level guardrails using Service Control Policies (SCPs).
Question 42Question →

A logistics company runs a fleet tracking application on Amazon EC2 instances in AWS Account A. The application must write daily transaction logs to an Amazon S3 bucket located in AWS Account B. The S3 bucket is configured with default encryption using an AWS KMS customer managed key (CMK) owned by Account B. The solutions architect must implement a secure, cross-account access solution that adheres to the principle of least privilege and avoids long-term security credentials. Which combination of steps will meet these requirements?

Show answer & explanation

Answer: Attach an IAM role to the EC2 instances in Account A. Grant the role permissions to perform s3:PutObject on the S3 bucket in Account B and kms:GenerateDataKey on the KMS CMK in Account B. In Account B, configure the S3 bucket policy to allow the IAM role to perform s3:PutObject, and configure the CMK key policy to allow the IAM role to perform kms:GenerateDataKey.

Answer

Attach an IAM role to the EC2 instances in Account A. Grant the role permissions to perform s3:PutObject on the S3 bucket in Account B and kms:GenerateDataKey on the KMS CMK in Account B. In Account B, configure the S3 bucket policy to allow the IAM role to perform s3:PutObject, and configure the CMK key policy to allow the IAM role to perform kms:GenerateDataKey.
The correct solution involves attaching an IAM role to the EC2 instances in Account A to provide temporary security credentials. The role is granted permission to write to Account B's bucket and generate data keys from Account B's customer managed key (CMK). In Account B, both the S3 bucket policy and the KMS key policy must trust the specific IAM role from Account A to allow the cross-account upload and encryption operations.

Step-by-Step Solution

1
Create and attach an IAM role to the Amazon EC2 instances in Account A to generate temporary security credentials.
The EC2 instances obtain temporary AWS credentials with the identity of the assumed role.
This avoids using long-term credentials (like IAM user access keys) and conforms to security best practices.
2
Assign IAM permissions to the role in Account A to write to the S3 bucket and to use the KMS key in Account B.
The local IAM role has the necessary permissions to initiate the upload and request key generation.
For cross-account access, the requesting account must grant the permission locally, in addition to the resource-level permissions in the destination account.
3
Update the S3 bucket policy in Account B to allow the IAM role in Account A to execute s3:PutObject.
Account B explicitly trusts the Account A IAM role to write objects to the S3 bucket.
Cross-account access to S3 requires the bucket owner to trust the external IAM principal via a bucket policy.
4
Configure the KMS key policy on the CMK in Account B to allow the IAM role in Account A to call kms:GenerateDataKey.
Account B allows the Account A IAM role to request a data key from KMS to encrypt the log files.
Since the bucket uses default KMS CMK encryption, the external role must have permissions on the KMS key policy to perform key operations.

Key Concept

Cross-account access to S3 buckets encrypted with a KMS Customer Managed Key requires IAM policies, S3 bucket policies, and KMS key policies to align and explicitly trust the calling IAM principal using temporary credentials.
Question 43Question →

An enterprise is deploying a microservices application on Amazon ECS using the AWS Fargate launch type. The application requires access to two sensitive values: a database password for an Amazon Aurora PostgreSQL DB cluster, and a static API key for a third-party payment provider. The security requirements mandate that: 1. The database password must be rotated automatically every 30 days. 2. The third-party API key must be encrypted at rest and retrieved securely by the ECS tasks at startup, but it does not require rotation. 3. Access to all credentials must be monitored and audited. 4. The architecture must minimize operational complexity and cost. Which approach meets these requirements?

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and configure automatic rotation using the built-in integration for Amazon RDS. Store the third-party API key in AWS Systems Manager Parameter Store as a SecureString parameter, and reference this parameter in the container definition of the Amazon ECS task definition.

Answer

Store the database password in AWS Secrets Manager with built-in RDS rotation, and store the third-party API key in AWS Systems Manager Parameter Store as a SecureString parameter injected into the ECS tasks at startup.
The correct architecture uses AWS Secrets Manager for the Aurora PostgreSQL password because it natively integrates with RDS to handle database credential rotation automatically without code changes or operational overhead. It uses AWS Systems Manager Parameter Store with a SecureString parameter for the payment provider API key because it does not require rotation, making Parameter Store a more cost-effective solution. Referencing the Parameter Store SecureString in the ECS task definition ensures the secret is fetched at task startup and injected as an environment variable, minimizing runtime API costs and latency.

Step-by-Step Solution

1
Select the storage and rotation mechanism for the database password.
AWS Secrets Manager is selected.
Secrets Manager provides native, out-of-the-box integration with Amazon RDS and Aurora for automated 30-day password rotation, eliminating the need to write and maintain custom Lambda functions.
2
Select the storage and retrieval mechanism for the static third-party API key.
AWS Systems Manager Parameter Store with a SecureString parameter is selected.
Parameter Store SecureString encrypts data at rest using AWS KMS. Since the API key does not require rotation, Parameter Store is a highly cost-effective choice compared to Secrets Manager.
3
Configure the retrieval pattern for the API key to optimize ECS task performance and costs.
Inject the Parameter Store parameter as an environment variable in the ECS task definition.
By referencing the parameter in the ECS task definition container properties, Fargate retrieves the value during container initialization. This prevents the application from making repeated, costly runtime API calls to Parameter Store for every transaction.

