Examkin

Tüm alıştırma soruları

1462 soru

Tüm türler1,462Çoktan seçmeli739Çoklu seçim723
Soru 321Soru →

A pharmaceutical company hosts a clinical trial monitoring application on AWS in the `us-east-1` Region. The application's database tier is running on an Amazon RDS for PostgreSQL Multi-AZ DB instance. The application tier runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The company needs to design a disaster recovery (DR) plan in the `us-west-2` Region. The DR plan must meet a Recovery Time Objective (RTO) of 33 hours and a Recovery Point Objective (RPO) of 1515 minutes. The company wants to minimize ongoing costs during normal operations. Which of the following database and application tier strategies should a solutions architect recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon RDS for PostgreSQL cross-region read replica in the `us-west-2` Region. Copy the application EC2 Amazon Machine Image (AMI) to the `us-west-2` Region. In the backup Region, pre-configure an Application Load Balancer and an Auto Scaling group with a minimum capacity of 00. During a failover event, promote the replica, scale up the Auto Scaling group, and update Amazon Route 53 active-passive failover routing.

Cevap

The correct strategy is to configure a cross-region read replica in the backup Region, copy the application AMI, pre-configure the load balancer and an Auto Scaling group set to 00 minimum capacity, and promote/scale resources only during failover.
The correct strategy uses a Pilot Light model where database replication is active (via a cross-region RDS read replica) to satisfy the 1515-minute RPO, while the compute resources (EC2 instances in an Auto Scaling group) are kept offline (capacity set to 00) to minimize costs. Since the RTO is 33 hours, there is sufficient time to promote the replica to primary, scale up the Auto Scaling group from the copied AMI, and update Route 53 routing.

Adım Adım Çözüm

1
Analyze the RTO and RPO constraints (33 hours and 1515 minutes) and the cost constraint.
The low RPO (1515 minutes) requires continuous database replication. The generous RTO (33 hours) allows the application tier to remain offline during normal operations to minimize compute costs.
This defines a Pilot Light disaster recovery model, where data is kept current but compute resources are only launched when a disaster occurs.
2
Determine the database replication strategy.
An Amazon RDS cross-region read replica provides asynchronous replication with lag typically measured in seconds, meeting the 1515-minute RPO.
Cross-region replicas are the standard mechanism to replicate RDS databases across AWS Regions for disaster recovery.
3
Determine the application tier deployment strategy to minimize operational costs.
Keeping the application instances shut down or the Auto Scaling group size at 00 in the backup Region avoids EC2 compute costs. Copying the AMI ensures that instances can be launched quickly during failover.
This meets the cost minimization requirement while ensuring the application can be restored within the 33-hour window.

Anahtar Kavram

Disaster Recovery (DR) Strategies (Pilot Light vs. Warm Standby vs. Active-Active) and RDS Cross-Region Replication
Tahmini Süre:2m 0s
Soru 322Soru →

An online auction platform allows users to submit bids on items. The platform must process these bids in the exact chronological sequence in which they are received to ensure that the correct winning bid is determined. Bidding activity is highly variable, with sudden spikes in traffic during the final minutes of popular auctions. The architecture must decouple the bid submission layer from the backend processing system to handle these traffic spikes without losing any bids. Which solution meets these requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: Configure the bid submission layer to send events to an Amazon SQS FIFO queue, using the auction item ID as the message group ID. Have the backend processing system consume messages from the queue.

Cevap

Configuring the bid submission layer to send events to an Amazon SQS FIFO queue, using the auction item ID as the message group ID, and having the backend processing system consume messages from the queue.
The correct solution uses an Amazon SQS FIFO queue to decouple the application components while guaranteeing that bids are processed in the exact order they are received. By using the auction item ID as the message group ID, the queue ensures that bids for the same auction item are processed sequentially, while bids for different items can be processed in parallel. This serverless approach minimizes operational overhead.

Adım Adım Çözüm

1
Analyze the requirements for ordering and decoupling.
The system requires strict chronological processing (ordering) and must decouple the frontend from the backend to handle sudden traffic spikes (queuing/decoupling).
This establishes the necessary AWS services (like Amazon SQS FIFO) that support both decoupling and message ordering.
2
Evaluate Amazon SQS queue types.
Amazon SQS FIFO queues guarantee that messages are processed in the exact order they are received, whereas standard SQS queues only offer best-effort ordering.
This rules out standard SQS queues, which could process bids out of order.
3
Determine the partition/grouping strategy and operational overhead.
Using the auction item ID as the message group ID in SQS FIFO allows parallel processing across different auctions while maintaining strict ordering within each auction, with minimal operational overhead.
This ensures both ordering correctness and high performance without the overhead of managing stream shards or database polling loops.

