Design Secure Architectures

438 questions

All types438 Multiple choice214 Multiple select224

A financial company separates its auditing workloads in Subnet A ( $10.0.1.0/24$ ) and production workloads in Subnet B ( $10.0.2.0/24$ ) within the same VPC. Security regulations dictate that auditing instances in Subnet A must be allowed to initiate SSH connections (port 22) to production workloads in Subnet B. However, production workloads must be prevented from initiating any connection back to the auditing workloads. To provide defense-in-depth, the network architect must configure Network Access Control Lists (Network ACLs) on both subnets to permit only this specific traffic flow and its return packets. Which configuration of Network ACL rules for Subnet A and Subnet B will correctly allow the auditing traffic while following the principle of least privilege?

Subnet A: Outbound rule allowing TCP port 22 to

10.0.2.0/24

with no inbound rules. Subnet B: Inbound rule allowing TCP port 22 from

10.0.1.0/24

with no outbound rules.

Subnet A: Outbound rule allowing TCP port 22 to

10.0.2.0/24

, and Inbound rule allowing TCP port 22 from

10.0.2.0/24

. Subnet B: Inbound rule allowing TCP port 22 from

10.0.1.0/24

, and Outbound rule allowing TCP port 22 to

10.0.1.0/24

Subnet A: Outbound rule allowing TCP port 22 to

10.0.2.0/24

, and Inbound rule allowing TCP ports 1024-65535 from

10.0.2.0/24

. Subnet B: Inbound rule allowing TCP port 22 from

10.0.1.0/24

, and Outbound rule allowing TCP ports 1024-65535 to

10.0.1.0/24

Subnet A: Inbound rule allowing TCP port 22 from

10.0.2.0/24

, and Outbound rule allowing TCP ports 1024-65535 to

10.0.2.0/24

. Subnet B: Outbound rule allowing TCP port 22 to

10.0.1.0/24

, and Inbound rule allowing TCP ports 1024-65535 from

10.0.1.0/24

Show answer & explanation

Answer: Subnet A: Outbound rule allowing TCP port 22 to $10.0.2.0/24$ , and Inbound rule allowing TCP ports 1024-65535 from $10.0.2.0/24$ . Subnet B: Inbound rule allowing TCP port 22 from $10.0.1.0/24$ , and Outbound rule allowing TCP ports 1024-65535 to $10.0.1.0/24$ .

Answer

Subnet A: Outbound rule allowing TCP port 22 to

10.0.2.0/24

, and Inbound rule allowing TCP ports 1024-65535 from

10.0.2.0/24

. Subnet B: Inbound rule allowing TCP port 22 from

10.0.1.0/24

, and Outbound rule allowing TCP ports 1024-65535 to

10.0.1.0/24

Network ACLs are stateless network-filtering boundaries. When an EC2 instance in Subnet A initiates an SSH connection to an EC2 instance in Subnet B, the outgoing request leaves Subnet A on port 22 and reaches Subnet B on port 22. Thus, Subnet A needs an outbound rule for port 22, and Subnet B needs an inbound rule for port 22. The return packets from Subnet B are sent from port 22 back to the ephemeral port range (1024-65535) allocated by the client in Subnet A. Because Network ACLs do not automatically track session state, Subnet B must have an outbound rule to allow traffic to the ephemeral ports of Subnet A, and Subnet A must have an inbound rule to allow traffic on the ephemeral ports from Subnet B.

Step-by-Step Solution

Analyze the direction of the initiation flow.

The connection is initiated from Subnet A (source) to Subnet B (destination) on TCP port 22.

This establishes that Subnet A needs outbound TCP port 22 allowed, and Subnet B needs inbound TCP port 22 allowed.

Determine return traffic behavior for stateless firewalls.

Network ACLs are stateless, meaning the returning traffic must be explicitly allowed in the reverse direction.

Because the SSH client allocates an ephemeral port (typically 1024-65535) to receive the response, the return traffic flows from Subnet B's ephemeral ports back to Subnet A's ephemeral ports.

Formulate the exact inbound and outbound rules for both subnets.

Subnet A needs outbound port 22 and inbound ephemeral ports 1024-65535. Subnet B needs inbound port 22 and outbound ephemeral ports 1024-65535.

This guarantees that the initial request and the response packets are both permitted through the stateless boundaries of both subnets.

Key Concept

VPC Network Security and Stateless Network ACL Rules

Question 62Question →

A solutions architect is designing a security strategy for a financial services company. The company requires customer-managed keys (CMKs) in AWS Key Management Service (AWS KMS) to encrypt sensitive data stored in Amazon S3 buckets. The company's compliance policy mandates that the key material must be rotated annually. However, historical data must remain readable, and administrative overhead must be minimized.

Which TWO statements accurately describe the mechanics and implications of enabling automatic key rotation for these customer-managed keys?

Select all that apply

AWS KMS automatically retains all previous versions of the key material to ensure that historical data can still be decrypted.

Enabling automatic key rotation does not automatically re-encrypt existing S3 objects that were encrypted using the older key material.

Rotating the key material automatically initiates an AWS Batch job to decrypt and re-encrypt all historical data with the new key version.

To simplify key administration, the database credentials used by applications that access the encrypted S3 buckets should be stored as plain String parameters in AWS Systems Manager Parameter Store.

To decrypt older S3 objects after rotation, the solutions architect must manually create and configure a unique KMS key alias for each retired version of the key material.

Show answer & explanation

Answer: AWS KMS automatically retains all previous versions of the key material to ensure that historical data can still be decrypted.; Enabling automatic key rotation does not automatically re-encrypt existing S3 objects that were encrypted using the older key material.

Answer

AWS KMS automatically retains all previous versions of the key material to ensure that historical data can still be decrypted, and enabling automatic key rotation does not automatically re-encrypt existing S3 objects that were encrypted using the older key material.

The correct options accurately describe how AWS KMS handles key rotation. First, AWS KMS automatically retains all previous versions of the key material, allowing the service to seamlessly decrypt historical data without manual configuration. Second, rotating key material does not automatically re-encrypt existing S3 objects, which remain encrypted under their original key material version.

Step-by-Step Solution

Analyze AWS KMS key rotation behavior for customer-managed keys.

Identified that automatic rotation generates a new version of key material annually while retaining previous versions.

To determine how historical data remains accessible without administrative intervention.

Evaluate the impact of rotation on existing S3 objects.

Understood that existing objects are not automatically re-encrypted with the new key material; they continue to use the version of the key material active at their creation.

To rule out misconceptions about automatic background re-encryption of historical data.

Assess secret storage and alias management requirements.

Confirmed that no manual alias configurations are needed for old versions and that credentials should never be stored as plaintext String parameters.

To ensure compliance with security best practices and eliminate incorrect options.

Key Concept

AWS KMS Customer Managed Key automatic rotation mechanics and behavior.

Question 63Question →

An e-commerce company runs an order processing application on Amazon EC2 instances in private subnets. The instances must download software updates from an external repository on the internet and securely access an Amazon DynamoDB table in the same AWS Region. The company's security policy requires that DynamoDB traffic must not traverse the public internet, and the EC2 instances must not be directly reachable from the public internet. Which TWO configurations should a solutions architect implement to meet these requirements securely and cost-effectively? (Select TWO.)

