Examkin

Question

Difficulty: HardStrengthening Identity, Access, and Network Security

A financial services company hosts a web application on Amazon ECS Fargate tasks behind an internet-facing Application Load Balancer (ALB). The application's administrative endpoints under the path `/admin/*` are currently protected by basic authentication. The security team mandates that the identity and network security of these endpoints must be strengthened. The `/admin/*` portal must be restricted to authenticated corporate employees who connect exclusively from the corporate office's public IP CIDR range (203.0.113.0/24203.0.113.0/24). In addition, audit logs stored in an Amazon S3 bucket must be encrypted using a key that can be shared with a security audit role in a separate AWS audit account. Which two actions should the Solutions Architect implement to meet these requirements? (Select TWO.)

  1. Configure an AWS WAF WebACL rule that matches the path `/admin/*` and blocks all requests that do not originate from the IP set containing the corporate CIDR range 203.0.113.0/24203.0.113.0/24, and assign this rule the highest evaluation priority in the WebACL.Answer
  2. Modify the ALB listener rules to authenticate users requesting `/admin/*` using an Amazon Cognito user pool federated with the company's corporate identity provider, and route authenticated sessions to the ECS target group.Answer
  3. C
    Add an AWS WAF WebACL rule that allows requests targeting `/admin/*` from the corporate IP set, and position it at the lowest evaluation priority after the default action of allow.
  4. D
    Configure default encryption on the S3 bucket using an AWS-managed KMS key (`aws/s3`), and delegate cross-account permissions by updating the default key policy to trust the security audit role in the external AWS account.
  5. E
    Attach a Service Control Policy (SCP) to the member account's Organizational Unit (OU) that explicitly permits administrative access to `/admin/*` paths for the `AdminAccess` role, which automatically grants local permissions to federated users without needing local IAM policies.

Answer

Configure an AWS WAF WebACL rule that blocks non-corporate IPs at the highest priority, and configure ALB listener rules to authenticate users via Amazon Cognito.
The correct strategy combines network and identity security controls. The WAF WebACL rule blocks all requests targeting `/admin/*` that do not originate from the corporate IP CIDR range, and must be evaluated first to prevent access from unauthorized networks. The ALB listener rule redirects legitimate traffic targeting `/admin/*` to Amazon Cognito for corporate identity federation, ensuring only authenticated employees can access the ECS tasks. To address S3 sharing, using a Customer Managed Key (CMK) allows policy edits for cross-account roles.

Step-by-Step Solution

1
Add an AWS WAF rule that targets `/admin/*` and evaluates the request source IP.
Requests from unauthorized IPs are blocked at the edge.
This establishes a robust perimeter security control by dropping traffic early in the WebACL priority list before it reaches the backend.
2
Implement Amazon Cognito authentication on the ALB listener rule for the `/admin/*` path.
Users are required to sign in via the corporate identity provider before the ALB forwards the request to ECS.
Integrating ALB with Cognito federated authentication offloads identity verification to the corporate provider securely.
3
Use a Customer Managed KMS key (CMK) for the S3 bucket encryption instead of the AWS-managed key.
The key policy can be updated to trust the external audit role.
AWS-managed keys do not support policy modification. Cross-account access requires a CMK with a customized key policy.

Key Concept

Continuous security improvement of network perimeter and authentication boundaries on AWS.
Rate this question

Topics

Strengthening Identity, Access, and Network Security