Anahtar Kavram

Decoupling message queues with ordering guarantees (SQS FIFO)
Tahmini Süre:1m 30s
Soru 323Soru →

A company needs to grant a third-party audit team temporary access to run query analysis on Amazon Athena using data stored in an Amazon S3 bucket. The audit team manages their users through their own external identity provider (IdP). Which of the following is the most secure method to grant the audit team access according to AWS security best practices?

Cevabı ve açıklamayı göster

Cevap: Configure identity federation using the audit team's external identity provider to allow their users to assume an IAM role that grants least-privilege permissions to Amazon Athena and the S3 bucket.

Cevap

Configure identity federation using the audit team's external identity provider to allow their users to assume an IAM role that grants least-privilege permissions to Amazon Athena and the S3 bucket.
The correct answer is to configure identity federation using the external identity provider (IdP) to allow the audit team to assume an IAM role. This solution avoids creating local IAM users with long-term credentials and aligns with the AWS well-architected framework security pillar, providing short-lived, least-privilege credentials.

Adım Adım Çözüm

1
Identify the requirement to grant temporary access to external users managed by an external identity provider.
Determine that AWS Identity Federation should be utilized instead of creating local IAM users.
Using federation avoids the creation and management of long-term credentials for external entities, satisfying security best practices.
2
Define the mechanism of access delegation using IAM roles.
Establish an IAM role with a trust policy that trusts the external IdP, granting least-privilege permissions to Amazon Athena and the Amazon S3 bucket.
IAM roles provide temporary, short-lived security credentials which automatically expire, reducing the blast radius of credential leaks.
3
Eliminate unsafe credential handling and administrative root usage.
Reject options proposing the sharing of root credentials or storing active access keys in plaintext parameter store.
Root usage must be avoided for standard tasks, and credentials must always be encrypted at rest and in transit.

Anahtar Kavram

AWS Identity Federation and IAM Roles
Soru 324Soru →

A logistics company is designing an application to process real-time status updates for package deliveries. The updates must be processed in the exact order they are generated for each package to ensure accurate tracking. If a status update fails to process, it must be isolated for analysis without interrupting the processing of subsequent updates for other packages. Which combination of steps will meet these requirements with the least operational overhead? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Amazon SQS FIFO queue to store the delivery status updates.; Configure an Amazon SQS FIFO dead-letter queue (DLQ) to receive messages that fail to process successfully.

Cevap

Create an Amazon SQS FIFO queue to store the delivery status updates, and configure an Amazon SQS FIFO dead-letter queue (DLQ) to receive messages that fail to process successfully.
To process package updates in the exact order they are generated, the architecture must use Amazon SQS FIFO queues. SQS FIFO queues guarantee first-in, first-out delivery within a message group. Additionally, isolating failed messages without blocking the queue is achieved by using a dead-letter queue (DLQ). Because the primary queue is a FIFO queue, the associated DLQ must also be a FIFO queue.

Adım Adım Çözüm

1
Select a message queue service that guarantees first-in, first-out ordering.
Amazon SQS FIFO queue is chosen to ensure status updates are processed in order for each package.
Standard SQS queues cannot guarantee strict message ordering.
2
Set up a dead-letter queue (DLQ) to isolate failed messages.
An SQS FIFO queue is created and configured as the DLQ for the main SQS FIFO queue.
FIFO queues require FIFO DLQs to preserve ordering and delivery characteristics.

Anahtar Kavram

Decoupling event-driven architectures with Amazon SQS FIFO queues and FIFO dead-letter queues to guarantee order and handle processing failures.
Soru 325Soru →

A company has a development workload running in AWS Account A. Developers assume an IAM role named `DeveloperRole` in Account A to perform their tasks. The solutions architect needs to grant these developers access to an Amazon S3 bucket named `prod-data-archive` located in AWS Account B. The access must be restricted to requests originating from the corporate office IP range (198.51.100.0/22198.51.100.0/22). Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In Account A, attach a policy to the `DeveloperRole` that allows the `s3:GetObject` and `s3:ListBucket` actions on the `prod-data-archive` bucket.; In Account B, attach a bucket policy to the `prod-data-archive` bucket that grants the `s3:GetObject` and `s3:ListBucket` permissions to the `DeveloperRole` in Account A, with a condition that restricts access to the source IP range 198.51.100.0/22198.51.100.0/22.

Cevap

Attaching an IAM policy to the role in the source account to allow access to the bucket, and attaching a bucket policy in the destination account that grants access to that role under a condition restricting requests to the corporate IP range.
For cross-account S3 access, permissions must be enabled on both sides: the IAM role policy in the source account must allow outbound access to the bucket, and the S3 bucket policy in the destination account must allow inbound access from the role. The S3 bucket policy can use the `aws:SourceIp` condition to enforce that requests originate only from the corporate IP range.

