Examkin

All practice questions

1964 questions

All types1,964Multiple choice1,006Multiple select931Ordering27
Question 121Question →

TerraGrid Energy is designing a new compliance monitoring system. Application servers run under an IAM role in a Production Account (Account A) and need to write telemetry logs containing sensitive customer data to an Amazon S3 bucket located in a centralized Compliance Account (Account B). All logs must be encrypted at rest using an encryption key managed in Account B. The security team requires that the encryption key policy enforces the principle of least privilege. Which two actions should the solutions architect take to configure this security control? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a customer managed key (CMK) in Account B, and configure the key policy to grant the IAM role in Account A permissions for the kms:GenerateDataKey and kms:Decrypt actions.; Configure the S3 bucket policy in Account B to allow the IAM role in Account A to perform the s3:PutObject action, and attach an IAM policy to the application role in Account A that grants access to the S3 bucket and the CMK in Account B.

Answer

Create a customer managed key (CMK) in the compliance account (Account B), configure the key policy to grant the application's IAM role in Account A permissions for the kms:GenerateDataKey and kms:Decrypt actions, update the destination S3 bucket policy in Account B to allow the role to perform the s3:PutObject action, and attach an IAM policy to the role in Account A granting access to the S3 bucket and the CMK in Account B.
To secure cross-account S3 data writing with KMS encryption, a Customer Managed Key (CMK) must be created in the destination account because AWS-managed keys cannot be shared across accounts. The CMK's key policy must trust the source IAM role. Additionally, access must be authorized symmetrically: the destination bucket policy must permit the source IAM role, and the source IAM role must have an IAM policy allowing it to perform the upload and use the external CMK.

Step-by-Step Solution

1
Evaluate the key management requirements.
Determine that a Customer Managed Key (CMK) is required in the destination account because default AWS-managed KMS keys cannot have their key policies modified to allow cross-account access.
AWS-managed keys are limited to their own accounts and cannot support cross-account operations.
2
Configure cross-account key access.
Define a key policy on the CMK in Account B that explicitly lists the application's IAM role ARN from Account A as a principal allowed to perform cryptographic operations (kms:GenerateDataKey, kms:Decrypt).
The key policy is the primary policy evaluation point for KMS, and it must trust the cross-account role.
3
Configure cross-account S3 bucket access.
Define an S3 bucket policy in Account B that permits the specific application role in Account A to execute s3:PutObject.
For cross-account bucket access, the bucket owner must explicitly grant permissions to the external principal.
4
Configure client-side identity permissions in the source account.
Attach an IAM policy to the application's role in Account A that grants permissions to write to the Account B bucket and use the Account B CMK.
Cross-account access requires authorization on both the resource (bucket/key policy) and the identity (IAM policy).

Key Concept

Cross-account security controls involving S3 and KMS require authorization in the KMS key policy, the S3 bucket policy, and the client's local IAM policy, utilizing Customer Managed Keys (CMKs) to enable cross-account policy sharing.
Estimated Time:2m 0s
Question 122Question →

A travel booking aggregator is migrating its legacy flight search API to a serverless architecture on AWS. The new application will use Amazon API Gateway to expose REST endpoints and AWS Lambda to process user requests. The Lambda functions must read and write reservation details to an Amazon RDS PostgreSQL database located in a private VPC subnet. During high-traffic marketing events, the volume of concurrent Lambda executions is expected to spike drastically, which could exceed the maximum database connection limits. Additionally, the Lambda functions must securely connect to external airline partner APIs over the public internet. Which TWO of the following configurations should the solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the Lambda functions within the private VPC subnets and route outbound internet traffic through redundant NAT Gateways deployed across multiple Availability Zones.; Deploy an Amazon RDS Proxy in the private VPC subnets associated with the database, and configure the Lambda functions to connect to the RDS Proxy endpoint instead of the database endpoint.

Answer

To modernize the workload with serverless Lambda and API Gateway securely and reliably, the solutions architect should configure the Lambda functions inside private VPC subnets with outbound routing through redundant NAT Gateways across multiple Availability Zones, and deploy Amazon RDS Proxy in the private VPC subnets to manage and pool connections to the RDS PostgreSQL database.
The correct solution involves two main aspects: scalability/database protection and high-availability network egress. To handle concurrent execution spikes without overloading the PostgreSQL database, Amazon RDS Proxy must be used because it pools and multiplexes connections. To enable secure outbound internet connectivity for VPC-bound Lambda functions while avoiding a single point of failure, the architect must place the Lambda functions in private subnets and route their traffic through redundant NAT Gateways deployed across multiple Availability Zones.

Step-by-Step Solution

1
Analyze database connection scaling issues.
Identified that Lambda's rapid scaling will exceed the RDS PostgreSQL connection limit.
Unlike traditional servers, serverless functions scale horizontally by launching individual instances, each creating its own database connection. A pooling mechanism is required to prevent database exhaustion.
2
Evaluate Amazon RDS Proxy.
Recognized that RDS Proxy pools and shares database connections, reducing CPU and memory overhead on the database.
RDS Proxy handles the connection spikes gracefully, queuing requests if the database is under heavy load rather than failing them.
3
Analyze network access requirements for external partner APIs.
Identified that Lambda functions inside the VPC need secure egress to the public internet.
Since the functions are in a private VPC subnet to access the RDS database and RDS Proxy, they cannot have public IP addresses directly. They must route their internet-bound traffic through NAT Gateways.
4
Ensure high availability for outbound traffic.
Selected redundant NAT Gateways across multiple Availability Zones.
Standard multi-AZ architectures require a NAT Gateway in each AZ to avoid a single point of failure and to satisfy AWS Well-Architected reliability guidelines.

Key Concept

Modernizing legacy workloads using serverless compute (Lambda) with private database resources requires robust connection pooling (RDS Proxy) and highly available outbound VPC egress (multi-AZ NAT Gateways) to handle massive spikes in transaction volume while securing internal connections.
Estimated Time:2m 30s
Question 123Question →

A smart-grid utility company is implementing a centralized telemetry data ingestion pipeline. Smart meter telemetry data is ingested in real-time in the Ingestion Account (Account ID 111122223333) via an Amazon Kinesis Data Firehose delivery stream. The compliance guidelines require all telemetry data to be stored long-term in an Amazon S3 bucket within a dedicated Security and Compliance Account (Account ID 444455556666). All data stored in the S3 bucket must be encrypted at rest using an AWS KMS Customer Managed Key (CMK) owned by the Security and Compliance Account. The Kinesis Data Firehose delivery stream must write the data directly to the cross-account S3 bucket.

