Tüm alıştırma soruları

1462 soru

Tüm türler1,462 Çoktan seçmeli739 Çoklu seçim723

A financial services firm is establishing a landing zone to host transaction-processing workloads that must comply with PCI-DSS. The company has structured its AWS Organizations hierarchy with distinct Organizational Units (OUs) for Core, Workloads, and Sandbox. The architecture team needs to restrict root user activity in the member accounts, enforce multi-factor authentication (MFA) for administrative tasks, and implement a single sign-on experience linked to their corporate identity provider (IdP). Which combination of actions should the Solutions Architect take to establish this governance framework? (Select TWO.)

Geçerli olan tümünü seçin

Configure AWS IAM Identity Center and federate it with the corporate identity provider to manage user access across all member accounts.

Apply an SCP to the Workloads and Sandbox OUs that denies API requests if the caller is the member account root user.

Create individual IAM users in the management account and configure cross-account roles to grant administrative access to member accounts.

Apply an SCP to the Organization root that restricts all permissions for the management account root user to prevent daily operations.

Establish VPC Peering connections between the management account and all member accounts to route administrative identity traffic through a central proxy server.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center and federate it with the corporate identity provider to manage user access across all member accounts.; Apply an SCP to the Workloads and Sandbox OUs that denies API requests if the caller is the member account root user.

Cevap

Configure AWS IAM Identity Center federated with the corporate identity provider, and apply an SCP to the Workloads and Sandbox OUs that denies API requests if the caller is the member account root user.

Centralizing access through AWS IAM Identity Center federated with the corporate IdP allows seamless, secure single sign-on access across all member accounts without maintaining static credentials. In addition, applying an SCP to the Workloads and Sandbox OUs that denies all actions when the principal is the root user restricts member account root activities, which helps satisfy security standards like PCI-DSS.

Adım Adım Çözüm

Centralize administrative access management.

Enable and configure AWS IAM Identity Center, linking it with the corporate Identity Provider (IdP) via SAML 2.0 or OIDC.

This establishes a single sign-on (SSO) experience for administrators, eliminating the need to manage individual IAM users in each AWS account.

Restrict member account root user access.

Create a Service Control Policy (SCP) that explicitly denies all actions if the AWS Principal is the root user. Apply this SCP to the Workloads and Sandbox Organizational Units.

Applying this SCP ensures that nobody can perform administrative tasks using member account root credentials, enforcing the use of federated administrative identities instead.

Anahtar Kavram

Centralized multi-account governance involves federating administrative identities using AWS IAM Identity Center and enforcing policy guardrails with Service Control Policies (SCPs) in AWS Organizations.

Soru 282Soru →

An enterprise is consolidating its billing and resource management under AWS Organizations. The security team wants to establish centralized access control so that employees can sign in using their existing corporate credentials and access their assigned AWS accounts without managing separate passwords. Which of the following is the most secure and operationally efficient method to achieve this goal?

Configure AWS IAM Identity Center integrated with the enterprise's corporate identity provider.

Create individual IAM users with long-term credentials in each member account for every employee.

Distribute the AWS account root user credentials of each member account to the respective employees.

Generate a single administrative IAM user in the management account and share the credentials with all employees.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center integrated with the enterprise's corporate identity provider.

Cevap

Configure AWS IAM Identity Center integrated with the enterprise's corporate identity provider.

The correct option is configuring AWS IAM Identity Center integrated with the enterprise's corporate identity provider. This approach centralizes permissions management and integrates directly with the existing corporate identity store, eliminating the need to manage individual IAM credentials in multiple member accounts.

Adım Adım Çözüm

Identify the primary requirement.

The requirement is to implement centralized identity federation and cross-account access management without using separate credentials for each AWS account.

This establishes the scope of the solution as multi-account identity and governance.

Evaluate the solutions against AWS best practices.

AWS IAM Identity Center is the native AWS service designed to handle centralized user federation and permission management across accounts within AWS Organizations.

This identifies the correct service matching the goals.

Eliminate options that rely on long-term or shared credentials.

Creating local IAM users or distributing root user credentials increases operational overhead and security risk, which fails the requirement.

Ensures the selected option is the most secure and operationally efficient.

Anahtar Kavram

Centralized multi-account access control via AWS IAM Identity Center

Tahmini Süre:45s

Soru 283Soru →

A logistics company is designing a multi-account strategy using AWS Organizations. The IT department wants to implement centralized user access for administrative staff by integrating their existing external identity provider. Furthermore, the security team requires that no member account is allowed to disable AWS CloudTrail logging. Which solution should a solutions architect recommend to satisfy these requirements?

Configure AWS IAM Identity Center federated with the external identity provider, and attach a Service Control Policy (SCP) that denies the cloudtrail:StopLogging action to the organizational unit containing the member accounts.

Create individual IAM users in each member AWS account mapping to external identities, and attach a Service Control Policy (SCP) that denies the cloudtrail:StopLogging action to the root of the organization to enforce limits globally.

Configure AWS IAM Identity Center for normal users, but utilize the management account's root user credentials for daily multi-account administration. Apply local IAM policies to deny CloudTrail changes within each member account.

Create IAM users in the management account for all administrative staff, configure trust relationships for cross-account roles, and configure a Service Control Policy (SCP) on the management account itself to restrict log modification.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center federated with the external identity provider, and attach a Service Control Policy (SCP) that denies the cloudtrail:StopLogging action to the organizational unit containing the member accounts.

Cevap

Integrating AWS IAM Identity Center with an external identity provider simplifies identity management by using federation rather than local credentials. Additionally, attaching an SCP to the member accounts' organizational unit successfully prevents any user or role inside those member accounts from stopping CloudTrail logging, guaranteeing compliance.

Adım Adım Çözüm

Select the centralized authentication mechanism.

AWS IAM Identity Center is configured and integrated with the external identity provider to enable federated access without creating local IAM users.

Centralized identity management reduces credentials overhead and simplifies access lifecycle management.

Define the policy structure to prevent disabling CloudTrail.

Create a Service Control Policy (SCP) with a Deny effect on the cloudtrail:StopLogging action.

SCPs are the primary mechanism in AWS Organizations to set maximum permissions boundaries across accounts.

Apply the policy to the multi-account hierarchy.

Attach the SCP to the organizational unit containing the member accounts.

Applying the SCP at the organizational unit level ensures enforcement across all member accounts in that unit while avoiding restrictions on the management account's root operational functions if they are kept separate.

Anahtar Kavram

Centralized multi-account governance using AWS Organizations SCPs and AWS IAM Identity Center.

Soru 284Soru →

A software-as-a-service (SaaS) provider has multiple development and production environments, each hosted in a separate AWS account within an organization in AWS Organizations. The IT security team must establish a single location to manage user access and ensure that developers cannot configure long-term IAM user credentials. Which of the following actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Enable AWS IAM Identity Center and integrate it with the organization's existing external identity provider.