Key Concept

Selecting and integrating Secrets Manager and Systems Manager Parameter Store based on automatic rotation needs, cost, and security.
Estimated Time:2m 0s
Question 44Question →

A solutions architect is designing a secure credential storage solution for a legacy application hosted on Amazon EC2 instances. The application requires access to database credentials for an Amazon RDS for PostgreSQL database, which must be rotated automatically every 30 days. Additionally, the application requires access to a static third-party API token that must be encrypted at rest but does not require automatic rotation. The solution must minimize monthly operational costs and configuration complexity. Which combination of actions should the solutions architect take to meet these requirements? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in RDS rotation template.; Store the external API token as a SecureString parameter in AWS Systems Manager Parameter Store.

Answer

Store the database credentials in AWS Secrets Manager with built-in RDS rotation, and store the external API token as a SecureString parameter in AWS Systems Manager Parameter Store.
Storing database credentials in AWS Secrets Manager is the best approach because it natively supports automatic rotation for RDS databases. Storing the static API token as a SecureString parameter in AWS Systems Manager Parameter Store provides encryption-at-rest at lower operational cost and complexity since the token does not require automatic rotation.

Step-by-Step Solution

1
Analyze the database credentials requirements.
The database credentials need to be rotated automatically every 30 days.
AWS Secrets Manager is the correct service for secrets requiring automatic rotation because it provides built-in integration and Lambda rotation templates for Amazon RDS databases.
2
Analyze the static API token requirements.
The token is static, does not require rotation, but must be encrypted at rest.
AWS Systems Manager Parameter Store with SecureString parameters provides secure, KMS-encrypted parameter storage with no additional cost for standard parameters, making it highly cost-effective for static secrets.
3
Evaluate the distractors against security and operational rules.
Reject plaintext storage options and options that misinterpret KMS key rotation mechanics.
String parameters and plaintext S3 files lack required encryption. KMS key rotation does not update the underlying database credentials or parameter values.

Key Concept

Selecting the appropriate secrets management service based on rotation capabilities, encryption needs, and cost profiles.
Question 45Question →

A company needs to implement a security monitoring strategy for its AWS environment. The strategy must include auditing all API activities for unauthorized actions and automatically detecting when security groups are modified to allow unrestricted public access (0.0.0.0/0). Which of the following actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable AWS CloudTrail to record and audit all API activity across the AWS account.; Create an AWS Config rule to automatically monitor and detect when security groups are modified to allow unrestricted public traffic.

Answer

Enable AWS CloudTrail to record all API activity, and create an AWS Config rule to monitor security group modifications.
AWS CloudTrail logs and monitors all API activity across the AWS account, providing auditing capability for unauthorized modifications. AWS Config continuously records configuration changes of AWS resources, such as security groups, and evaluates them against compliance rules (e.g., detecting if a security group allows unrestricted 0.0.0.0/0 ingress traffic). Together, these services fulfill the requirements of monitoring API changes and detecting insecure resource configurations.

Step-by-Step Solution

1
Identify the requirement for tracking and auditing API actions.
AWS CloudTrail is selected to log all API calls across the AWS account.
CloudTrail provides a complete history of API activity, enabling security auditing and monitoring.
2
Identify the requirement for monitoring and alerting on resource configuration compliance.
AWS Config is chosen to detect security group compliance violations.
AWS Config continuously monitors resource configurations and evaluates them against rules (e.g., checking for unrestricted port access).

Key Concept

AWS CloudTrail is used for auditing and monitoring API activity, while AWS Config is used to monitor, audit, and evaluate the configurations of AWS resources.
Estimated Time:1m 0s
Question 46Question →

An enterprise application hosted on Amazon ECS Fargate needs to access two types of configuration data: database credentials for a production Amazon RDS for PostgreSQL instance, and public API endpoints for external microservices. The database credentials must be encrypted at rest, rotated every 30 days, and accessed securely. The public API endpoints are non-sensitive, do not change frequently, and must be retrieved with the lowest possible cost.

Which combination of actions should a solutions architect recommend to manage these configurations? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and enable automatic secret rotation with a schedule of 30 days.; Store the public API endpoints as Standard String parameters in AWS Systems Manager Parameter Store.

Answer

Store the database credentials in AWS Secrets Manager with automatic rotation, and store the public API endpoints as Standard String parameters in AWS Systems Manager Parameter Store.
To securely manage sensitive and non-sensitive configuration data at the lowest cost, a solutions architect should use AWS Secrets Manager for database credentials and Systems Manager Parameter Store for public API endpoints. Secrets Manager encrypts data at rest and natively supports automatic 30-day rotation for Amazon RDS. For the non-sensitive API endpoints, Systems Manager Parameter Store's Standard String parameters are free of charge, making them the most cost-effective choice.