Which two configurations must the solutions architect implement to enable this cross-account delivery while satisfying the security and encryption requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the KMS key policy of the Customer Managed Key in Account 444455556666 to grant the Kinesis Data Firehose IAM role in Account 111122223333 permissions for the kms:GenerateDataKey and kms:Decrypt actions.; Configure the S3 bucket policy in Account 444455556666 to grant the Kinesis Data Firehose IAM role in Account 111122223333 permission for the s3:PutObject action, and configure the Firehose delivery stream to apply the bucket-owner-full-control canned ACL.

Answer

The correct configurations are to configure the KMS key policy of the Customer Managed Key in the Security and Compliance Account to allow the Firehose IAM role the kms:GenerateDataKey and kms:Decrypt actions, and to configure the S3 bucket policy in the Security and Compliance Account to allow the Firehose IAM role the s3:PutObject action along with using the bucket-owner-full-control canned ACL.
The correct solution requires configuring permissions at both the S3 bucket level and the KMS key level. First, the KMS key policy of the Customer Managed Key (CMK) in the Security and Compliance Account must grant the cross-account Firehose IAM role permissions to generate data keys and decrypt. Second, the S3 bucket policy in the Security and Compliance Account must permit the Firehose IAM role to put objects, and the Firehose delivery stream must specify the 'bucket-owner-full-control' canned ACL to delegate object ownership to the destination bucket owner.

Step-by-Step Solution

1
Analyze cross-account encryption requirements
Identify that Kinesis Data Firehose in the Ingestion Account needs access to the Customer Managed Key (CMK) in the Security and Compliance Account.
AWS-managed keys cannot be shared across accounts, meaning a Customer Managed Key must be used, and its key policy must explicitly authorize the external Firehose IAM role.
2
Determine necessary KMS key policy permissions
The KMS key policy in the Security and Compliance Account must include a statement granting kms:GenerateDataKey and kms:Decrypt to the Firehose IAM role ARN.
Firehose requires kms:GenerateDataKey to encrypt data before writing to S3, and kms:Decrypt is required to verify key permissions.
3
Determine S3 bucket policy and ownership configuration
The S3 bucket policy in the Security and Compliance Account must allow the Firehose IAM role to perform s3:PutObject, and Firehose must specify the bucket-owner-full-control canned ACL.
Without the bucket-owner-full-control ACL, the uploaded objects would be owned by the Ingestion Account, preventing the Security and Compliance Account from reading or managing the data.

Key Concept

Cross-account access delegation for S3 buckets encrypted with KMS Customer Managed Keys (CMKs)
Estimated Time:3m 0s
Question 124Question →

An insurance provider is modernizing its claims intake system by refactoring a legacy API to a serverless architecture on AWS. The new API is deployed using Amazon API Gateway and routes requests to an AWS Lambda function. This function processes the claims, invokes an external third-party API over the internet to validate claim details, and stores the results in an Amazon Aurora PostgreSQL database. During peak periods, the system experiences sudden, massive spikes in traffic. A secondary auditing application in a separate AWS account also needs to retrieve database credentials from AWS Secrets Manager to verify claims data. Which architecture should a solutions architect design to meet these requirements securely and reliably?

Show answer & explanation

Answer: Deploy the Lambda function in private subnets across multiple Availability Zones, and route outbound internet traffic through redundant NAT Gateways. Configure Amazon RDS Proxy to manage connection pooling to the Aurora database. Store the database credentials in AWS Secrets Manager, encrypting them with a Customer Managed Key in AWS KMS to allow cross-account access, and configure a reserved concurrency limit on the Lambda function.

Answer

Deploying the Lambda function in multi-AZ private subnets with redundant NAT Gateways, using RDS Proxy for connection pooling, encrypting Secrets Manager secrets using a Customer Managed KMS key, and configuring reserved concurrency on the Lambda function.
The correct architecture configures RDS Proxy to prevent database connection exhaustion, places the Lambda function in a multi-AZ private subnet with redundant NAT Gateways to ensure highly available outbound connectivity for third-party API validation, uses a Customer Managed Key in KMS to allow cross-account key delegation to the auditing application, and configures a reserved concurrency limit on the Lambda function to protect the rest of the account's regional concurrency capacity from being exhausted by unexpected claims ingestion spikes.

Step-by-Step Solution

1
Evaluate the database connection handling under bursty traffic conditions.
Amazon RDS Proxy should be selected to pool database connections and avoid overloading Aurora PostgreSQL with rapid connection cycles.
Serverless Lambda scale-out can exhaust database connection limits without connection management.
2
Determine the requirements for internet access and high availability.
The Lambda function needs redundant NAT Gateways across multiple AZs to ensure outbound internet connectivity is not vulnerable to a single AZ failure.
The function must access a third-party API over the internet reliably.
3
Address the cross-account access requirement for the database credentials.
Use AWS Secrets Manager encrypted with a Customer Managed KMS Key rather than an AWS-managed key.
AWS-managed KMS keys do not allow policy edits required for cross-account delegation.
4
Protect the account's regional concurrency pool against starvation.
Configure a reserved concurrency limit on the claims processing Lambda function.
Reserved concurrency bounds the burst scaling to prevent exhausting the account's overall regional execution capacity.

Key Concept

Designing secure, highly-available serverless architectures integrated with VPCs, relational databases, and cross-account access controls.
Question 125Question →

A digital advertising company is designing a real-time bidding (RTB) platform on AWS. The platform must ingest and process 2.5 million2.5\text{ million} bid requests per second from external ad exchanges. Each request has a strict latency budget of 50 ms50\text{ ms} for processing, matching with active advertiser campaigns, and returning a bid response. The campaign metadata is currently 15 GB15\text{ GB} in size and is updated periodically throughout the day. The architecture must scale horizontally to handle unpredictable spikes in bid requests while maintaining the sub-50 ms50\text{ ms} response time. Which combination of actions should the Solutions Architect take to meet these performance and scalability requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Cache the campaign metadata using Amazon ElastiCache for Redis with cluster mode enabled, and configure the application to read from replica nodes to minimize latency and distribute the query volume.; Deploy a Network Load Balancer (NLB) to handle incoming traffic, terminating TCP/TLS connections at the load balancer to reduce computing load on target instances.

Answer

Deploy a Network Load Balancer (NLB) to handle incoming traffic, terminating TCP/TLS connections at the load balancer, and cache the campaign metadata using Amazon ElastiCache for Redis with cluster mode enabled, reading from replica nodes to minimize latency.
Deploying a Network Load Balancer (NLB) to handle traffic is correct because it scales instantly to support millions of requests per second with ultra-low latency and offloads TLS termination to preserve computing capacity on the application tier. Storing campaign metadata in Amazon ElastiCache for Redis with cluster mode enabled is correct because it fits the 15 GB15\text{ GB} dataset in-memory and supports multi-AZ read replication, allowing application instances to execute queries against local replica nodes with sub-millisecond response times.

