Examkin

Design Secure Architectures

438 questions

All types438Multiple choice214Multiple select224
Question 81Question →

A digital media corporation is migrating its workflows to a multi-account environment managed by AWS Organizations. The company utilizes Microsoft Entra ID as its central identity provider. The security team requires that access to the AWS Management Console be authenticated against Entra ID, and that group memberships in Entra ID automatically determine the AWS permissions granted to users without manually creating IAM users in individual accounts. The solution must minimize operational overhead. Which two actions should a solutions architect take to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Enable AWS IAM Identity Center in the organization's management account and configure an external identity provider using SAML 2.0 federation.; Configure automatic provisioning using the System for Cross-domain Identity Management (SCIM) v2.0 protocol between Microsoft Entra ID and AWS IAM Identity Center.

Answer

The correct actions are enabling AWS IAM Identity Center with SAML 2.0 federation to an external identity provider, and configuring automatic provisioning via the System for Cross-domain Identity Management (SCIM) v2.0 protocol.
AWS IAM Identity Center simplifies multi-account access management by allowing centralized single sign-on. By configuring Microsoft Entra ID as an external SAML 2.0 identity provider, users can authenticate using their existing credentials. Using SCIM v2.0 automates the provisioning of users and groups from Microsoft Entra ID to AWS IAM Identity Center, mapping Entra ID groups directly to permission sets in AWS without manual intervention.

Step-by-Step Solution

1
Determine the identity source and centralized portal requirement.
AWS IAM Identity Center is selected as the recommended service for centralized access across multiple AWS accounts.
IAM Identity Center integrates with AWS Organizations to manage multi-account permissions from a single place, minimizing operational overhead.
2
Establish trust between AWS IAM Identity Center and Microsoft Entra ID.
SAML 2.0 federation is configured to delegate authentication to Microsoft Entra ID as the external Identity Provider.
This allows users to authenticate using their existing Entra ID credentials without storing or replicating passwords in AWS.
3
Automate user and group provisioning.
SCIM v2.0 is enabled to automatically synchronize user accounts and group memberships into IAM Identity Center.
SCIM enables automatic synchronization of identity changes and group mappings, eliminating the need to manually create local IAM users.

Key Concept

Centralized multi-account identity federation using AWS IAM Identity Center and external SAML/SCIM providers.
Question 82Question →

A Solutions Architect is designing a multi-account governance strategy for a media company that manages its workloads using AWS Organizations. The company's security policy requires that all administrative access to member accounts in the Production OU must be federated using the corporate identity provider. Additionally, member account administrators must be prevented from creating local IAM users or generating long-term IAM access keys. Which combination of actions should the Solutions Architect recommend to meet these requirements?

Show answer & explanation

Answer: Enable AWS IAM Identity Center in the management account and link it to the corporate identity provider. Configure administrative permission sets, and apply an SCP to the Production OU that denies the iam:CreateUser and iam:CreateAccessKey actions.

Answer

Enable AWS IAM Identity Center in the management account and link it to the corporate identity provider, configure administrative permission sets, and apply an SCP to the Production OU that denies the iam:CreateUser and iam:CreateAccessKey actions.
Enabling AWS IAM Identity Center and linking it to the corporate identity provider centralizes federated identity management across all member accounts in the organization. Combining this with an SCP applied to the Production OU that denies the iam:CreateUser and iam:CreateAccessKey actions enforces compliance by preventing administrators from creating local users or using long-term credentials.

Step-by-Step Solution

1
Centralize identity federation
Enable AWS IAM Identity Center in the management account of AWS Organizations and integrate it with the corporate identity provider (IdP).
This allows centralized login and access control without having to manage credentials or users locally in member accounts.
2
Configure permissions centrally
Create administrative permission sets in AWS IAM Identity Center and assign them to the appropriate corporate identity provider groups/users for the member accounts.
This grants the necessary administrative permissions in member accounts via short-term security credentials instead of long-term keys.
3
Enforce credentials and user restrictions
Create and attach an SCP to the Production OU that denies the iam:CreateUser and iam:CreateAccessKey actions.
This policy ensures that even administrators within the member accounts cannot create local users or long-term credentials, enforcing the compliance rule.

Key Concept

Centralized federation with AWS IAM Identity Center and governance enforcement via Service Control Policies (SCPs) in AWS Organizations
Question 83Question →

A company is integrating its AWS environment with a third-party SaaS monitoring tool. The SaaS vendor requires read-only access to the company's AWS resources to collect performance metrics. The security team mandates that the integration must prevent the 'confused deputy' problem and avoid the use of long-term credentials. Which combination of actions should a solutions architect recommend to configure this access? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM role in the company's AWS account with a trust policy that specifies the SaaS vendor's AWS account ID as the principal and includes a condition requiring a unique external ID.; Attach an IAM permissions policy to the role that grants read-only access to the required AWS services.

Answer

Create an IAM role in the company's AWS account with a trust policy specifying the SaaS vendor's AWS account ID and a unique external ID condition, and attach a read-only permissions policy to this role.
The correct configuration is to create an IAM role that delegates access to the SaaS vendor's AWS account while validating a unique external ID in the trust policy's condition block. This allows the vendor's application to assume the role securely without requiring long-term AWS credentials. In addition, attaching a read-only permissions policy to this role ensures that the vendor has only the permissions required to gather metrics, adhering to the principle of least privilege.