Step-by-Step Solution

1
Evaluate the security and rotation requirements of the database credentials.
Database credentials are sensitive secrets that require encryption at rest and automatic rotation every 30 days. AWS Secrets Manager is the optimal service because it provides built-in integration with RDS and automatic secret rotation via Lambda.
Systems Manager Parameter Store does not support out-of-the-box automatic database credential rotation, whereas Secrets Manager does.
2
Evaluate the storage and cost requirements of the non-sensitive public API endpoints.
The public API endpoints are non-sensitive and need to be stored at the lowest possible cost. Standard parameters (String type) in AWS Systems Manager Parameter Store do not incur additional costs.
Using AWS Secrets Manager for non-sensitive settings would incur unnecessary storage costs ($0.40 per secret per month).

Key Concept

Selecting the appropriate AWS service for configuration management based on data sensitivity, rotation requirements, and cost-effectiveness.
Estimated Time:1m 30s
Question 47Question →

A retail corporation recently migrated its inventory management system to AWS. The security team must implement a solution to continuously monitor for configuration compliance drifts, such as unencrypted Amazon Elastic Block Store (Amazon EBS) volumes or public Amazon S3 buckets, and receive immediate alerts when unauthorized IAM policy changes occur. Which combination of AWS services should the solutions architect recommend to meet these monitoring and alerting requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable AWS Config to continuously monitor and record resource configuration changes, evaluating compliance against AWS managed rules.; Configure Amazon EventBridge to detect IAM configuration API events logged in AWS CloudTrail and trigger Amazon Simple Notification Service (Amazon SNS) notifications.

Answer

The correct solution involves enabling AWS Config to monitor and evaluate resource configuration compliance drifts, and configuring Amazon EventBridge to detect IAM configuration API events in AWS CloudTrail to trigger notifications via Amazon Simple Notification Service (Amazon SNS).
AWS Config is the native service designed to track and record AWS resource configurations, evaluating them against rules such as verifying that S3 buckets are private and EBS volumes are encrypted. To alert on security alterations like IAM changes in real time, AWS CloudTrail audits the API logs, and Amazon EventBridge can be configured with a rule matching those API activities to trigger an Amazon SNS topic for instant alert notifications.

Step-by-Step Solution

1
Identify the tool suitable for continuous resource configuration compliance monitoring.
AWS Config is identified as the service that records configurations and evaluates them against custom or managed rules.
AWS Config maintains a configuration history and evaluates resource compliance status (such as identifying public S3 buckets or unencrypted EBS volumes).
2
Determine the service integration necessary to capture IAM API activity and generate real-time alerts.
AWS CloudTrail logs the IAM API actions, Amazon EventBridge matches the specific pattern of those events, and Amazon SNS sends notifications.
This integration enables near real-time event-driven alerting for critical security configuration changes like IAM mutations.

Key Concept

Continuous security configuration auditing and near real-time compliance monitoring on AWS.
Estimated Time:2m 0s
Question 48Question →

A genomic research organization is establishing a multi-account environment on AWS using AWS Control Tower to isolate clinical datasets. The organization wants to federate user access using their existing on-premises Active Directory identity provider. Additionally, the security policy mandates that no long-term credentials (such as access keys) can be generated for IAM users in any member account, and standard daily administration must not utilize root user credentials.

Which combination of actions will meet these requirements while maintaining centralized governance? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using an Active Directory Connector to manage user access across the AWS accounts.; Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level that denies iam:CreateUser and iam:CreateAccessKey API calls.

Answer

Configure AWS IAM Identity Center connected to the on-premises Active Directory via an Active Directory Connector, and apply a Service Control Policy (SCP) at the Organizational Unit (OU) level that denies user and access key creation.
The correct combination involves integrating AWS IAM Identity Center with the on-premises Active Directory using an Active Directory Connector, which provides single sign-on access with short-term credentials. Concurrently, a Service Control Policy (SCP) applied at the Organizational Unit level centrally denies the creation of new IAM users and long-term access keys, ensuring strict compliance across all member accounts.

Step-by-Step Solution

1
Evaluate the federation requirement.
Identify that AWS IAM Identity Center can integrate with an on-premises Active Directory (using AD Connector) to manage identity federation centralized, avoiding local IAM users.
This meets the federation objective without manual local credential management.
2
Evaluate the policy to prevent long-term IAM credential generation.
Formulate a Service Control Policy (SCP) that denies iam:CreateUser and iam:CreateAccessKey API actions.
Applying this SCP at the OU level prevents users and administrators in member accounts from creating static credentials.
3
Ensure root credentials are not used for standard operations.
Rely on AWS IAM Identity Center permission sets mapped to federated roles for daily administrative work instead of logging into root accounts.
This aligns with the AWS well-architected framework for multi-account access governance.

Key Concept

Multi-Account Security Governance and Identity Federation
Question 49Question →

A financial services firm is implementing a multi-account governance strategy using AWS Organizations. The security department requires that no users or roles within any member account, including local administrators, can delete Amazon RDS automated or manual database snapshots. Furthermore, the firm wants to enable employees to access AWS resources using their existing corporate credentials, ensuring that no long-term IAM user credentials are created in individual member accounts. Which strategy should the solutions architect recommend to satisfy these requirements?