Apply a Service Control Policy (SCP) to the root of the organization that denies the creation of new IAM users and access keys.

Use the AWS account root user credentials of each member account to perform daily administrative and access management tasks.

Manually create individual IAM users with administrative permissions in each member account for all engineering employees.

Save user access tokens and passwords as plaintext parameters in Systems Manager Parameter Store in the management account.

Cevabı ve açıklamayı göster

Cevap: Enable AWS IAM Identity Center and integrate it with the organization's existing external identity provider.; Apply a Service Control Policy (SCP) to the root of the organization that denies the creation of new IAM users and access keys.

Cevap

Enable AWS IAM Identity Center integrated with an external identity provider, and apply a Service Control Policy (SCP) to the root of the organization that denies the creation of new IAM users and access keys.

The correct approach involves centralizing user access management using AWS IAM Identity Center integrated with an external identity provider. To enforce compliance and prevent the creation of unauthorized long-term credentials, a Service Control Policy (SCP) must be applied to the organization's root to explicitly deny the creation of new IAM users and access keys across member accounts.

Adım Adım Çözüm

Centralize user identity and credentials.

By enabling AWS IAM Identity Center and connecting it to an external identity provider, the organization eliminates the need to create local IAM users and long-term credentials.

This simplifies credential rotation and centralizes access control across all AWS accounts.

Enforce governance guardrails across the organization.

By attaching a Service Control Policy (SCP) to the root of the organization, the creation of IAM users and long-term access keys is blocked in all member accounts.

SCPs define the maximum permission boundary for member accounts, preventing administrators or developers from bypassing the centralized identity configuration.

Anahtar Kavram

Centralized identity management and organizational guardrails using AWS IAM Identity Center and Service Control Policies (SCPs).

Tahmini Süre:1m 0s

Soru 285Soru →

A solutions architect is configuring a new AWS Lambda function that must read data from an Amazon DynamoDB table. According to AWS security best practices, how should the solutions architect grant the Lambda function the necessary permissions to access the table?

Create an IAM execution role with a permissions policy that allows read access to the DynamoDB table, and associate this role with the Lambda function.

Configure the Lambda function to execute using the AWS account root user credentials to ensure that database access is never blocked by permission changes.

Create an IAM user with DynamoDB read permissions, generate long-term access keys, and store them as a plain text string in Systems Manager Parameter Store for the Lambda function to retrieve.

Create individual IAM users for each corporate identity, and configure the Lambda function to authenticate against the database using these federated user credentials.

Cevabı ve açıklamayı göster

Cevap: Create an IAM execution role with a permissions policy that allows read access to the DynamoDB table, and associate this role with the Lambda function.

Cevap

Create an IAM execution role with a permissions policy that allows read access to the DynamoDB table, and associate this role with the Lambda function.

The correct answer is correct because configuring an IAM execution role and attaching it to the Lambda function allows the function to securely assume the role at runtime. This provides the function with temporary credentials via AWS STS and follows the principle of least privilege without managing static credentials.

Adım Adım Çözüm

Create an IAM execution role with a trust policy that allows the AWS Lambda service to assume the role.

The Lambda service gains the capability to dynamically assume the role and request temporary security credentials.

AWS services must establish a trust relationship before they can assume an identity and access other resources.

Attach a permissions policy to the IAM role that grants read-only access (such as GetItem or Query actions) to the target DynamoDB table.

The role is granted the minimum necessary permissions required to read data from the database.

Restricting access to only the required resource and actions adheres to the security principle of least privilege.

Associate the execution role with the configuration of the Lambda function.

When the Lambda function is invoked, AWS securely injects temporary credentials representing the role into the execution environment.

This eliminates the need to hardcode or manually retrieve long-term access keys, significantly reducing the credential exposure risk.

Anahtar Kavram

AWS Lambda execution roles permit service-to-service authorization using temporary credentials rather than long-term access keys.

Soru 286Soru →

A company has multiple AWS accounts managed under AWS Organizations. The security audit team in the central audit account needs read-only access to Amazon S3 buckets containing CloudTrail logs in all member accounts. A solutions architect must configure this access securely following the principle of least privilege. Which TWO actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Create an IAM role in each member account with a trust policy that trusts the central audit account, and attach a policy allowing read-only access to the S3 buckets.

Grant permissions to the security audit team members in the central audit account to assume the IAM roles in the member accounts.

Create individual IAM users in each member account for every security auditor and generate permanent access keys for their access.

Distribute the AWS account root user credentials of each member account to the security audit team to allow unrestricted read access.

Store the security audit team's access keys in Systems Manager Parameter Store as plaintext String parameters for programmatic access.

Cevabı ve açıklamayı göster

Cevap: Create an IAM role in each member account with a trust policy that trusts the central audit account, and attach a policy allowing read-only access to the S3 buckets.; Grant permissions to the security audit team members in the central audit account to assume the IAM roles in the member accounts.

Cevap

The solutions architect should create an IAM role in each member account that trusts the central audit account and allows read-only access to the S3 buckets. Additionally, the security audit team members in the central audit account must be granted permissions to assume those roles.

Establishing cross-account access securely involves creating an IAM role in the target (member) accounts with a trust policy that trusts the trusted (audit) account, along with a permissions policy granting read-only S3 access. Additionally, users in the trusted account must be granted permissions to assume that cross-account role.

Adım Adım Çözüm

Configure the receiving accounts (member accounts) to trust the sending account.

An IAM role is created in each member account with a trust policy that points to the central audit account ID, allowing users from that account to assume the role.

This establishes cross-account trust securely without creating IAM users or long-term credentials in the target accounts.

Configure the permissions within the receiving accounts' roles.

An IAM permission policy is attached to the role, granting read-only access specifically to the S3 buckets containing CloudTrail logs.

This limits the scope of the assumed role to only the required resources, enforcing the principle of least privilege.

Grant assume role permissions to the audit team in the central account.

The IAM users, groups, or roles representing the audit team in the central audit account are given a policy allowing the sts:AssumeRole action on the ARN of the roles in the member accounts.

This enables the audit team to dynamically assume the target roles in the member accounts to perform their audit tasks.

Anahtar Kavram

Cross-account access using IAM roles allows users from one AWS account to access resources in another AWS account securely without creating duplicate IAM users or using long-term credentials.

Soru 287Soru →

A financial services company is deploying an application on-premises that needs to periodically read and write files to an Amazon S3 bucket. The application must also retrieve credentials to connect to an Amazon RDS database and decrypt sensitive configuration files using an AWS KMS customer managed key. The company's security policy strictly prohibits the use of long-term AWS credentials and requires that all access be based on temporary security credentials. The company already has an established internal public key infrastructure (PKI). Which combination of actions should a solutions architect recommend?