Step-by-Step Solution

1
Define the trust relationship for the cross-account IAM role.
An IAM role is created with a trust policy that designates the SaaS vendor's AWS account ID as the trusted entity and specifies a unique external ID in the condition block.
This establishes cross-account delegation and mitigates the confused deputy problem by verifying the unique external ID during the role assumption process.
2
Define and attach the permissions policy to the IAM role.
A read-only permissions policy is attached to the IAM role, restricting the actions the SaaS vendor can perform to only what is required.
This enforces the principle of least privilege, preventing the SaaS vendor from making unauthorized modifications or accessing unrelated resources.

Key Concept

Cross-account IAM roles with external IDs are used to securely delegate access to third-party SaaS vendors while mitigating the confused deputy vulnerability.
Estimated Time:2m 0s
Question 84Question →

A company hosts a two-tier web application in a VPC. The web servers are deployed in a public subnet (10.0.1.0/2410.0.1.0/24) and receive HTTPS traffic from the internet. The database servers are deployed in a private subnet (10.0.2.0/2410.0.2.0/24) and accept MySQL connections from the web servers on TCP port 3306.

A security architect configures custom network ACLs (NACLs) to secure both subnets.
The public subnet NACL is configured with the following rules:
* Inbound: Allow TCP port 443 from 0.0.0.0/00.0.0.0/0
* Outbound: Allow TCP port 443 to 0.0.0.0/00.0.0.0/0, and allow TCP port 3306 to 10.0.2.0/2410.0.2.0/24

The private subnet NACL is configured with the following rules:
* Inbound: Allow TCP port 3306 from 10.0.1.0/2410.0.1.0/24
* Outbound: Allow TCP ports 1024−655351024-65535 to 10.0.1.0/2410.0.1.0/24

The security groups for both the web servers and database servers are already correctly configured to allow the necessary inbound and outbound traffic. Currently, external clients cannot establish HTTPS connections to the web servers, and the web servers are unable to connect to the database.

Which combination of NACL modifications will resolve these connectivity issues?

Show answer & explanation

Answer: In the public subnet NACL, add an inbound rule allowing TCP ports 1024−655351024-65535 from 10.0.2.0/2410.0.2.0/24, and update the outbound rule to allow TCP ports 1024−655351024-65535 to 0.0.0.0/00.0.0.0/0 instead of TCP port 443.

Answer

In the public subnet NACL, add an inbound rule allowing TCP ports 1024−655351024-65535 from 10.0.2.0/2410.0.2.0/24, and update the outbound rule to allow TCP ports 1024−655351024-65535 to 0.0.0.0/00.0.0.0/0 instead of TCP port 443.
The correct option correctly addresses the stateless nature of Network ACLs. When a client establishes an HTTPS connection to the web server, the inbound rule allows port 443, but the return response from the web server must be allowed to go to the client's ephemeral ports (1024−655351024-65535). Therefore, the public subnet outbound rule must allow TCP ports 1024−655351024-65535 to 0.0.0.0/00.0.0.0/0. Additionally, when the web server initiates a connection to the database on port 3306, the database responses return to the web server's ephemeral ports. Thus, the public subnet NACL must allow inbound traffic on TCP ports 1024−655351024-65535 from the private subnet (10.0.2.0/2410.0.2.0/24).

Step-by-Step Solution

1
Analyze client-to-web server HTTPS traffic flow.
Inbound HTTPS traffic to the web server targets port 443. The return traffic sent back to the client targets the client's ephemeral ports (range 1024−655351024-65535).
NACLs are stateless, so the outbound path must explicitly allow the response traffic to client ephemeral ports.
2
Analyze web server-to-database MySQL traffic flow.
The web server initiates connection to the database on port 3306. The database responds back to the web server's ephemeral ports (range 1024−655351024-65535).
Since the web server is in the public subnet and the database is in the private subnet, the public subnet NACL must explicitly allow inbound traffic from the database subnet on destination ports 1024−655351024-65535.
3
Determine the necessary modifications on the public subnet NACL.
Update the outbound rule to allow TCP ports 1024−655351024-65535 to 0.0.0.0/00.0.0.0/0 (instead of restricting to port 443), and add an inbound rule to allow TCP ports 1024−655351024-65535 from the private subnet CIDR (10.0.2.0/2410.0.2.0/24).
These changes ensure that both HTTPS client responses and database responses can bypass the stateless boundaries of the public subnet NACL.

Key Concept

Stateless Network ACLs (NACLs) require explicit rules for both request and response traffic, including accounting for client and initiator ephemeral ports.
Question 85Question →

A company is deploying an in-memory caching tier in a private subnet within an Amazon VPC. The caching nodes run on Amazon EC2 instances and use port 63796379. Only the application servers running in the web subnet should be allowed to read from and write to the cache nodes. A solutions architect needs to restrict network access to the caching tier.

Which two configuration steps should the solutions architect perform to secure the caching tier? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a security group for the caching instances that allows inbound TCP traffic on port 63796379 from the security group associated with the application instances.; Rely on the stateful behavior of the caching instances' security group to automatically allow the outbound return traffic back to the application instances.