Adım Adım Çözüm

1
Configure the identity-based policy in the source account.
The IAM role `DeveloperRole` in Account A is granted permissions to call S3 actions on the external bucket.
IAM identity policies govern outbound permissions from a principal.
2
Configure the resource-based policy in the destination account.
The S3 bucket policy in Account B is updated to allow the ARN of the IAM role from Account A.
Resource policies govern inbound access to a resource from external accounts.
3
Apply source network constraints to the resource policy.
A condition block checking `aws:SourceIp` against 198.51.100.0/22198.51.100.0/22 is added to the bucket policy.
This restricts bucket access exclusively to requests originating from the corporate network.

Anahtar Kavram

Cross-account access to Amazon S3 requires permissions to be granted both on the IAM identity in the source account and on the S3 bucket policy in the target account.
Soru 326Soru →

A company is migrating its deployment pipeline from a self-hosted server to GitHub Actions. The pipeline workflows must deploy serverless applications in a production AWS account and retrieve sensitive database credentials. The company's security policy requires that all database credentials be rotated automatically every 30 days and strictly prohibits storing long-term AWS credentials or plaintext secrets in external repositories.

Which combination of actions should a solutions architect recommend to meet these security requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an OpenID Connect (OIDC) identity provider in AWS IAM for GitHub, and create an IAM role with a trust policy that allows the `sts:AssumeRoleWithWebIdentity` action restricted to the specific GitHub repository.; Store the database credentials in AWS Secrets Manager, configure automatic rotation every 30 days using an AWS Lambda function, and grant the IAM role permissions to retrieve the secret.

Cevap

To securely integrate GitHub Actions and manage database credentials, configure an OpenID Connect (OIDC) identity provider in AWS IAM with an IAM role using web identity federation. Additionally, store the database credentials in AWS Secrets Manager and set up automatic 30-day rotation using an AWS Lambda function.
Establishing an OIDC identity provider in AWS IAM enables GitHub Actions workflows to request short-lived temporary security credentials using the `sts:AssumeRoleWithWebIdentity` action. This removes the need for storing long-term IAM user access keys in GitHub. Storing the database credentials in AWS Secrets Manager allows native integration with rotation schedules using Lambda functions to enforce the 30-day rotation policy.

Adım Adım Çözüm

1
Configure an OpenID Connect (OIDC) identity provider for GitHub Actions in the IAM console.
Establishes a trust relationship between AWS and GitHub's Identity Provider.
Allows AWS to verify identity tokens issued by GitHub Actions.
2
Create an IAM role with a trust policy allowing the `sts:AssumeRoleWithWebIdentity` action, constrained to the specific GitHub organization and repository using condition keys.
Provides temporary security credentials for the GitHub runner without storing long-term credentials.
Enforces least privilege access and avoids credential exposure.
3
Store the database password as a secret in AWS Secrets Manager.
The secret is encrypted at rest using an AWS KMS Customer Managed Key.
Protects sensitive database credentials from being exposed in plaintext.
4
Enable automatic rotation in AWS Secrets Manager with a 30-day schedule using a rotation AWS Lambda function.
The Lambda function automatically rotates the database credentials in both the database and Secrets Manager.
Satisfies the regulatory requirement for automatic 30-day credential rotation.

Anahtar Kavram

Identity federation using OpenID Connect (OIDC) and automated secrets management with rotation.
Tahmini Süre:2m 0s
Soru 327Soru →

An enterprise is migrating its legacy inventory system to a multi-account AWS environment. A legacy application running on-premises must write daily inventory reports directly to an Amazon S3 bucket located in a centralized AWS account. The company's security policy strictly prohibits the storage of long-term AWS security credentials on-premises. Which solution meets these requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: Implement AWS IAM Roles Anywhere. Configure a trust anchor with the on-premises Certificate Authority (CA), define an IAM role with permissions to write to the S3 bucket, and exchange X.509 certificates for temporary AWS credentials.

Cevap

Implement AWS IAM Roles Anywhere by establishing a trust anchor with the on-premises Certificate Authority (CA), defining an IAM role, and exchanging X.509 certificates for temporary AWS credentials.
The solution that configures AWS IAM Roles Anywhere is correct because it uses X.509 digital certificates from an on-premises Certificate Authority to authenticate and retrieve temporary, short-lived credentials. This avoids the security risk of storing long-term credentials on physical on-premises servers.

Adım Adım Çözüm

1
Analyze the security constraints.
The application is on-premises and must access AWS resources (Amazon S3), but the local storage of long-term AWS credentials (like IAM access keys) is forbidden.
To identify which mechanism can provide secure, short-lived credentials for non-AWS workloads.
2
Evaluate AWS credential provisioning options for on-premises workloads.
AWS IAM Roles Anywhere allows non-AWS workloads to use local digital certificates (X.509) to obtain temporary security credentials via IAM roles.
IAM Roles Anywhere is the native AWS service designed specifically to eliminate long-term credentials for workloads running outside of AWS.
3
Define the implementation details.
Create a trust anchor linked to the internal CA, define a role with S3 write access, and configure the application to request temporary session credentials using the certificate.
This establishes a cryptographic trust chain between the local infrastructure and AWS without introducing static credentials.