Generate access keys for the AWS account root user and configure the application to use them to ensure uninterrupted access. Store the database credentials in AWS Secrets Manager, and configure AWS KMS to automatically rotate the customer managed key daily, which immediately re-encrypts all historical data.

Configure AWS IAM Roles Anywhere to allow the on-premises application to assume an IAM role with the minimum required S3 and KMS permissions. Store the database credentials in AWS Secrets Manager with automatic rotation enabled, and enable automatic annual rotation for the KMS customer managed key.

Create a dedicated IAM user with administrative permissions for the application, generate long-term access keys, and store them in the application configuration. Store the database credentials in AWS Secrets Manager, and manually rotate the KMS customer managed key by creating a new key and immediately deleting the old key.

Create a dedicated IAM user for the application, generate long-term access keys, and configure the application to use them. Store the database credentials in AWS Systems Manager Parameter Store as a plaintext String parameter, and enable automatic annual rotation for the KMS customer managed key.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Roles Anywhere to allow the on-premises application to assume an IAM role with the minimum required S3 and KMS permissions. Store the database credentials in AWS Secrets Manager with automatic rotation enabled, and enable automatic annual rotation for the KMS customer managed key.

Cevap

The correct solution uses AWS IAM Roles Anywhere to establish trust between the on-premises PKI and AWS IAM. This allows the on-premises application to assume an IAM role and obtain temporary credentials, avoiding long-term access keys. AWS Secrets Manager is the best practice for storing database credentials because it supports automatic rotation. Enabling automatic annual key rotation for the KMS key is the recommended key management practice.

Adım Adım Çözüm

Establish a trust anchor in AWS IAM Roles Anywhere using the company's internal PKI Certificate Authority (CA) certificate.

AWS IAM Roles Anywhere can now authenticate the on-premises application based on its X.509 certificate.

To eliminate the need for long-term AWS credentials on the on-premises server.

Create an IAM role with a trust policy that allows the AWS IAM Roles Anywhere service principal to assume the role, and attach policies granting the required permissions for S3 and KMS.

The application can exchange its certificate for temporary security credentials corresponding to the role.

To enforce the principle of least privilege using short-lived credentials.

Store the database credentials in AWS Secrets Manager with automatic rotation enabled, and enable automatic key rotation for the customer managed key in AWS KMS.

Database credentials are rotated automatically without application downtime, and the KMS key is rotated annually without disabling the ability to decrypt historical data.

To satisfy the security requirements for secrets management and secure key lifecycle management.

Anahtar Kavram

AWS IAM Roles Anywhere and Secure Credentials Management

Soru 288Soru →

A Solutions Architect is designing a secure multi-account environment using AWS Organizations. The environment consists of a management account and multiple member accounts grouped into operational Organizational Units (OUs). The security team has established two key governance mandates: first, users from the corporate external Active Directory must have single sign-on access to member accounts based on their job roles without using persistent IAM credentials; second, all member accounts must be prevented from stopping AWS CloudTrail logging or deleting trails. Which combination of actions should the Solutions Architect take to satisfy these mandates? (Select TWO.)

Geçerli olan tümünü seçin

Configure AWS IAM Identity Center, integrate it with the external Active Directory, and assign permission sets to corporate groups mapped to the target accounts.

Create an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach it to the root of the Organization or to the parent OUs of the member accounts.

Create individual IAM users in each member account, configure long-term credentials for federated users, and map them to corporate Active Directory identities.

Apply an SCP directly to the management account to restrict its root user from modifying Organization-wide CloudTrail configurations.

Store the corporate Active Directory connection credentials as plaintext parameters in Systems Manager Parameter Store to automate role assumption across member accounts.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center, integrate it with the external Active Directory, and assign permission sets to corporate groups mapped to the target accounts.; Create an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach it to the root of the Organization or to the parent OUs of the member accounts.

Cevap

The correct combination of actions is to configure AWS IAM Identity Center integrated with the external Active Directory to assign permission sets to corporate groups, and to create an SCP denying the stopping or deleting of CloudTrail logs attached to the root of the Organization or parent OUs.

Configuring AWS IAM Identity Center integrated with the external Active Directory provides a centralized federation mechanism that avoids persistent IAM credentials. Attaching an SCP with explicit deny statements for cloudtrail:StopLogging and cloudtrail:DeleteTrail to the root or parent OUs ensures that all member accounts conform to the security guardrail, while the management account remains unaffected as SCPs do not restrict it.

Adım Adım Çözüm

Address the centralized identity and access mandate by establishing federation.

AWS IAM Identity Center is configured and connected to the corporate Active Directory.

This allows group-based mapping and grants temporary security credentials for single sign-on access without managing persistent credentials.

Address the governance requirement to prevent disabling or deleting CloudTrail logs across member accounts.

An SCP with explicit deny rules for cloudtrail:StopLogging and cloudtrail:DeleteTrail is drafted.

SCPs are the standard mechanism to enforce guardrails across member accounts in AWS Organizations.

Attach the SCP to the appropriate boundary within the Organization hierarchy.

The SCP is attached to the Organization root or parent OUs, exempting the management account.

SCPs do not restrict the management account, which satisfies the operational separation of the management account while enforcing strict policies on all member accounts.

Anahtar Kavram

Centralized multi-account governance and secure identity federation using AWS Organizations SCPs and AWS IAM Identity Center.

Tahmini Süre:2m 30s

Soru 289Soru →

A company needs to grant a third-party auditing firm temporary access to run configuration compliance checks on resources across all accounts in its AWS Organization. The auditing firm will access the organization's accounts from their own AWS account ( $123456789012$ ) using a commercial automated tool. The company's security policy requires that:

- The auditing tool must only be allowed to read resource configuration metadata, with no access to read actual data stored in Amazon S3 buckets or databases.
- The configuration must mitigate the risk of the 'confused deputy' security vulnerability.
- The access granted to the auditing firm must automatically expire in $30$ days without requiring manual intervention.

Which solution meets these requirements securely and with the least administrative overhead?

Share the AWS account root user credentials of the company's AWS Organizations management account with the auditing firm to allow direct access. Set a calendar reminder to manually change the root user password and rotate the multi-factor authentication (MFA) token after

30

days to revoke their access.

Create a dedicated IAM user in the company's AWS Organizations management account. Attach the AWS-managed ReadOnlyAccess policy to this user, generate long-term access keys, and provide them to the auditing firm. Configure an Amazon S3 lifecycle policy to delete the credentials document after

30

days.

Create an IAM role in the company's AWS Organizations management account that trusts the auditing firm's AWS account (

123456789012

). In the trust policy, specify a condition for the unique external ID provided by the auditing firm and a DateLessThan condition restricting the current time to

30

days. Attach the AWS-managed SecurityAudit policy to this role.