Step-by-Step Solution

1
Evaluate the ingestion mechanism for extreme throughput and latency requirements.
Using a Network Load Balancer (NLB) is selected because it operates at the transport layer (Layer 4) and is built to handle millions of requests per second with sub-millisecond latencies, scaling instantly without the pre-warming delays inherent in Application Load Balancers.
An Application Load Balancer would drop requests during instant, massive spikes because it relies on a scaling process that cannot keep pace with flash traffic.
2
Determine the optimal caching layer for rapid, highly available metadata retrieval.
Amazon ElastiCache for Redis with cluster mode enabled is selected because the 15 GB15\text{ GB} dataset easily fits in memory, and Redis supports read replication across multiple Availability Zones to scale read operations sub-millisecond.
Memcached does not support multi-AZ replication to satisfy high availability constraints, and RDS Multi-AZ standby instances are passive and cannot serve reads.

Key Concept

Decoupling high-throughput load balancing and ultra-low latency caching to scale workloads under strict sub-second performance SLAs.
Question 126Question →

An enterprise healthcare provider, ApexHealth, is setting up a centralized compliance auditing platform across its multi-account AWS Organization. A third-party SaaS security application running in an external AWS account (Account Vendor) must periodically scan resources and read access logs across the provider's production accounts. To meet strict regulatory requirements: 1. The SaaS application must assume a read-only role in each member account. 2. The trust relationship must be secured using a unique external ID provided by the vendor. 3. The logs collected by the SaaS application must be written directly to a centralized S3 bucket in a dedicated Compliance Account (Account C). 4. All logs in Account C must be encrypted at rest with a key that allows the security team to revoke access immediately if a compromise is suspected. Which configuration must the Solutions Architect implement to meet these requirements?

Show answer & explanation

Answer: In each member account, configure an IAM role with a trust policy that specifies the vendor's AWS account principal, includes the `sts:AssumeRole` action, and enforces a condition for the external ID. In the Compliance Account, use a Customer Managed Key (CMK) for S3 bucket encryption, and update the KMS key policy and the S3 bucket policy to allow the roles in the member accounts to perform the write operations.

Answer

The correct solution requires creating an IAM role in each member account with a trust policy that permits cross-account role assumption using the vendor's AWS account principal and the external ID condition. S3 bucket encryption in the Compliance Account must use a Customer Managed Key, and both the KMS key policy and the S3 bucket policy must be updated to grant permissions to the member account roles.
The correct approach involves configuring cross-account IAM roles with a trust policy using the vendor's AWS account principal and enforcing a condition for the external ID. For cross-account access to encrypted S3 buckets, AWS-managed keys cannot be used since their key policies are immutable and cannot be shared across accounts. Therefore, a Customer Managed Key must be used, and its key policy must explicitly grant access to the external roles, along with a corresponding S3 bucket policy allowing write access.

Step-by-Step Solution

1
Define cross-account access roles in the member accounts.
IAM roles are created with a trust policy allowing the vendor's AWS account principal to assume the role, secured by a condition requiring the external ID.
This implements secure cross-account delegated access with a unique external ID to prevent the confused deputy problem.
2
Configure encryption for the central log bucket in the Compliance Account using a Customer Managed Key (CMK).
A Customer Managed Key is generated with a key policy allowing access from the member accounts' assumed roles.
AWS-managed KMS keys (such as `aws/s3`) do not support cross-account access because their key policies cannot be modified.
3
Update resource policies in the Compliance Account.
The S3 bucket policy and the KMS key policy in the Compliance Account are updated to allow the specific member account role ARNs to perform write and encrypt operations.
Both the S3 bucket policy and the KMS key policy must explicitly authorize cross-account access for the encryption/decryption and write actions to succeed.

Key Concept

Cross-account IAM role assumption combined with Customer Managed Key (CMK) resource policies for cross-account S3 bucket access.
Question 127Question →

A financial services enterprise is designing a new centralized security administration portal inside a Shared Services account (111122223333111122223333). Administrators managed in an external corporate identity provider (IdP) must federate into AWS using SAML 2.0 to assume an IAM role named `PortalAdminRole` in the Shared Services account.

The design must satisfy the following security and compliance requirements:
- Only federated users who belong to the "SecurityOps" group in the corporate IdP should be allowed to assume the `PortalAdminRole`.
- The federation request must originate from the company's corporate network public IP CIDR block of 198.51.100.0/24198.51.100.0/24.
- The administration portal must write session logs to an Amazon S3 bucket located in a separate Security Account (444455556666444455556666). These logs must be encrypted at rest using a key that ensures only the Shared Services account can use it to encrypt the logs.

Which configuration strategy should the security architect implement to meet these requirements?

Show answer & explanation

Answer: Configure the trust policy of the `PortalAdminRole` in the Shared Services account with the SAML provider as the principal, the `sts:AssumeRoleWithSAML` action, and a condition evaluating `saml:memberOf` equals "SecurityOps" and `aws:SourceIp` in 198.51.100.0/24198.51.100.0/24. Encrypt the S3 bucket in the Security Account using a Customer Managed Key (CMK), and configure the KMS key policy to grant the `PortalAdminRole` permissions for `kms:GenerateDataKey` and `kms:Decrypt`.

Answer

The configuration that sets up the trust policy of the `PortalAdminRole` with `sts:AssumeRoleWithSAML`, restricts access based on SAML attributes and source IP, and encrypts the S3 bucket using a Customer Managed Key (CMK) with cross-account KMS permissions.
The correct strategy uses `sts:AssumeRoleWithSAML` for the SAML federation trust relationship. It restricts access under the `Condition` block to only allow requests originating from the corporate IP range and where the SAML assertion contains the 'SecurityOps' group attribute. Furthermore, encrypting the cross-account S3 bucket with a Customer Managed Key (CMK) allows the security architect to modify the key policy in the Security Account to grant `kms:GenerateDataKey` and `kms:Decrypt` access to the `PortalAdminRole` in the Shared Services account.

Step-by-Step Solution

1
Determine the required STS action and principal for SAML federation.
The principal must be the SAML provider ARN and the action must be `sts:AssumeRoleWithSAML`.
SAML federation requests cannot use standard `sts:AssumeRole` and must use the specific SAML assume-role action.
2
Configure role trust policy conditions.
Evaluate `saml:memberOf` for group validation and `aws:SourceIp` for network perimeter control.
This enforces identity attribute validation and IP restriction directly on the STS assume-role call.
3
Determine key type for cross-account S3 encryption.
Select a Customer Managed Key (CMK) instead of the default AWS-managed `aws/s3` key.
AWS-managed keys cannot have their key policies edited and thus cannot be shared with principals in external accounts.