Anahtar Kavram

Exchanging X.509 certificates for short-lived credentials via AWS IAM Roles Anywhere
Soru 328Soru →

An enterprise company wants to grant its employees access to multiple AWS accounts within AWS Organizations. The company uses an external identity provider (IdP) that supports SAML 2.0 to manage its workforce. The company wants to minimize administrative overhead and avoid creating duplicate credentials.

Which solution meets these requirements with the least operational complexity?

Cevabı ve açıklamayı göster

Cevap: Enable AWS IAM Identity Center, connect it to the external identity provider via SAML 2.0, and map corporate groups to AWS permission sets in the target accounts.

Cevap

Enable AWS IAM Identity Center, connect it to the external identity provider via SAML 2.0, and map corporate groups to AWS permission sets in the target accounts.
Configuring AWS IAM Identity Center with a SAML 2.0 external identity provider enables single sign-on (SSO) across multiple AWS accounts. By mapping corporate groups to AWS permission sets, administrators can grant permissions centrally, eliminating the need to create individual IAM users or credentials in each account.

Adım Adım Çözüm

1
Identify the requirement to manage access across multiple AWS accounts using an existing external Identity Provider (IdP) supporting SAML 2.0.
Determine that federation is required to avoid duplicating credentials and minimize administrative overhead.
Federation allows users to log in using their existing corporate credentials.
2
Evaluate the options for multi-account federation in AWS.
AWS IAM Identity Center is the AWS-recommended service for centralizing access control across AWS Organizations.
It supports SAML 2.0 integration and allows mapping corporate directory groups directly to AWS permission sets without managing individual IAM users.

Anahtar Kavram

AWS IAM Identity Center provides centralized management of SSO access to multiple AWS accounts and SAML applications using an external IdP.
Soru 329Soru →

A software-as-a-service (SaaS) company hosts a global hotel booking platform in the eu-west-1 Region. The application tier runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The database tier uses an Amazon RDS for PostgreSQL DB instance. The company wants to implement a disaster recovery (DR) strategy in the us-east-1 Region that achieves a recovery point objective (RPO) of 5 minutes and a recovery time objective (RTO) of 30 minutes. Which combination of actions should the solutions architect recommend to meet these requirements at the lowest cost? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Amazon RDS cross-region read replica in the secondary region, and promote the replica to a standalone DB instance during a failover event.; Deploy the application infrastructure in the secondary region using AWS CloudFormation, and configure the Auto Scaling group with a desired capacity of 0.

Cevap

Creating an Amazon RDS cross-region read replica and promoting it during failover, along with deploying the secondary application infrastructure using AWS CloudFormation with the Auto Scaling group's desired capacity set to 0.
The correct solution uses a Pilot Light disaster recovery strategy. Creating an Amazon RDS cross-region read replica ensures database replication with an RPO of under 5 minutes, and promoting it to a standalone database during failover satisfies the RTO of 30 minutes. Deploying the application tier using AWS CloudFormation with the Auto Scaling group's desired capacity set to 0 minimizes cost by not running any EC2 instances until a failover is needed, while still allowing the application to be launched within the 30-minute RTO.

Adım Adım Çözüm

1
Analyze the RPO requirement (5 minutes) and choose the appropriate database replication mechanism.
An Amazon RDS cross-region read replica is selected, as it replicates asynchronously across regions with very low lag (usually seconds to minutes), satisfying the 5-minute RPO.
A database backup/restore method would fail the RPO, and Multi-AZ cannot span multiple regions.
2
Analyze the RTO requirement (30 minutes) and cost constraint to determine the compute tier strategy.
Choose the Pilot Light strategy by pre-staging the infrastructure with AWS CloudFormation and setting the Auto Scaling group desired capacity to 0.
This avoids running compute resources continuously (saving cost) while ensuring that the EC2 instances can be provisioned and scaled up within the 30-minute window.
3
Combine the database and compute tier actions to form the complete disaster recovery plan.
A cross-region read replica handles the database, and CloudFormation with a desired capacity of 0 handles the compute tier.
This combination satisfies both RPO and RTO requirements at the lowest cost.

Anahtar Kavram

Disaster Recovery (DR) patterns in AWS prioritize tradeoffs between RTO, RPO, and cost. A Pilot Light strategy pre-stages infrastructure (such as CloudFormation templates and scaled-down resources) and replicates database data asynchronously to meet low RPO/RTO targets while minimizing compute costs.
Tahmini Süre:2m 0s
Soru 330Soru →

A company is designing a security baseline for its new multi-account AWS environment. The solution must address two requirements:
First, 500500 corporate identity directory users need single sign-on access to the AWS Management Console and CLI.
Second, a containerized application running on Amazon ECS needs to securely retrieve database credentials that must be rotated every 3030 days.
Which combination of actions should the solutions architect recommend to meet these requirements securely? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center to federate the company's identity provider and assign permissions using permission sets; Store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function

Cevap

Configure AWS IAM Identity Center to federate the company's identity provider, and store the database credentials in AWS Secrets Manager with automatic rotation using an AWS Lambda function.
Centralizing access control through AWS IAM Identity Center provides federated single sign-on without the overhead and risk of long-term IAM users. For sensitive data like database credentials, AWS Secrets Manager securely stores the secret and automates its rotation using an AWS Lambda function, maintaining compliance with security standards.