Show answer & explanation

Answer: Enable AWS IAM Identity Center and integrate it with the corporate identity provider for federated access. Create a Service Control Policy (SCP) that denies the rds:DeleteDBSnapshot and rds:DeleteDBClusterSnapshot actions, and attach the SCP to the organization root or the Organizational Units containing the member accounts.

Answer

Enable AWS IAM Identity Center integrated with the corporate identity provider, and apply a Service Control Policy (SCP) denying the database snapshot deletion actions to the organization root or organizational units.
The correct strategy combines AWS IAM Identity Center with a Service Control Policy (SCP) applied at the organization level. AWS IAM Identity Center enables seamless identity federation with the corporate directory, removing the need for local IAM users and long-term access keys. Applying an SCP that denies the database snapshot deletion actions to the organization root or OUs establishes a mandatory security guardrail that cannot be bypassed by any user or role in the member accounts, including local administrators.

Step-by-Step Solution

1
Configure identity federation using AWS IAM Identity Center connected to the corporate identity provider.
Users can log in using corporate credentials without creating individual IAM users with long-term security keys in member accounts.
This meets the requirement of centralized single sign-on and adheres to the security principle of not distributing long-term credentials.
2
Write a Service Control Policy (SCP) with an explicit Deny statement for rds:DeleteDBSnapshot and rds:DeleteDBClusterSnapshot.
A policy document is created that blocks any delete operations on RDS database snapshots.
Explicit denies in SCPs act as guardrails that override any local administrator permissions.
3
Attach the SCP to the organization root or specific OUs containing the member accounts.
The restriction is enforced across all member accounts within the scope of the organization root or OUs.
This ensures the security guardrail is inherited by all target member accounts, preventing snapshot deletion by any user or role.

Key Concept

Centralized multi-account governance using AWS IAM Identity Center for identity federation and Service Control Policies (SCPs) for policy enforcement.
Question 50Question →

An application developer has deployed a web server on an Amazon EC2 instance inside a public subnet. To control traffic, the developer associates a custom Network Access Control List (NACL) with the subnet. The developer adds an inbound rule allowing TCP traffic on port 80 from any IP address to reach the web server. However, external web clients are unable to load the webpage hosted on the server.

Which configuration change is necessary to allow the web clients to successfully establish a connection?

Show answer & explanation

Answer: Add an outbound rule to the Network Access Control List that allows TCP traffic to ephemeral ports (1024-65535).

Answer

Add an outbound rule to the Network Access Control List that allows TCP traffic to ephemeral ports (1024-65535)
Network Access Control Lists are stateless, meaning that outbound response traffic must be explicitly allowed even if the inbound request was permitted. When a client initiates a connection to a web server (port 80), the server sends the response back to a random port in the client's ephemeral port range (typically 1024-65535). Therefore, an outbound rule allowing traffic to these ephemeral ports is required.

Step-by-Step Solution

1
Identify the firewall layer causing the block.
The block is happening at the subnet level because of the custom Network Access Control List, which defaults to denying outbound traffic.
We need to determine why traffic is blocked despite the inbound rules being correct.
2
Analyze the statefulness behavior of the firewall layers.
Security Groups are stateful and automatically allow response traffic, whereas Network Access Control Lists are stateless and require explicit outbound rules for response traffic.
This helps determine whether the configuration needs to happen at the Security Group or Network Access Control List layer.
3
Determine the destination ports for the outbound return traffic.
Web clients connect using ephemeral ports (1024-65535), so the return traffic from the web server (originating from port 80) is destined for these ephemeral ports.
This ensures the outbound Network Access Control List rule is configured with the correct port range.

Key Concept

Network Access Control Lists are stateless firewalls at the subnet level, meaning that return traffic must be explicitly allowed via outbound rules, typically targeting the client's ephemeral port range.
Question 51Question →

A company has hired an external auditing firm to review sensitive database logs stored in an Amazon S3 bucket. The logs are encrypted with a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS). The audit team uses their own AWS account to manage their IAM users. A solutions architect must design a secure architecture to grant the external auditors temporary, read-only access to the logs. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM role in the company's AWS account with a trust policy that trusts the external auditors' AWS account, and attach a read-only S3 permissions policy to the role.; Configure the KMS key policy of the Customer Managed Key (CMK) to grant the external auditors' assumed IAM role decryption permissions.

Answer

Creating an IAM role in the company's AWS account with a trust policy that trusts the external auditors' account while attaching a read-only S3 policy, and updating the KMS key policy of the Customer Managed Key to grant decryption permissions to the auditors' assumed role.
The correct solution requires configuring cross-account access via an IAM role and granting access to the KMS Customer Managed Key used for encrypting the S3 objects. First, creating an IAM role in the trusting account (the company's account) with a trust policy that specifies the trusted account (the auditors' account) allows the auditors to assume the role. Attaching a read-only S3 policy restricts their access to the required resources. Second, since the objects are encrypted using a Customer Managed Key, KMS requires that the key policy itself explicitly trust the assumed IAM role for decryption operations.