Key Concept

Designing secure federated access using SAML trust policies combined with cross-account resource encryption using Customer Managed Keys.
Estimated Time:2m 30s
Question 128Question →

An enterprise logistics company is designing a new compliance tracking application. The application runs on Amazon EC2 instances in an Application Account under a specific IAM role. The application must write transaction logs to a centralized Amazon S3 bucket in a Security Account. The compliance team requires all logs to be encrypted at rest using a Key Management Service (KMS) key managed by the compliance team, with access restricted using the principle of least privilege.

Which two of the following configuration steps are required to implement this secure cross-account logging solution? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a Customer Managed Key (CMK) in the Security Account, and configure its key policy to allow the Application Account's IAM role to perform kms:GenerateDataKey and kms:Decrypt actions.; Configure the S3 bucket policy in the Security Account to grant s3:PutObject permissions directly to the specific IAM role from the Application Account.

Answer

To configure secure cross-account logging, a Customer Managed Key must be created in the Security Account with a key policy allowing the application's IAM role to perform cryptographic operations, and the S3 bucket policy in the Security Account must explicitly grant write permissions to the application's IAM role.
The correct solution involves creating a Customer Managed Key (CMK) in the Security Account and configuring its key policy to delegate access to the application's IAM role, alongside configuring the central S3 bucket policy to grant write permissions to the application's IAM role. This establishes trust and permissions at both the identity level (Application Account) and the resource level (Security Account), while enabling cross-account encryption using a key that the compliance team can manage.

Step-by-Step Solution

1
Identify the KMS requirements for cross-account encryption.
Determine that an AWS-managed key cannot be shared across accounts, requiring a Customer Managed Key (CMK) in the Security Account.
AWS-managed keys have immutable key policies that do not support cross-account access.
2
Configure the Customer Managed Key policy in the Security Account.
Add a statement to the key policy that permits the Application Account's IAM role to perform kms:GenerateDataKey and kms:Decrypt.
This allows the application to encrypt the logs before storing them in S3 using the centralized key.
3
Identify the S3 permissions required for cross-account writes.
Determine that both the IAM policy in the Application Account and the S3 bucket policy in the Security Account must allow the write operation.
Cross-account S3 access requires explicit authorization on both the source identity and the destination resource.
4
Configure the S3 bucket policy in the Security Account.
Add a policy statement granting s3:PutObject to the specific ARN of the Application Account's IAM role.
This satisfies the destination-side permission and restricts access to only the authorized application role.

Key Concept

Cross-account security controls require explicit resource policies (S3 bucket policy and KMS key policy) in the destination account that trust the specific IAM principal in the source account, combined with a Customer Managed Key for shared encryption capability.
Question 129Question →

A fleet management company is designing a new real-time tracking application that receives GPS coordinate telemetry from 50,00050,000 active vehicles every 10 seconds10\text{ seconds} via HTTPS POST requests. The incoming telemetry messages must be processed asynchronously to calculate vehicle velocity and then stored in a database. The database must scale dynamically to handle high-write throughput and provide single-digit millisecond latency for queries retrieving the latest position of any vehicle. Which two architectural components should the solutions architect include in the design to meet these performance and latency requirements?

Select all that apply

Show answer & explanation

Answer: Use Amazon Kinesis Data Streams behind an Amazon API Gateway regional endpoint to ingest and buffer the incoming high-frequency telemetry data.; Store the processed telemetry data in an Amazon DynamoDB table configured with on-demand capacity, using the vehicle ID as the partition key.

Answer

The correct architecture uses Amazon Kinesis Data Streams behind Amazon API Gateway to ingest and buffer telemetry data, and stores the processed telemetry in Amazon DynamoDB with on-demand capacity using the vehicle ID as the partition key.
The correct solution involves utilizing Amazon Kinesis Data Streams behind an Amazon API Gateway regional endpoint to ingest and buffer high-frequency telemetry data, combined with storing the telemetry in Amazon DynamoDB configured with on-demand capacity and vehicle ID as the partition key. This decoupled architecture scales dynamically to handle millions of incoming requests, buffers writes, and provides single-digit millisecond read/write latency.

Step-by-Step Solution

1
Evaluate the ingestion and scaling requirements for 50,00050,000 vehicles sending data every 10 seconds10\text{ seconds}.
This requires a highly scalable and reliable buffering ingestion mechanism that handles the persistent stream of incoming HTTPS telemetry requests without latency bottlenecks.
An Application Load Balancer alone may drop requests during sudden traffic spikes, making Amazon Kinesis Data Streams behind API Gateway the ideal architecture for ingestion and buffering.
2
Assess the database capabilities for high-write throughput and single-digit millisecond lookup latency.
Amazon DynamoDB with vehicle ID partition key satisfies the latency and high throughput requirements while dynamically scaling on-demand.
Relational options like Aurora PostgreSQL cannot easily scale writes horizontally via Multi-AZ standby instances, and Memcached lacks the persistence needed for durable data storage.

Key Concept

Decoupled serverless ingestion using Kinesis and API Gateway combined with DynamoDB partition key optimization for low-latency write scaling.
Estimated Time:2m 0s
Question 130Question →

An enterprise is modernizing a legacy scheduling system by refactoring its API backend to a serverless architecture on AWS. The modernized solution uses Amazon API Gateway and AWS Lambda. The API must securely query a PostgreSQL database hosted on Amazon RDS in a private subnet. The Lambda function must also make HTTP requests to a third-party webhook validation API over the public internet. The system must support high-volume transaction spikes without exhausting database connections, and the database credentials must be securely stored and accessible by a compliance auditing service hosted in a separate AWS account. Which TWO actions should the Solutions Architect take to design a secure, reliable, and performant solution?

Select all that apply

Show answer & explanation

Answer: Deploy an Amazon RDS Proxy in the private subnets of the VPC, and configure the Lambda function to connect to the database via the RDS Proxy endpoint.; Store the database credentials in AWS Secrets Manager, encrypt the secret using a Customer Managed Key (CMK), and configure a resource policy on the secret to grant read access to the auditing account.

Answer

Deploy an Amazon RDS Proxy in the private subnets of the VPC, and configure the Lambda function to connect via the RDS Proxy endpoint; and store the database credentials in AWS Secrets Manager, encrypt the secret using a Customer Managed Key (CMK), and configure a resource policy to grant cross-account read access.
Deploying Amazon RDS Proxy handles connection management dynamically, protecting the database from scaling spikes. Using Secrets Manager with a Customer Managed Key allows the custom policy modification necessary to delegate access to a separate auditing account.