Create an IAM user with access keys configured to assume an administrative role. Store the IAM user's Access Key ID and Secret Access Key as a plaintext String parameter in AWS Systems Manager Parameter Store. Configure an AWS Lambda function to run daily to delete the parameter and the IAM user after

30

days.

Cevabı ve açıklamayı göster

Cevap: Create an IAM role in the company's AWS Organizations management account that trusts the auditing firm's AWS account ( $123456789012$ ). In the trust policy, specify a condition for the unique external ID provided by the auditing firm and a DateLessThan condition restricting the current time to $30$ days. Attach the AWS-managed SecurityAudit policy to this role.

Cevap

Create an IAM role in the company's AWS Organizations management account that trusts the auditing firm's AWS account. Use a trust policy containing conditions for the unique external ID and a DateLessThan current time condition set to

30

days, while attaching the SecurityAudit managed policy.

The correct solution involves creating a cross-account IAM role that trusts the auditing firm's AWS account. To address the confused deputy problem, a condition for the external ID is added to the trust policy. The requirement for automatic expiration after

30

days is met by using the DateLessThan condition block with the aws:CurrentTime key in the trust policy. The SecurityAudit AWS-managed policy provides read-only access to resource metadata and configurations (such as AWS Config or CloudTrail) without granting access to actual customer data inside Amazon S3 or databases.

Adım Adım Çözüm

Determine the correct access mechanism

Utilize role-based cross-account access rather than creating IAM users or sharing root credentials to adhere to AWS security best practices.

This establishes temporary security credentials and avoids managing long-term access keys.

Address the confused deputy risk

Include the unique external ID provided by the third-party auditor in the trust policy condition block (sts:ExternalId).

This ensures the auditing firm's tool only assumes the role when acting specifically on behalf of the company.

Enforce automatic expiration

Implement a temporal constraint in the trust policy using the DateLessThan condition block compared against aws:CurrentTime set to

30

days in the future.

This prevents STS from issuing credentials once the date threshold is exceeded, meeting the automatic expiration requirement.

Apply least privilege permissions

Attach the AWS-managed SecurityAudit policy to the role.

This policy allows read-only access to configurations and metadata without exposing raw customer data in databases or Amazon S3.

Anahtar Kavram

Implementing secure cross-account access using IAM roles, mitigating the confused deputy vulnerability using external IDs, enforcing temporary access duration with temporal policy conditions, and applying least privilege with predefined security audit policies.

Tahmini Süre:3m 0s

Soru 290Soru →

A financial services company is using AWS Organizations to manage its multi-account environment. The security team wants to ensure that no member accounts in the 'Core-Workloads' Organizational Unit (OU) can disable Amazon GuardDuty or delete its detectors. Additionally, the company needs to establish centralized access control so that employees can sign in using their existing corporate identity provider credentials and be mapped to specific roles across various AWS accounts. Which combination of actions will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Enable AWS IAM Identity Center in the organization's management account and configure federation with the corporate identity provider.

Create a Service Control Policy (SCP) that denies guardduty:DeleteDetector and guardduty:UpdateDetector, and attach the SCP to the Core-Workloads OU.

Create individual IAM users with long-term security credentials in each member account for every corporate user, and write a custom script to synchronize their credentials.

Configure the administration team to use the AWS account root user credentials of the management account to perform federated single sign-on administration tasks.

Store the corporate identity provider's integration client secrets as plaintext parameters in Systems Manager Parameter Store in each member account.

Cevabı ve açıklamayı göster

Cevap: Enable AWS IAM Identity Center in the organization's management account and configure federation with the corporate identity provider.; Create a Service Control Policy (SCP) that denies guardduty:DeleteDetector and guardduty:UpdateDetector, and attach the SCP to the Core-Workloads OU.

Cevap

Enable AWS IAM Identity Center in the organization's management account and configure federation with the corporate identity provider, and create a Service Control Policy (SCP) that denies guardduty:DeleteDetector and guardduty:UpdateDetector, and attach the SCP to the Core-Workloads OU.

Centralizing access control through AWS IAM Identity Center and federating it with the corporate identity provider simplifies administration and eliminates the need to manage individual IAM users in member accounts. Additionally, applying a Service Control Policy (SCP) to the OU containing member accounts enforces security policies globally, preventing local administrators from disabling Amazon GuardDuty.

Adım Adım Çözüm

Evaluate the requirement to prevent member accounts from disabling Amazon GuardDuty.

Local IAM policies are insufficient because local administrators can modify or bypass them. A Service Control Policy (SCP) must be used at the Organizational Unit (OU) level to establish a permission guardrail.

SCPs apply to all users and roles in member accounts, including the root user, ensuring compliance with security baselines.

Evaluate the requirement for centralized federated access using the corporate identity provider.

AWS IAM Identity Center should be enabled in the management account and integrated with the identity provider via SAML 2.0 or OIDC.

This centralizes user management, eliminates local IAM users, and enforces single sign-on across the organization.

Combine the security baseline and federation solutions to form the complete architectural recommendation.

The final architecture uses IAM Identity Center for access governance and SCPs for resource governance.

This meets both the security and operations requirements according to AWS Well-Architected best practices.

Anahtar Kavram

Multi-Account Security Governance and Centralized Identity Management

Soru 291Soru →

A Solutions Architect is designing a multi-account strategy using AWS Organizations. The organization consists of a management account, a Security organizational unit (OU), a Production OU, and a Development OU. The security team requires that no users or roles in the Production and Development OUs are allowed to disable AWS CloudTrail or delete trails. However, the Security OU must retain the ability to modify CloudTrail settings for automated maintenance. Additionally, the company wants to implement centralized single sign-on access using their existing external identity provider (IdP) without managing individual credentials in each member account.

Which combination of actions will meet these security and access requirements?

Create individual IAM users with long-term credentials in the management account for all corporate users. Set up cross-account IAM roles in the member OUs that trust the management account. Attach a Service Control Policy (SCP) that denies CloudTrail deletion actions to the organization's root.

Enable AWS IAM Identity Center in the management account and configure federation with the external IdP. Create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions. Attach this SCP to the management account itself to restrict its administrative and root users from modifying organizational trails.

Enable AWS IAM Identity Center in the management account and configure federation with the external IdP. Create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach this SCP to the Production and Development OUs.

Enable AWS IAM Identity Center in the management account. Create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach this SCP to the organization's root. For member account access, create individual IAM users with administrative permissions in each member account and configure federated API access.

Cevabı ve açıklamayı göster

Cevap: Enable AWS IAM Identity Center in the management account and configure federation with the external IdP. Create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach this SCP to the Production and Development OUs.