Adım Adım Çözüm

1
Address the single sign-on requirement for the 500500 users by configuring federation.
AWS IAM Identity Center is configured to connect to the external identity provider, enabling users to access AWS accounts with temporary credentials.
This avoids creating individual IAM users, complying with security best practices for identity management.
2
Address the secure credential storage and 3030-day rotation requirement.
AWS Secrets Manager is chosen to store the database credentials, and its built-in rotation feature is enabled with an AWS Lambda function running every 3030 days.
Secrets Manager provides native support for rotating database credentials automatically, which is not available as a native feature in Systems Manager Parameter Store without custom scripting, and is much more secure than storing credentials in plaintext.

Anahtar Kavram

Centralized identity federation using AWS IAM Identity Center and automated secrets management with AWS Secrets Manager.
Soru 331Soru →

A company wants to grant a third-party security audit application access to read log files in an Amazon S3 bucket within the company's AWS account. The third-party application runs in the auditor's AWS account. The company's security policy dictates that no long-term credentials can be shared, and the design must prevent the 'confused deputy' problem. Which configuration should a solutions architect implement to meet these security requirements?

Cevabı ve açıklamayı göster

Cevap: Create an IAM role in the company's account with a trust policy that allows the auditor's AWS account to assume the role, conditioning the trust policy on a unique External ID provided by the auditor. Attach an IAM policy to the role that grants read-only permissions to the S3 bucket.

Cevap

Create an IAM role in the company's account with a trust policy that allows the auditor's AWS account to assume the role, conditioning the trust policy on a unique External ID provided by the auditor. Attach an IAM policy to the role that grants read-only permissions to the S3 bucket.
The correct configuration involves creating an IAM role in the company's account with a trust policy that allows the auditor's account to assume the role. By requiring an External ID in the condition block of the trust policy, the configuration prevents the confused deputy problem, which is a security risk where an entity that does not have permission to access a resource can coerce a more privileged entity (the third-party audit tool) to access it. An IAM policy attached to the role restricts permissions to read-only access on the S3 log bucket, following the principle of least privilege.

Adım Adım Çözüm

1
Establish secure access for the third-party AWS account by using IAM roles instead of sharing long-term credentials.
An IAM role is defined in the resource owner's account that can be assumed by the trusted third-party account using temporary security credentials.
This satisfies the security requirement to avoid sharing long-term access keys or secret keys.
2
Address the confused deputy problem by adding a condition to the role's trust policy.
The role's trust policy is configured with an External ID condition that requires the third party to present a specific, unique string when assuming the role.
The External ID ensures that the role cannot be assumed by the third party on behalf of other customers, preventing unauthorized cross-tenant access.
3
Apply the principle of least privilege by attaching a permissions policy to the IAM role.
A permissions policy is attached that grants read-only permissions limited to the specific S3 log bucket.
This ensures the auditor has only the minimum necessary permissions required to perform their security audit.

Anahtar Kavram

AWS IAM Roles and External IDs for Secure Cross-Account Third-Party Access
Tahmini Süre:1m 30s
Soru 332Soru →

A university needs to provide its staff members with access to the AWS Management Console. The staff identities are stored in an external SAML 2.0-compliant identity provider. The security team wants to ensure that no long-term AWS credentials are created for these users, and access is managed centrally. Which AWS service is the recommended solution to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: AWS IAM Identity Center

Cevap

AWS IAM Identity Center
AWS IAM Identity Center allows organizations to configure single sign-on access to the AWS Management Console by federating with external SAML 2.0 identity providers. It dynamically provides short-term credentials, removing the need for long-term IAM credentials and reducing management overhead.

Adım Adım Çözüm

1
Identify the requirement for federated access using an external SAML 2.0-compliant identity provider.
The solution must authenticate external identities without duplicating them locally.
This rules out solutions that require local directory hosting or manually creating local credentials.
2
Identify the constraint regarding credentials and management overhead.
Long-term credentials must not be generated, and management should be centralized.
This rules out individual IAM users and sharing the root account credentials.
3
Select the modern AWS service designed for central single sign-on and integration with external identity providers.
AWS IAM Identity Center enables connection with external SAML 2.0 providers and provides short-term credentials dynamically.
This matches all security and operational requirements.

Anahtar Kavram

AWS IAM Identity Center provides federated single sign-on access to the AWS Management Console from external SAML 2.0 identity providers without the use of long-term credentials.
Tahmini Süre:1m 0s
Soru 333Soru →

A company wants to grant its on-premises Active Directory users access to the AWS Management Console. The solutions architect needs to configure identity federation using AWS IAM Identity Center to allow users to sign in with their existing corporate credentials.