Step-by-Step Solution

1
Configure trust relationship for cross-account access.
An IAM role is created in the company's account that trusts the auditors' AWS account ID, allowing their IAM users to assume the role.
This establishes a secure trust boundary without creating long-term credentials for external entities.
2
Assign read-only permissions to the S3 bucket.
An IAM policy is attached to the role granting read-only access to the specific S3 bucket.
This adheres to the principle of least privilege by ensuring the role can only read the logs.
3
Update the KMS Customer Managed Key policy.
The KMS key policy is modified to grant the assumed role permissions to perform the decrypt operation.
Because the objects are encrypted using a Customer Managed Key, the role needs explicit decryption permissions in the key policy as S3 permissions alone are insufficient.

Key Concept

AWS KMS key policies and cross-account IAM roles for delegation of access to encrypted S3 resources.
Question 52Question →

A solutions architect is designing a multi-account environment using AWS Organizations for a company. The company requires that all employees authenticate using their existing corporate external identity provider (IdP) to access AWS resources. Additionally, the security team mandates that CloudTrail must be enabled in all member accounts, and no administrator in any member account should be able to disable it. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate with the external IdP and assign permission sets to manage user access across the member accounts.; Implement a Service Control Policy (SCP) at the organization's root level that denies the cloudtrail:StopLogging action, and apply it to all member organizational units (OUs).

Answer

Configure AWS IAM Identity Center to federate with the external IdP and assign permission sets, and implement a Service Control Policy (SCP) at the organization's root level that denies the cloudtrail:StopLogging action.
The correct combination of actions leverages AWS IAM Identity Center for federated identity management and Service Control Policies (SCPs) for centralized account governance. Configuring AWS IAM Identity Center enables staff to log in using the external identity provider (IdP) with role-based access, while applying an SCP that denies the 'cloudtrail:StopLogging' action to the organizational units ensures that member account administrators cannot disable audit logging.

Step-by-Step Solution

1
Address the authentication requirement by configuring identity federation.
AWS IAM Identity Center is connected to the corporate external Identity Provider (IdP), enabling single sign-on (SSO) and temporary credentials.
This centralizes authentication and avoids managing individual IAM users with long-term credentials.
2
Address the governance and auditing requirement by using AWS Organizations policies.
A Service Control Policy (SCP) is created in the management account that denies actions like cloudtrail:StopLogging and applied to member OUs.
This enforces organizational guardrails that cannot be overridden by administrators in member accounts.

Key Concept

AWS Organizations and AWS IAM Identity Center governance integration
Question 53Question →

A startup is hosting a public-facing web application using an Amazon CloudFront distribution as the entry point. The startup needs to protect the application from common web exploits, such as SQL injection, and secure the infrastructure against sophisticated network-layer Distributed Denial of Service (DDoS) attacks. Which TWO actions should the Solutions Architect take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Associate an AWS WAF web ACL with the Amazon CloudFront distribution to filter application-layer exploits.; Enable AWS Shield Advanced on the Amazon CloudFront distribution to provide enhanced protection against network and transport layer DDoS attacks.

Answer

Associate an AWS WAF web ACL with the Amazon CloudFront distribution and enable AWS Shield Advanced on the Amazon CloudFront distribution.
The correct options are associating an AWS WAF web ACL with the CloudFront distribution and enabling AWS Shield Advanced on the distribution. AWS WAF provides protection against Layer 7 application exploits like SQL injection by inspecting request payloads. AWS Shield Advanced provides comprehensive protection against Layer 3 and Layer 4 DDoS attacks for CloudFront distributions.

Step-by-Step Solution

1
Determine the service needed to block application-layer (Layer 7) exploits such as SQL injection at the edge.
AWS WAF is selected because it integrates with CloudFront to inspect HTTP/HTTPS request bodies and headers.
AWS WAF is designed specifically to prevent application-layer exploits.
2
Determine the service needed to defend against infrastructure-layer (Layer 3 and 4) DDoS attacks targeting CloudFront.
AWS Shield Advanced is selected to provide advanced network and transport layer DDoS mitigation.
AWS Shield Advanced offers enhanced, tailored protection for edge services compared to AWS Shield Standard.

Key Concept

Combining AWS WAF for Layer 7 application security and AWS Shield Advanced for Layer 3 and 4 infrastructure DDoS protection at the CloudFront edge.
Estimated Time:1m 30s
Question 54Question →

A company is deploying an application on Amazon EC2 instances that connects to an Amazon RDS for PostgreSQL database. The company's security policy requires database credentials to be encrypted and rotated every 30 days. Additionally, the master key used to encrypt these credentials must be a customer managed KMS key that is rotated annually. The solutions architect must implement a solution that minimizes administrative overhead and prevents the application from storing credentials in plaintext configuration files.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic credentials rotation every 30 days using an AWS Lambda function.; Enable automatic key rotation on the customer managed KMS key to rotate the key material annually without changing the key ARN.

Answer

To secure the database credentials and satisfy the rotation requirements, store the credentials in AWS Secrets Manager and configure automatic rotation every 30 days using an AWS Lambda function, and enable automatic key rotation on the customer managed KMS key to rotate the key material annually without changing the key ARN.
Storing database credentials in AWS Secrets Manager with Lambda-based rotation enables secure, automated credential rotation every 30 days. Additionally, enabling automatic key rotation on the customer managed KMS key meets the requirement for annual key rotation with zero administrative overhead and no change to the key ARN.

Step-by-Step Solution

1
Store the database credentials in AWS Secrets Manager.
The credentials are encrypted at rest using a customer managed KMS key and are accessible via the Secrets Manager API.
This avoids storing credentials in plaintext configuration files on the EC2 instances.
2
Configure automatic rotation for the secret in Secrets Manager.
A predefined AWS Lambda function is configured to rotate the PostgreSQL database credentials every 30 days.
This meets the requirement to rotate the database credentials every 30 days automatically.
3
Enable automatic key rotation on the customer managed KMS key.
AWS KMS automatically rotates the key material once a year.
This rotates the key material annually while keeping the same key ARN, ensuring no disruption to Secrets Manager or the application.

Key Concept

Key rotation in AWS KMS is separate from secret rotation in AWS Secrets Manager. KMS automatic rotation rotates the underlying key material without changing the key ARN, while Secrets Manager handles updating credentials in the target database.
Estimated Time:2m 0s
Question 55Question →

A healthcare provider hosts a web application on Amazon EC2 instances in AWS Account A. The application processes sensitive patient files and stores them in an Amazon S3 bucket located in Account A. To comply with regulatory standards, all files must be encrypted at rest using an AWS KMS customer managed key stored in a centralized security account (Account B).

Which combination of configuration steps is required to enable the EC2 instances in Account A to upload encrypted files to the S3 bucket? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In Account B, configure the KMS key policy to grant the IAM role associated with the EC2 instances in Account A permissions to perform the kms:GenerateDataKey and kms:Decrypt operations.; In Account A, attach an IAM policy to the EC2 instances' IAM role that grants permissions to perform the kms:GenerateDataKey and kms:Decrypt operations on the key ARN in Account B.

Answer

In Account B, configure the KMS key policy to grant the IAM role associated with the EC2 instances in Account A permissions to perform the kms:GenerateDataKey and kms:Decrypt operations, and in Account A, attach an IAM policy to the EC2 instances' IAM role that grants permissions to perform the kms:GenerateDataKey and kms:Decrypt operations on the key ARN in Account B.
To successfully establish cross-account access to an AWS KMS customer managed key, permissions must be granted on both sides of the trust boundary. First, the key policy in Account B (the key owner) must explicitly allow the IAM role of the EC2 instances in Account A to use the key for cryptographic operations. Second, the IAM policy attached to the EC2 instances' IAM role in Account A must grant permission to perform the target actions (specifically generating data keys and decrypting) referencing the full ARN of the KMS key in Account B.

Step-by-Step Solution

1
Determine the cross-account encryption requirements.
Identify that the EC2 instances in Account A need to access a customer managed key located in Account B to perform envelope encryption (generate a data key) when writing to Amazon S3.
Since the KMS key and the S3 bucket are in different accounts, cross-account permissions must be explicitly set on both the key policy and IAM policy.
2
Configure the key policy in the key's host account (Account B).
Modify the key policy to explicitly authorize the IAM role from Account A to perform kms:GenerateDataKey and kms:Decrypt.
By default, customer managed keys are only accessible within the account where they reside unless the key policy explicitly allows cross-account entities.
3
Configure the IAM policy in the identity's host account (Account A).
Attach an IAM policy to the EC2 instance role in Account A that permits kms:GenerateDataKey and kms:Decrypt targeting the specific ARN of the KMS key in Account B.
For cross-account access, both the trust boundary at the resource (key policy) and the permission boundary at the caller (IAM policy) must allow the interaction.

Key Concept

Cross-account KMS key access requires trust configuration on both the key policy (resource-based policy) in the owner account and the IAM policy (identity-based policy) in the consumer account.
Question 56Question →

An online education platform is migrating its core learning management system (LMS) to AWS. The platform has a multi-account structure managed under AWS Organizations. The company wants to enable its employees to log in to the AWS Management Console across all accounts using their existing corporate credentials, which are managed in an on-premises Microsoft Active Directory. The solutions architect needs to design a solution that minimizes administrative overhead, avoids duplicating user credentials or password hashes in the cloud, and utilizes modern AWS best practices. Which combination of actions should the solutions architect recommend? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure AWS Directory Service AD Connector to establish a connection with the on-premises Microsoft Active Directory.; Enable AWS IAM Identity Center and configure it to use the AD Connector directory as the identity source.

Answer

Configure AWS Directory Service AD Connector to connect to the on-premises Microsoft Active Directory, and enable AWS IAM Identity Center with the AD Connector directory specified as the identity source.
The correct solution involves configuring the AWS Directory Service AD Connector and enabling AWS IAM Identity Center. AD Connector operates as a proxy to redirect sign-in requests to on-premises Active Directory domain controllers without synchronizing or storing password hashes in AWS. Integrating AD Connector with AWS IAM Identity Center allows users to federate into their respective AWS accounts within AWS Organizations using their corporate credentials, providing a seamless single sign-on experience with minimal administrative overhead.