Answer

The solutions architect should create a security group for the caching instances allowing inbound traffic on port 63796379 from the application security group, and rely on the stateful nature of security groups to permit return traffic.
To secure the caching tier, the caching instances must have a security group that explicitly allows inbound traffic on port 63796379 from the application instances' security group. Because security groups are stateful, outbound response traffic from the caching instances to the application instances is permitted automatically, without requiring explicit outbound rules.

Step-by-Step Solution

1
Identify the resource-level firewall requirements.
Determine that security groups should be used for fine-grained instance-level traffic control.
Security groups act as a firewall for associated EC2 instances, allowing traffic to be restricted by port and source security group.
2
Configure the inbound security group rules for the caching instances.
Allow TCP port 63796379 from the application security group ID.
This establishes least-privilege access, ensuring only application instances can communicate with the caching tier.
3
Leverage the stateful nature of security groups for return traffic.
Do not configure any additional inbound or outbound rules for the return traffic.
Because security groups are stateful, allowing inbound request traffic automatically allows the outbound response traffic.

Key Concept

Security groups are stateful, resource-level firewalls that can reference other security groups as sources, whereas network ACLs are stateless, subnet-level firewalls.
Question 86Question →

A healthcare analytics company is deploying a compliant application on Amazon EC2 instances in private subnets. The application must retrieve database credentials from AWS Secrets Manager and write processed records to Amazon DynamoDB. The company's security policy dictates that no traffic from the private subnets is allowed to traverse the public internet. Which two actions should a solutions architect take to meet these security requirements in a cost-effective manner? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the private subnet route tables.; Create an Interface VPC Endpoint for AWS Secrets Manager, and configure its security group to allow inbound HTTPS traffic on port 443 from the EC2 security group.

Answer

Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the private subnet route tables; and create an Interface VPC Endpoint for AWS Secrets Manager, and configure its security group to allow inbound HTTPS traffic on port 443 from the EC2 security group.
To securely access AWS services without traversing the public internet, VPC Endpoints are utilized. For Amazon DynamoDB, a Gateway VPC Endpoint is the most cost-effective and secure option, as it is free and functions by adding a route to the subnet route tables. For AWS Secrets Manager, an Interface VPC Endpoint is required. Because Interface Endpoints use Elastic Network Interfaces (ENIs) within the VPC, access must be secured by attaching a security group to the endpoint that permits inbound HTTPS traffic from the backend application instances.

Step-by-Step Solution

1
Identify the type of VPC endpoint required for Amazon DynamoDB.
Amazon DynamoDB supports Gateway VPC Endpoints, which are free and update subnet route tables directly.
This allows EC2 instances in private subnets to communicate with DynamoDB without leaving the AWS network or incurring NAT Gateway costs.
2
Identify the type of VPC endpoint required for AWS Secrets Manager.
AWS Secrets Manager supports Interface VPC Endpoints (AWS PrivateLink), which deploy elastic network interfaces (ENIs) inside the subnets.
This enables private access to AWS Secrets Manager using private IP addresses from the VPC.
3
Configure the security access rules for the Interface VPC Endpoint.
Attach a security group to the Secrets Manager interface endpoint that allows inbound HTTPS (port 443) traffic from the security group of the EC2 instances.
Security groups on Interface VPC Endpoints act as stateful firewalls controlling which resources can access the endpoint.

Key Concept

Selecting the correct VPC endpoint type (Gateway vs. Interface) and configuring its associated security controls (route tables or security groups) to establish secure, private, and cost-effective communication with AWS services.
Question 87Question →

A company is designing a mobile application that allows authenticated external users to upload profile documents directly to a shared Amazon S3 bucket. The application authenticates users via an external OpenID Connect (OIDC) compliant identity provider. The architecture must strictly prevent the storage of long-term credentials on the mobile devices, enforce the principle of least privilege, and avoid manual administrative overhead for user provisioning. Which TWO actions should a solutions architect take to meet these security requirements? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Configure an OIDC-compatible identity provider in AWS IAM, and create an IAM role with a trust policy that allows the sts:AssumeRoleWithWebIdentity action.; Implement dynamic access control by using policy variables in the IAM role's permissions policy to restrict S3 prefix access to the user's OIDC unique identifier.

Answer

The solutions architect should configure an OIDC-compatible identity provider in AWS IAM, create an IAM role with a trust policy that allows the web identity federation action, and implement dynamic access control by using policy variables to restrict S3 prefix access.
To support external authentication via an OIDC provider without creating IAM users, we use web identity federation. Registering the OIDC provider in IAM and creating an IAM role with a trust policy for the web identity action allows users to exchange their OIDC token for temporary AWS credentials. By applying an IAM policy with dynamic policy variables, we restrict users to their own S3 prefix without manually managing unique policies for each user.

Step-by-Step Solution

1
Register the OIDC provider.
Establish a trust relationship between AWS IAM and the external OIDC identity provider.
Allows AWS to accept authentication assertions from the external provider.
2
Create an IAM role with AssumeRoleWithWebIdentity trust policy.
Generate a role that authenticated mobile app users can assume dynamically.
Eliminates the need for long-term AWS credentials on mobile devices by using temporary security tokens.
3
Define dynamic policies with policy variables.
Apply a resource-level restriction using OIDC-specific claims in the policy.
Enforces folder isolation within the S3 bucket dynamically, preventing users from accessing other users' prefixes.

Key Concept

AWS web identity federation allows OIDC authenticated users to obtain temporary credentials to access AWS resources like Amazon S3, using policy variables to enforce least-privilege folder boundaries dynamically.
Question 88Question →

A Solutions Architect is establishing a multi-account AWS environment for a financial organization. The compliance guidelines require that no member accounts can modify VPC flow logs or delete customer managed keys. Additionally, all administrative access to the AWS accounts must be mapped directly to the organization's existing corporate identity provider. Which two actions should the Solutions Architect implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center and federate it with the corporate identity provider to centrally manage cross-account permissions.; Create and attach an SCP to the organizational units containing the member accounts to deny actions such as deleting flow logs and scheduling key deletion.

Answer

Configure AWS IAM Identity Center integrated with the corporate identity provider, and apply SCPs at the organizational unit level to restrict member accounts.
Establishing centralized authentication through AWS IAM Identity Center integrated with the corporate identity provider represents the best practice for federated access. Enforcing compliance restrictions through SCPs attached to organizational units ensures that policy boundaries are enforced on all member accounts automatically.

Step-by-Step Solution

1
Configure identity federation using AWS IAM Identity Center.
Centralized identity federation is established with the corporate identity provider.
This allows administrators to log in using their existing credentials and receive temporary credentials, eliminating the need to manage individual IAM users.
2
Define and attach SCPs at the organizational unit level.
Actions such as deleting flow logs and scheduling KMS key deletion are blocked for all principals within the member accounts.
SCPs are the standard way to enforce strict governance boundaries across multiple member accounts under AWS Organizations.

Key Concept

Multi-Account Governance with SCPs and IAM Identity Center
Question 89Question →

An enterprise uses a multi-account AWS architecture. Internal auditors authenticate via an identity provider (IdP) federated with a central Identity AWS account. The auditors need to read sensitive audit logs stored in an Amazon S3 bucket located in a separate Production AWS account. The S3 bucket is encrypted using a customer managed AWS KMS key in the Production account. A solutions architect must design a secure access strategy that adheres to the principle of least privilege.

Which strategy should the solutions architect implement to meet these requirements?

Show answer & explanation

Answer: Configure SAML 2.0 federation to allow auditors to assume an IAM role in the Identity account, which then assumes a cross-account IAM role in the Production account. Attach an IAM policy to the Production role allowing s3:GetObject on the bucket and kms:Decrypt on the KMS key. Configure the S3 bucket policy and the KMS key policy in the Production account to explicitly trust the Production IAM role.

Answer

Configure SAML 2.0 federation to allow auditors to assume an IAM role in the Identity account, which then assumes a cross-account IAM role in the Production account. Attach an IAM policy to the Production role allowing s3:GetObject on the bucket and kms:Decrypt on the KMS key. Configure the S3 bucket policy and the KMS key policy in the Production account to explicitly trust the Production IAM role.
The correct strategy establishes identity federation to avoid creating long-term IAM users, uses cross-account role assumption to bridge the Identity and Production accounts, and configures the necessary trust/permission policies across IAM, S3, and KMS. In cross-account scenarios, S3 bucket policies and KMS key policies must explicitly grant access to the external role, and the role's policy itself must permit the corresponding API calls.

Step-by-Step Solution

1
Establish federated identity access using SAML 2.0 with an Identity provider.
Users authenticate against the corporate directory and assume an IAM role in the central Identity account without requiring long-term IAM user credentials.
This centralizes identity management and follows AWS best practices for enterprise user access.
2
Configure cross-account IAM role assumption from the Identity account to the Production account.
The IAM role in the Identity account is trusted to assume a target role in the Production account.
This enables secure boundaries across different AWS accounts in a multi-account landing zone.
3
Assign least-privilege permissions to the target IAM role in the Production account and configure resource-based policies.
The target IAM role is granted permission to get objects and decrypt them via KMS. The S3 bucket policy and KMS key policy explicitly trust the target IAM role.
For cross-account resource access (specifically S3 and KMS), both the caller's IAM policy and the resource-based policy must explicitly allow the action.

Key Concept

Cross-Account IAM delegation and Resource Access with KMS Decryption under Federated Identities
Estimated Time:3m 0s
Question 90Question →

A global healthcare SaaS provider hosts its telemedicine platform on AWS. The architecture consists of an Amazon CloudFront distribution caching static web content, an Application Load Balancer (ALB), and an Amazon ECS cluster running containerized microservices on AWS Fargate. During a high-profile launch, the platform experiences a distributed denial of service (DDoS) attack consisting of a massive Layer 3/4 UDP reflection attack, a Layer 7 HTTP GET flood targeting the patient search API endpoint, and concurrent SQL injection attempts on the database through the search parameters. The provider needs to implement a solution that automatically detects and mitigates the Layer 3/4 volumetric attacks at the network edge, identifies and blocks the SQL injection attempts and the Layer 7 HTTP GET flood before they reach the ECS cluster, protects the organization from unexpected billing spikes caused by the scale-up of resources during the attack, and prevents attackers from bypassing CloudFront and targeting the ALB directly. Which combination of configurations should the solutions architect implement to meet these requirements?