Which two actions must the solutions architect perform to establish this integration? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Connect the on-premises Active Directory to AWS using AD Connector.; Enable AWS IAM Identity Center and configure the identity source to use the connected directory.

Cevap

Connect the on-premises Active Directory to AWS using AD Connector, and enable AWS IAM Identity Center to use the connected directory as the identity source.
To integrate an on-premises Active Directory with AWS for federated access, the solutions architect must connect the on-premises directory to AWS (e.g., using AD Connector) and configure AWS IAM Identity Center to use that directory as the identity source. This allows users to authenticate using their existing corporate credentials without storing credentials in the AWS cloud.

Adım Adım Çözüm

1
Establish a connection between the on-premises Active Directory and AWS.
AWS Directory Service AD Connector is configured to route authentication requests to the on-premises domain controllers.
This avoids synchronization or replication of passwords to AWS and allows directory queries to reach the on-premises infrastructure.
2
Configure AWS IAM Identity Center to use the external directory.
IAM Identity Center is configured with the connected directory as its identity source.
This allows corporate users to log in to the AWS Management Console with their existing Active Directory credentials.

Anahtar Kavram

Federating an on-premises Active Directory with AWS IAM Identity Center using AD Connector to allow single sign-on without creating individual IAM users.
Tahmini Süre:1m 0s
Soru 334Soru →

A retail enterprise has recently adopted a multi-account AWS environment using AWS Organizations. The IT security team must enable corporate employees to log in to the AWS Management Console across multiple accounts using their existing Microsoft Active Directory credentials, without creating permanent IAM credentials for each user. Which AWS service should the solutions architect recommend to meet these requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: AWS IAM Identity Center

Cevap

AWS IAM Identity Center
AWS IAM Identity Center is the recommended service for centrally managing SSO access to multiple AWS accounts. It connects directly with an external Microsoft Active Directory and eliminates the need to manage individual IAM users or permanent credentials.

Adım Adım Çözüm

1
Identify the core requirement, which is to allow enterprise users to access multiple AWS accounts centrally using their existing Microsoft Active Directory credentials without creating individual IAM users.
Centralized federation is required.
This minimizes operational overhead and avoids managing long-term IAM credentials for every employee.
2
Evaluate the available AWS services that support integration with external identity providers (IdPs) like Microsoft Active Directory and multi-account setups in AWS Organizations.
AWS IAM Identity Center is the modern, recommended service for multi-account federation.
It natively integrates with AWS Organizations and external directories to enable single sign-on (SSO) with minimal configuration.

Anahtar Kavram

Centralized multi-account federation using AWS IAM Identity Center and external directory integration
Soru 335Soru →

A company is designing a new security strategy to grant its development team access to AWS resources. The developers are currently authenticated via an on-premises Active Directory. The solutions architect must implement a solution that allows developers to access the AWS Management Console and AWS CLI without introducing the administrative overhead of managing individual long-term credentials in AWS. Which solution should the solutions architect recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center to federate with the on-premises Active Directory, and assign AWS permission sets to the Active Directory groups.

Cevap

Configure AWS IAM Identity Center to federate with the on-premises Active Directory, and assign AWS permission sets to the Active Directory groups.
The correct solution uses AWS IAM Identity Center to federate with the on-premises Active Directory. This allows the organization to leverage existing user identities and group memberships. Security policies (permission sets) are mapped to these groups, enabling developers to sign in using their existing Active Directory credentials and obtain short-lived, temporary access keys for the AWS Management Console and CLI, which eliminates the administrative overhead of managing IAM users and long-term credentials.

Adım Adım Çözüm

1
Establish federation between the on-premises Active Directory and AWS IAM Identity Center.
AWS IAM Identity Center trusts the Active Directory as the external Identity Provider (IdP) for user authentication.
This removes the need to recreate user identities in AWS and allows engineers to use single sign-on (SSO) with their existing enterprise credentials.
2
Create AWS IAM permission sets representing the access levels required by the development team.
Defined policies that grant specific permissions to perform actions on EC2 and RDS resources.
Permission sets define what actions federated users can perform once they sign into an AWS account.
3
Map the Active Directory developer groups to the corresponding AWS accounts and permission sets.
When developers authenticate through the IdP, they are dynamically assigned the appropriate IAM roles and temporary security credentials.
This automates access control, enforces the principle of least privilege, and avoids managing long-term AWS access keys.

Anahtar Kavram

Identity Federation and Single Sign-On (SSO) using AWS IAM Identity Center
Soru 336Soru →

An e-commerce company is designing an order processing application on AWS. When a customer places an order, the application must publish order events to multiple downstream services. The transaction service must process payments in the exact order they are received to ensure ledger accuracy. However, the shipping notification service and the analytics service can process events asynchronously without strict ordering requirements. If a service fails to process an order event after multiple retries, the event must be isolated for troubleshooting without blocking other orders.