Select all that apply

Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the route table of the private subnets.

Deploy a NAT Gateway in a public subnet, and configure the route table of the private subnets to route internet-bound traffic (

0.0.0.0/0

) to the NAT Gateway.

Create an Interface VPC Endpoint for Amazon DynamoDB and configure it to handle all DynamoDB traffic from the private subnets.

Configure the Network ACL for the private subnets to allow inbound traffic only on TCP ports

80

and

443

to receive response packets from the update repository.

Deploy a NAT Instance inside the private subnets to route outbound software update traffic directly to the internet.

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the route table of the private subnets.; Deploy a NAT Gateway in a public subnet, and configure the route table of the private subnets to route internet-bound traffic ( $0.0.0.0/0$ ) to the NAT Gateway.

Answer

To secure DynamoDB traffic cost-effectively without public internet routing, associate a Gateway VPC Endpoint for DynamoDB with the private subnets' route table. To enable secure outbound internet access for updates, deploy a NAT Gateway in a public subnet and update the private subnets' route table to direct all

0.0.0.0/0

traffic through the NAT Gateway.

The correct answer combines a Gateway VPC Endpoint for Amazon DynamoDB and a NAT Gateway in a public subnet. The Gateway VPC Endpoint routes DynamoDB traffic privately over the AWS backbone network without traversing the public internet, doing so without any hourly or data processing charges. The NAT Gateway provides secure, one-way outbound connectivity to the internet for downloading updates, ensuring the instances remain unreachable from inbound internet traffic.

Step-by-Step Solution

Analyze the access requirement for DynamoDB and evaluate cost-optimal network isolation paths.

Identify that Gateway VPC Endpoints are free and direct DynamoDB traffic privately, fulfilling the security and cost-efficiency criteria.

VPC endpoints keep traffic within the AWS network, and Gateway endpoints for DynamoDB do not incur charges.

Analyze the outbound internet requirements for software updates on private EC2 instances.

Determine that a NAT Gateway deployed in a public subnet allows outbound-initiated traffic and blocks unsolicited inbound traffic, which satisfies the security policy.

EC2 instances in private subnets cannot have public IP addresses or route directly to an Internet Gateway.

Evaluate the incorrect options regarding stateless Network ACL behavior, incorrect NAT placement, and non-optimal endpoint selection.

Eliminate the Interface VPC Endpoint option due to higher cost, the stateless Network ACL rule option because it blocks ephemeral return traffic, and the private NAT Instance option because NAT devices must reside in public subnets.

This ensures the final architecture is correct, highly available, secure, and cost-effective.

Key Concept

VPC Network Security and Egress Routing Control

Question 64Question →

A healthcare provider hosts a web portal on AWS that stores patient medical imaging files in an Amazon S3 bucket and patient metadata in an Amazon Aurora PostgreSQL database. The provider's compliance policy mandates that all data at rest must be encrypted using customer managed keys in AWS Key Management Service (AWS KMS). The cryptographic key material must be updated annually, but existing data must not be actively re-encrypted. Additionally, the database credentials must be rotated every 30 days without causing database connection issues or application downtime. Which combination of actions will meet these requirements in the most secure manner? (Select TWO.)

Select all that apply

Enable automatic key rotation on the customer managed keys in AWS KMS.

Store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function every 30 days.

Store the database credentials as a String parameter in AWS Systems Manager Parameter Store and write a custom script to rotate the password.

Enable automatic key rotation in AWS KMS and execute an AWS Batch job to immediately re-encrypt all existing data with the new key version.

Manually create a new customer managed key annually to replace the active key, and delete the previous customer managed key to prevent its unauthorized use.

Show answer & explanation

Answer: Enable automatic key rotation on the customer managed keys in AWS KMS.; Store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function every 30 days.

Answer

Enable automatic key rotation on the customer managed keys in AWS KMS, and store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function every 30 days.

Enabling automatic key rotation for customer managed keys satisfies the annual rotation requirement without re-encrypting existing data because AWS KMS automatically retains older key versions to decrypt historical data. Storing database credentials in AWS Secrets Manager and using an AWS Lambda function to rotate the credentials every 30 days satisfies the rotation requirement while avoiding application downtime or connection issues.

Step-by-Step Solution

Address the KMS key rotation requirement.

Enable automatic key rotation on the customer managed keys in AWS KMS. This rotates key material annually and retains old key material to decrypt old data without re-encryption.

This complies with the policy of rotating keys annually without actively re-encrypting existing data.

Address the database credential security and rotation requirement.

Store the database credentials in AWS Secrets Manager and set up automatic 30-day rotation via an AWS Lambda function.

Secrets Manager securely stores secrets and supports seamless rotation for RDS/Aurora databases without causing downtime.

Key Concept

AWS KMS Automatic Key Rotation and AWS Secrets Manager Credential Rotation

Estimated Time:2m 0s

Question 65Question →

A retail company is migrating its workloads to a multi-account AWS environment managed by AWS Organizations. The company wants to enable its 500 corporate employees to access their respective AWS accounts using their existing on-premises Active Directory (AD) credentials. The solution must minimize operational overhead, avoid replicating user credentials or directory metadata to the cloud, and provide centralized access control. Which solution meets these requirements?

Create individual IAM users in each target AWS account for all 500 corporate employees. Distribute access keys and configure a custom script to synchronize their on-premises Active Directory passwords to their IAM profiles.

Configure AWS IAM Identity Center. Export corporate user names and passwords from the on-premises Active Directory and store them as plaintext parameters in Systems Manager Parameter Store to allow AWS to authenticate the users.

Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector. Define permission sets in IAM Identity Center to centrally manage access to the AWS accounts.

Use the AWS account root user credentials to log in to each AWS account, then configure a SAML 2.0 integration directly with the on-premises Active Directory to allow administrative access.

Show answer & explanation

Answer: Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector. Define permission sets in IAM Identity Center to centrally manage access to the AWS accounts.

Answer

Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector, then define permission sets in IAM Identity Center to centrally manage access to the AWS accounts.

The correct solution uses AWS IAM Identity Center integrated with the on-premises Active Directory via AWS Directory Service AD Connector. AD Connector is a directory gateway that redirects directory requests to the on-premises Active Directory without caching or replicating credentials in the cloud. Using permission sets in IAM Identity Center allows administrators to centrally assign and manage permissions across the multi-account environment, minimizing operational overhead.

Step-by-Step Solution

Establish network connectivity and directory integration.

Connect AWS IAM Identity Center to the on-premises Active Directory by deploying AWS Directory Service AD Connector as a proxy gateway, which forwards authentication requests without local credential replication.

This establishes federated login capabilities using existing corporate credentials without storing or replicating passwords in AWS, satisfying the security and overhead requirements.

Configure AWS Organizations integration.

Enable AWS IAM Identity Center within the organization's management account to centrally oversee multi-account access.

Centralized governance via IAM Identity Center reduces operational overhead compared to configuring individual IAM configurations in each member account.