Step-by-Step Solution

1
Implement connection pooling.
Amazon RDS Proxy is deployed inside the VPC.
Since serverless Lambda functions can scale rapidly and open many concurrent connections, RDS Proxy pools these connections to prevent database exhaustion.
2
Ensure secure cross-account credential sharing.
Secrets Manager stores the credentials with a Customer Managed Key.
AWS-managed keys cannot be shared cross-account because their policies cannot be edited. A Customer Managed Key allows the necessary key policy changes to grant access to the auditing account.
3
Establish high-availability outbound networking.
Multiple NAT Gateways are deployed across Availability Zones.
To maintain reliability when calling external APIs, outbound traffic must not depend on a single NAT Gateway.

Key Concept

Serverless VPC integration, connection pooling with RDS Proxy, and secure cross-account KMS key access.
Question 131Question →

A financial media platform publishes quarterly earnings reports. During a major company's earnings release, traffic to the historical stock data service spikes from a baseline of 2,0002,000 requests per second to over 120,000120,000 requests per second within 3030 seconds. The application tier runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The database tier currently uses an Amazon RDS for PostgreSQL Multi-AZ deployment. Which strategy should a solutions architect recommend to scale both the database read capacity and the load balancer to handle this sudden traffic surge?

Show answer & explanation

Answer: Migrate the database to Amazon Aurora PostgreSQL, configure Aurora Auto Scaling to dynamically provision Aurora Replicas to handle the read load, and request AWS Support to pre-warm the ALB prior to the scheduled earnings release.

Answer

Migrate the database to Amazon Aurora PostgreSQL, configure Aurora Auto Scaling to dynamically provision Aurora Replicas to handle the read load, and request AWS Support to pre-warm the ALB prior to the scheduled earnings release.
The correct strategy migrates the database to Amazon Aurora PostgreSQL, enabling dynamic write/read splitting and horizontal scaling through Aurora Auto Scaling replicas. It also addresses the sudden, extreme spike in front-end traffic by requesting ALB pre-warming, which ensures the load balancer has pre-allocated capacity ready to handle the immediate surge to 120,000120,000 requests per second without dropping packets.

Step-by-Step Solution

1
Evaluate the database scaling requirements.
Determine that Amazon RDS for PostgreSQL Multi-AZ standbys are purely passive and cannot serve read traffic, requiring a transition to Aurora Replicas or RDS Read Replicas to handle read-heavy traffic scaling.
To scale read operations dynamically, we need an architecture that supports active replicas and auto-scaling, which Amazon Aurora PostgreSQL provides.
2
Address the rapid traffic spike at the load balancer tier.
Identify that the surge from 2,0002,000 to 120,000120,000 requests per second in 3030 seconds is too rapid for the Application Load Balancer's standard automated scaling algorithm to handle without dropping requests.
ALBs scale gradually based on incoming traffic patterns. Sudden spikes require requesting pre-warming from AWS Support to allocate adequate capacity beforehand.
3
Combine the database and load balancer optimizations into a unified strategy.
Combine ALB pre-warming and Aurora Replica Auto Scaling to address both the sudden entry point load and the backend database read amplification.
This dual approach ensures both the ingestion tier and the data storage tier scale efficiently to handle flash traffic.

Key Concept

Scaling read capacity dynamically and handling sudden traffic spikes requires a combination of database read replicas and pre-warming load balancers.
Question 132Question →

A logistics company is modernizing its legacy telemetry system by migrating to a serverless architecture on AWS. The new application uses Amazon API Gateway to receive real-time GPS payloads from delivery vehicles, which are processed by an AWS Lambda function. During peak hours, a massive surge in vehicle transmissions causes the Lambda function to scale rapidly, exhausting the account's regional concurrency pool. Consequently, other business-critical applications in the same account are being throttled. The company needs a solution to prevent the telemetry function from consuming all account concurrency while ensuring that telemetry data is not lost during spikes. Which architectural solution will meet these requirements with the least operational overhead?

Show answer & explanation

Answer: Configure reserved concurrency on the Lambda function to limit its maximum concurrency. Re-architect the integration by configuring Amazon API Gateway to write telemetry payloads directly to an Amazon Simple Queue Service (SQS) queue, and configure the Lambda function to consume messages from the queue.

Answer

Configure reserved concurrency on the Lambda function to limit its maximum concurrency, configure Amazon API Gateway to write telemetry payloads directly to an Amazon Simple Queue Service (SQS) queue, and configure the Lambda function to consume messages from the queue.
The correct solution involves configuring reserved concurrency on the Lambda function to place a hard limit on its concurrent executions. This ensures the function cannot scale out of control and exhaust the entire regional pool, thereby protecting other critical services. To prevent data loss when incoming request volumes exceed this concurrency limit, Amazon API Gateway is integrated directly with Amazon SQS using a service integration, buffering the payloads. The Lambda function then consumes messages from the queue at a controlled rate, guaranteeing that telemetry data is processed without being dropped.

Step-by-Step Solution

1
Analyze the concurrency exhaustion issue and identify that a spike in incoming telemetry requests triggers rapid scaling of the Lambda function, consuming the regional pool.
Confirming the need for a mechanism to restrict the maximum concurrency of the validation function (Reserved Concurrency) to protect other applications.
By default, a function can scale to consume the entire account's regional concurrency pool, causing starvation for other functions.
2
Evaluate the requirement to prevent data loss during traffic spikes while keeping operational overhead low.
Selecting Amazon SQS as a buffer between API Gateway and Lambda.
API Gateway can write directly to SQS using a service integration, which decouples the ingestion from processing and ensures payloads are queued rather than dropped if the processing Lambda is throttled.
3
Integrate the components and ensure configuration matches AWS best practices.
The final architecture uses API Gateway -> SQS -> Lambda with reserved concurrency, satisfying all requirements.
This setup isolates the compute consumption, guarantees message persistence, and maintains high availability without managing complex server infrastructure.

Key Concept

Modernizing legacy workloads using serverless architectures (API Gateway, SQS, and Lambda) with concurrency controls to ensure high availability and prevent resource starvation.
Estimated Time:2m 0s
Question 133Question →

A media streaming service is preparing to broadcast a high-profile live sporting event. The application is deployed behind an Application Load Balancer (ALB) and uses Amazon Aurora MySQL for user profile and authorization metadata. Historical data shows that traffic will spike from 5,0005,000 requests per second to over 250,000250,000 requests per second in the first 55 minutes of the broadcast. The workload is highly read-intensive, with a 95:595:5 read-to-write ratio. Which combination of actions should a solutions architect recommend to ensure the platform handles the peak flash traffic with minimal latency and no dropped connections?

Show answer & explanation

Answer: Request AWS Support to pre-warm the ALB to handle the expected load, and deploy Amazon ElastiCache for Redis with replica nodes to cache metadata queries using a cache-aside pattern.

Answer

Request AWS Support to pre-warm the ALB to handle the expected load, and deploy Amazon ElastiCache for Redis with replica nodes to cache metadata queries using a cache-aside pattern.
The correct architecture requires requesting AWS Support to pre-warm the Application Load Balancer to ensure it has enough capacity ready to handle the immediate 250,000250,000 requests per second without dropping packets. Furthermore, implementing Amazon ElastiCache for Redis with replica nodes provides a highly available, sub-millisecond caching layer that handles the 95%95\% read workload, preventing database exhaustion.

Step-by-Step Solution

1
Analyze the rate of the traffic spike.
The traffic increases 5050-fold (from 5,0005,000 to 250,000250,000 requests per second) in 55 minutes.
This extremely rapid rate of scaling exceeds the capabilities of standard ALB auto-scaling, which requires pre-warming by AWS Support to avoid dropped connections.
2
Determine database scaling requirements.
Identify that the database workload is 95%95\% reads, meaning caching is highly effective.
Offloading reads to a caching tier reduces the load on the Amazon Aurora primary cluster and provides sub-millisecond latencies.
3
Select the appropriate caching technology.
Choose Amazon ElastiCache for Redis over Memcached.
ElastiCache for Redis supports replication, multi-AZ failover, and persistence, ensuring the caching tier remains highly available during the live event.

Key Concept

Handling rapid flash traffic spikes requires pre-warming load balancers and offloading read traffic using a highly available cache-aside pattern.
Estimated Time:2m 0s
Question 134Question →

A retail company, ShopNova Retail, is designing a new compliance reporting system. Application servers running in the Production Account (Account A) under an IAM role need to write encrypted compliance reports to an Amazon S3 bucket located in the centralized Compliance Account (Account B). The compliance team requires that all data at rest be encrypted using a Customer Managed Key (CMK) in AWS KMS that they can manage and rotate. Which configuration strategy will meet these requirements while following the principle of least privilege?

Show answer & explanation

Answer: In Account B, create a Customer Managed Key (CMK) and configure its key policy to allow the IAM role in Account A to perform the kms:GenerateDataKey action. In the S3 bucket policy in Account B, grant the IAM role in Account A the s3:PutObject permission. In Account A, attach an IAM policy to the IAM role that allows the s3:PutObject action on the S3 bucket in Account B and the kms:GenerateDataKey action on the CMK in Account B.

Answer

In Account B, create a Customer Managed Key (CMK) and configure its key policy to allow the IAM role in Account A to perform the kms:GenerateDataKey action. In the S3 bucket policy in Account B, grant the IAM role in Account A the s3:PutObject permission. In Account A, attach an IAM policy to the IAM role that allows the s3:PutObject action on the S3 bucket in Account B and the kms:GenerateDataKey action on the CMK in Account B.
The correct solution correctly defines both local IAM permissions in the source account and resource-based policies in the destination account. Cross-account access requires explicit permission in both the IAM policy of the source account and the S3 bucket and KMS key policies of the destination account. Furthermore, using a Customer Managed Key is required because AWS managed keys do not support policy modification and cannot be accessed cross-account.

Step-by-Step Solution

1
Configure the resource policies in Account B.
The S3 bucket policy in Account B allows s3:PutObject for the IAM role in Account A. The KMS CMK key policy in Account B allows kms:GenerateDataKey for the IAM role in Account A.
Since the resources (S3 bucket and KMS CMK) reside in Account B, they must explicitly grant cross-account access to the IAM role in Account A.
2
Configure the identity policy in Account A.
The IAM role in Account A is granted permissions to write to the S3 bucket in Account B and generate a data key using the KMS CMK in Account B.
For cross-account access, the calling entity's local IAM policy must also grant permission to perform the operations on the remote resources.

Key Concept

Cross-account access in AWS requires explicit delegation on both the resource side (bucket policy and key policy) and the caller side (IAM policy), using a Customer Managed Key since AWS managed keys cannot be shared cross-account.
Question 135Question →

A SaaS provider is designing a multi-tenant analytics dashboard. Each tenant's dashboard displays real-time operational metrics gathered from various IoT devices. The metrics are ingested into a central relational database. During a major industry event, the read queries to the database from tenant dashboards are expected to spike from a baseline of 5,0005,000 requests per minute to over 800,000800,000 requests per minute. Concurrently, the ingestion API endpoint will experience an instantaneous volume increase from 1,0001,000 requests per second to 120,000120,000 requests per second. The dashboard is backed by Amazon Aurora PostgreSQL, and the ingestion endpoint uses an Application Load Balancer (ALB) routing to Amazon Elastic Container Service (Amazon ECS) tasks. Which two actions should the Solutions Architect take to optimize the platform's performance and scalability for the upcoming event?

Select all that apply

Show answer & explanation

Answer: Contact AWS Support to pre-warm the Application Load Balancer (ALB) to handle the expected spike of 120,000120,000 requests per second on the ingestion endpoint.; Deploy Aurora Replicas in the database cluster and configure Aurora Auto Scaling with a target tracking policy based on average reader CPU utilization to scale out read capacity for the dashboards.

Answer

Contact AWS Support to pre-warm the Application Load Balancer (ALB) to handle the expected spike of 120,000120,000 requests per second on the ingestion endpoint, and deploy Aurora Replicas in the database cluster and configure Aurora Auto Scaling with a target tracking policy based on average reader CPU utilization.
To handle the sudden traffic spike from 1,0001,000 to 120,000120,000 requests per second, the Solutions Architect must contact AWS Support to pre-warm the Application Load Balancer. Additionally, to scale database read capacity from 5,0005,000 to 800,000800,000 queries per minute, deploying Aurora Replicas and enabling Aurora Auto Scaling based on CPU utilization is the recommended, operationally efficient solution.

Step-by-Step Solution

1
Analyze the load balancer performance requirements.
Identify that the ingestion API endpoint will experience an instantaneous surge from 1,0001,000 to 120,000120,000 requests per second. Default ALB scaling is gradual and cannot cope with this rate of acceleration.
Determining the need for ELB pre-warming to avoid dropped requests during the flash spike.
2
Analyze the database scaling options for read queries.
Determine that read queries will increase from 5,0005,000 to 800,000800,000 requests per minute. Aurora PostgreSQL can scale reads horizontally by adding Aurora Replicas.
Configuring Aurora Auto Scaling to dynamically provision read replicas based on CPU utilization ensures the database handles the query spikes.
3
Evaluate the architectural validity of the remaining options.
Verify that Multi-AZ standby instances in standard RDS are passive and cannot serve reads, and that ElastiCache for Memcached lacks replication and persistence capabilities.
Eliminating options that rely on unsupported engine features or invalid replication architectures.