Which TWO configurations should a solutions architect recommend to meet these requirements with the least operational overhead?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Publish order events to an Amazon SNS FIFO topic. Subscribe an Amazon SQS FIFO queue for the transaction service, and subscribe standard Amazon SQS queues for the shipping and analytics services.; Configure a redrive policy on the SQS queues to redirect failed messages to a dead-letter queue (DLQ) after the maximum receive count is exceeded.

Cevap

Publishing order events to an Amazon SNS FIFO topic with SQS FIFO and standard SQS queues subscribed, combined with configuring redrive policies to a dead-letter queue (DLQ) for failed messages.
Publishing events to an Amazon SNS FIFO topic enables message fan-out to multiple downstream queues while preserving ordering. Subscribing an SQS FIFO queue ensures the transaction service processes orders sequentially, while subscribing standard SQS queues for shipping and analytics allows them to run asynchronously without ordering constraints. Using SQS redrive policies to a DLQ isolates failed messages after a specified number of retries, preventing head-of-line blocking.

Adım Adım Çözüm

1
Determine the event routing and fan-out mechanism.
Amazon SNS FIFO is selected as the publisher because it supports fan-out to multiple subscribers while maintaining strict message ordering and deduplication.
The system needs to send the same order event to multiple downstream systems (transaction, shipping, analytics).
2
Select the appropriate SQS queue types for each subscriber.
An SQS FIFO queue is configured for the transaction service to guarantee ordered processing. Standard SQS queues are configured for shipping and analytics to allow asynchronous, high-throughput processing.
The transaction service requires strict chronological order, whereas shipping and analytics do not.
3
Configure error handling and message isolation.
Enable a redrive policy on the SQS queues pointing to an SQS dead-letter queue (DLQ).
Failed messages must be isolated for analysis without blocking subsequent messages in the queues.

Anahtar Kavram

Decoupling event-driven architectures using Amazon SNS FIFO fan-out to SQS queues, combined with dead-letter queues (DLQ) for fault isolation.
Tahmini Süre:2m 0s
Soru 337Soru →

A financial services company is setting up a hybrid cloud environment. The company needs to allow its on-premises Active Directory users to log in to the AWS Management Console to manage Amazon EC2 instances. The security policy states that user credentials must not be stored or replicated in the AWS Cloud, and administrative effort must be minimized. Which two actions should a solutions architect take to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable AWS IAM Identity Center and configure it to use AWS Directory Service as the identity source.; Configure an AD Connector in AWS Directory Service to redirect directory requests to the on-premises Active Directory.

Cevap

Enabling AWS IAM Identity Center as the identity source and configuring AD Connector in AWS Directory Service to proxy authentication requests directly to the on-premises Active Directory.
The correct solution involves enabling AWS IAM Identity Center and connecting it to the on-premises Active Directory via an AD Connector. AD Connector functions as a gateway to forward authentication requests to the on-premises domain controllers without caching or replicating passwords in the AWS Cloud. AWS IAM Identity Center then maps those authenticated users to specific AWS IAM roles, minimizing operational overhead.

Adım Adım Çözüm

1
Select a gateway method to integrate the on-premises Active Directory with AWS.
Identify that AD Connector acts as a directory gateway that proxies authentication requests directly to the on-premises Active Directory without database replication.
This satisfies the constraint of not replicating credentials to the AWS Cloud while maintaining on-premises AD as the source of truth.
2
Set up a centralized single sign-on service for console access.
Enable AWS IAM Identity Center and configure its identity source to point to the AWS Directory Service directory.
This allows the solutions architect to map Active Directory groups to AWS permissions and provides users with a single portal for console access.

Anahtar Kavram

Using AD Connector alongside AWS IAM Identity Center allows organizations to federate their existing on-premises Active Directory to AWS without replicating credentials or introducing heavy management overhead.
Soru 338Soru →

An enterprise is migrating its applications to a multi-account environment managed by AWS Organizations. The company's security policy requires corporate users to authenticate using their existing on-premises Active Directory credentials to access the AWS Management Console of various AWS accounts. The solution must enforce multi-factor authentication (MFA), minimize operational overhead, and avoid synchronizing passwords or user directory data to the cloud. Which two actions should a solutions architect take to implement this architecture? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable AWS IAM Identity Center in the organization's management account and configure it to use Active Directory as the identity source.; Deploy an AWS Directory Service AD Connector in a VPC with VPN or Direct Connect connectivity to the on-premises domain controllers to proxy authentication requests.

Cevap

Enable AWS IAM Identity Center in the organization's management account and configure it to use Active Directory as the identity source, and deploy an AWS Directory Service AD Connector in a VPC with network connectivity to on-premises domain controllers to proxy authentication requests.
Centralizing access control through AWS IAM Identity Center enabled in the organization's management account satisfies the enterprise requirement to manage access across multiple accounts. Pairing it with AD Connector provides a secure authentication proxy that forwards requests directly to the on-premises domain controllers via VPN or Direct Connect, ensuring passwords and directory data are not synchronized or replicated to AWS.