Show answer & explanation

Answer: Subscribe to AWS Shield Advanced and associate it with both the CloudFront distribution and the ALB. Deploy AWS WAF on the CloudFront distribution with a rate-based rule for the search endpoint and a SQL injection inspection rule. Configure the ALB security group to allow inbound traffic only from the CloudFront managed prefix list, and restrict the ECS security group to allow traffic only from the ALB.

Answer

Subscribe to AWS Shield Advanced and associate it with both the CloudFront distribution and the ALB. Deploy AWS WAF on the CloudFront distribution with a rate-based rule for the search endpoint and a SQL injection inspection rule. Configure the ALB security group to allow inbound traffic only from the CloudFront managed prefix list, and restrict the ECS security group to allow traffic only from the ALB.
Subscribing to AWS Shield Advanced and protecting both Amazon CloudFront and the Application Load Balancer (ALB) provides automatic Layer 3/4 protection and cost protection for scaling charges of these resources. Applying AWS WAF rules at the CloudFront distribution allows Layer 7 rate-limiting and SQL injection protection to happen at the edge, blocking malicious requests before they reach the backend. Restricting the ALB security group to the CloudFront managed prefix list prevents attackers from bypassing the CDN to attack the load balancer directly, and restricting the ECS security group to allow traffic only from the ALB ensures proper multi-tier isolation.

Step-by-Step Solution

1
Select AWS Shield Advanced and associate it with the CloudFront distribution and the Application Load Balancer (ALB).
Establishes automatic mitigation of Layer 3/4 volumetric attacks at the edge and activates DDoS cost protection, allowing the company to request credits for scaling charges on the protected ALB and CloudFront resources.
AWS Shield Standard does not offer cost protection or advanced mitigation for scaling charges.
2
Deploy AWS WAF on the Amazon CloudFront distribution and configure rate-based rules alongside SQL injection detection rules.
Inspects and filters Layer 7 traffic at the CloudFront edge locations, blocking SQL injection attempts and rate-limiting the HTTP GET flood before they reach the ALB or the ECS Fargate containers.
Blocking malicious requests at the edge prevents backend resources from scaling up unnecessarily, saving costs and protecting performance.
3
Configure the ALB security group to restrict inbound traffic to the CloudFront managed prefix list.
Ensures that all incoming traffic to the ALB must originate from CloudFront, preventing attackers from bypassing CloudFront and hitting the load balancer directly.
Direct hits to the ALB bypass the AWS WAF rules and Shield Advanced protections configured on CloudFront.

Key Concept

Edge security design combining AWS Shield Advanced for L3/L4 volumetric protection and cost protection, AWS WAF for L7 application-layer filtering and rate-limiting, and CloudFront managed prefix lists to prevent origin bypass.
Estimated Time:3m 0s
Question 91Question →

A company wants to set up a multi-account environment on AWS. They need to automate the provisioning of new accounts with pre-configured security baselines. Additionally, they must manage user access by federating their existing external directory. Which combination of actions should a solutions architect recommend? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy a landing zone using AWS Control Tower and use Account Factory to provision new accounts.; Configure AWS IAM Identity Center to federate user authentication from the external directory.

Answer

Deploy a landing zone using AWS Control Tower to automate account provisioning, and configure AWS IAM Identity Center to federate user authentication from the external directory.
AWS Control Tower is designed to establish a landing zone and automate the creation of member accounts using Account Factory with pre-defined governance. AWS IAM Identity Center provides centralized federation to external directories, allowing users to authenticate once and access authorized member accounts.

Step-by-Step Solution

1
Evaluate the requirement for automating multi-account provisioning with security guardrails.
Identify AWS Control Tower as the primary service for creating a landing zone and provisioning accounts via Account Factory.
AWS Control Tower automates the setup of a secure, multi-account AWS environment using best practices.
2
Evaluate the requirement for central identity federation using an external corporate directory.
Identify AWS IAM Identity Center as the service to connect the external directory and manage centralized single sign-on access.
AWS IAM Identity Center allows federated users to access multiple AWS accounts without managing credentials locally in IAM.

Key Concept

Multi-account management and centralized federation in AWS Organizations.
Estimated Time:1m 0s
Question 92Question →

A company hosts a public-facing web application on AWS. The company needs to protect the application from common web exploits, such as SQL injection, and from infrastructure-layer DDoS attacks, such as UDP floods. Which two AWS services should the solutions architect utilize to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS WAF to inspect incoming HTTP/HTTPS traffic and block common web exploits; AWS Shield Standard to safeguard the application against common Layer 3 and Layer 4 DDoS attacks

Answer

To meet the requirements, the solutions architect should use AWS WAF to inspect HTTP/HTTPS traffic and block web exploits like SQL injection, and use AWS Shield Standard to protect against infrastructure-layer DDoS attacks like UDP floods.
The correct options are the services that inspect and protect different layers of the application network stack. AWS WAF provides Layer 7 inspection to block common web exploits like SQL injection by analyzing the HTTP request payload. AWS Shield Standard provides automatic Layer 3 and Layer 4 DDoS protection to mitigate infrastructure attacks like UDP floods before they reach the application resources.