Step-by-Step Solution

1
Identify directory integration requirements
Determine that the customer requires on-premises Active Directory integration without replicating user credentials to AWS, while keeping administrative overhead low.
This rules out solutions requiring directory synchronization or trust relationships that cache database information in the cloud.
2
Select the directory gateway service
Select AD Connector to proxy authentication requests back to the on-premises Active Directory domain controllers.
AD Connector does not store or replicate user credentials, fulfilling the requirement of keeping passwords on-premises.
3
Select and configure the identity federation service
Enable AWS IAM Identity Center in the Organizations management account and connect it to the Active Directory using the AD Connector.
This establishes a centralized single sign-on portal for all accounts in the organization, aligning with modern AWS security best practices and minimizing administration compared to legacy manual SAML configurations.

Key Concept

Active Directory Federation with AWS IAM Identity Center via AD Connector
Estimated Time:2m 0s
Question 57Question →

An organization is designing a secure two-tier application in a VPC. The application servers reside in a private subnet (Subnet A: 192.168.1.0/24192.168.1.0/24), and the database servers reside in another private subnet (Subnet B: 192.168.2.0/24192.168.2.0/24). A solutions architect must restrict database access so that database instances in Subnet B only receive database traffic on TCP port 54325432 from Subnet A. The security architecture requires utilizing both Network ACLs (NACLs) and Security Groups to enforce this isolation. Which combination of configuration rules meets these requirements while ensuring the database can successfully respond to the application servers?

Show answer & explanation

Answer: Configure the database security group with an inbound rule allowing TCP port 54325432 from the application security group. Configure the Subnet B NACL with an inbound rule allowing TCP port 54325432 from 192.168.1.0/24192.168.1.0/24 and an outbound rule allowing TCP ports 1024−655351024-65535 to 192.168.1.0/24192.168.1.0/24.

Answer

Configure the database security group with an inbound rule allowing TCP port 5432 from the application security group, and configure the Subnet B Network ACL with an inbound rule allowing TCP port 5432 from Subnet A's CIDR block and an outbound rule allowing TCP ports 1024-65535 to Subnet A's CIDR block.
The correct answer combines the stateful nature of security groups with the stateless nature of network ACLs. Because security groups are stateful, allowing inbound TCP port 5432 from the application security group is sufficient to allow bidirectional traffic. In contrast, Network ACLs are stateless, requiring both inbound and outbound rules. The inbound rule must allow TCP port 5432 from the application subnet CIDR block (192.168.1.0/24). The outbound rule must allow TCP traffic to the client's ephemeral port range (1024-65535) back to Subnet A's CIDR block.

Step-by-Step Solution

1
Analyze Security Group requirements for stateful traffic tracking.
The database security group needs an inbound rule for TCP port 5432 from the application security group. No outbound rule is needed on the security group because security groups are stateful and automatically allow return traffic.
Security groups automatically track connection states, allowing return traffic for established connections.
2
Analyze Network ACL (NACL) inbound requirements for stateless filtering.
The database subnet NACL (Subnet B) requires an inbound rule allowing TCP port 5432 traffic from the application subnet CIDR block (192.168.1.0/24).
NACLs are stateless and apply at the subnet level, so inbound traffic must be explicitly allowed.
3
Analyze Network ACL (NACL) outbound requirements for stateless return traffic.
The database subnet NACL (Subnet B) requires an outbound rule allowing TCP traffic to destination ports 1024-65535 back to Subnet A's CIDR block (192.168.1.0/24).
Since NACLs are stateless, return traffic must be explicitly allowed. Because the client application initiated the request from an ephemeral port, the database response is sent to that ephemeral port (range 1024-65535).

Key Concept

Stateful Security Groups vs Stateless Network ACLs (NACLs) and Ephemeral Ports
Question 58Question →

A company wants to share a daily Amazon RDS PostgreSQL database snapshot from its production AWS account (Account A) to a data analytics AWS account (Account B). The production database is encrypted at rest using an AWS KMS key. The solution must ensure that the snapshot is securely shared, decrypted, and restored in Account B while adhering to the principle of least privilege.

Which set of actions will meet these requirements?

Show answer & explanation

Answer: Ensure the RDS database is encrypted with a customer managed KMS key in Account A. Modify the key policy of the customer managed key in Account A to grant Account B access. Share the DB snapshot with Account B. In Account B, copy the shared DB snapshot to a new DB snapshot encrypted with a KMS key in Account B, and then restore the DB instance from the copied snapshot.

Answer

Ensure the RDS database is encrypted with a customer managed KMS key in Account A. Modify the key policy of the customer managed key in Account A to grant Account B access. Share the DB snapshot with Account B. In Account B, copy the shared DB snapshot to a new DB snapshot encrypted with a KMS key in Account B, and then restore the DB instance from the copied snapshot.
The correct solution uses a customer managed key (CMK) in the source account, grants the target account access to that CMK via its key policy, shares the RDS snapshot, and then copies the snapshot locally in the target account using the target account's KMS key before restoring. This complies with AWS restrictions where AWS managed keys cannot be shared, and encrypted RDS snapshots cannot be directly restored across accounts.

Step-by-Step Solution

1
Verify key type and configure policy permissions
The RDS instance in Account A must be encrypted with a Customer Managed Key (CMK) because the default AWS managed key cannot be shared cross-account. The CMK's key policy in Account A is modified to grant Account B the permissions to decrypt and create grants.
Allows Account B to access the cryptographic operations of the key used to encrypt the source snapshot.
2
Share and copy the database snapshot
The DB snapshot is shared with Account B. Account B initiates a copy of the shared snapshot, specifying a KMS key owned by Account B to encrypt the new copy.
AWS RDS does not support restoring a shared encrypted database snapshot directly across accounts. The snapshot must be copied locally first.
3
Restore the DB instance in the target account
Account B restores the RDS DB instance from the copied snapshot that is local to Account B.
Completes the recovery process in Account B using local resources and credentials.

Key Concept

Cross-Account KMS Key Sharing and RDS Snapshot Restore Mechanics

Alternative Method

Instead of sharing and copying the snapshot directly, an alternative is to export the RDS snapshot data to an Amazon S3 bucket in Account A encrypted with a customer managed KMS key, grant Account B access to the S3 bucket and key, and then import the data into a new RDS DB instance in Account B. However, this is operationally more complex.
Estimated Time:2m 30s
Question 59Question →

A solutions architect is designing the security and encryption architecture for an Amazon Aurora PostgreSQL DB cluster that will store sensitive financial transactions. The company's compliance policy mandates that data at rest must be encrypted using an AWS Key Management Service (AWS KMS) customer managed key, and the key material must be rotated annually. The DB cluster must remain fully operational, and existing data must be readable without requiring cluster recreation, manual data re-encryption, or database downtime.

Which combination of actions should the solutions architect recommend to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable automatic key rotation for the KMS customer managed key.; Enable encryption at rest on the Aurora DB cluster using the customer managed key during cluster creation.

Answer

Enable automatic key rotation for the KMS customer managed key, and enable encryption at rest on the Aurora DB cluster using the customer managed key during cluster creation.
To encrypt the database cluster with a customer managed key, encryption must be enabled at cluster creation since encryption cannot be enabled on an existing unencrypted database. Enabling automatic key rotation in AWS KMS generates a new backing key every year while keeping the same key ARN. AWS KMS automatically uses the correct backing key version to decrypt existing data, which avoids database downtime or any need to re-encrypt old data manually.

Step-by-Step Solution

1
Ensure the database cluster is encrypted at creation using the customer managed key.
The database cluster is provisioned with encryption enabled, securing all database volumes and backups.
Encryption at rest for an Amazon Aurora DB cluster cannot be enabled after creation.
2
Enable automatic key rotation for the KMS customer managed key.
AWS KMS automatically rotates the backing key material every year without changing the key ARN.
This avoids the need to update database configuration, prevents database downtime, and does not require re-encrypting existing data.

Key Concept

AWS KMS Automatic Key Rotation and DB Cluster Encryption
Question 60Question →

An energy infrastructure company is deploying a multi-account AWS environment managed by AWS Organizations. The company uses Microsoft Entra ID as its central identity provider. The security team requires that cloud engineers be able to sign in to the AWS Management Console and AWS CLI using their existing corporate credentials. Additionally, user access and group memberships must automatically provision and deprovision from Microsoft Entra ID to AWS. Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate with Microsoft Entra ID using SAML 2.0, and enable automatic provisioning using the System for Cross-domain Identity Management (SCIM) protocol.

Answer

Configure AWS IAM Identity Center to federate with Microsoft Entra ID using SAML 2.0, and enable automatic provisioning using the System for Cross-domain Identity Management (SCIM) protocol.
Configuring AWS IAM Identity Center to federate with Microsoft Entra ID using SAML 2.0 and enabling automatic provisioning via SCIM satisfies all authentication and synchronization requirements. This configuration delegates credential verification to the corporate identity provider while ensuring that access is automatically terminated in AWS when a user is deprovisioned in Entra ID, minimizing administrative overhead across multiple AWS accounts.

Step-by-Step Solution

1
Identify the central identity source and single sign-on requirement.
Microsoft Entra ID is the corporate identity source, and AWS IAM Identity Center is selected to centralize multi-account access control.
AWS IAM Identity Center is the modern and recommended service to configure single sign-on across all member accounts in AWS Organizations.
2
Select the correct integration protocol for authentication and directory synchronization.
Configure SAML 2.0 federation for single sign-on and enable the SCIM protocol for identity synchronization.
SAML 2.0 allows federated authentication, while SCIM automates the provisioning and deprovisioning of users and groups from the external IdP without manual overhead.

Key Concept

AWS IAM Identity Center Federation with SCIM
PreviousPage 3 / 22Next
Design Secure Architectures Practice Questions — AWS Certified Solutions Architect - Associate — Page 3 | Examkin