Adım Adım Çözüm

1
Select a centralized management solution for multi-account access control.
AWS IAM Identity Center is selected as it integrates with AWS Organizations and external directories.
This avoids having to manually configure federation or local users in each individual account.
2
Determine the directory integration method that avoids password synchronization and database replication.
AD Connector is selected because it acts as an active directory proxy redirecting authentication requests without synchronizing user database details to AWS.
This satisfies the constraint of avoiding password synchronization and minimizing operational overhead.
3
Ensure secure connectivity between AWS and on-premises network.
Deploy the AD Connector within a VPC that has a VPN or Direct Connect connection to the on-premises domain controllers.
The AD Connector needs local network routing to reach domain controllers on port 389/445/88/53.

Anahtar Kavram

Centralized multi-account federation using AWS IAM Identity Center coupled with AD Connector to leverage on-premises Active Directory without password synchronization.
Soru 339Soru →

A solutions architect is configuring the network security settings for resources within an Amazon VPC. The architect needs to establish controls using both security groups and network access control lists (network ACLs). Which TWO of the following statements correctly describe the characteristics of security groups and network ACLs?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Security groups are stateful, meaning that return traffic is automatically allowed.; Network ACLs are stateless, meaning that return traffic must be explicitly allowed by outbound rules.

Cevap

Security groups are stateful, meaning that return traffic is automatically allowed, and network ACLs are stateless, meaning that return traffic must be explicitly allowed by outbound rules.
The correct statements are that security groups are stateful and network ACLs are stateless. When traffic is permitted inbound through a security group, the return outbound traffic is automatically allowed. Conversely, network ACLs do not track session states, so return traffic must be explicitly permitted by a corresponding outbound rule.

Adım Adım Çözüm

1
Determine the statefulness of both security groups and network ACLs.
Security groups are stateful (inbound allows outbound response), and network ACLs are stateless (both paths must be explicitly configured).
This is a fundamental operational difference between the two security layers.
2
Identify the boundary or level at which each security feature operates.
Security groups operate at the resource/instance level, whereas network ACLs operate at the subnet boundary level.
Correctly applying rules requires knowing whether they affect specific instances or the entire subnet.
3
Analyze the rule actions supported by each feature.
Security groups only support allow rules, whereas network ACLs support both allow and deny rules.
This determines how explicit blocklists or default-deny configurations should be implemented.

Anahtar Kavram

Operational differences, statefulness, and boundary levels of Security Groups and Network ACLs
Tahmini Süre:1m 0s
Soru 340Soru →

A company is establishing a multi-account environment using AWS Organizations. The security team wants to delegate the ability to create IAM roles to the development team lead in a member account. However, the security team must ensure that the team lead cannot create roles that grant permissions exceeding a defined threshold. Furthermore, compliance rules dictate that no entity within the member account—including the AWS account root user—should be able to stop or delete AWS CloudTrail logging. Which TWO options should the solutions architect choose to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Apply a Service Control Policy (SCP) at the member account level in AWS Organizations that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.; Configure an IAM permissions boundary that defines the maximum permitted actions, and attach an IAM policy to the team lead that allows role creation only if the permissions boundary is applied.

Cevap

The solutions architect should apply a Service Control Policy (SCP) to deny CloudTrail logging modifications and configure an IAM permissions boundary to restrict the maximum permissions of roles created by the team lead.
Applying a Service Control Policy (SCP) to the member account is the only way to enforce restrictions (such as denying changes to CloudTrail) on all users and roles, including the member account's root user. Creating an IAM permissions boundary and requiring it during role creation ensures that the development team lead can create roles for developers without granting permissions that exceed the security team's defined boundary.

Adım Adım Çözüm

1
Restricting CloudTrail modification across all users including root.
Apply an AWS Organizations Service Control Policy (SCP) denying cloudtrail:StopLogging and cloudtrail:DeleteTrail.
SCPs apply to all accounts in the Organization and affect all principals in member accounts, including the AWS account root user, which cannot be restricted by standard IAM policies.
2
Delegating role creation with a boundary.
Use an IAM permissions boundary defining the maximum allowed permissions.
Requiring a permissions boundary during role creation prevents delegated administrators from creating roles with privilege escalation capabilities.
3
Eliminating options with insecure patterns.
Reject options that propose using root credentials, creating management account IAM users, or storing access keys in plaintext.
These violate AWS security best practices regarding root account protection, federation, and secrets management.

Anahtar Kavram

Delegating IAM administration with permissions boundaries and enforcing organization-wide guardrails using SCPs.
ÖncekiSayfa 17 / 74Sonraki
Tüm alıştırma soruları — AWS Certified Solutions Architect - Associate | Examkin