Step-by-Step Solution

1
Identify the service required to protect against Layer 7 application-layer exploits (such as SQL injection).
AWS WAF is designed specifically for this purpose, inspecting HTTP/HTTPS traffic at Layer 7.
Web application firewalls inspect the payload of HTTP requests to identify and block patterns associated with SQL injection and cross-site scripting.
2
Identify the service required to protect against Layer 3 and Layer 4 infrastructure DDoS attacks (such as UDP floods).
AWS Shield Standard provides automatic protection against these types of attacks at the AWS edge.
AWS Shield Standard operates at the network and transport layers to defend resources from high-volume attacks like UDP floods.
3
Evaluate the remaining options to ensure they do not meet the security and architectural requirements.
Security groups and Network ACLs operate at Layer 3/4 but lack application-layer inspection or automatic managed DDoS mitigation capabilities. Amazon Inspector is a vulnerability scanner, not a real-time traffic filtering or DDoS protection tool.
This confirms that the selected services are the correct and optimal choices for the architecture.

Key Concept

Combining AWS WAF for Layer 7 application protection and AWS Shield Standard for Layer 3/4 infrastructure DDoS protection is the standard AWS best practice for edge security.
Estimated Time:1m 0s
Question 93Question →

A Solutions Architect is designing the multi-account governance and security framework for an enterprise using AWS Organizations. The organization consists of separate Organizational Units (OUs) for Core Services, Production Workloads, and Development Sandboxes. The compliance team requires that no member account be able to modify or delete centralized AWS CloudTrail and AWS Config configurations. Additionally, corporate users must authenticate using an external SAML 2.0 identity provider to access target member accounts using temporary credentials, minimizing administrative overhead in individual accounts. Finally, these controls must not restrict management functions or billing administrative tasks in the management account. Which two actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate with the external identity provider using SAML 2.0, and assign permission sets to manage access across member accounts.; Create an SCP that denies the ability to delete or modify AWS CloudTrail and AWS Config resources, and attach it to the organization's root or specific OUs.

Answer

Configure AWS IAM Identity Center to federate with the external identity provider using SAML 2.0, and assign permission sets to manage access across member accounts. Create an SCP that denies the ability to delete or modify AWS CloudTrail and AWS Config resources, and attach it to the organization's root or specific OUs.
Centralizing identity access via AWS IAM Identity Center allows integration with an external SAML 2.0 identity provider to manage users and permission sets centrally, providing short-term credentials without creating IAM users in every account. Additionally, Service Control Policies (SCPs) applied at the organization's root or OUs prevent member accounts from modifying auditing resources, while leaving the management account unaffected because SCPs do not apply to it.

Step-by-Step Solution

1
Identify the mechanism for centralized identity federation.
AWS IAM Identity Center is selected to federate with the SAML 2.0 identity provider, enabling single sign-on with short-term credentials across member accounts.
This avoids manual IAM user creation and complies with security best practices.
2
Determine the control policy type for compliance enforcement across member accounts.
An SCP is designed to deny deletion or modification of AWS CloudTrail and AWS Config.
SCPs allow global permission boundaries to be enforced across all member accounts within an OU or the entire organization.
3
Evaluate the impact on the management account.
The SCP is attached to the organization's root or specific OUs. Since SCPs do not apply to the management account, the management account's administrative and billing functions remain unrestricted.
This satisfies the requirement that governance controls do not disrupt the management account's functions.

Key Concept

Centralized governance via AWS Organizations SCPs and identity federation via AWS IAM Identity Center.
Question 94Question →

A company is developing a hybrid cloud application. A component of the application runs on a physical server in the company's on-premises data center and requires programmatic access to write transaction logs to an Amazon DynamoDB table. To comply with security standards, the application must not use long-term AWS credentials, and access must be secured using the company's existing on-premises public key infrastructure (PKI). Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Configure AWS IAM Roles Anywhere. Establish a trust anchor using the on-premises Certificate Authority (CA) and associate it with an IAM role that has write permissions to the DynamoDB table. Configure the on-premises application to exchange its X.509 digital certificate for temporary AWS credentials.

Answer

Configure AWS IAM Roles Anywhere by establishing a trust anchor with the on-premises Certificate Authority (CA), associating it with an IAM role, and exchanging X.509 digital certificates for temporary AWS credentials.
The correct solution uses AWS IAM Roles Anywhere to extend IAM role capabilities to workloads outside of AWS. By setting up a trust anchor with the on-premises Certificate Authority (CA), the on-premises application can exchange its X.509 certificate for temporary, short-lived AWS credentials. This avoids the use of long-term credentials and utilizes the existing PKI infrastructure.

Step-by-Step Solution

1
Establish trust with the on-premises environment.
Create a trust anchor in AWS IAM Roles Anywhere using the company's existing Certificate Authority (CA) certificate.
This establishes a cryptographic trust relationship between AWS IAM Roles Anywhere and the on-premises PKI.
2
Define permissions and trust relationships.
Create an IAM role with write permissions to the DynamoDB table, and define a trust policy that allows the IAM Roles Anywhere service principal (rolesanywhere.amazonaws.com) to assume the role.
This ensures the temporary credentials obtained will have the correct permissions and that IAM Roles Anywhere is authorized to assume the role.
3
Associate the role with a profile and request credentials.
Create an IAM Roles Anywhere profile containing the IAM role. Configure the on-premises application to use the credential helper tool to sign requests with its X.509 certificate and request temporary credentials.
This dynamically generates short-lived IAM credentials for the application without storing any long-term AWS access keys on-premises.

Key Concept

AWS IAM Roles Anywhere enables on-premises workloads to securely obtain temporary AWS credentials using local digital certificates (X.509) instead of using long-term IAM access keys, aligning with security best practices.
Question 95Question →

A startup is setting up its AWS environment and wants to establish secure access for its developers and applications. The solutions architect needs to follow the principle of least privilege and AWS security best practices. Which TWO actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate the company's corporate identity provider for user access.; Create IAM roles with least-privilege permissions and require users or applications to assume them.

Answer

Configuring AWS IAM Identity Center to federate the company's corporate identity provider and creating IAM roles with least-privilege permissions.
Configuring AWS IAM Identity Center for identity federation and utilizing IAM roles with least-privilege policies are standard AWS best practices. Federation provides central access management using temporary security credentials, while roles enforce granular access limits without relying on long-term keys.

Step-by-Step Solution

1
Evaluate user access requirements.
Identify that using AWS IAM Identity Center for federation is the best practice for directory users.
This avoids creating individual IAM users with long-term access keys and centralizes user management.
2
Apply the principle of least privilege for permissions.
Create IAM roles with minimal necessary permissions that users and systems assume dynamically.
Roles issue short-lived credentials, which reduces the threat window if credentials are intercepted.

Key Concept

AWS Identity and Access Management (IAM) security best practices including identity federation, least-privilege IAM roles, and avoiding long-term credentials or root user usage.
Estimated Time:1m 0s
Question 96Question →

A company needs to grant daily administrative access to a team of solutions architects. The administrators will perform tasks such as launching Amazon EC2 instances and configuring Amazon S3 buckets. Additionally, the company needs to store database connection strings and passwords securely.

Which design choice represents the most secure approach for these requirements?

Show answer & explanation

Answer: Configure individual IAM users or roles with policies granting least privilege for daily administrative tasks, and store the database credentials in AWS Secrets Manager.

Answer

Configure individual IAM users or roles with policies granting least privilege for daily administrative tasks, and store the database credentials in AWS Secrets Manager.
The correct configuration utilizes individual IAM identities (users or roles) adhering to the principle of least privilege, while leveraging AWS Secrets Manager to securely encrypt, store, and manage database credentials. This aligns with AWS security best practices.

Step-by-Step Solution

1
Evaluate the mechanism for administrative access, ensuring the root account is restricted to account-level actions only.
The root account should not be used, and standard administrative tasks should be executed via individual IAM users or roles.
This enforces the principle of least privilege and provides accountability for administrative actions.
2
Analyze the requirement for database credential storage, comparing secure storage options with plaintext parameters.
Sensitive credentials must be encrypted using Secrets Manager, rather than being stored in plaintext.
Plaintext parameters in Systems Manager Parameter Store expose credentials to unauthorized access.
3
Verify if federated access should be used over local IAM users.
If users authenticate via an external identity provider, identity federation is preferred over creating long-term IAM users.
This reduces administrative complexity and centralizes user lifecycle management.

Key Concept

AWS IAM Best Practices (least privilege, avoiding root accounts, and securing sensitive data)
Question 97Question →

A company is onboarding a third-party audit firm to perform security compliance checks on their AWS infrastructure. The auditor needs access to read configuration logs from an Amazon S3 bucket located in the company's production AWS account. The S3 bucket is encrypted using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS). The auditor also needs to retrieve database credentials from AWS Secrets Manager to verify rotation compliance. Which configuration meets these requirements securely under the principle of least privilege?

Show answer & explanation

Answer: Configure a cross-account IAM role in the production account that the auditor's AWS account can assume. Attach an IAM policy to the role that grants read access to the S3 bucket, decryption permissions on the KMS key, and read access to the Secrets Manager secret. Update the KMS key policy in the production account to allow the cross-account role to perform the kms:Decrypt action.

Answer

Configure a cross-account IAM role in the production account that the auditor's AWS account can assume, attach an IAM policy to the role granting access to the S3 bucket, the KMS key, and the Secrets Manager secret, and update the KMS key policy to permit the role to perform the kms:Decrypt action.
The correct configuration implements cross-account access using an IAM role, which is the AWS-recommended security best practice for granting external third-party access. It avoids creating long-term credentials. Since the S3 bucket is encrypted using a Customer Managed Key (CMK), cross-account access requires permissions to be granted in both the role's identity-based policy and the key policy of the KMS key. Granting the role access to the S3 bucket, the KMS key, and the Secrets Manager secret follows the principle of least privilege.

Step-by-Step Solution

1
Create a cross-account IAM role in the production AWS account.
An IAM role is created with a trust policy that permits the auditor's AWS account to assume it.
This establishes secure cross-account delegation and avoids the creation of long-term credentials for external entities.
2
Attach an identity-based policy to the IAM role.
The role is granted permissions to read from the S3 bucket, decrypt using the KMS key, and retrieve the secret from Secrets Manager.
This defines the specific actions the role is authorized to perform under the principle of least privilege.
3
Modify the KMS Customer Managed Key policy in the production account.
The key policy is updated to explicitly allow the cross-account role to perform the kms:Decrypt action.
For cross-account access to resources encrypted with KMS, both the identity-based policy in the calling account/role and the resource-based key policy in the owning account must explicitly allow the action.

Key Concept

Cross-account access delegation using IAM roles, S3 bucket policies, Secrets Manager, and KMS key policies.
Estimated Time:2m 0s
Question 98Question →

A solutions architect is designing a secure architecture for an application running on Amazon EC2 instances. The application needs to retrieve database credentials to connect to an Amazon Aurora database. Which combination of actions should the solutions architect take to grant the application access to the credentials securely? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation.; Create an IAM role with permissions to access the secret, and attach it to the EC2 instances using an instance profile.

Answer

Store the database credentials in AWS Secrets Manager and create an IAM role with permissions to access the secret, attaching it to the EC2 instances using an instance profile.
The correct solution involves storing the credentials in AWS Secrets Manager, which secures and automatically rotates the secret, and using an IAM role attached to the EC2 instance profile. This design allows the application to dynamically retrieve temporary credentials to access the secret, satisfying the principle of least privilege and eliminating long-term hardcoded credentials.

Step-by-Step Solution

1
Store the credentials in AWS Secrets Manager.
The credentials are encrypted at rest and can be rotated automatically.
Securing database credentials prevents unauthorized access and meets security compliance requirements.
2
Create an IAM role that grants access to the specific secret and assign it to the EC2 instance profile.
The application running on the EC2 instances can fetch temporary security credentials automatically.
This avoids hardcoding long-term access keys or using administrative credentials on the instance.

Key Concept

Applying IAM roles for EC2 instances and using Secrets Manager for secure credential storage.
Question 99Question →

A company is onboarding an external contractor team to manage application servers running on Amazon EC2. The contractors authenticate using an external SAML 2.0 identity provider (IdP). The solutions architect must grant the contractors permission to start and stop EC2 instances, ensuring they can only manage instances assigned to their specific project team. The solution must avoid the use of long-term credentials and minimize administrative overhead. Which solution should the solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Configure SAML 2.0 federation to allow contractors to assume an IAM role. Attach an IAM policy to the role that allows ec2:StartInstances and ec2:StopInstances, using a policy condition that matches the principal's project tag with the EC2 instance's project tag.

Answer

The solution that configures SAML 2.0 federation to allow contractors to assume an IAM role, and uses a policy condition to match the principal's project tag with the EC2 instance's project tag.
Configuring SAML 2.0 federation allows users to authenticate via their corporate identity provider and assume an IAM role, which provides temporary security credentials. Employing Attribute-Based Access Control (ABAC) by matching principal tags with resource tags dynamically enforces fine-grained access control. This solution automatically scales as new project teams are added without needing to modify existing IAM policies, thus minimizing administrative overhead.

Step-by-Step Solution

1
Establish federation with the corporate identity provider.
Contractors can authenticate and assume an IAM role to receive temporary security credentials, avoiding long-term access keys.
Security best practices dictate using temporary credentials via federation for external users.
2
Implement Attribute-Based Access Control (ABAC) using resource and principal tags.
The solutions architect designs an IAM policy that checks if the principal tag matches the resource tag.
This dynamically restricts contractors to only start and stop EC2 instances belonging to their specific project team.
3
Verify that no administrative secrets are exposed.
Root credentials are secure, and no access keys are stored in plaintext parameters.
This guarantees compliance with SAA security guidelines and prevents unauthorized privilege escalation.

Key Concept

Attribute-Based Access Control (ABAC) and SAML 2.0 Federation
Question 100Question →

A solutions architect is configuring security for a new AWS account. The account will host an application that connects to an Amazon RDS database. The solutions architect needs to provide access to the AWS Management Console for a team of database administrators who already authenticate using the corporate Active Directory. Additionally, the architect needs to store the database credentials securely. Which TWO actions should the solutions architect take? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure identity federation using AWS IAM Identity Center to grant the database administrators access to the AWS Management Console.; Store the database credentials in AWS Secrets Manager and configure automatic credential rotation.

Answer

The database administrators should access the AWS Management Console using identity federation with AWS IAM Identity Center, and the database credentials should be stored in AWS Secrets Manager with automatic rotation enabled.
The correct actions are to configure identity federation using AWS IAM Identity Center and to store database credentials in AWS Secrets Manager with automatic rotation. Integrating AWS IAM Identity Center with the corporate Active Directory allows users to authenticate using their existing credentials and avoids the need to manage individual IAM users with long-term security keys. AWS Secrets Manager is the designated service to securely store, manage, and automatically rotate database credentials.

Step-by-Step Solution

1
Determine the optimal identity management strategy for the database administrators.
Since the database administrators already authenticate via a corporate Active Directory, configure identity federation using AWS IAM Identity Center instead of creating individual IAM users.
This avoids creating individual IAM users with long-term credentials, conforming to AWS security best practices.
2
Select the correct mechanism for securing database credentials.
Store the credentials in AWS Secrets Manager and enable automatic rotation.
Secrets Manager is built to securely store, retrieve, and automatically rotate credentials, ensuring compliance and minimizing the risk of credential exposure.

Key Concept

AWS Identity and Access Management (IAM) best practices mandate using identity federation instead of long-term credentials for existing directory users, avoiding the use of root user accounts for daily tasks, and securing sensitive database credentials using dedicated secrets management services with automatic rotation.
PreviousPage 5 / 22Next
Design Secure Architectures Practice Questions — AWS Certified Solutions Architect - Associate — Page 5 | Examkin