Define and assign permissions.

Create permission sets based on job functions and assign them to Active Directory groups to grant users access to specific AWS accounts.

This allows for role-based access control managed centrally, ensuring least privilege and simple access revocation.

Key Concept

Federating identity from an on-premises Active Directory to AWS using AWS Directory Service AD Connector and AWS IAM Identity Center to minimize operational overhead and avoid credential replication.

Question 66Question →

A company is building a financial application that runs on AWS Lambda and stores transaction records in an Amazon DynamoDB table. The security policy requires database credentials used by the Lambda function to be stored securely and rotated every 30 days. Additionally, the DynamoDB table must be encrypted using a customer managed key (CMK) in AWS Key Management Service (AWS KMS) that is rotated annually without requiring manual re-encryption of historical data. Which combination of actions should the solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.

Store the database credentials as a plaintext String parameter in AWS Systems Manager Parameter Store and use a custom Lambda function to rotate the credentials.

Configure DynamoDB to use a customer managed key in AWS KMS and enable automatic key rotation for that key.

Configure DynamoDB to use a customer managed key in AWS KMS, enable automatic key rotation, and schedule an AWS Batch script to re-encrypt historical table records.

Create a new customer managed key in AWS KMS each year, update the DynamoDB table configuration to use the new key, and run a script to re-encrypt all existing table items.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.; Configure DynamoDB to use a customer managed key in AWS KMS and enable automatic key rotation for that key.

Answer

Storing the database credentials in AWS Secrets Manager with automatic rotation enabled, and configuring DynamoDB to use a customer managed key in AWS KMS with automatic key rotation enabled.

Storing database credentials in AWS Secrets Manager ensures secure storage and supports automatic rotation via built-in integration. Enabling automatic rotation on the KMS customer managed key ensures that AWS KMS automatically rotates the key material annually. AWS KMS retains older key material so that existing data can still be decrypted without needing to re-encrypt any data manually, which perfectly fulfills the encryption and operational constraints.

Step-by-Step Solution

Address credential security and rotation requirements.

Database credentials are secure and automatically rotated without downtime.

AWS Secrets Manager natively supports storing database secrets and integrates with Lambda to handle automatic 30-day rotation, satisfying the first security constraint.

Address database encryption and key rotation requirements.

The DynamoDB table is encrypted using a customer managed key that rotates automatically.

AWS KMS customer managed keys support automatic rotation. When automatic rotation is enabled, AWS KMS generates new key material annually and keeps older key material to decrypt historical data without requiring manual re-encryption of the data.

Key Concept

AWS KMS automatic key rotation preserves previous key material to decrypt existing data, eliminating the need for manual re-encryption. For sensitive secrets, AWS Secrets Manager provides built-in rotation capabilities, unlike SSM Parameter Store plaintext parameters.

Question 67Question →

A retail company stores sensitive customer profile data in an Amazon DynamoDB table. The security team requires that the data be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS to allow full audit logging of key usage. The company also requires that the encryption key be rotated automatically every year, and they must ensure that DynamoDB can continue to read and write existing and new data seamlessly after key rotation without any manual re-encryption or table configuration changes. How should the solutions architect configure this to meet these requirements?

Configure the DynamoDB table to use the default AWS owned key. To meet the audit logging requirement, store the sensitive database attributes as plaintext parameters in AWS Systems Manager Parameter Store and reference them in the application.

Configure the DynamoDB table to use a Customer Managed Key for encryption. Enable automatic annual rotation on the Customer Managed Key in AWS KMS.

Configure the DynamoDB table to use a Customer Managed Key. Enable automatic annual key rotation, and schedule a monthly AWS Batch job to read all DynamoDB items and write them back to force immediate re-encryption of all historical records under the new key version.

Manually create a new Customer Managed Key in AWS KMS each year. Update the DynamoDB table encryption settings to use the new key identifier, then execute an AWS Lambda function to scan the table and update every item to ensure it is encrypted with the new key version.

Show answer & explanation

Answer: Configure the DynamoDB table to use a Customer Managed Key for encryption. Enable automatic annual rotation on the Customer Managed Key in AWS KMS.

Answer

Configure the DynamoDB table to use a Customer Managed Key for encryption, and enable automatic annual rotation on the Customer Managed Key in AWS KMS.

Configuring the DynamoDB table with a Customer Managed Key (CMK) ensures that all key usage is logged in AWS CloudTrail, satisfying the audit logging requirement. Enabling automatic annual key rotation on the CMK allows AWS KMS to generate new key material every year while keeping the same key ID. KMS automatically retains older key versions to decrypt historical data and uses the new key version to encrypt new writes, providing seamless access without any application downtime, table configuration changes, or manual re-encryption.

Step-by-Step Solution

Enable AWS KMS Customer Managed Key encryption for the Amazon DynamoDB table to generate detailed key usage logs in AWS CloudTrail.

The table encryption is managed by a customer controlled key, satisfying the audit logging requirement.

AWS owned keys do not write key usage events to CloudTrail, whereas Customer Managed Keys do.

Enable automatic key rotation for the Customer Managed Key in AWS KMS.

The key material is automatically rotated annually while retaining the same Key ID.

This satisfies the requirement for annual rotation without modifying table configurations or application code.

Allow AWS KMS to manage historical key versions for decryption.

Existing items can be decrypted seamlessly, and new items are encrypted using the rotated key material.

AWS KMS automatically retains previous versions of key material to decrypt existing data, removing the need for manual re-encryption.

Key Concept

KMS Key Rotation Mechanics and Customer Managed Keys

Question 68Question →

A solutions architect is migrating an on-premises application to AWS. The application requires access to a database password and a third-party partner's API token. These credentials must be encrypted at rest and rotated automatically every 60 days. Additionally, the application writes audit logs to an Amazon EBS volume, which must be encrypted using a customer managed KMS key that is rotated every year. The historical audit logs must remain readable after key rotation without manual intervention.

Which combination of actions should the solutions architect take to meet these security requirements? (Select TWO.)

Select all that apply

Store the database password and API token in AWS Secrets Manager, and configure a custom AWS Lambda function to rotate the secrets every 60 days.

Enable automatic key rotation for the customer managed KMS key used for the EBS volume.

Store the database password and API token as String parameters in AWS Systems Manager Parameter Store, and write an Amazon EventBridge rule to update the plaintext values every 60 days.

Enable automatic key rotation for the customer managed KMS key, and schedule an AWS Lambda function to decrypt and re-encrypt all existing EBS volume snapshots with the new key version immediately after rotation.

Create a new customer managed KMS key annually, update the EBS volume configuration to use the new key, and delete the old KMS key to ensure only the active key is used.

Show answer & explanation

Answer: Store the database password and API token in AWS Secrets Manager, and configure a custom AWS Lambda function to rotate the secrets every 60 days.; Enable automatic key rotation for the customer managed KMS key used for the EBS volume.

Answer

The correct solutions are to store the credentials in AWS Secrets Manager with a custom Lambda function for rotation, and to enable automatic key rotation on the customer managed KMS key used for the EBS volume.

To secure credentials and meet the 60-day rotation requirement, AWS Secrets Manager should be used with a custom AWS Lambda function to rotate the database password and third-party API token. To secure the EBS volume and meet the annual rotation requirement without manual re-encryption or interrupting access to historical data, automatic key rotation should be enabled on the customer managed KMS key. AWS KMS automatically manages the rotation and retains the older key versions to decrypt existing data when needed.

Step-by-Step Solution

Analyze the credentials requirement.

The database password and API token must be encrypted and rotated every 60 days.

AWS Secrets Manager supports encrypting and rotating secrets. Since a third-party partner's API key is involved, a custom Lambda function is required to perform the rotation logic.

Analyze the storage encryption requirement.

The EBS volume must be encrypted using a customer managed KMS key that is rotated annually without manual key management or re-encryption.

Enabling automatic key rotation for the customer managed KMS key satisfies the annual rotation requirement. AWS KMS automatically retains the old key versions for decryption of older snapshots and volume blocks, removing the need for manual re-encryption.

Evaluate the distractors.

Identify insecure configurations (plaintext Parameter Store) and incorrect KMS rotation mechanics (unnecessary re-encryption or deletion of old keys).

Parameter Store String parameters do not encrypt data. Deleting retired KMS keys prevents decrypting existing logs. Re-encrypting historical data is an unnecessary operational overhead since KMS handles decryption of older data automatically.

Key Concept

Data Encryption and Key Management

Question 69Question →

An architectural design for a secure application separates the processing service (deployed in subnet $172.16.1.0/24$ ) and the database cluster (deployed in subnet $172.16.2.0/24$ ). The database listens on custom TCP port $8000$ . A solutions architect is configuring a Network Access Control List (Network ACL) for the database subnet to restrict traffic. The database instances are already associated with a security group that allows inbound traffic on port $8000$ from the processing service's security group. Which configuration must be applied to the database subnet's Network ACL to allow successful communication between the services?

An inbound rule allowing TCP port

8000

from the processing service's security group ID and an outbound rule allowing TCP ports

1024 - 65535

to the processing service's security group ID.

An inbound rule allowing TCP port

8000

from

172.16.1.0/24

and an outbound rule allowing TCP ports

1024 - 65535

172.16.1.0/24

An inbound rule allowing TCP port

8000

from

172.16.1.0/24

, with no outbound rule required because Network ACLs automatically track connection states.

An inbound rule allowing TCP ports

1024 - 65535

from

172.16.1.0/24

and an outbound rule allowing TCP port

8000

172.16.1.0/24

Show answer & explanation

Answer: An inbound rule allowing TCP port $8000$ from $172.16.1.0/24$ and an outbound rule allowing TCP ports $1024 - 65535$ to $172.16.1.0/24$ .

Answer

An inbound rule allowing TCP port

8000

from

172.16.1.0/24

and an outbound rule allowing TCP ports

1024 - 65535

172.16.1.0/24

The correct option correctly configures the stateless Network ACL. The inbound rule allows the processing service's subnet (

172.16.1.0/24

) to connect to the database subnet on port

8000

. Since Network ACLs do not track connection states, a corresponding outbound rule is required to allow return traffic from the database back to the processing service's client instances. Because client instances initiate connections from random ports within the ephemeral port range (

1024 - 65535

), the outbound rule must allow traffic to those ports.

Step-by-Step Solution

Analyze the state tracking characteristics of Network ACLs vs Security Groups.

Security groups are stateful, but Network ACLs are stateless. Therefore, the database subnet Network ACL must contain explicit rules for both inbound request traffic and outbound return traffic.

This establishes that both an inbound rule and an outbound rule are required for successful network communication.

Determine the correct source and destination targets for Network ACLs.

Identify that Network ACL rules must use CIDR blocks (such as

172.16.1.0/24

), because Network ACLs do not support security group references.

This rules out options that attempt to reference security group IDs inside Network ACL rules.

Map the ports for the inbound and outbound traffic directions.

The inbound rule must allow target port

8000

from the client's subnet CIDR. The outbound rule must allow return traffic to the client's ephemeral ports (

1024 - 65535

) on the client's subnet CIDR.

When a client connects to a server, it uses a random ephemeral port as its source port. Return traffic must be allowed back to this ephemeral port range.

Key Concept

Stateless nature of Network ACLs and the requirement for ephemeral port rules.

Question 70Question →

A company hosts a secure API on Amazon EC2 instances in a private subnet ( $10.0.2.0/24$ ). The instances receive incoming HTTPS requests forwarded by an Application Load Balancer (ALB) located in the public subnets ( $10.0.1.0/24$ ). The instances also initiate outbound HTTPS connections to an external payment processor's API on the internet ( $0.0.0.0/0$ ). The solutions architect is configuring a custom Network Access Control List (NACL) for the private subnet. Which TWO rule configurations must be added to the custom NACL to allow this traffic while maintaining the principle of least privilege? (Select TWO.)

Select all that apply

Inbound rule: Allow TCP port

443

from source

10.0.1.0/24

. Outbound rule: Allow TCP ports

1024

65535

to destination

10.0.1.0/24

Outbound rule: Allow TCP port

443

to destination

0.0.0.0/0

. Inbound rule: Allow TCP ports

1024

65535

from source

0.0.0.0/0

Inbound rule: Allow TCP port

443

from source

10.0.1.0/24

. Outbound rule: None required, as Network ACLs are stateful and return traffic is allowed automatically.

Outbound rule: Allow TCP port

443

to destination

0.0.0.0/0

. Inbound rule: None required, as the stateful Security Group associated with the instances overrides Network ACL statelessness.

Inbound rule: Configure AWS Shield Standard to inspect Layer

7

headers from source

10.0.1.0/24

. Outbound rule: Allow TCP port

443

to destination

0.0.0.0/0

Show answer & explanation

Answer: Inbound rule: Allow TCP port $443$ from source $10.0.1.0/24$ . Outbound rule: Allow TCP ports $1024$ - $65535$ to destination $10.0.1.0/24$ .; Outbound rule: Allow TCP port $443$ to destination $0.0.0.0/0$ . Inbound rule: Allow TCP ports $1024$ - $65535$ from source $0.0.0.0/0$ .

Answer

The correct configurations are the rules allowing inbound TCP port

443

from the public subnet with outbound ephemeral port access to the public subnet, and outbound TCP port

443

to the internet with inbound ephemeral port access from the internet.

Because Network ACLs are stateless, rules must be explicitly configured for both request and response paths. For the inbound flow from the ALB, the request arrives on destination port

443

and the response returns to the ALB's ephemeral source ports (

1024

65535

). For the outbound flow to the external gateway, the request goes to destination port

443

and the response returns to the instances' ephemeral source ports (

1024

65535

). Thus, both options representing these configurations must be selected.

Step-by-Step Solution

Analyze the direction of traffic for the inbound requests from the ALB.

The ALB in

10.0.1.0/24

communicates with the application instances on TCP port

443

. Because Network ACLs are stateless, both inbound and outbound paths must be explicitly allowed.

To allow the inbound request, an inbound rule permitting TCP port

443

from source

10.0.1.0/24

is needed. To allow the response back to the ALB's ephemeral ports, an outbound rule permitting TCP ports

1024

65535

to destination

10.0.1.0/24

must be created.

Analyze the direction of traffic for the outbound connections to the external payment processor.

The application instances initiate outbound connections on TCP port

443

to destination

0.0.0.0/0

. Because Network ACLs are stateless, both outbound and inbound paths must be explicitly allowed.

To allow the outbound request, an outbound rule permitting TCP port

443

to destination

0.0.0.0/0

is needed. To allow the response back from the external gateway, an inbound rule permitting TCP ports

1024

65535

from source

0.0.0.0/0

must be created.

Evaluate the other options to verify why they are incorrect.

Options suggesting Network ACLs are stateful, or that Security Groups override Network ACLs, or that AWS Shield Standard provides Layer

7

inspection at the NACL level are invalid.

Network ACLs are strictly stateless, whereas Security Groups are stateful. Both are evaluated, and one cannot override the other. AWS Shield Standard operates at layers

3

and

4

for DDoS protection and is not configured in NACL rules.

Key Concept

Network Access Control Lists (NACLs) are stateless firewall rules applied at the subnet level, meaning that outbound response traffic must be explicitly permitted for allowed inbound requests, and inbound response traffic must be explicitly permitted for allowed outbound requests.

Estimated Time:2m 0s

Question 71Question →

A company is designing a secure architecture for a web application. The application requires access to a database password for an Amazon RDS for PostgreSQL DB instance. The security policy requires database credentials to be rotated every 30 days. In addition, the application stores transactional logs in an Amazon S3 bucket. The logs must be encrypted at rest using an AWS KMS Customer Managed Key (CMK) that is automatically rotated every year. The solutions architect must ensure that previously encrypted logs can still be decrypted after key rotation.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Store the database credentials in AWS Secrets Manager, and configure automatic rotation every 30 days using the database-specific AWS Lambda rotation function.

Enable automatic key rotation for the KMS CMK. AWS KMS automatically retains the older backing keys to decrypt logs that were encrypted prior to rotation.

Store the database credentials in AWS Systems Manager Parameter Store as a plaintext String parameter to simplify rotation scripts.

Manually create a new KMS CMK each year, delete the old CMK, and re-encrypt all existing log files in the S3 bucket using the new CMK.

Enable automatic key rotation for the KMS CMK, and configure a scheduled task to re-encrypt all historical log files under the new key version immediately after rotation.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager, and configure automatic rotation every 30 days using the database-specific AWS Lambda rotation function.; Enable automatic key rotation for the KMS CMK. AWS KMS automatically retains the older backing keys to decrypt logs that were encrypted prior to rotation.

Answer

Store the database credentials in AWS Secrets Manager with automatic Lambda rotation, and enable automatic key rotation for the KMS CMK.

The correct combination of actions involves using AWS Secrets Manager to store and automatically rotate database credentials every 30 days, and enabling automatic key rotation for the KMS CMK. AWS Secrets Manager provides native database credential rotation using Lambda, which simplifies configuration. AWS KMS automatic key rotation keeps old key material active for decryption, ensuring historical logs remain readable without any manual re-encryption or key management.

Step-by-Step Solution

Address the requirement to securely store and automatically rotate database credentials every 30 days.

Database credentials should be stored in AWS Secrets Manager, which natively integrates with RDS databases to automate credential rotation using built-in AWS Lambda rotation templates.

Secrets Manager allows for secure storage and provides out-of-the-box support for rotating RDS database credentials without manual scripting.

Address the requirement to encrypt S3 logs using a KMS CMK with annual rotation, ensuring historical logs remain decryptable.

Enable automatic annual key rotation on the Customer Managed Key (CMK) in AWS KMS.

AWS KMS automatic key rotation generates a new backing key every year but retains the historical backing keys. This allows KMS to automatically decrypt historical data encrypted under previous versions of the key without requiring re-encryption of existing logs.

Key Concept

AWS KMS Customer Managed Key automatic rotation retains older key versions for decryption, and AWS Secrets Manager provides built-in rotation integration for Amazon RDS.

Question 72Question →

A company stores historical compliance reports in an Amazon S3 bucket. The reports are encrypted at rest using Server-Side Encryption with an AWS KMS customer managed key (SSE-KMS). To satisfy new security standards, a solutions architect enables automatic annual key rotation for this KMS key. Which of the following describes the impact of this configuration on the historical reports and future write operations?

AWS KMS retains the previous backing key material to seamlessly decrypt historical reports, while any newly uploaded reports are encrypted using the new backing key material under the same KMS key ARN.

AWS KMS automatically schedules a background job to decrypt and re-encrypt all existing S3 objects with the new backing key material to ensure consistent encryption across all historical reports.

The solutions architect must manually download, decrypt, and re-upload the historical reports to re-encrypt them, because the previous backing key material is permanently deleted upon rotation.

The solutions architect must export the legacy backing key material and save it as a plaintext parameter of type String in Systems Manager Parameter Store to allow historical reports to be decrypted.

Show answer & explanation

Answer: AWS KMS retains the previous backing key material to seamlessly decrypt historical reports, while any newly uploaded reports are encrypted using the new backing key material under the same KMS key ARN.

Answer

The correct answer correctly states that AWS KMS retains historical backing key material to seamlessly decrypt legacy objects. S3 reads are transparently decrypted using the appropriate historical key version, whereas all new uploads are encrypted with the newly generated backing key material. The external KMS key metadata, including its ARN and Key ID, remains unchanged, meaning no updates to bucket policies or application code are needed.

Step-by-Step Solution

Analyze the automatic key rotation behavior of AWS KMS customer managed keys.

Automatic rotation generates new cryptographic backing key material annually, while keeping the key's metadata (Key ID, ARN, and policies) unchanged.

This allows applications to continue referencing the same KMS key without code modifications.

Determine the impact of rotation on existing (historical) encrypted data.

AWS KMS preserves the older backing key material versions to decrypt data that was encrypted under those versions.

Rotating the key does not automatically re-encrypt existing data, as doing so would be resource-intensive and expensive.

Determine the impact of rotation on new write operations.

New data write requests (such as new S3 uploads) will automatically be encrypted using the newly generated backing key material.

This ensures that all future data writes use the latest, rotated key material.

Key Concept

AWS KMS automatic key rotation preserves legacy backing key versions to decrypt historical data while using the new backing key version for new encryption operations, keeping the key's metadata unchanged.

Estimated Time:1m 30s

Question 73Question →

A company is hosting a secure data processing application on Amazon EC2 instances within a private subnet. The instances must retrieve training datasets from a specific Amazon S3 bucket. Security policies dictate that the VPC must not have an Internet Gateway or a NAT Gateway, and the EC2 instances must be restricted from accessing any other S3 buckets in AWS. A solutions architect deploys a Gateway VPC Endpoint for Amazon S3 to enable private connectivity. Which configuration should the solutions architect implement to restrict the instances to only access the specified S3 bucket?

Configure the Security Group associated with the EC2 instances to restrict outbound traffic to the Amazon Resource Name (ARN) of the specific S3 bucket.

Add a route to the private subnet's route table that maps the specific S3 bucket's IP addresses to the S3 Gateway VPC endpoint.

Attach a custom VPC endpoint policy to the S3 Gateway VPC endpoint that allows S3 actions only when the resource matches the specific S3 bucket's ARN.

Deploy an AWS WAF Web ACL on the subnet's network interfaces to inspect and deny outbound requests destined for unauthorized S3 buckets.

Show answer & explanation

Answer: Attach a custom VPC endpoint policy to the S3 Gateway VPC endpoint that allows S3 actions only when the resource matches the specific S3 bucket's ARN.

Answer

Attach a custom VPC endpoint policy to the S3 Gateway VPC endpoint that allows S3 actions only when the resource matches the specific S3 bucket's ARN.

A VPC endpoint policy is an IAM resource policy that you attach to a VPC endpoint to control access to the service. By default, endpoints have full access. A custom policy can restrict access to specific S3 buckets by specifying their ARNs in the 'Resource' block, ensuring that EC2 instances using the endpoint can only interact with the approved bucket.

Step-by-Step Solution

Analyze the constraint that EC2 instances must access a specific S3 bucket privately without traversing the internet or NAT gateways.

Confirm that a Gateway VPC Endpoint for S3 is the correct private networking route, but by default, it permits access to all S3 buckets.

This sets the foundation for understanding where the access restriction must be applied.

Evaluate the capabilities of Security Groups and Route Tables to restrict access to a specific S3 bucket.

Determine that Security Groups and Route Tables operate at the network layers (IP/port) and cannot inspect or filter S3 traffic by bucket ARN.

This rules out standard subnet and interface-level network configurations.

Select the correct policy enforcement mechanism for VPC Endpoints.

Apply a custom VPC endpoint policy to the S3 Gateway endpoint that specifies the S3 bucket's ARN in the resource block of the policy.

VPC endpoint policies act as a network perimeter filter, allowing fine-grained IAM controls at the VPC boundary.

Key Concept

VPC Endpoint Policies

Estimated Time:1m 30s

Question 74Question →

A company stores historical financial reports in an Amazon S3 bucket. The reports are encrypted at rest using an AWS Key Management Service (AWS KMS) customer managed key. To comply with regulatory standards, the company must rotate the encryption key every year. A solutions architect must implement a key rotation strategy that ensures all existing reports remain accessible for read operations while minimizing administrative overhead. Which strategy meets these requirements?

Enable automatic key rotation for the customer managed key, which automatically generates a new key version annually while keeping the older key versions available to decrypt historical data.

Enable automatic key rotation for the customer managed key, and run an Amazon S3 Batch Operations job to re-encrypt all existing S3 objects with the new key version immediately after rotation.

Create a new customer managed key manually each year, update the S3 bucket configuration, and delete the previous customer managed key to maintain security hygiene.

Store the current key version ID in AWS Systems Manager Parameter Store as a standard String parameter, and update the application logic to retrieve this value to encrypt new reports.

Show answer & explanation

Answer: Enable automatic key rotation for the customer managed key, which automatically generates a new key version annually while keeping the older key versions available to decrypt historical data.

Answer

Enable automatic key rotation for the customer managed key, which automatically generates a new key version annually while keeping the older key versions available to decrypt historical data.

Enabling automatic key rotation for customer managed keys in AWS KMS automatically creates a new backing key version every year. Because AWS KMS retains all historical backing keys, it can seamlessly decrypt older objects when they are accessed. This requires no manual intervention, configuration changes, or re-encryption of existing data, satisfying the compliance requirement with the lowest administrative overhead.

Step-by-Step Solution

Identify the rotation frequency and decryption requirements for S3 objects encrypted with AWS KMS.

The requirement is annual key rotation while ensuring all older data remains readable without manual intervention.

This establishes the constraints: automatic execution and zero-downtime read access to historical objects.

Evaluate AWS KMS automatic key rotation capabilities.

Automatic key rotation creates a new backing key version every year but retains the metadata (ARN/ID) and the older backing keys.

By retaining the older backing keys, AWS KMS can automatically decrypt historical data encrypted with those older versions.

Select the option that matches KMS best practices with the lowest administrative overhead.

Enabling automatic rotation satisfies the compliance requirement without requiring any code changes, key policy updates, or data re-encryption.

This avoids manual re-encryption tasks and prevents data loss from deleting older keys.

Key Concept

AWS KMS Automatic Key Rotation

Question 75Question →

A company is building a document processing application that stores PDF files in an Amazon S3 bucket. The company's compliance policy requires all files to be encrypted at rest using a customer managed key in AWS Key Management Service (AWS KMS). The policy also mandates that the cryptographic key material must be rotated every year. After the key is rotated, the application must still be able to decrypt and access historical documents immediately without any manual intervention or decryption downtime. Which configuration should the solutions architect choose to meet these requirements?

Enable automatic key rotation for the customer managed key, which automatically rotates the key material annually while retaining the old key material to decrypt existing documents.

Enable automatic key rotation for the customer managed key, and immediately run a batch job to decrypt and re-encrypt all existing PDF files with the new key material version.

Manually rotate the key by creating a new customer managed key each year, configure the S3 bucket to use the new key, and delete the old customer managed key.

Generate custom encryption key material annually, store it as a plaintext string parameter in AWS Systems Manager Parameter Store, and configure a scheduled Lambda function to update the S3 bucket's default encryption configuration.

Show answer & explanation

Answer: Enable automatic key rotation for the customer managed key, which automatically rotates the key material annually while retaining the old key material to decrypt existing documents.

Answer

Enable automatic key rotation for the customer managed key, which automatically rotates the key material annually while retaining the old key material to decrypt existing documents.

Enabling automatic key rotation for a customer managed key in AWS KMS automatically creates a new version of the key material every year. AWS KMS retains the older versions of the key material indefinitely, allowing the application to decrypt historical documents transparently without any manual intervention or decryption downtime.

Step-by-Step Solution

Evaluate the encryption requirements and identify the correct key type.

A customer managed key in AWS KMS is required to support the custom rotation policies and metadata management.

AWS managed keys do not support manual rotation configuration changes or cross-account access controls that might be required under strict compliance policies.

Determine the mechanism for key rotation.

Enable automatic key rotation on the customer managed key.

AWS KMS automatically rotates the key material every year (365 days) for customer managed keys when enabled.

Verify historical data access behavior after key rotation.

AWS KMS retains the older key material versions to seamlessly decrypt historical data that was encrypted under previous versions.

This avoids the need to decrypt and re-encrypt existing S3 objects, saving cost and preventing decryption downtime.

Key Concept

AWS KMS automatic key rotation rotates the backing key material while preserving older versions of the key material to decrypt historical data.

Question 76Question →

A company is designing a secure network architecture for a high-throughput processing application hosted on Amazon EC2 instances in a private subnet. The application must securely transfer large volumes of data to Amazon S3 and access secrets stored in AWS Secrets Manager. The network architecture must prevent any data from traversing the public internet, minimize data transfer charges, and enforce strict network boundaries. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Create a gateway VPC endpoint for Amazon S3 and associate it with the route tables of the private subnet.

Create an interface VPC endpoint for AWS Secrets Manager in the private subnet, and associate a security group with the endpoint that allows inbound HTTPS (port 443) traffic from the application security group.

Deploy a NAT gateway in a public subnet, configure the private subnet's route table to point all outbound traffic to the NAT gateway, and access both services via their public endpoints.

Configure a stateless Network ACL on the private subnet to permit outbound HTTPS traffic to Secrets Manager public IP addresses, as security groups cannot filter traffic directed to interface endpoints.

Deploy AWS Shield Advanced at the subnet boundary to inspect traffic and protect the Secrets Manager endpoint from Layer 7 application exploits.

Show answer & explanation

Answer: Create a gateway VPC endpoint for Amazon S3 and associate it with the route tables of the private subnet.; Create an interface VPC endpoint for AWS Secrets Manager in the private subnet, and associate a security group with the endpoint that allows inbound HTTPS (port 443) traffic from the application security group.

Answer

Create a gateway VPC endpoint for Amazon S3 associated with the private subnet's route tables, and create an interface VPC endpoint for AWS Secrets Manager with a security group allowing inbound HTTPS traffic from the application security group.

The correct architecture uses a Gateway VPC Endpoint for Amazon S3 and an Interface VPC Endpoint for AWS Secrets Manager. S3 Gateway Endpoints are free and route traffic via VPC route tables. Interface Endpoints use Elastic Network Interfaces (ENIs) inside the VPC and are secured using stateful security groups that limit inbound HTTPS traffic to the application's security group.

Step-by-Step Solution

Analyze connectivity and cost requirements for Amazon S3 traffic.

Determine that a Gateway VPC Endpoint is the most secure and cost-effective method to connect to Amazon S3, as it does not incur data processing fees and routes traffic privately using route table entries.

Routing high-volume data to S3 via a NAT gateway results in high data transfer costs.

Analyze connectivity and security requirements for AWS Secrets Manager.

Identify that AWS Secrets Manager requires an Interface VPC Endpoint (AWS PrivateLink) for private VPC access because Secrets Manager does not support Gateway VPC Endpoints.

Interface endpoints use Elastic Network Interfaces (ENIs) inside the subnet and allocate private IP addresses from the subnet range.

Configure security group rules for the interface endpoint to restrict access.

Create a security group for the Secrets Manager interface endpoint that allows inbound HTTPS (port 443) traffic only from the security group associated with the application EC2 instances.

Security groups are stateful, apply at the interface level, and enforce the principle of least privilege.

Key Concept

VPC endpoints (Gateway vs Interface) allow private connectivity to AWS services without internet traversal, utilizing route tables and security groups to manage security and optimize costs.

Question 77Question →

A developer is deploying a data processing application on Amazon EC2 instances in private subnets. The application needs to securely access Amazon Kinesis Data Streams to publish streaming data. Corporate security policies dictate that the EC2 instances must not have any route to the public internet, and all AWS API traffic must remain within the AWS network. The solutions architect creates an interface VPC endpoint for Kinesis in the same VPC. Which configuration steps must the solutions architect perform to enable the application to communicate with Kinesis?

Enable Private DNS for the VPC endpoint, and associate a security group with the VPC endpoint that allows inbound HTTPS traffic from the security group of the EC2 instances.

Add a route in the private subnet route table with the destination pointing to the Kinesis service prefix list and the target as the interface VPC endpoint ID.

Deploy a NAT Gateway in a public subnet, configure the private subnet route table to target the NAT Gateway, and configure a security group to restrict access to Kinesis.

Configure the private subnet's Network ACL to allow outbound traffic to the VPC endpoint, and disable the 'Enable DNS hostnames' setting in the VPC.

Show answer & explanation

Answer: Enable Private DNS for the VPC endpoint, and associate a security group with the VPC endpoint that allows inbound HTTPS traffic from the security group of the EC2 instances.

Answer

Enable Private DNS for the VPC endpoint, and associate a security group with the VPC endpoint that allows inbound HTTPS traffic from the security group of the EC2 instances.

The correct option addresses the requirements by enabling Private DNS for the interface VPC endpoint, which ensures Kinesis API requests resolve to the private endpoint ENIs. It also configures the stateful security group on the interface endpoint to allow inbound HTTPS traffic from the EC2 security group, completing the secure private path.

Step-by-Step Solution

Configure DNS settings for PrivateLink

Enabling the Private DNS option ensures that standard Amazon Kinesis endpoint DNS queries resolve to the private IP addresses of the interface endpoint's ENIs within the VPC.

This allows the application to use the default AWS SDK configurations without modifying the API endpoint URL in the code.

Configure the VPC Endpoint Security Group

Associate a security group with the interface VPC endpoint and add an inbound rule allowing TCP port 443 (HTTPS) traffic from the security group assigned to the EC2 instances.

Interface endpoints use ENIs which are secured by security groups. Traffic must be allowed inbound to these interfaces.

Configure the EC2 Instance Security Group

Ensure the EC2 instances' security group allows outbound TCP port 443 traffic to the VPC endpoint's security group.

Since security groups are stateful, allowing outbound HTTPS traffic from the instances to the endpoint enables the outbound request, and the return traffic is automatically allowed.

Key Concept

Interface VPC Endpoints (AWS PrivateLink) require Private DNS hostnames and proper Security Group configurations to allow private communication with AWS services without traversing the public internet.

Question 78Question →

A company hosts a reporting application on Amazon EC2 instances within private subnets. The application is required to query Amazon DynamoDB to fetch user profiles and must also securely call an external SaaS provider's HTTPS endpoint to retrieve currency exchange rates. Company security policies dictate that all traffic to DynamoDB must remain within the AWS network and must not traverse the public internet, while keeping data transfer costs minimized. Additionally, the EC2 instances must be able to securely connect to the external SaaS provider's endpoint.

Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Create a Gateway VPC Endpoint for Amazon DynamoDB, and add a route directing DynamoDB traffic to the endpoint in the private subnet route tables.

Deploy a NAT Gateway in a public subnet, and configure a route in the private subnet route tables directing internet-bound traffic (

0.0.0.0/0

) to the NAT Gateway.

Create an Interface VPC Endpoint (AWS PrivateLink) for Amazon DynamoDB, and configure the security groups to route all database traffic through it.

Configure a route in the private subnet route tables directing outbound traffic (

0.0.0.0/0

) directly to the Internet Gateway.

Modify the security groups associated with the EC2 instances to allow outbound HTTPS traffic to the SaaS endpoint, and add inbound rules to allow return traffic on ephemeral ports.

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for Amazon DynamoDB, and add a route directing DynamoDB traffic to the endpoint in the private subnet route tables.; Deploy a NAT Gateway in a public subnet, and configure a route in the private subnet route tables directing internet-bound traffic ( $0.0.0.0/0$ ) to the NAT Gateway.

Answer

To secure and cost-effectively route the traffic, create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the private subnet route tables. In addition, deploy a NAT Gateway in a public subnet and add a route in the private subnet route tables directing all internet-bound traffic to the NAT Gateway.

Creating a Gateway VPC Endpoint for Amazon DynamoDB ensures that database traffic remains within the AWS network without traversing the public internet. Because Gateway VPC Endpoints are free of charge, they satisfy the requirement to minimize data transfer costs. Additionally, deploying a NAT Gateway in a public subnet allows EC2 instances in private subnets to securely initiate outbound HTTPS requests to the external SaaS provider's endpoint.

Step-by-Step Solution

Address private DynamoDB access and cost goals.

Identify Gateway VPC Endpoints as the optimal solution for DynamoDB because they route traffic entirely within the AWS network and do not incur data processing or hourly fees.

This satisfies the requirement to prevent traffic from traversing the public internet while keeping data transfer costs minimized.

Address external SaaS provider connectivity.

Determine that private EC2 instances require a NAT translation device in a public subnet to reach the public internet.

Private subnets cannot route directly to an Internet Gateway, so a NAT Gateway must be provisioned in a public subnet to handle outbound egress traffic.

Evaluate security group and routing rules.

Confirm that security groups are stateful and require no inbound configurations for return traffic, and ensure that route tables are updated with appropriate routes for the NAT Gateway and the DynamoDB endpoint.

To ensure correct traffic routing and maintain a secure infrastructure configuration.

Key Concept

VPC Network Security and Egress Routing

Question 79Question →

A gaming company runs an application on Amazon EC2 instances in a private subnet. The security team needs to implement a solution to monitor network traffic for threats, specifically detecting if any EC2 instance has been compromised and is communicating with external command-and-control (C&C) servers. Additionally, they must monitor the configuration of their security groups to detect and alert on unauthorized changes. Which combination of AWS services should a solutions architect recommend to meet these requirements with the least operational overhead?

Configure stateless Network ACLs to inspect outbound packets for malicious signatures and automatically block command-and-control servers, and use stateful Security Groups at the subnet level to monitor configuration changes.

Enable Amazon GuardDuty to analyze VPC Flow Logs for malicious outbound communications, and use AWS Config to track and alert on changes to the security groups.

Deploy AWS Shield Standard on the EC2 instances to monitor network payloads for command-and-control traffic, and use AWS WAF to monitor configuration changes to the security groups.

Configure AWS WAF on the private EC2 instances to analyze network flow logs for command-and-control threats, and use AWS Shield Standard to monitor security group configuration drift.

Show answer & explanation

Answer: Enable Amazon GuardDuty to analyze VPC Flow Logs for malicious outbound communications, and use AWS Config to track and alert on changes to the security groups.

Answer

Enable Amazon GuardDuty to analyze VPC Flow Logs for malicious outbound communications, and use AWS Config to track and alert on changes to the security groups.

The correct answer combines Amazon GuardDuty and AWS Config. Amazon GuardDuty uses machine learning and threat intelligence to analyze VPC Flow Logs and detect compromised EC2 instances talking to malicious command-and-control servers. AWS Config records configurations of AWS resources and detects when rules change, satisfying the compliance tracking requirement with minimum operational overhead.

Step-by-Step Solution

Select a managed service for threat detection in network traffic.

Amazon GuardDuty is selected.

GuardDuty automatically analyzes metadata sources such as VPC Flow Logs, DNS query logs, and CloudTrail management events to identify compromised instances communicating with malicious command-and-control endpoints.

Select a service for tracking AWS resource configuration and compliance.

AWS Config is selected.

AWS Config continuously monitors and records configuration details of AWS resources, allowing the creation of compliance rules to detect unauthorized changes in security groups.

Evaluate the operational overhead and capability limits of alternative services.

Incorrect options are eliminated.

Stateless Network ACLs and stateful Security Groups cannot be used to audit configuration changes or perform deep packet threat inspection. AWS WAF and AWS Shield Standard operate at the web and edge layers for DDoS/Web exploits and cannot be used for internal configuration auditing or VPC-level threat monitoring.

Key Concept

Continuous security monitoring and threat detection in AWS requires combining GuardDuty for behavior-based threat analysis and AWS Config for resource configuration tracking.

Question 80Question →

An enterprise is migrating its multi-tier workloads to AWS and has established an organization in AWS Organizations. The enterprise has created separate OUs for development, testing, and production workloads. The security team mandates that employees must use their existing corporate IdP to access AWS resources. Additionally, the team requires that no administrator in any member account can disable or modify Amazon GuardDuty or AWS CloudTrail in their respective accounts. Which combination of actions should a solutions architect recommend to meet these requirements with the least operational overhead?

Configure AWS IAM Identity Center to federate with the corporate IdP. Create an SCP at the organization root that denies permissions to delete or modify GuardDuty and CloudTrail resources, which automatically applies to all member accounts.

Create individual IAM users in each member account for all employees and configure SAML 2.0 federation for each user. Apply local IAM policies in each account to deny permissions to modify GuardDuty and CloudTrail.

Require administrators to use the root user credentials of the organization's management account to centrally manage all member accounts. Store the root access keys in a central repository to run daily automated verification scripts.

Configure AWS IAM Identity Center for user federation. Store the sensitive API keys and configurations of GuardDuty and CloudTrail as plaintext parameters in AWS Systems Manager Parameter Store using standard String parameters to simplify cross-account validation.

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate with the corporate IdP. Create an SCP at the organization root that denies permissions to delete or modify GuardDuty and CloudTrail resources, which automatically applies to all member accounts.

Answer

Configure AWS IAM Identity Center to federate with the corporate IdP, and apply an SCP at the organization root to deny permissions to delete or modify GuardDuty and CloudTrail resources.

The correct option addresses the requirements by configuring AWS IAM Identity Center to federate with the corporate IdP, which provides single sign-on access across all member accounts without the overhead of individual IAM users. It then applies an SCP at the organization root, which prevents administrators in member accounts from deleting or modifying GuardDuty and CloudTrail configurations, ensuring governance compliance.

Step-by-Step Solution

Address the centralized access requirement by setting up federation using AWS IAM Identity Center linked to the corporate IdP.

Users can authenticate via the corporate IdP and access their designated AWS accounts and resources using single sign-on (SSO) without managing individual IAM user credentials in each account.

This meets the security team's requirement for centralized corporate identity integration while minimizing operational overhead.

Address the guardrail requirement by creating an SCP in AWS Organizations.

The SCP is defined to deny actions like guardduty:DeleteDetector, guardduty:UpdateDetector, cloudtrail:StopLogging, and cloudtrail:DeleteTrail.

SCPs act as permission boundaries that apply to all users and roles in member accounts, including the root user of those accounts.

Attach the SCP to the organization root or target OUs.

The restriction is enforced globally across all member accounts under those OUs, preventing administrators from bypassing or disabling these security services.

Centralized enforcement at the OU or organization root level ensures consistent governance and compliance.

Key Concept

Centralized multi-account governance using AWS Organizations Service Control Policies (SCPs) combined with AWS IAM Identity Center for federated identity management.

PreviousPage 4 / 22Next

Design Secure Architectures

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept