Examkin

Question

Difficulty: Very hardStrengthening Identity, Access, and Network Security

A logistics enterprise is upgrading the security posture of an internal tracking application deployed in a multi-account environment. The core application runs on Amazon ECS inside private subnets of a production VPC (VPC-A) in Account-1, fronted by an internal Application Load Balancer (ALB). The DNS for the application is managed in a Route 53 Private Hosted Zone (PHZ) in Account-1. To meet new compliance requirements, the Solutions Architect must configure the following:
1. Allow consumer services running in a development VPC (VPC-B) in Account-2 to resolve the application's domain name. VPC-A and VPC-B are connected via an AWS Transit Gateway.
2. Allow consumer services in Account-2 to write application logs directly to an Amazon S3 bucket in Account-1, ensuring all data is encrypted at rest using AWS KMS.
3. Deploy an AWS WAF Web ACL on the ALB that blocks SQL injection (SQLi) attacks from all sources, while exempting a partner's whitelisted CIDR range from rate-limiting rules that apply to general traffic.
Which combination of actions represents the most secure and operationally viable configuration to meet these requirements?

  1. In Account-1, authorize the association of VPC-B with the PHZ, then associate VPC-B with the PHZ in Account-2. Create a Customer Managed Key (CMK) in Account-1, configure its key policy to allow access from the Account-2 IAM role, and encrypt the S3 bucket with it. Update the S3 bucket policy to trust the Account-2 IAM role. Configure the WAF Web ACL with the SQLi block rule set to priority 10, followed by the partner IP allow rule at priority 20, and the general rate-limiting rule at priority 30.Answer
  2. B
    In Account-1, authorize the association of VPC-B with the PHZ, then associate VPC-B with the PHZ in Account-2. Create a Customer Managed Key (CMK) in Account-1, configure its key policy to allow access from the Account-2 IAM role, and encrypt the S3 bucket with it. Update the S3 bucket policy to trust the Account-2 IAM role. Configure the WAF Web ACL with the partner IP allow rule set to priority 10, followed by the SQLi block rule at priority 20, and the general rate-limiting rule at priority 30.
  3. C
    Configure Route 53 Resolver outbound endpoints in VPC-A and inbound endpoints in VPC-B, then configure a Route 53 forwarding rule to route queries for the application's domain name from VPC-B to VPC-A. Create a Customer Managed Key (CMK) in Account-1, configure its key policy to allow access from the Account-2 IAM role, and encrypt the S3 bucket with it. Update the S3 bucket policy to trust the Account-2 IAM role. Configure the WAF Web ACL with the SQLi block rule set to priority 10, followed by the partner IP allow rule at priority 20, and the general rate-limiting rule at priority 30.
  4. D
    In Account-1, authorize the association of VPC-B with the PHZ, then associate VPC-B with the PHZ in Account-2. Encrypt the S3 bucket using the default AWS managed key (aws/s3). Configure the S3 bucket policy in Account-1 to trust the Account-2 IAM role, and attach an IAM policy to the Account-2 IAM role granting access to the aws/s3 key in Account-1. Configure the WAF Web ACL with the SQLi block rule set to priority 10, followed by the partner IP allow rule at priority 20, and the general rate-limiting rule at priority 30.

Answer

In Account-1, authorize the association of VPC-B with the PHZ, then associate VPC-B with the PHZ in Account-2. Create a Customer Managed Key (CMK) in Account-1, configure its key policy to allow access from the Account-2 IAM role, and encrypt the S3 bucket with it. Update the S3 bucket policy to trust the Account-2 IAM role. Configure the WAF Web ACL with the SQLi block rule set to priority 10, followed by the partner IP allow rule at priority 20, and the general rate-limiting rule at priority 30.
The correct solution accurately addresses all constraints. First, cross-account Route 53 Private Hosted Zone (PHZ) association is authorized from Account-1 and accepted from Account-2, enabling VPC-B to natively resolve the private domain name. Second, a Customer Managed Key (CMK) is used in Account-1 because the default AWS managed key cannot be configured to allow cross-account access. Third, the SQLi block rule is placed at a higher priority than the partner allow rule to ensure all incoming requests are inspected for payloads before any IP-based bypass rules are evaluated.

Step-by-Step Solution

1
Authorize and associate the Private Hosted Zone cross-account.
VPC-B in Account-2 resolves the application's domain name natively.
Cross-account PHZ association is the standard, most cost-effective method to allow resource resolution across VPCs in different accounts connected via Transit Gateway.
2
Create a Customer Managed Key (CMK) and configure S3 bucket policies.
The Account-2 IAM role successfully encrypts and writes logs to the S3 bucket in Account-1.
AWS managed KMS keys (aws/s3) cannot be shared across accounts because their key policies cannot be modified. A CMK must be used with a policy explicitly allowing the Account-2 principal.
3
Set the WAF Web ACL rule evaluation order, prioritizing SQLi detection.
SQLi payloads are blocked from all sources, and only non-malicious traffic from the partner IP bypasses rate limiting.
Rules in AWS WAF are evaluated sequentially based on priority. Placing the partner IP allow rule before the SQLi block rule would cause SQLi payloads from the partner range to bypass the block filter.

Key Concept

Strengthening identity and access via cross-account KMS CMK policies, private DNS sharing via cross-account Route 53 PHZ associations, and securing edge networks using AWS WAF rule ordering.
Rate this question

Topics

Strengthening Identity, Access, and Network Security