Cevap

Enable AWS IAM Identity Center in the management account, configure federation with the external IdP, create an SCP that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach this SCP to the Production and Development OUs.

The correct option addresses all requirements by using AWS IAM Identity Center to federate identity access from the external identity provider, which avoids managing local IAM users. It correctly limits the scope of the SCP by attaching it only to the Production and Development OUs, thereby exempting the Security OU and allowing it to perform authorized maintenance tasks.

Adım Adım Çözüm

Address the centralized authentication requirement.

Enable AWS IAM Identity Center in the organization's management account and configure integration with the external identity provider.

This establishes centralized single sign-on and federated access, eliminating the need to create and manage individual IAM users with long-term credentials in each member account.

Define the policy to prevent unauthorized CloudTrail modifications.

Create a Service Control Policy (SCP) containing a Deny rule for the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.

SCPs act as permission guardrails that define the maximum permissions for member accounts under an organization.

Target the policy attachment to respect organizational unit boundaries.

Attach the created SCP to the Production and Development OUs, leaving the Security OU and the management account root exempt from the policy.

Attaching the SCP to specific OUs allows granular enforcement, ensuring the Security OU retains its administrative capability over CloudTrail while protecting the target environments.

Anahtar Kavram

Fine-grained governance using Service Control Policies and centralized authentication with AWS IAM Identity Center.

Tahmini Süre:2m 30s

Soru 292Soru →

A Solutions Architect is designing a security governance framework for a healthcare technology provider. The provider has a multi-account environment managed through AWS Organizations, structured with separate OUs for Production, Testing, and Shared Services. The compliance team mandates that no IAM user or role within any member account—including administrative users—can create unencrypted Amazon EBS volumes or delete AWS KMS customer managed keys. Furthermore, the organization wants to manage human access centrally via an existing Microsoft Entra ID tenant without maintaining long-term security credentials in individual member accounts.

Which combination of actions should the Solutions Architect take to satisfy these governance and security requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure AWS IAM Identity Center to federate with Microsoft Entra ID as the external identity provider, and assign permission sets to manage user access across the member accounts.

Create a Service Control Policy (SCP) that denies kms:DeleteKey and ec2:CreateVolume actions if encryption is not enabled, and attach the policy to the organization's root or specific organizational units.

Apply a Service Control Policy (SCP) to the organization's management account to block kms:DeleteKey and ec2:CreateVolume actions, ensuring the management account's administrative users are subject to the same compliance constraints.

Create individual IAM users with long-term credentials in each member account for every user in Microsoft Entra ID, and use IAM groups to map permissions.

Configure AWS Directory Service for Microsoft Active Directory inside each member account to directly synchronize user identities from the external cloud identity provider, mapping them to local IAM users.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center to federate with Microsoft Entra ID as the external identity provider, and assign permission sets to manage user access across the member accounts.; Create a Service Control Policy (SCP) that denies kms:DeleteKey and ec2:CreateVolume actions if encryption is not enabled, and attach the policy to the organization's root or specific organizational units.

Cevap

Configure AWS IAM Identity Center to federate with Microsoft Entra ID and assign permission sets, and create a Service Control Policy (SCP) denying the unauthorized actions attached to the organization's root or organizational units.

Integrating AWS IAM Identity Center with Microsoft Entra ID allows central management of user access across multiple AWS accounts using temporary credentials, which avoids creating long-term IAM user credentials. At the same time, applying an SCP to the root or OUs prevents actions such as deleting KMS customer managed keys or creating unencrypted volumes across all member accounts, including administrative identities.

Adım Adım Çözüm

Analyze the compliance requirement to restrict all administrative and standard users in member accounts from creating unencrypted volumes or deleting KMS keys.

Determine that Service Control Policies (SCPs) attached to the organization's root or organizational units (OUs) are the correct mechanism to enforce these mandatory guardrails across all member account roles.

SCPs define permission guardrails that even account administrators in member accounts cannot bypass.

Analyze the identity requirement to centralize access from Microsoft Entra ID without creating individual member account IAM users.

Determine that AWS IAM Identity Center integrated with Microsoft Entra ID as the external identity provider is the standard and secure solution.

AWS IAM Identity Center provides federated access using short-term credentials, avoiding the creation and maintenance of long-term IAM users.

Anahtar Kavram

Centralized governance and federated access in a multi-account structure using AWS Organizations SCPs and AWS IAM Identity Center.

Tahmini Süre:2m 30s

Soru 293Soru →

A company needs to configure administrative access for a systems administrator to manage AWS resources daily. According to AWS security best practices, which approach should the company use to grant this access?

Use the AWS account root user credentials for daily administrative tasks to simplify management.

Create individual IAM users with long-term credentials for each user in the external corporate directory.

Create an IAM user with the required administrative permissions and require Multi-Factor Authentication (MFA).

Store the administrative credentials in Systems Manager Parameter Store as a plaintext parameter for script access.

Cevabı ve açıklamayı göster

Cevap: Create an IAM user with the required administrative permissions and require Multi-Factor Authentication (MFA).

Cevap

Create an IAM user with the required administrative permissions and require Multi-Factor Authentication (MFA).

The correct approach is to create a dedicated IAM user with the necessary administrative permissions and enforce Multi-Factor Authentication (MFA). AWS strongly recommends not using the root user for daily tasks, utilizing IAM roles/users with least privilege, and protecting privileged accounts with MFA.

Adım Adım Çözüm

Evaluate the requirement for daily administrative access to AWS resources.

Identify that standard administrative tasks should follow the principle of least privilege and use separate credentials rather than root credentials.

To secure the AWS environment and prevent accidental or malicious actions that could compromise the entire account.

Select the appropriate IAM entity for the administrator.

Choose to create a dedicated IAM user (or use IAM Identity Center for federated access) and assign only the necessary permissions.

This aligns with the principle of least privilege and isolates the administrator's actions.

Apply additional security controls.

Enforce Multi-Factor Authentication (MFA) on the administrative user account.

MFA adds an essential layer of security to prevent unauthorized access even if the primary credentials are compromised.

Anahtar Kavram

AWS Identity and Access Management (IAM) Best Practices

Tahmini Süre:1m 0s

Soru 294Soru →

An organization is designing a serverless data processing application. AWS Lambda functions in the application must securely access a database password to connect to an Amazon RDS database. The database credentials must be rotated every 30 days without application downtime. Additionally, an external compliance auditor requires temporary, read-only access to the Amazon S3 bucket where the processed output files are stored.

Which combination of actions should the solutions architect take to meet these requirements securely? (Select TWO.)

Geçerli olan tümünü seçin

Configure AWS Secrets Manager to store the database credentials, enable automatic rotation every 30 days using a rotation Lambda function, and grant the Lambda execution role permissions to retrieve the secret.