Key Concept

Handling sudden flash traffic on ELB endpoints via pre-warming and scaling read-heavy relational databases horizontally using Aurora Auto Scaling replicas.
Question 136Question →

A media company is designing a secure video processing pipeline. The architecture uses two AWS accounts within an AWS Organization: an Ingestion Account and a Processing Account. Users upload raw video files to an Amazon S3 bucket in the Ingestion Account. An application hosted on Amazon ECS tasks in the Processing Account must read the raw video files, process them, and store the output in a bucket in the Processing Account. All raw video files must be encrypted at rest using AWS KMS. The solution must follow the principle of least privilege. Which combination of configuration steps will allow the ECS application in the Processing Account to read the encrypted raw video files from the Ingestion Account? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the Ingestion Account, update the key policy of a customer managed KMS key to grant the ECS task role in the Processing Account permissions to perform the kms:Decrypt action, and update the Ingestion S3 bucket policy to allow the same task role to perform the s3:GetObject action.; In the Processing Account, attach an IAM policy to the ECS task role that grants permissions to perform the s3:GetObject action on the Ingestion S3 bucket and the kms:Decrypt action on the customer managed KMS key in the Ingestion Account.

Answer

The correct configurations are to update the customer managed KMS key policy and S3 bucket policy in the Ingestion Account to grant access to the ECS task role, and to attach an IAM policy to the ECS task role in the Processing Account allowing s3:GetObject on the bucket and kms:Decrypt on the KMS key.
The correct answer combines updating the resource-based policies (S3 bucket policy and KMS key policy) in the Ingestion Account to delegate trust to the ECS task role, and attaching a matching identity-based IAM policy to the ECS task role in the Processing Account. Because cross-account access requires evaluation of both identity-based policies in the requesting account and resource-based policies in the owning account, both configurations are necessary.

Step-by-Step Solution

1
Ensure that the KMS key in the source account allows cross-account decryption by using a customer managed key instead of an AWS managed key, and update its key policy to trust the ECS task role.
The KMS key policy explicitly permits the ECS task role from the Processing Account to call the kms:Decrypt API.
AWS managed keys cannot be shared cross-account, so a Customer Managed Key (CMK) is required.
2
Grant the destination task role permissions on the source S3 bucket via a resource policy.
The Ingestion S3 bucket policy explicitly allows the ECS task role to execute s3:GetObject.
Cross-account S3 access requires explicit resource-level permission in the host account.
3
Configure the local identity-based permissions for the ECS application.
The ECS task role in the Processing Account contains an IAM policy with s3:GetObject for the remote bucket and kms:Decrypt for the remote KMS key.
Cross-account access requires evaluation and approval from both the trustor (resource-based policy) and the trustee (identity-based policy).

Key Concept

Cross-account S3 bucket access with KMS encryption requires explicit authorization on both the resource policies (S3 bucket and KMS key policies) and the identity-based policy, using a customer managed KMS key.
Question 137Question →

A logistics company is designing a new package tracking system to support a major global expansion. The system must ingest package location scans from sorting facilities, averaging 120,000120,000 write requests per second with burst peaks up to 250,000250,000 writes per second. Customers globally will query the API for real-time tracking updates, generating up to 600,000600,000 read requests per second. The read queries must return tracking data with sub-10 millisecond10\text{ millisecond} latency. The architecture must be highly scalable, performant, and minimize operational overhead. Which of the following database and tiering designs meets these requirements most efficiently?

Show answer & explanation

Answer: Route incoming write requests through a Network Load Balancer (NLB) to an Amazon Kinesis Data Stream. Process the stream using AWS Lambda functions with provisioned concurrency configured to prevent scaling latency, and write the tracking data to an Amazon DynamoDB table. Deploy an Amazon DynamoDB Accelerator (DAX) cluster to serve the high-volume tracking read queries with sub-millisecond latency.

Answer

Route incoming write requests through a Network Load Balancer (NLB) to an Amazon Kinesis Data Stream. Process the stream using AWS Lambda functions with provisioned concurrency configured to prevent scaling latency, and write the tracking data to an Amazon DynamoDB table. Deploy an Amazon DynamoDB Accelerator (DAX) cluster to serve the high-volume tracking read queries with sub-millisecond latency.
The correct architecture uses a Network Load Balancer (NLB) to scale instantly without the pre-warming limits associated with ALBs. The writes are buffered in Amazon Kinesis Data Streams, which manages high-throughput ingestion. Lambda functions process the stream using provisioned concurrency to eliminate scaling latency. Amazon DynamoDB stores the tracking records, and DynamoDB Accelerator (DAX) caches the reads to easily handle the 600,000600,000 read queries per second with sub-millisecond latency, preventing database read exhaustion.

Step-by-Step Solution

1
Analyze write ingestion layer scalability.
The ingestion tier must scale to handle spikes of up to 250,000250,000 write requests per second. A Network Load Balancer (NLB) handles millions of requests per second with ultra-low latency and scales instantly, making it superior to an Application Load Balancer (ALB) for raw TCP/UDP ingestion without pre-warming. Buffering through Amazon Kinesis Data Streams protects downstream systems from database saturation.
Decoupling ingestion via a stream buffer prevents write dropouts and ensures smooth scaling during high traffic spikes.
2
Evaluate database engine performance.
Amazon DynamoDB handles horizontal scale seamlessly, accommodating hundreds of thousands of write requests per second without the replication lag, storage allocation, or connection management limitations of traditional relational databases like RDS PostgreSQL.
DynamoDB scales partitions automatically to handle high-throughput workloads with predictable, single-digit millisecond write latencies.
3
Determine read caching and latency reduction strategies.
To handle 600,000600,000 read queries per second under 10 milliseconds10\text{ milliseconds}, a caching layer in front of the database is required. Amazon DynamoDB Accelerator (DAX) is an in-memory cache that integrates natively with DynamoDB API operations. It reduces read latency to microseconds and significantly lowers the required read capacity units (RCUs) on the underlying table.
DAX simplifies cache management and delivers sub-millisecond read latency without requiring complex application caching code.

Key Concept

Ingestion buffering with Kinesis, serverless scaling with Lambda, and read caching with DynamoDB Accelerator (DAX) for high-performance and low-latency workloads.
Estimated Time:3m 0s
Question 138Question →

A company is preparing to launch a new limited-time promotional campaign that is expected to generate an immediate surge of traffic, going from 500500 requests per second to over 250,000250,000 requests per second within less than a minute. The application is deployed on Amazon ECS Fargate behind an Application Load Balancer (ALB) and uses an Amazon Aurora PostgreSQL database. The application performs read-heavy catalog lookups and write-heavy transaction processing. Which two actions should the Solutions Architect recommend to optimize the performance and scalability of the architecture to handle the peak load?

Select all that apply

Show answer & explanation

Answer: Submit a support case to AWS to pre-warm the Application Load Balancer (ALB) based on the expected traffic spike of 250,000250,000 requests per second.; Deploy Aurora Replicas in the DB cluster and configure the application to route read-heavy catalog lookups to the Aurora reader endpoint.

Answer

Pre-warm the Application Load Balancer (ALB) via AWS Support and deploy Aurora Replicas while directing read queries to the reader endpoint.
Pre-warming the ALB ensures that AWS pre-allocates the necessary network and compute resources to handle the rapid traffic increase, preventing dropped connections. Using Aurora Replicas and directing queries to the reader endpoint scales read operations horizontally and prevents database resource exhaustion during peak volumes.

Step-by-Step Solution

1
Analyze the scaling characteristics of the Application Load Balancer under sudden flash traffic.
Identify that a sudden jump from 500500 to 250,000250,000 requests per second requires pre-warming to avoid initial HTTP 503 errors and dropped connections.
The ALB autoscaler takes time to detect and scale out in response to traffic growth, making pre-warming essential for instantaneous spikes.
2
Evaluate the database read scaling requirements.
Determine that deploying Aurora Replicas and routing read-heavy queries to the reader endpoint offloads the primary database instance.
This allows the primary instance to handle write-heavy transaction processing without performance degradation.
3
Evaluate and eliminate incorrect database scaling and caching strategies.
Discard RDS Multi-AZ standby routing and Memcached replication architectures.
RDS standby instances do not serve read traffic, and ElastiCache for Memcached lacks built-in multi-AZ replication.

Key Concept

Handling sudden high-scale traffic spikes on AWS requires pre-provisioning capacity (pre-warming) at the load balancing tier and horizontally scaling the database tier using read replicas rather than relying on standby instances.
Question 139Question →

A pharmaceutical corporation is deploying a drug research database in AWS. The architecture consists of two AWS accounts within the same organization: a Data Store Account containing an Amazon S3 bucket with clinical trial data, and an Analytics Account where Amazon EC2 instances analyze the data. The compliance department mandates that all data in the S3 bucket must be encrypted at rest, and the EC2 instances in the Analytics Account must have read-only access to the S3 bucket. Additionally, the encryption keys must be managed by the security team with custom rotation schedules. Which configuration meets these security and compliance requirements?

Show answer & explanation

Answer: Create a Customer Managed Key (CMK) in the Data Store Account to encrypt the S3 bucket. Update the KMS key policy in the Data Store Account to allow the Analytics Account IAM role access to the kms:Decrypt action. In the Data Store Account, configure the S3 bucket policy to allow read access from the Analytics Account IAM role. In the Analytics Account, configure the EC2 instance profile IAM policy to allow S3 read permissions and kms:Decrypt permissions on the CMK.

Answer

Create a Customer Managed Key (CMK) in the Data Store Account to encrypt the S3 bucket. Update the KMS key policy in the Data Store Account to allow the Analytics Account IAM role access to the kms:Decrypt action. In the Data Store Account, configure the S3 bucket policy to allow read access from the Analytics Account IAM role. In the Analytics Account, configure the EC2 instance profile IAM policy to allow S3 read permissions and kms:Decrypt permissions on the CMK.
The correct configuration uses a Customer Managed Key (CMK) to allow policy modifications and custom rotation schedules. For cross-account S3 bucket access with KMS encryption, permissions must be granted on both the resource policies (S3 bucket policy and KMS key policy) in the host account, and in the IAM policy of the accessing principal in the client account.

Step-by-Step Solution

1
Identify the key management and encryption type.
Choose a Customer Managed Key (CMK) rather than an AWS-managed key.
AWS-managed keys do not allow policy modifications, which are required for cross-account access and custom rotation schedules.
2
Configure the key policy in the owning account (Data Store Account).
Modify the CMK key policy to grant the Analytics Account's IAM role the 'kms:Decrypt' action.
Cross-account access to KMS keys requires explicit delegation in the key policy.
3
Configure the S3 bucket policy in the owning account (Data Store Account).
Add an S3 bucket policy allowing 's3:GetObject' from the Analytics Account's IAM role.
Cross-account S3 access requires explicit delegation in the bucket policy.
4
Configure the IAM policy in the client account (Analytics Account).
Attach an IAM policy to the EC2 instance profile allowing 's3:GetObject' on the bucket and 'kms:Decrypt' on the CMK.
The client identity must have local permissions to perform both S3 and KMS actions to successfully access the encrypted object.

Key Concept

Cross-account KMS key delegation and S3 resource sharing under encryption constraints.
Estimated Time:2m 0s
Question 140Question →

An enterprise is designing a secure cross-account logging solution. Application servers running on Amazon EC2 instances in a Production Account (Account A) need to write sensitive log files to an Amazon S3 bucket in a centralized Security Account (Account B). The log files must be encrypted at rest using an AWS KMS key located in Account B, and the security team requires the use of a Customer Managed Key (CMK) to allow key policy modification and annual rotation. Which combination of configuration steps is required to implement this secure, least-privilege architecture? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the Security Account (Account B), configure the S3 bucket policy to allow the application server IAM role from the Production Account (Account A) to perform the s3:PutObject action, and configure the KMS key policy to allow the same role to perform the kms:GenerateDataKey action.; In the Production Account (Account A), attach an IAM policy to the EC2 instance role that grants the s3:PutObject permission on the destination S3 bucket and the kms:GenerateDataKey permission on the KMS key in the Security Account (Account B).

Answer

Configure the S3 bucket policy and KMS key policy in the Security Account to grant access to the application server's IAM role, and attach a local IAM policy in the Production Account that allows the application server role to perform the required actions on the S3 bucket and KMS key.
Establishing secure cross-account access for S3 buckets encrypted with a KMS CMK requires explicit permissions on both the trusting and trusted sides. The resource owner (the Security Account) must configure the S3 bucket policy and the KMS key policy to permit the IAM role from the Production Account. Simultaneously, the trusted side (the Production Account) must configure the IAM policy attached to the application role to grant access to the external S3 bucket and the external KMS key.

Step-by-Step Solution

1
Configure destination resource policies in the Security Account
The S3 bucket policy allows s3:PutObject for the Production Account's IAM role, and the KMS key policy allows kms:GenerateDataKey for the same role.
Cross-account access requires the resource owner to explicitly delegate access to the external trust principal.
2
Configure the source IAM role permissions in the Production Account
The application server's IAM role is updated with an identity-based policy granting s3:PutObject and kms:GenerateDataKey on the resources in the Security Account.
Even when the resource policy allows access, the IAM principal must have explicit identity-based permissions to perform cross-account actions.

Key Concept

Cross-account resource sharing and KMS delegation
Estimated Time:2m 0s
PreviousPage 7 / 99Next
All practice questions — AWS Certified Solutions Architect - Professional | Examkin