Examkin

Design Secure Architectures

438 questions

All types438Multiple choice214Multiple select224
Question 121Question →

A company needs to configure administrative access for a systems administrator to manage AWS resources daily. According to AWS security best practices, which approach should the company use to grant this access?

Show answer & explanation

Answer: Create an IAM user with the required administrative permissions and require Multi-Factor Authentication (MFA).

Answer

Create an IAM user with the required administrative permissions and require Multi-Factor Authentication (MFA).
The correct approach is to create a dedicated IAM user with the necessary administrative permissions and enforce Multi-Factor Authentication (MFA). AWS strongly recommends not using the root user for daily tasks, utilizing IAM roles/users with least privilege, and protecting privileged accounts with MFA.

Step-by-Step Solution

1
Evaluate the requirement for daily administrative access to AWS resources.
Identify that standard administrative tasks should follow the principle of least privilege and use separate credentials rather than root credentials.
To secure the AWS environment and prevent accidental or malicious actions that could compromise the entire account.
2
Select the appropriate IAM entity for the administrator.
Choose to create a dedicated IAM user (or use IAM Identity Center for federated access) and assign only the necessary permissions.
This aligns with the principle of least privilege and isolates the administrator's actions.
3
Apply additional security controls.
Enforce Multi-Factor Authentication (MFA) on the administrative user account.
MFA adds an essential layer of security to prevent unauthorized access even if the primary credentials are compromised.

Key Concept

AWS Identity and Access Management (IAM) Best Practices
Estimated Time:1m 0s
Question 122Question →

An organization is designing a serverless data processing application. AWS Lambda functions in the application must securely access a database password to connect to an Amazon RDS database. The database credentials must be rotated every 30 days without application downtime. Additionally, an external compliance auditor requires temporary, read-only access to the Amazon S3 bucket where the processed output files are stored.

Which combination of actions should the solutions architect take to meet these requirements securely? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure AWS Secrets Manager to store the database credentials, enable automatic rotation every 30 days using a rotation Lambda function, and grant the Lambda execution role permissions to retrieve the secret.; Create an IAM role in the processing account that grants read-only access to the S3 bucket, configure a trust policy that allows the auditor's AWS account to assume the role, and provide the auditor with the role ARN.

Answer

Configure AWS Secrets Manager to store database credentials with automatic rotation, and create a cross-account IAM role with a trust policy for the external auditor.
The correct architecture uses AWS Secrets Manager to store and rotate database passwords dynamically, which keeps credentials secure and satisfies the rotation requirement. To grant secure cross-account access to the external auditor, creating an IAM role with a trust policy allowing the auditor's account to assume it is the standard and most secure pattern because it provides temporary credentials instead of long-term access keys.

Step-by-Step Solution

1
Store the sensitive database credentials securely in AWS Secrets Manager and set up automatic 30-day rotation using the built-in integration with AWS Lambda.
The database credentials are encrypted at rest, rotated automatically without manual intervention or downtime, and can be retrieved dynamically by the application.
This meets the security requirement for credential rotation and protects the credentials from exposure.
2
Configure the Lambda execution role with permissions to access the specific secret from Secrets Manager.
The Lambda function can authenticate to the database securely at runtime without hardcoding credentials.
This enforces the principle of least privilege by restricting access to only the authorized resource.
3
Establish a cross-account IAM role in the local AWS account that has read-only access to the S3 bucket, and define a trust policy referencing the external auditor's AWS account ID.
The external auditor can assume the role to receive temporary security credentials for S3 access.
This avoids creating long-term IAM users or sharing permanent credentials with external third parties.

Key Concept

AWS IAM identity federation, cross-account access via roles, and secure secrets management with rotation.
Question 123Question →

An enterprise runs a microservices-based application on Amazon ECS in Account B. The application requires read access to sensitive customer data files stored in an Amazon S3 bucket within Account A. The S3 bucket is encrypted using an AWS KMS customer managed key (CMK) in Account A. A solutions architect must design a secure, cross-account access pattern following the principle of least privilege, ensuring that credentials are not hardcoded or stored insecurely. Which combination of configurations must the solutions architect implement to achieve this goal? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM task role in Account B with permissions to read from the S3 bucket and decrypt using the KMS key, and associate it with the ECS task definition.; Configure both the S3 bucket policy and the KMS key policy in Account A to explicitly grant the ECS task role in Account B permissions for read and decrypt actions.

Answer

Creating an IAM task role in Account B associated with the ECS task definition, and configuring the S3 bucket policy and KMS key policy in Account A to grant permissions to that role.
To establish secure cross-account access, the solutions architect must assign an IAM task role directly to the ECS container. Additionally, because the S3 bucket and KMS CMK are in Account A (cross-account relative to the ECS task in Account B), the resource-based policies in Account A (the bucket policy and KMS key policy) must explicitly authorize the ECS task role from Account B.

Step-by-Step Solution

1
Define an IAM task role in the application's account (Account B) with a trust policy allowing the ECS task executor to assume the role.
An IAM role is created that can be assumed by ECS containers at launch.
Allows containerized tasks to dynamically obtain temporary security credentials instead of relying on long-term IAM user keys.
2
Associate the newly created IAM task role with the ECS task definition.
The ECS container receives local environment variables with temporary AWS credentials.
Permits the application code inside the container to make authenticated AWS API calls under the identity of the task role.
3
Modify the S3 bucket policy in Account A to allow read permissions for the IAM task role's ARN in Account B.
Cross-account S3 access is authorized at the resource level.
Cross-account access to S3 requires explicit authorization from both the IAM identity policy and the target resource's bucket policy.
4
Update the KMS key policy in Account A to allow decrypt permissions for the IAM task role's ARN in Account B.
Cross-account KMS decrypt authorization is established.
Because the S3 objects are encrypted with a Customer Managed Key, the reader must have explicit decrypt permissions on the key policy; IAM policies alone cannot grant access to cross-account KMS keys.

Key Concept

Cross-account resource delegation using IAM roles, S3 bucket policies, and KMS key policies.
Estimated Time:3m 0s
Question 124Question →

A company is deploying a new web application on AWS using Amazon CloudFront and an Application Load Balancer. The company needs to design a security strategy that protects the application against two specific threats: common application-layer exploits such as SQL injection, and volumetric Layer 3 and Layer 4 DDoS attacks.

Which combination of AWS services should the solutions architect implement to address these threats? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: AWS WAF to inspect incoming HTTP/HTTPS requests and block SQL injection patterns.; AWS Shield Standard to provide automatic, always-on protection against Layer 3 and Layer 4 DDoS attacks.

Answer

AWS WAF to inspect incoming HTTP/HTTPS requests and block SQL injection patterns, and AWS Shield Standard to provide automatic, always-on protection against Layer 3 and Layer 4 DDoS attacks.
The solution requires addressing both Layer 7 exploits (like SQL injection) and Layer 3/4 DDoS attacks. AWS WAF provides Layer 7 protection by inspecting HTTP/HTTPS traffic to filter out SQL injection patterns. AWS Shield Standard automatically provides Layer 3 and Layer 4 protection against common infrastructure-layer DDoS attacks at the edge.

Step-by-Step Solution

1
Identify the application-layer (Layer 7) security requirement.
SQL injection is a Layer 7 exploit that requires HTTP/HTTPS payload inspection to detect and block malicious patterns.
AWS WAF is the service that inspects Layer 7 web traffic and applies rules to filter out exploits like SQL injection.
2
Identify the infrastructure-layer (Layer 3/4) security requirement.
Volumetric DDoS attacks target the network and transport layers (Layers 3 and 4).
AWS Shield Standard provides automatic, always-on protection against common Layer 3 and 4 DDoS attacks at no additional cost.
3
Evaluate and eliminate incorrect firewalls.
Security Groups and Network Access Control Lists (NACLs) operate at Layer 4 and cannot inspect application payloads.
They are unsuitable for Layer 7 SQL injection detection, and AWS Shield Standard automatically covers the Layer 3/4 DDoS protection requirement without manually configuring NACLs or Security Groups for DDoS.

Key Concept

AWS WAF provides Layer 7 application-layer filtering, whereas AWS Shield Standard automatically protects against Layer 3/4 infrastructure-layer DDoS attacks.
Question 125Question →

A municipal transit authority operates a real-time vehicle tracking API endpoint on AWS. The API is deployed behind an Application Load Balancer (ALB) and receives rapid HTTP requests from commuter mobile applications. The authority needs to protect the infrastructure from volumetric Layer 3/4 DDoS attacks and prevent clients from overwhelming the backend EC2 instances with high-rate Layer 7 HTTP GET requests. Which combination of AWS configurations should a solutions architect implement to meet these security requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable AWS Shield Advanced on the Application Load Balancer to provide automatic mitigation against infrastructure-layer volumetric attacks.; Deploy AWS WAF with a rate-based rule associated with the Application Load Balancer to block clients exceeding request thresholds.

Answer

Enable AWS Shield Advanced on the Application Load Balancer to protect against infrastructure-layer volumetric attacks, and deploy AWS WAF with a rate-based rule associated with the Application Load Balancer to block clients exceeding HTTP request rate thresholds.
Implementing AWS Shield Advanced on the Application Load Balancer provides dedicated protection against volumetric Layer 3 and Layer 4 infrastructure attacks. Simultaneously, associating AWS WAF with a rate-based rule on the Application Load Balancer dynamically mitigates Layer 7 HTTP flood attacks by tracking request rates from individual client IPs and blocking those that exceed safe thresholds.

Step-by-Step Solution

1
Address the infrastructure-layer (Layer 3 and 4) volumetric DDoS protection requirement.
Enable AWS Shield Advanced on the Application Load Balancer.
AWS Shield Advanced provides active mitigation against volumetric Layer 3/4 attacks specifically tailored to protected AWS resources like Application Load Balancers.
2
Address the application-layer (Layer 7) protection and rate-limiting requirement.
Create an AWS WAF Web ACL containing a rate-based rule and associate it with the Application Load Balancer.
AWS WAF rate-based rules evaluate client requests over a sliding window (e.g., 5 minutes) and block traffic from client IPs that exceed the specified limit, protecting backend EC2 instances from HTTP floods.

Key Concept

Edge protection requires a layered approach: AWS Shield Advanced for L3/L4 volumetric protection, and AWS WAF with rate-based rules for L7 application-layer mitigation.
Estimated Time:2m 0s
Question 126Question →

A company is deploying an application on Amazon EC2 instances. The application needs to retrieve data from an Amazon DynamoDB table. Which TWO actions should a solutions architect take to configure access to the DynamoDB table in a secure manner? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM role that has query permissions for the DynamoDB table.; Create an EC2 instance profile, attach the IAM role to it, and associate it with the EC2 instances.

Answer

Create an IAM role with query permissions for the DynamoDB table, and associate that role with the EC2 instances using an EC2 instance profile.
Defining permissions in an IAM role and attaching it to the EC2 instances via an instance profile is the secure, standard pattern on AWS. The application uses temporary, auto-rotating credentials from the Instance Metadata Service, which completely avoids storing long-term credentials.

Step-by-Step Solution

1
Define the IAM role permissions.
An IAM role is created with a policy allowing query operations on the specific DynamoDB table.
This establishes least privilege access for the application's required operations.
2
Attach the role to the EC2 instances.
An EC2 instance profile containing the IAM role is created and associated with the EC2 instances.
This allows the application on EC2 to automatically request temporary security credentials from the Instance Metadata Service (IMDS) without managing hardcoded keys.

Key Concept

IAM roles for EC2 instances allow applications to securely access AWS resources using temporary credentials rather than long-term keys.
Question 127Question →

A Solutions Architect is designing a multi-account environment on AWS for a global retail analytics platform. The company wants to enforce a policy where database administrators can only manage database resources within specific production and development accounts. In addition, the security team requires that all user authentication be centralized against their existing external identity provider, and that security monitoring configurations in member accounts cannot be modified by any local administrators. Which combination of actions should the Solutions Architect recommend to meet these requirements with the least administrative effort?

Show answer & explanation

Answer: Configure AWS IAM Identity Center connected to the external identity provider for user access. Create Service Control Policies (SCPs) in AWS Organizations that prevent the modification of security configurations, and attach them to the member Organizational Units (OUs).

Answer

Configure AWS IAM Identity Center connected to the external identity provider for user access, and create Service Control Policies (SCPs) in AWS Organizations that prevent the modification of security configurations, attaching them to the member Organizational Units (OUs).
Centralizing authentication using AWS IAM Identity Center integrated with an external identity provider simplifies user access management without creating individual IAM users. Service Control Policies (SCPs) applied at the Organizational Unit (OU) level can restrict member accounts from modifying security configurations, implementing guardrails that even local administrators cannot bypass.

Step-by-Step Solution

1
Evaluate identity federation options to meet the centralized authentication requirement.
Identify AWS IAM Identity Center as the recommended tool to integrate with an external identity provider rather than creating static IAM users.
Centralized identity provider integration reduces credential management complexity and follows the principle of least privilege.
2
Determine the mechanism to enforce compliance and prevent local administrators from changing security settings.
Identify Service Control Policies (SCPs) in AWS Organizations attached to member Organizational Units (OUs) to act as permission guardrails.
SCPs apply to all users and roles in member accounts, including the local administrators (administrator/root permissions inside that account).
3
Combine the identity federation and SCP strategy to form a cohesive multi-account governance solution.
Select the option that configures AWS IAM Identity Center for external federation and uses SCPs attached to member OUs.
This combination achieves secure governance, centralized identity management, and enforces policy controls with minimal administrative effort.

Key Concept

Multi-Account Governance with AWS Organizations, AWS IAM Identity Center, and Service Control Policies (SCPs)
Question 128Question →

A financial company uses a central identity AWS account to federate user logins from an external OIDC-compliant Identity Provider (IdP). Developers must perform administrative tasks on Amazon EC2 instances and Amazon RDS databases in multiple application-specific AWS accounts. The security team mandates that access must be granted dynamically based on the developer’s active project assignment, which is stored as a custom attribute in the IdP. The solution must enforce Attribute-Based Access Control (ABAC), support temporary credentials, and ensure no credentials or user profiles are manually maintained in the target application accounts. Which combination of actions will meet these requirements securely?

Show answer & explanation

Answer: Configure the external IdP to send the project attribute as a session tag in the OIDC token. In the central identity account, allow the IAM role assumed by developers to transitively pass session tags. In each application account, configure the trust policy of the target IAM role to trust the identity account and permit the sts:AssumeRole and sts:TagSession actions. Attach an identity-based policy to the target role that allows EC2 and RDS actions only when the resource's project tag matches the principal tag aws:PrincipalTag/Project.

Answer

The configuration using session tags in the IdP, transitively passing them through sts:TagSession in trust policies, and using aws:PrincipalTag/Project for ABAC.
The correct solution leverages native AWS federation and Attribute-Based Access Control (ABAC). By configuring the external IdP to pass the project attribute as a session tag and allowing the sts:TagSession action in the cross-account trust policy, developers can securely carry their attributes across AWS accounts. In the destination accounts, the target role's identity policy compares the resource tag with the principal's session tag (using the aws:PrincipalTag/Project key), ensuring that access is granted dynamically without manually managing IAM users or static credentials in each environment.

Step-by-Step Solution

1
Configure OIDC and pass Attributes as Tags
The external IdP passes the project attribute as a session tag (e.g., Project) within the SAML assertion or OIDC token during authentication.
This allows AWS to receive the user's identity attributes as session tags, which is the foundation of Attribute-Based Access Control (ABAC).
2
Configure cross-account delegation with TagSession trust
In the application accounts, the cross-account role's trust policy is configured to trust the central identity account and explicitly allow the action sts:TagSession in addition to sts:AssumeRole.
The sts:TagSession action is required to permit the calling identity in the central account to transitively pass session tags to the role in the target application account.
3
Implement ABAC evaluation logic in the target role's permission policy
An identity-based policy attached to the target role in the application account allows EC2 and RDS actions only when the resource's project tag matches the context key aws:PrincipalTag/Project.
The aws:PrincipalTag/Project context key evaluates the Project session tag of the principal (developer) against the resource's tags to authorize access dynamically.

Key Concept

Federated Attribute-Based Access Control (ABAC) using IAM Session Tags and cross-account sts:TagSession trust policies.
Estimated Time:3m 0s
Question 129Question →

A global financial services enterprise uses AWS Organizations to manage its multi-account environment. The security team needs to implement governance controls with the following requirements:
- Security audit teams require read-only access across all member accounts without managing local IAM credentials.
- No member account administrator can disable CloudTrail or delete the S3 buckets containing audit logs.
- Developers in sandbox accounts must have administrative privileges but must be prevented from launching GPU-based instance types (such as `p*` or `g*`) or creating resources outside of approved regions (`us-east-1` and `us-west-2`).
- Day-to-day administration of the AWS Organization must be delegated to administrators using temporary credentials, preventing the use of the management account's root credentials for routine tasks.

Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center integrated with the enterprise identity provider (IdP). Create a read-only permission set and assign it to the security audit team's group across the organization. Create administrative permission sets for day-to-day organization management in the management account.; Attach a Service Control Policy (SCP) at the organization root that denies log deletion and CloudTrail modification API calls. Attach a separate SCP to the Sandbox Organizational Unit (OU) that denies the `ec2:RunInstances` action for non-approved regions and GPU instance types.

Answer

The correct strategy combines configuring AWS IAM Identity Center integrated with the enterprise identity provider to govern administrative and audit access, along with deploying Service Control Policies (SCPs) at the organization root and organizational unit levels to enforce log protection and developer resource constraints.
The correct solution uses AWS IAM Identity Center to federate user access, allowing administrative and audit teams to log in using temporary credentials, which complies with the mandate to avoid root credentials. The application of SCPs at the organization root secures CloudTrail and S3 logs against member account admin modifications, and applying another SCP to the Sandbox OU isolates resource constraints to the developer environments.

Step-by-Step Solution

1
Address the centralized access and root credential requirements by setting up AWS IAM Identity Center.
Federation is established with the enterprise identity provider, mapping the audit group to a read-only permission set and the admin group to administrative permission sets. This avoids local credentials and management account root user usage.
AWS IAM Identity Center provides centralized access management with temporary credentials, adhering to compliance and least-privilege mandates.
2
Address the log protection requirement by writing a Service Control Policy (SCP) that restricts S3 bucket deletion and CloudTrail modifications.
An SCP containing deny actions for S3 and CloudTrail is applied at the root of the AWS Organization.
SCPs apply to all member accounts in the organization, preventing even local administrators from disabling logs or deleting audit trails.
3
Address the sandbox constraints by writing an SCP that restricts regions and instance types.
An SCP is attached directly to the Sandbox Organizational Unit (OU), preventing developers from running unauthorized instance types or operating in unauthorized regions.
Applying the SCP at the OU level ensures sandbox constraints do not affect production workloads or core security operations.

Key Concept

Centralized multi-account governance using AWS Organizations SCPs for policy guardrails combined with AWS IAM Identity Center for federated identity control.
Estimated Time:3m 0s
Question 130Question →

A financial services startup is establishing its AWS cloud architecture. The organization needs to centralize authentication using its external Okta directory and restrict member accounts from modifying or deleting baseline security auditing configurations. Additionally, the security policy prohibits the use of long-term credentials for daily operations. Which two actions should be performed to establish this administrative governance model? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Integrate AWS IAM Identity Center with the Okta directory to allow users to sign in and assume permission sets using temporary security credentials.; Deploy a Service Control Policy (SCP) at the root level of the organization to prevent member accounts from stopping or modifying CloudTrail logging configurations.

Answer

Integrating AWS IAM Identity Center with Okta for temporary credential generation, and deploying an organization-level Service Control Policy to protect CloudTrail logging configurations.
Integrating AWS IAM Identity Center with the external directory allows federated users to obtain short-term credentials, eliminating static credential storage. Implementing a Service Control Policy at the organization root enforces compliance and protects logging systems from modifications by administrators in individual member accounts.

Step-by-Step Solution

1
Centralize identity governance and single sign-on access.
Integrate Okta with AWS IAM Identity Center using SAML and SCIM protocols.
This allows users to authenticate using their existing enterprise credentials and obtain temporary security credentials for AWS access, satisfying the requirement to avoid long-term credentials.
2
Enforce organization-wide audit policies.
Create and attach a Service Control Policy (SCP) to the organization's root OU that denies the cloudtrail:StopLogging, cloudtrail:UpdateTrail, and cloudtrail:DeleteTrail actions.
SCPs define permission guardrails across all member accounts, ensuring that local administrators in member accounts cannot modify the auditing configurations.

Key Concept

Centralized identity federation and multi-account security guardrails using Service Control Policies.
Question 131Question →

A Solutions Architect is designing the governance strategy for a company's multi-account environment managed by AWS Organizations. The company requires central control over user access using an external identity provider. Additionally, they must ensure that CloudTrail logging cannot be disabled in any member account. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate access with the company's external identity provider.; Create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging action and attach it to the organization root.

Answer

Configure AWS IAM Identity Center to federate access with the company's external identity provider, and create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging action and attach it to the organization root.
Centralized access control is best achieved by integrating AWS IAM Identity Center with the external identity provider. Enforcing organization-wide security boundaries (such as preventing the disabling of CloudTrail) is done via Service Control Policies (SCPs) attached to the organization's root or organizational units (OUs), which restrict actions in all member accounts.

Step-by-Step Solution

1
Set up centralized identity federation.
AWS IAM Identity Center is connected to the external identity provider, allowing users to log into member accounts without needing local credentials.
This simplifies governance and complies with single sign-on security standards.
2
Establish guardrails against disabling logging.
A Service Control Policy denying the cloudtrail:StopLogging action is created and attached to the root of the organization.
SCPs allow centralized restriction of actions across all member accounts in the organization, preventing users from altering vital security logging.

Key Concept

Centralized multi-account governance using AWS Organizations Service Control Policies (SCPs) and federated access with AWS IAM Identity Center.
Question 132Question →

A retail company hosts a web application on AWS. The solutions architect needs to configure a security solution that blocks malicious SQL injection payloads in incoming HTTP requests before they reach the backend application. Which AWS service should the solutions architect deploy to meet this requirement?

Show answer & explanation

Answer: AWS WAF

Answer

AWS WAF
AWS WAF (Web Application Firewall) operates at the application layer (Layer 7) and allows you to monitor HTTP and HTTPS requests that are forwarded to protected resources, such as an Application Load Balancer or Amazon CloudFront. It includes built-in managed rules to detect and block common exploits, including SQL injection payloads, before they reach backend servers.

Step-by-Step Solution

1
Identify the target layer of the threat.
The threat is SQL injection, which occurs at the application layer (Layer 7) of the OSI model.
Security controls must be chosen based on the network layer they operate on.
2
Evaluate the capabilities of the proposed services.
Only AWS WAF operates at Layer 7 and is capable of inspecting HTTP/HTTPS payloads to block SQL injection patterns.
Layer 3/4 controls like Shield Standard, Network ACLs, and Security Groups do not have visibility into HTTP payload contents.

Key Concept

AWS WAF protects applications at the application layer (Layer 7) from web exploits like SQL injection, whereas AWS Shield Standard and VPC security controls operate at lower layers (Layer 3/4) to mitigate network-level attacks.
Estimated Time:45s
Question 133Question →

An enterprise uses AWS IAM Identity Center to federate identity provider users into their AWS development account. The junior solutions architects in this account need the ability to create and manage IAM roles for Amazon EC2 instances. However, the senior security team requires that these junior architects must not be able to elevate their own permissions or assign administrative permissions to the EC2 instances they configure. Which TWO actions should the solutions architect take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Create a permissions boundary IAM policy that defines the maximum permissions that the junior architects can delegate to the EC2 roles.; Attach an IAM policy to the junior architects' federated role that permits role creation only when the request includes the permissions boundary condition referencing the boundary policy.

Answer

To secure delegated role creation, the solutions architect should create a permissions boundary policy to define the maximum delegated permissions and require the junior architects to apply this boundary policy whenever they create an IAM role.
Delegating the creation of IAM roles to non-administrator users without risk of privilege escalation is achieved using IAM Permissions Boundaries. First, a permissions boundary policy defines the upper limit of permissions. Second, the policy governing the creators (junior architects) is configured to require this permissions boundary when executing role creation commands. This prevents them from granting administrative rights or access they do not possess.

Step-by-Step Solution

1
Define the boundaries of delegation.
A permissions boundary policy is created in IAM that outlines the maximum set of permissions a junior architect can assign.
This establishes a hard limit on what the newly created roles can do, regardless of the policies attached to them.
2
Enforce boundary usage on role creation.
An IAM policy is attached to the junior architects' role containing a condition that permits iam:CreateRole and iam:PutRolePolicy/iam:AttachRolePolicy only if the iam:PermissionsBoundary matches the boundary policy ARN.
This prevents junior architects from creating unmanaged or administrative roles that could bypass security limits.

Key Concept

Delegated Administration with IAM Permissions Boundaries
Question 134Question →

A media streaming company is organizing its cloud footprint using AWS Organizations. To enforce compliance, the security team must restrict specific activities within member accounts without affecting the management account. The environment consists of a Production OU and a Sandbox OU. The compliance rules are:

1. Production accounts must not be able to disable AWS Security Hub or modify resource-tagging policies.
2. Sandbox accounts must be prohibited from launching EC2 instances that are not of the 't3' or 'm5' instance families.

Which combination of actions should a Solutions Architect implement to meet these governance requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach a Service Control Policy (SCP) to the Production OU that denies Security Hub configuration modifications and tag-policy changes.; Attach a Service Control Policy (SCP) to the Sandbox OU that denies the ec2:RunInstances action unless the ec2:InstanceType condition key matches t3.* or m5.*.

Answer

Attach a Service Control Policy (SCP) to the Production OU that denies Security Hub configuration modifications and tag-policy changes, and attach a Service Control Policy (SCP) to the Sandbox OU that denies the ec2:RunInstances action unless the ec2:InstanceType condition key matches t3.* or m5.*.
The correct strategy combines target-specific Service Control Policies (SCPs) attached directly to the respective Organizational Units (OUs). Attaching a policy to prevent disabling Security Hub and modifying tag policies directly to the Production OU ensures that compliance is enforced only for production resources. Similarly, attaching an SCP restricting instance types to the Sandbox OU ensures developers have freedom to experiment within cost-effective boundaries. In both cases, the policies do not affect the management account, which satisfies the requirement to exclude it from the restrictions.

Step-by-Step Solution

1
Analyze the scope of the governance requirements for the Production OU and the Sandbox OU.
Identified that the Production OU requires restriction of Security Hub and tag policy modifications, while the Sandbox OU requires restricting EC2 instance types to t3 and m5 families. The management account must remain unaffected.
To design the correct AWS Organizations structure and policy placement without causing unintended policy inheritance across OUs.
2
Select the appropriate mechanism to enforce governance across member accounts centrally.
Determined that Service Control Policies (SCPs) are the native tool in AWS Organizations to restrict actions at the member account level, and they do not apply to the management account.
SCPs act as guardrails that define the maximum permissions for member accounts without affecting the management account's administrative access.
3
Formulate the SCPs and attach them to their target Organizational Units.
Created one SCP targeting Security Hub and tagging controls, attaching it to the Production OU. Created a second SCP targeting EC2 instance type restrictions using the ec2:InstanceType condition key, attaching it to the Sandbox OU.
Attaching the policies directly to the specific OUs applies the rules target-selectively, preventing policies from bleeding over to unintended OUs (e.g. preventing sandbox restrictions from affecting production).

Key Concept

AWS Organizations Service Control Policies (SCPs) and Organizational Unit (OU) policy inheritance.
Question 135Question →

A company is migrating its on-premises web application to AWS. The application will run on Amazon ECS containers. The solutions architect must design a security strategy to grant database administrators (DBAs) administrative access to the Amazon RDS DB instances using their existing corporate identity provider (IdP). Furthermore, the ECS application containers must securely access the database credentials, which must be rotated every 30 days without hardcoding them in the application or storing them in plaintext.

Which combination of actions should the solutions architect take to meet these security requirements?

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate the corporate identity provider, granting DBAs federated access to manage RDS. Store the database credentials in AWS Secrets Manager, enable automatic 30-day rotation, and grant the ECS task execution role permissions to retrieve the secret.

Answer

Configure AWS IAM Identity Center to federate the corporate identity provider for DBA access, store the database credentials in AWS Secrets Manager with automatic 30-day rotation, and grant the ECS task execution role permissions to retrieve the secret.
The correct solution integrates AWS IAM Identity Center with the existing corporate identity provider to handle DBA access securely without creating long-term IAM users. It also utilizes AWS Secrets Manager to encrypt, store, and automatically rotate database credentials every 30 days, while using the ECS task execution role to dynamically retrieve the secret at runtime.

Step-by-Step Solution

1
Integrate the corporate identity provider with AWS IAM Identity Center.
Database administrators can log in to the AWS Management Console using their existing corporate credentials, eliminating the need to manage individual IAM users with long-term keys.
Aligns with the principle of least privilege and simplifies identity management via single sign-on.
2
Store the database credentials in AWS Secrets Manager.
The sensitive database password is encrypted at rest and stored securely.
Allows AWS Secrets Manager to manage the lifecycle of the credentials, preventing exposure in plaintext parameter store parameters or container images.
3
Configure AWS Secrets Manager to automatically rotate the secret every 30 days and update the Amazon RDS database.
Automatic rotation of the password is handled natively by AWS Secrets Manager via an integration with Amazon RDS.
Meets the security requirement for monthly credential rotation without manual intervention or custom script scheduling.
4
Grant retrieval permissions to the ECS task execution role and inject the secret into the container task definition.
The application container retrieves the credentials at startup without hardcoding the password in the image or exposing it in task environment variables.
Ensures secure, runtime access to the database credentials using IAM role-based authorization.

Key Concept

Centralized identity federation and secure, automated secrets management
Question 136Question →

An enterprise is designing a secure multi-account AWS environment using AWS Organizations to comply with regulatory standards. The architecture contains a management account and multiple member accounts grouped into OUs, including a Production OU and a Development OU.

The security team has specified the following requirements:
1. Centralize administrative access management by integrating with the enterprise's corporate Active Directory.
2. Prevent administrators in any member account from deleting or modifying a specific compliance auditing IAM role named SecurityAuditRole.
3. Restrict member accounts under the Development OU to only run Amazon EC2 and Amazon S3 workloads, while ensuring that the management account is never blocked from performing administrative recovery actions.

Which combination of actions will meet these requirements with the least operational overhead?

Show answer & explanation

Answer: Enable AWS IAM Identity Center and configure Active Directory synchronization for user federation. Create an SCP that denies the deletion or modification of the SecurityAuditRole and attach it to the organization root. Create a second SCP that denies access to all services except Amazon EC2 and Amazon S3, and attach it to the Development OU.

Answer

Enable AWS IAM Identity Center and configure Active Directory synchronization for user federation. Create an SCP that denies the deletion or modification of the SecurityAuditRole and attach it to the organization root. Create a second SCP that denies access to all services except Amazon EC2 and Amazon S3, and attach it to the Development OU.
The correct answer uses AWS IAM Identity Center to federate user identity from the on-premises Active Directory, matching AWS best practices for centralized identity management. To protect the auditing IAM role across all member accounts, a Service Control Policy (SCP) is attached to the root of the organization. Because SCPs do not apply to the management account, the management account administrators can still manage the role if necessary for recovery. Restricting services via a separate SCP attached to the Development OU ensures only the workloads within that OU are constrained, satisfying the requirements with minimal operational overhead.

Step-by-Step Solution

1
Identify the proper service for centralizing authentication with corporate identity providers in a multi-account setup.
AWS IAM Identity Center is selected over manual IAM user creation.
Reduces operational overhead and eliminates long-term credentials.
2
Determine the mechanism to protect the auditing IAM role across all member accounts.
An SCP denying modifications to the role is attached to the organization root.
SCPs apply to all member accounts but naturally do not restrict the management account, preserving recovery access.
3
Apply service restrictions specifically to the Development OU.
A separate SCP denying unauthorized services is attached directly to the Development OU.
Ensures developers are restricted to EC2 and S3 without affecting accounts in other OUs or the management account.

Key Concept

Centralized multi-account identity federation and Service Control Policy scoping rules
Question 137Question →

A Solutions Architect is designing a secure multi-account environment for a growing enterprise. The company's security policy requires centralized access management for employee identities, enforcement of compliance guardrails across all member accounts in the organization, and preventing individual account administrators from disabling logging or modifying centralized security resources. Which architectural strategy best meets these requirements?

Show answer & explanation

Answer: Configure AWS IAM Identity Center for centralized single sign-on access, and use AWS Organizations to apply a Service Control Policy (SCP) at the organizational unit level that denies CloudTrail deletion and S3 log bucket modifications.

Answer

Configure AWS IAM Identity Center for centralized single sign-on access, and use AWS Organizations to apply a Service Control Policy (SCP) at the organizational unit level that denies CloudTrail deletion and S3 log bucket modifications.
The correct strategy combines AWS IAM Identity Center for centralized, federated access (avoiding individual IAM users and long-term credentials) with AWS Organizations SCPs applied at the OU level to prevent member account administrators from disabling CloudTrail or altering S3 logging resources.

Step-by-Step Solution

1
Implement centralized identity management.
Enable AWS IAM Identity Center, integrating it with the enterprise identity provider to allow centralized authentication and role assignment without provisioning long-term IAM user credentials.
This establishes federated access control in line with security best practices.
2
Enforce multi-account governance guardrails.
Use AWS Organizations to define a Service Control Policy (SCP) that explicitly denies actions like `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, and `s3:DeleteBucket` on the centralized log repository.
SCPs act as organizational guardrails that apply to all principal identities in member accounts, including the root user of those accounts.
3
Apply the policy to the organization structure.
Attach the SCP to the relevant Organizational Units (OUs) containing the member accounts.
This ensures the guardrails are inherited by all accounts within the targeted OUs without manually configuring permissions in each individual account.

Key Concept

Centralized multi-account governance using Service Control Policies and federated identity integration via AWS IAM Identity Center.
Question 138Question →

A logistics company is designing a multi-account environment on AWS using AWS Organizations. The company has several business units, each requiring separate development and production environments. To comply with corporate security standards, the solutions architect must implement a solution that enforces federated identity management via the company's external identity provider. Additionally, the solution must guarantee that security auditing cannot be disabled by stopping or deleting AWS CloudTrail trails in any member account. Which two actions should the solutions architect take to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate with the external identity provider, and assign permission sets to centralized groups.; Implement a service control policy (SCP) that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach it to the Organizational Units (OUs) containing the member accounts.

Answer

Configure AWS IAM Identity Center to federate with the external identity provider, and implement a service control policy (SCP) that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail actions attached to the Organizational Units (OUs) containing the member accounts.
Centralizing identity access using AWS IAM Identity Center federated with an external identity provider allows administrative access without managing individual IAM users. Additionally, creating and applying a service control policy (SCP) that denies CloudTrail modification/deletion actions (cloudtrail:StopLogging and cloudtrail:DeleteTrail) at the Organizational Unit level prevents member account administrators from disabling auditing, satisfying the compliance requirements securely.

Step-by-Step Solution

1
Set up centralized identity federation.
AWS IAM Identity Center is configured to synchronize and authenticate users against the external identity provider.
This removes the need to create static IAM users in individual member accounts and enables single sign-on using temporary security credentials.
2
Enforce auditing compliance across the Organization.
A service control policy (SCP) is drafted with explicit Deny rules for cloudtrail:StopLogging and cloudtrail:DeleteTrail.
SCPs allow the organization's administration to set guardrails that member account administrators cannot override.
3
Apply the guardrails to the appropriate scope.
The SCP is attached to the OUs containing the member accounts.
This ensures the guardrails are inherited by all existing and future accounts under those OUs without impacting the management account itself.

Key Concept

AWS multi-account governance using AWS Organizations, Service Control Policies (SCPs), and AWS IAM Identity Center.

Alternative Method

An alternative method is to use AWS Control Tower to set up the landing zone, which automatically configures AWS IAM Identity Center and applies default guardrails (implemented as SCPs) that prevent disabling CloudTrail across the managed accounts.
Estimated Time:2m 0s
Question 139Question →

A solutions architect is configuring baseline security controls for a new AWS account. The company wants to secure administrative access and protect resources in accordance with AWS Identity and Access Management (IAM) best practices. Which of the following security practices should the solutions architect implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Multi-Factor Authentication (MFA) for the AWS account root user and all administrative identities.; Apply the principle of least privilege by granting only the minimum permissions necessary to perform a task.

Answer

Enable Multi-Factor Authentication (MFA) for the AWS account root user and all administrative identities, and apply the principle of least privilege by granting only the minimum permissions necessary to perform a task.
The correct practices are to enable Multi-Factor Authentication (MFA) on the root user and administrative accounts to prevent unauthorized access, and to apply the principle of least privilege so that users only have the permissions necessary to do their job.

Step-by-Step Solution

1
Analyze administrative account security.
Identify that the root user and other administrative accounts represent high-privilege entry points requiring MFA.
MFA adds an extra layer of protection beyond a standard password, which is essential for administrative credentials.
2
Analyze standard credential management guidelines.
Confirm that permission policies should follow the least privilege model, while avoiding root credentials and individual IAM users for federated employees.
Applying least privilege limits security exposure, while using identity federation avoids creating unnecessary long-term IAM credentials.

Key Concept

AWS Identity and Access Management (IAM) Best Practices
Question 140Question →

A logistics firm hosts its web portal on AWS. The firm requires advanced DDoS protection, direct access to the AWS Shield Response Team (SRT) during an active event, and financial protection to mitigate scaling costs associated with a DDoS attack. Which AWS service should the solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: AWS Shield Advanced

Answer

AWS Shield Advanced
The correct answer is AWS Shield Advanced. This subscription-based service provides enhanced DDoS protection for resource types such as Elastic IP, CloudFront, Route 53, and Elastic Load Balancing. It features 24/7 access to the AWS Shield Response Team (SRT) and provides cost protection to mitigate billing spikes resulting from DDoS attacks.

Step-by-Step Solution

1
Analyze the requirements: advanced DDoS protection, specialized team support (SRT), and billing protection for scaling costs.
Identify that the requirements point to a paid tier of AWS DDoS protection.
Standard services or firewalls do not include human support or financial guarantees.
2
Compare Shield tiers and related security services.
Confirm Shield Advanced covers all three criteria.
AWS Shield Advanced is specifically designed to provide cost protection and SRT support.

Key Concept

AWS Shield Advanced Features
PreviousPage 7 / 22Next