Create an IAM role in the processing account that grants read-only access to the S3 bucket, configure a trust policy that allows the auditor's AWS account to assume the role, and provide the auditor with the role ARN.

Store the database credentials as a standard String parameter in AWS Systems Manager Parameter Store, and schedule a custom Lambda function to update the parameter value every 30 days.

Create an IAM user in the AWS account for the external auditor, attach an IAM policy for S3 read-only access, and provide the auditor with the access key ID and secret access key.

Configure the Lambda functions to run using the AWS account root user credentials to ensure they have administrative permissions to rotate the database passwords and manage the S3 bucket policies.

Cevabı ve açıklamayı göster

Cevap: Configure AWS Secrets Manager to store the database credentials, enable automatic rotation every 30 days using a rotation Lambda function, and grant the Lambda execution role permissions to retrieve the secret.; Create an IAM role in the processing account that grants read-only access to the S3 bucket, configure a trust policy that allows the auditor's AWS account to assume the role, and provide the auditor with the role ARN.

Cevap

Configure AWS Secrets Manager to store database credentials with automatic rotation, and create a cross-account IAM role with a trust policy for the external auditor.

The correct architecture uses AWS Secrets Manager to store and rotate database passwords dynamically, which keeps credentials secure and satisfies the rotation requirement. To grant secure cross-account access to the external auditor, creating an IAM role with a trust policy allowing the auditor's account to assume it is the standard and most secure pattern because it provides temporary credentials instead of long-term access keys.

Adım Adım Çözüm

Store the sensitive database credentials securely in AWS Secrets Manager and set up automatic 30-day rotation using the built-in integration with AWS Lambda.

The database credentials are encrypted at rest, rotated automatically without manual intervention or downtime, and can be retrieved dynamically by the application.

This meets the security requirement for credential rotation and protects the credentials from exposure.

Configure the Lambda execution role with permissions to access the specific secret from Secrets Manager.

The Lambda function can authenticate to the database securely at runtime without hardcoding credentials.

This enforces the principle of least privilege by restricting access to only the authorized resource.

Establish a cross-account IAM role in the local AWS account that has read-only access to the S3 bucket, and define a trust policy referencing the external auditor's AWS account ID.

The external auditor can assume the role to receive temporary security credentials for S3 access.

This avoids creating long-term IAM users or sharing permanent credentials with external third parties.

Anahtar Kavram

AWS IAM identity federation, cross-account access via roles, and secure secrets management with rotation.

Soru 295Soru →

An enterprise runs a microservices-based application on Amazon ECS in Account B. The application requires read access to sensitive customer data files stored in an Amazon S3 bucket within Account A. The S3 bucket is encrypted using an AWS KMS customer managed key (CMK) in Account A. A solutions architect must design a secure, cross-account access pattern following the principle of least privilege, ensuring that credentials are not hardcoded or stored insecurely. Which combination of configurations must the solutions architect implement to achieve this goal? (Select TWO.)

Geçerli olan tümünü seçin

Create an IAM task role in Account B with permissions to read from the S3 bucket and decrypt using the KMS key, and associate it with the ECS task definition.

Configure both the S3 bucket policy and the KMS key policy in Account A to explicitly grant the ECS task role in Account B permissions for read and decrypt actions.

Grant access by adding the AWS account root user of Account B to the S3 bucket policy in Account A, and configure the ECS tasks to run with the root user credentials.

Generate an IAM user in Account A, attach a policy allowing read and decrypt permissions, and store the access key and secret key as standard parameters in Systems Manager Parameter Store for the ECS task to retrieve.

Enable KMS automatic key rotation in Account A to automatically re-encrypt existing objects in the S3 bucket and implicitly delegate cross-account decryption rights to Account B.

Cevabı ve açıklamayı göster

Cevap: Create an IAM task role in Account B with permissions to read from the S3 bucket and decrypt using the KMS key, and associate it with the ECS task definition.; Configure both the S3 bucket policy and the KMS key policy in Account A to explicitly grant the ECS task role in Account B permissions for read and decrypt actions.

Cevap

Creating an IAM task role in Account B associated with the ECS task definition, and configuring the S3 bucket policy and KMS key policy in Account A to grant permissions to that role.

To establish secure cross-account access, the solutions architect must assign an IAM task role directly to the ECS container. Additionally, because the S3 bucket and KMS CMK are in Account A (cross-account relative to the ECS task in Account B), the resource-based policies in Account A (the bucket policy and KMS key policy) must explicitly authorize the ECS task role from Account B.

Adım Adım Çözüm

Define an IAM task role in the application's account (Account B) with a trust policy allowing the ECS task executor to assume the role.

An IAM role is created that can be assumed by ECS containers at launch.

Allows containerized tasks to dynamically obtain temporary security credentials instead of relying on long-term IAM user keys.

Associate the newly created IAM task role with the ECS task definition.

The ECS container receives local environment variables with temporary AWS credentials.

Permits the application code inside the container to make authenticated AWS API calls under the identity of the task role.

Modify the S3 bucket policy in Account A to allow read permissions for the IAM task role's ARN in Account B.

Cross-account S3 access is authorized at the resource level.

Cross-account access to S3 requires explicit authorization from both the IAM identity policy and the target resource's bucket policy.

Update the KMS key policy in Account A to allow decrypt permissions for the IAM task role's ARN in Account B.

Cross-account KMS decrypt authorization is established.

Because the S3 objects are encrypted with a Customer Managed Key, the reader must have explicit decrypt permissions on the key policy; IAM policies alone cannot grant access to cross-account KMS keys.

Anahtar Kavram

Cross-account resource delegation using IAM roles, S3 bucket policies, and KMS key policies.

Tahmini Süre:3m 0s

Soru 296Soru →

A company is deploying a new web application on AWS using Amazon CloudFront and an Application Load Balancer. The company needs to design a security strategy that protects the application against two specific threats: common application-layer exploits such as SQL injection, and volumetric Layer 3 and Layer 4 DDoS attacks.

Which combination of AWS services should the solutions architect implement to address these threats? (Select TWO.)

Geçerli olan tümünü seçin

AWS WAF to inspect incoming HTTP/HTTPS requests and block SQL injection patterns.

AWS Shield Standard to provide automatic, always-on protection against Layer 3 and Layer 4 DDoS attacks.

AWS Shield Standard to analyze application-layer traffic and automatically block SQL injection exploits.

Network Access Control Lists (NACLs) configured at the subnet level to inspect and block SQL injection payloads.

Security Groups applied to the Application Load Balancer to perform deep packet inspection and filter SQL injection attacks.

Cevabı ve açıklamayı göster

Cevap: AWS WAF to inspect incoming HTTP/HTTPS requests and block SQL injection patterns.; AWS Shield Standard to provide automatic, always-on protection against Layer 3 and Layer 4 DDoS attacks.

Cevap

AWS WAF to inspect incoming HTTP/HTTPS requests and block SQL injection patterns, and AWS Shield Standard to provide automatic, always-on protection against Layer 3 and Layer 4 DDoS attacks.

The solution requires addressing both Layer 7 exploits (like SQL injection) and Layer 3/4 DDoS attacks. AWS WAF provides Layer 7 protection by inspecting HTTP/HTTPS traffic to filter out SQL injection patterns. AWS Shield Standard automatically provides Layer 3 and Layer 4 protection against common infrastructure-layer DDoS attacks at the edge.

Adım Adım Çözüm

Identify the application-layer (Layer 7) security requirement.

SQL injection is a Layer 7 exploit that requires HTTP/HTTPS payload inspection to detect and block malicious patterns.

AWS WAF is the service that inspects Layer 7 web traffic and applies rules to filter out exploits like SQL injection.

Identify the infrastructure-layer (Layer 3/4) security requirement.

Volumetric DDoS attacks target the network and transport layers (Layers 3 and 4).

AWS Shield Standard provides automatic, always-on protection against common Layer 3 and 4 DDoS attacks at no additional cost.

Evaluate and eliminate incorrect firewalls.

Security Groups and Network Access Control Lists (NACLs) operate at Layer 4 and cannot inspect application payloads.

They are unsuitable for Layer 7 SQL injection detection, and AWS Shield Standard automatically covers the Layer 3/4 DDoS protection requirement without manually configuring NACLs or Security Groups for DDoS.

Anahtar Kavram

AWS WAF provides Layer 7 application-layer filtering, whereas AWS Shield Standard automatically protects against Layer 3/4 infrastructure-layer DDoS attacks.

Soru 297Soru →

A municipal transit authority operates a real-time vehicle tracking API endpoint on AWS. The API is deployed behind an Application Load Balancer (ALB) and receives rapid HTTP requests from commuter mobile applications. The authority needs to protect the infrastructure from volumetric Layer 3/4 DDoS attacks and prevent clients from overwhelming the backend EC2 instances with high-rate Layer 7 HTTP GET requests. Which combination of AWS configurations should a solutions architect implement to meet these security requirements? (Select TWO.)

Geçerli olan tümünü seçin

Enable AWS Shield Advanced on the Application Load Balancer to provide automatic mitigation against infrastructure-layer volumetric attacks.

Deploy AWS WAF with a rate-based rule associated with the Application Load Balancer to block clients exceeding request thresholds.

Configure stateful Network Access Control Lists (NACLs) at the subnet boundaries to automatically identify and block IP addresses generating excessive HTTP traffic.

Rely on AWS Shield Standard to inspect incoming application-layer payloads and automatically block SQL injection and HTTP flood exploits.

Implement Security Groups on the backend EC2 instances with ingress rules set to dynamically block individual source IP addresses that send rapid requests.

Cevabı ve açıklamayı göster

Cevap: Enable AWS Shield Advanced on the Application Load Balancer to provide automatic mitigation against infrastructure-layer volumetric attacks.; Deploy AWS WAF with a rate-based rule associated with the Application Load Balancer to block clients exceeding request thresholds.

Cevap

Enable AWS Shield Advanced on the Application Load Balancer to protect against infrastructure-layer volumetric attacks, and deploy AWS WAF with a rate-based rule associated with the Application Load Balancer to block clients exceeding HTTP request rate thresholds.

Implementing AWS Shield Advanced on the Application Load Balancer provides dedicated protection against volumetric Layer 3 and Layer 4 infrastructure attacks. Simultaneously, associating AWS WAF with a rate-based rule on the Application Load Balancer dynamically mitigates Layer 7 HTTP flood attacks by tracking request rates from individual client IPs and blocking those that exceed safe thresholds.

Adım Adım Çözüm

Address the infrastructure-layer (Layer 3 and 4) volumetric DDoS protection requirement.

Enable AWS Shield Advanced on the Application Load Balancer.

AWS Shield Advanced provides active mitigation against volumetric Layer 3/4 attacks specifically tailored to protected AWS resources like Application Load Balancers.

Address the application-layer (Layer 7) protection and rate-limiting requirement.

Create an AWS WAF Web ACL containing a rate-based rule and associate it with the Application Load Balancer.

AWS WAF rate-based rules evaluate client requests over a sliding window (e.g., 5 minutes) and block traffic from client IPs that exceed the specified limit, protecting backend EC2 instances from HTTP floods.

Anahtar Kavram

Edge protection requires a layered approach: AWS Shield Advanced for L3/L4 volumetric protection, and AWS WAF with rate-based rules for L7 application-layer mitigation.

Tahmini Süre:2m 0s

Soru 298Soru →

A company is deploying an application on Amazon EC2 instances. The application needs to retrieve data from an Amazon DynamoDB table. Which TWO actions should a solutions architect take to configure access to the DynamoDB table in a secure manner? (Select TWO.)

Geçerli olan tümünü seçin

Create an IAM role that has query permissions for the DynamoDB table.

Create an EC2 instance profile, attach the IAM role to it, and associate it with the EC2 instances.

Use the AWS account root user credentials directly inside the application configuration file to authenticate requests.

Create an IAM user, generate long-term access keys, and store them in plaintext in a Systems Manager Parameter Store parameter.

Create individual IAM users for the EC2 instances and set up federation via IAM Identity Center to manage instance access.

Cevabı ve açıklamayı göster

Cevap: Create an IAM role that has query permissions for the DynamoDB table.; Create an EC2 instance profile, attach the IAM role to it, and associate it with the EC2 instances.

Cevap

Create an IAM role with query permissions for the DynamoDB table, and associate that role with the EC2 instances using an EC2 instance profile.

Defining permissions in an IAM role and attaching it to the EC2 instances via an instance profile is the secure, standard pattern on AWS. The application uses temporary, auto-rotating credentials from the Instance Metadata Service, which completely avoids storing long-term credentials.

Adım Adım Çözüm

Define the IAM role permissions.

An IAM role is created with a policy allowing query operations on the specific DynamoDB table.

This establishes least privilege access for the application's required operations.

Attach the role to the EC2 instances.

An EC2 instance profile containing the IAM role is created and associated with the EC2 instances.

This allows the application on EC2 to automatically request temporary security credentials from the Instance Metadata Service (IMDS) without managing hardcoded keys.

Anahtar Kavram

IAM roles for EC2 instances allow applications to securely access AWS resources using temporary credentials rather than long-term keys.

Soru 299Soru →

A Solutions Architect is designing a multi-account environment on AWS for a global retail analytics platform. The company wants to enforce a policy where database administrators can only manage database resources within specific production and development accounts. In addition, the security team requires that all user authentication be centralized against their existing external identity provider, and that security monitoring configurations in member accounts cannot be modified by any local administrators. Which combination of actions should the Solutions Architect recommend to meet these requirements with the least administrative effort?

Configure an identity federation solution by creating individual IAM users with programmatic access in every AWS account, and write a custom synchronization script that maps corporate directory groups to local IAM group policies. Attach SCPs to the Organizational Units (OUs) to restrict security configuration modifications.

Configure AWS IAM Identity Center for centralized federation. Create Service Control Policies (SCPs) that restrict security modifications, and apply them to the root of the organization to restrict both the management account and all member accounts. Perform all daily administrative tasks using the management account's root user credentials to ensure full compliance.

Configure AWS IAM Identity Center connected to the external identity provider for user access. Create Service Control Policies (SCPs) in AWS Organizations that prevent the modification of security configurations, and attach them to the member Organizational Units (OUs).

Create IAM users in a centralized security account and configure cross-account IAM roles in the member accounts. Instruct users to log in using their IAM user credentials and manually assume the appropriate roles. Apply local IAM policies with explicit deny statements in each member account to prevent security modifications.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center connected to the external identity provider for user access. Create Service Control Policies (SCPs) in AWS Organizations that prevent the modification of security configurations, and attach them to the member Organizational Units (OUs).

Cevap

Configure AWS IAM Identity Center connected to the external identity provider for user access, and create Service Control Policies (SCPs) in AWS Organizations that prevent the modification of security configurations, attaching them to the member Organizational Units (OUs).

Centralizing authentication using AWS IAM Identity Center integrated with an external identity provider simplifies user access management without creating individual IAM users. Service Control Policies (SCPs) applied at the Organizational Unit (OU) level can restrict member accounts from modifying security configurations, implementing guardrails that even local administrators cannot bypass.

Adım Adım Çözüm

Evaluate identity federation options to meet the centralized authentication requirement.

Identify AWS IAM Identity Center as the recommended tool to integrate with an external identity provider rather than creating static IAM users.

Centralized identity provider integration reduces credential management complexity and follows the principle of least privilege.

Determine the mechanism to enforce compliance and prevent local administrators from changing security settings.

Identify Service Control Policies (SCPs) in AWS Organizations attached to member Organizational Units (OUs) to act as permission guardrails.

SCPs apply to all users and roles in member accounts, including the local administrators (administrator/root permissions inside that account).

Combine the identity federation and SCP strategy to form a cohesive multi-account governance solution.

Select the option that configures AWS IAM Identity Center for external federation and uses SCPs attached to member OUs.

This combination achieves secure governance, centralized identity management, and enforces policy controls with minimal administrative effort.

Anahtar Kavram

Multi-Account Governance with AWS Organizations, AWS IAM Identity Center, and Service Control Policies (SCPs)

Soru 300Soru →

A financial company uses a central identity AWS account to federate user logins from an external OIDC-compliant Identity Provider (IdP). Developers must perform administrative tasks on Amazon EC2 instances and Amazon RDS databases in multiple application-specific AWS accounts. The security team mandates that access must be granted dynamically based on the developer’s active project assignment, which is stored as a custom attribute in the IdP. The solution must enforce Attribute-Based Access Control (ABAC), support temporary credentials, and ensure no credentials or user profiles are manually maintained in the target application accounts. Which combination of actions will meet these requirements securely?

Configure the external IdP to send the project attribute as a session tag in the OIDC token. In the central identity account, allow the IAM role assumed by developers to transitively pass session tags. In each application account, configure the trust policy of the target IAM role to trust the identity account and permit the sts:AssumeRole and sts:TagSession actions. Attach an identity-based policy to the target role that allows EC2 and RDS actions only when the resource's project tag matches the principal tag aws:PrincipalTag/Project.

Create individual IAM users in each target application account corresponding to each developer in the identity provider. Use a cron job on an EC2 instance to synchronize project tags from the external IdP to each IAM user daily. Attach a permission policy to the IAM users that grants access to EC2 and RDS resources only if the aws:PrincipalTag/Project tag matches the resource's project tag.

Use the AWS account root user of each target application account to create a direct OpenID Connect (OIDC) identity provider configuration. Grant administrative permissions directly to the root user's execution space, allowing federated users to access resources without the overhead of assuming cross-account IAM roles.

Store the developers' IdP session tokens and database credentials as plaintext String parameters in AWS Systems Manager Parameter Store in the central identity account. Create an IAM role in each application account that retrieves these parameters to verify the project attribute and authenticate access requests.

Cevabı ve açıklamayı göster

Cevap: Configure the external IdP to send the project attribute as a session tag in the OIDC token. In the central identity account, allow the IAM role assumed by developers to transitively pass session tags. In each application account, configure the trust policy of the target IAM role to trust the identity account and permit the sts:AssumeRole and sts:TagSession actions. Attach an identity-based policy to the target role that allows EC2 and RDS actions only when the resource's project tag matches the principal tag aws:PrincipalTag/Project.

Cevap

The configuration using session tags in the IdP, transitively passing them through sts:TagSession in trust policies, and using aws:PrincipalTag/Project for ABAC.

The correct solution leverages native AWS federation and Attribute-Based Access Control (ABAC). By configuring the external IdP to pass the project attribute as a session tag and allowing the sts:TagSession action in the cross-account trust policy, developers can securely carry their attributes across AWS accounts. In the destination accounts, the target role's identity policy compares the resource tag with the principal's session tag (using the aws:PrincipalTag/Project key), ensuring that access is granted dynamically without manually managing IAM users or static credentials in each environment.

Adım Adım Çözüm

Configure OIDC and pass Attributes as Tags

The external IdP passes the project attribute as a session tag (e.g., Project) within the SAML assertion or OIDC token during authentication.

This allows AWS to receive the user's identity attributes as session tags, which is the foundation of Attribute-Based Access Control (ABAC).

Configure cross-account delegation with TagSession trust

In the application accounts, the cross-account role's trust policy is configured to trust the central identity account and explicitly allow the action sts:TagSession in addition to sts:AssumeRole.

The sts:TagSession action is required to permit the calling identity in the central account to transitively pass session tags to the role in the target application account.

Implement ABAC evaluation logic in the target role's permission policy

An identity-based policy attached to the target role in the application account allows EC2 and RDS actions only when the resource's project tag matches the context key aws:PrincipalTag/Project.

The aws:PrincipalTag/Project context key evaluates the Project session tag of the principal (developer) against the resource's tags to authorize access dynamically.

Anahtar Kavram

Federated Attribute-Based Access Control (ABAC) using IAM Session Tags and cross-account sts:TagSession trust policies.

Tahmini Süre:3m 0s

ÖncekiSayfa 15 / 74Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram