Tüm alıştırma soruları

1462 soru

Tüm türler1,462 Çoktan seçmeli739 Çoklu seçim723

An enterprise architecture team is reviewing the security posture of a document management system. The application stores sensitive PDF contracts in an Amazon S3 bucket. The S3 bucket currently uses Server-Side Encryption with AWS KMS (SSE-KMS) with the default AWS managed key ('aws/s3'). A new compliance mandate requires that the encryption key used for these contracts must be rotated every year. Additionally, to mitigate the risk of key exposure, all existing documents in the bucket must be immediately re-encrypted using the new key version upon rotation. Database credentials for the application must also be securely rotated every 30 days. Which combination of actions will meet these security and compliance requirements?

Create a customer managed KMS key and enable automatic key rotation. Configure the S3 bucket to use this customer managed key. To re-encrypt historical documents after key rotation, execute an Amazon S3 Batch Operations job to copy the objects in-place. Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.

Enable automatic key rotation on the default AWS managed key ('aws/s3'). Rely on S3 automatic server-side encryption to automatically re-encrypt all existing objects with the new key version. Store the database credentials as a String parameter in AWS Systems Manager Parameter Store, and configure a scheduled AWS Lambda function to rotate the parameter value every 30 days.

Create a customer managed KMS key and enable automatic key rotation. Configure the S3 bucket to use this customer managed key. Rely on AWS KMS automatic key rotation to automatically re-encrypt all historical documents stored in the S3 bucket. Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.

Create a customer managed KMS key and enable automatic key rotation. Configure the S3 bucket to use this customer managed key. To re-encrypt historical documents after key rotation, execute an Amazon S3 Batch Operations job to copy the objects in-place. Store the database credentials as a String parameter in AWS Systems Manager Parameter Store, and configure AWS Systems Manager Run Command to update the parameter every 30 days.

Cevabı ve açıklamayı göster

Cevap: Create a customer managed KMS key and enable automatic key rotation. Configure the S3 bucket to use this customer managed key. To re-encrypt historical documents after key rotation, execute an Amazon S3 Batch Operations job to copy the objects in-place. Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.

Cevap

To meet the compliance requirements, a customer managed KMS key must be used because the rotation frequency of AWS managed keys (like 'aws/s3') cannot be customized. When a customer managed key is rotated, KMS creates a new backing key version for new encryption requests. However, KMS does not automatically re-encrypt existing ciphertext. To re-encrypt historical documents, an S3 Batch Operations job must perform an in-place copy, which decrypts the objects using the old backing key version and re-encrypts them using the new active backing key version. For the credentials, AWS Secrets Manager should be used as it supports automatic rotation every 30 days, unlike Parameter Store plain String parameters which lack native rotation capabilities and store sensitive data in plaintext.

Adım Adım Çözüm

Address key rotation requirements by choosing between AWS managed keys and customer managed keys.

Identify that AWS managed keys ('aws/s3') do not support custom rotation intervals and cannot be customized. A customer managed key must be created, which supports automatic rotation every year.

Compliance requires annual key rotation, which is only configurable on customer managed KMS keys.

Determine the mechanism for re-encrypting historical data in the S3 bucket.

Establish that enabling automatic rotation in AWS KMS does not touch existing S3 objects. To re-encrypt existing objects under the new backing key version immediately, an S3 Batch Operations job must be run to copy the objects in-place (copying them to themselves).

AWS KMS automatic rotation only encrypts new data. Existing data remains encrypted under the older backing key versions until explicitly rewritten or copied.

Evaluate the secure secret storage and rotation strategy.

Select AWS Secrets Manager over Systems Manager Parameter Store plain String parameters.

AWS Secrets Manager natively supports 30-day automatic credential rotation and integrates with databases securely, whereas plain String parameters in Parameter Store store credentials in plaintext and lack native automatic rotation.

Anahtar Kavram

AWS KMS key rotation behavior, customer managed vs. AWS managed keys, and secure secret storage using AWS Secrets Manager.

Soru 542Soru →

An enterprise has a security account (Account B) that hosts an AWS KMS Customer Managed Key (CMK). This CMK is used to encrypt sensitive telemetry data stored in Amazon S3 buckets located in a production account (Account A). The processing application in Account A runs on Amazon EC2 instances and requires access to decrypt these S3 objects. A security requirement states that the CMK must be rotated annually. The security team wants to ensure that key rotation does not disrupt the application's ability to read older archived S3 objects encrypted with previous versions of the key, and that the configuration strictly adheres to the principle of least privilege without exposing access credentials. Which of the following architectural configurations meets these requirements?

Enable automatic key rotation on the CMK in Account B. To ensure decryption capability is maintained for older objects, schedule a monthly AWS Lambda function to decrypt and re-encrypt all historical S3 data in Account A under the newly rotated key version before the previous key material is retired.

Enable automatic key rotation on the CMK in Account B. Store the CMK ARN and the security account's IAM cross-account access keys as a plain String parameter in AWS Systems Manager Parameter Store to allow the EC2 instances in Account A to programmatically authenticate and bypass cross-account IAM role mapping.

Enable automatic key rotation on the CMK in Account B. In Account B, edit the CMK key policy to grant the EC2 IAM role in Account A permissions for the kms:Decrypt and kms:GenerateDataKey actions. In Account A, attach an IAM policy to the EC2 IAM role allowing these same KMS actions on the CMK ARN.

Enable automatic key rotation on the CMK in Account B. To simplify cross-account permissions, configure the key policy in Account B to allow access to the AWS account root user of Account A, and use the root credentials of Account A within the processing application to perform all S3 decryption tasks.

Cevabı ve açıklamayı göster

Cevap: Enable automatic key rotation on the CMK in Account B. In Account B, edit the CMK key policy to grant the EC2 IAM role in Account A permissions for the kms:Decrypt and kms:GenerateDataKey actions. In Account A, attach an IAM policy to the EC2 IAM role allowing these same KMS actions on the CMK ARN.

Cevap

Enable automatic key rotation on the CMK in the security account, configure the CMK's key policy to trust the production account's IAM role, and attach a matching IAM policy to the role in the production account allowing decryption and data key generation.

The correct configuration enables automatic key rotation, which naturally preserves all historical backing keys to decrypt older objects without requiring re-encryption. Cross-account access is correctly configured by editing the KMS key policy in Account B to trust the EC2 IAM role in Account A, and attaching an IAM policy to that role in Account A to permit the necessary KMS actions.

Adım Adım Çözüm

Evaluate key rotation behavior

Automatic key rotation preserves the historical backing keys automatically. Older S3 objects can still be decrypted without any manual re-encryption workflow.

Understanding KMS automatic rotation mechanics prevents unnecessary data re-encryption operations.

Establish trust on the KMS key

Edit the KMS key policy in Account B to allow the specific IAM role in Account A to perform kms:Decrypt and kms:GenerateDataKey.

For cross-account access, the key policy itself must explicitly authorize the external identity or account.

Authorize the IAM identity in the production account

Attach an IAM policy to the EC2 execution role in Account A allowing kms:Decrypt and kms:GenerateDataKey on the Account B CMK ARN.

Cross-account access requires explicit permission in both the resource policy (key policy) and the identity policy (IAM policy).

Enforce credentials best practices

Verify that no root credentials or plain text parameters are used to store access keys.

This guarantees compliance with AWS security best practices and the principle of least privilege.

Anahtar Kavram

Cross-account AWS KMS key access and automatic key rotation behavior

Soru 543Soru →

A company's security policy requires that all Customer Managed Keys (CMKs) in AWS Key Management Service (AWS KMS) used for encrypting database backups must be rotated annually. Additionally, all historical database backups must remain decryptable without administrative effort.

Which actions should a solutions architect recommend to meet these security requirements? (Select TWO.)

Geçerli olan tümünü seçin

Enable automatic key rotation for the Customer Managed Key in AWS KMS.

Retain the older key material, as AWS KMS automatically manages the mapping of older key versions to decrypt historical backups.

Manually create a new Customer Managed Key each year and re-encrypt all historical database backups with the new key.

Disable the older versions of the Customer Managed Key after rotation to prevent unauthorized decryption of historical backups.

Store the decryption keys as plaintext String parameters in AWS Systems Manager Parameter Store for easy access by the backup utility.

Cevabı ve açıklamayı göster

Cevap: Enable automatic key rotation for the Customer Managed Key in AWS KMS.; Retain the older key material, as AWS KMS automatically manages the mapping of older key versions to decrypt historical backups.

Cevap

Enable automatic key rotation for the Customer Managed Key in AWS KMS and retain the older key material, as AWS KMS automatically manages the mapping of older key versions to decrypt historical backups.

To meet the requirements, the solutions architect should enable automatic key rotation for the Customer Managed Key in AWS KMS, which rotates the key material automatically on an annual schedule. Additionally, the older key material must be retained because AWS KMS automatically tracks and uses the correct historical key material version to decrypt older backups, eliminating the need for administrative effort or manual data re-encryption.

Adım Adım Çözüm

Enable automatic key rotation on the Customer Managed Key.

AWS KMS will automatically rotate the backing key material every year.

To satisfy the requirement of rotating the key material annually without manual overhead.

Retain older key material and let AWS KMS handle decryption.

AWS KMS maintains the metadata mapping older ciphertexts to the corresponding older key versions.

To satisfy the requirement that historical backups remain decryptable without administrative effort or data re-encryption.

Anahtar Kavram

AWS KMS automatic key rotation generates new key material annually for Customer Managed Keys while retaining old key material to automatically decrypt older data without requiring manual data re-encryption.

Soru 544Soru →

A company hosts a backend processing application on Amazon EC2 instances in a private VPC subnet with the CIDR block $10.0.2.0/24$ . The instances receive incoming requests on TCP port $8080$ from an Elastic Load Balancer (ELB) situated in a public subnet with the CIDR block $10.0.1.0/24$ . Additionally, the EC2 instances must make outbound HTTPS calls (TCP port $443$ ) to a third-party vendor's API gateway at the public IP address $203.0.113.50/32$ . The private subnet is associated with a custom Network Access Control List (NACL), and the EC2 instances are associated with a stateful security group. To implement the principle of least privilege, the security team requires the custom NACL to be hardened to permit only these specific traffic flows. Which of the following configurations meets these requirements while ensuring successful bidirectional communication?

Inbound Rules: Allow TCP from

10.0.1.0/24

on Port Range

8080

, and allow TCP from

203.0.113.50/32

on Port Range

1024-65535

. Outbound Rules: Allow TCP to

10.0.1.0/24

on Port Range

1024-65535

, and allow TCP to

203.0.113.50/32

on Port Range

443

Inbound Rules: Allow TCP from

10.0.1.0/24

on Port Range

1024-65535

, and allow TCP from

203.0.113.50/32

on Port Range

443

. Outbound Rules: Allow TCP to

10.0.1.0/24

on Port Range

8080

, and allow TCP to

203.0.113.50/32

on Port Range

1024-65535

Inbound Rules: Allow TCP from

10.0.1.0/24

on Port Range

8080

, and allow TCP from

203.0.113.50/32

on Port Range

443

. Outbound Rules: Allow TCP to

10.0.1.0/24

on Port Range

8080

, and allow TCP to

203.0.113.50/32

on Port Range

443

Inbound Rules: Allow TCP from

10.0.1.0/24

on Port Range

8080

, and allow TCP from

203.0.113.50/32

on Port Range

1024-65535

. Outbound Rules: Allow TCP to

203.0.113.50/32

on Port Range

443

, relying on the security group's statefulness to automatically permit the return traffic to the Elastic Load Balancer.

Cevabı ve açıklamayı göster

Cevap: Inbound Rules: Allow TCP from $10.0.1.0/24$ on Port Range $8080$ , and allow TCP from $203.0.113.50/32$ on Port Range $1024-65535$ . Outbound Rules: Allow TCP to $10.0.1.0/24$ on Port Range $1024-65535$ , and allow TCP to $203.0.113.50/32$ on Port Range $443$ .

Cevap

The configuration that allows inbound TCP from the load balancer subnet on port

8080

and from the vendor API on the ephemeral range (

1024-65535

), while allowing outbound TCP to the load balancer subnet on the ephemeral range (

1024-65535

) and to the vendor API on port

443

The correct configuration properly implements stateless NACL rules by defining the destination ports for both request and response traffic. For inbound connections from the load balancer, the destination port is

8080

, and the return traffic to the load balancer uses the destination ephemeral ports (

1024-65535

). For outbound connections initiated by the EC2 instances, the destination port is

443

, and the return traffic from the API gateway uses the destination ephemeral ports (

1024-65535

) on the EC2 instances.

Adım Adım Çözüm

Analyze the inbound flow from the Elastic Load Balancer (ELB) to the EC2 instances.

Incoming packets from

10.0.1.0/24

target destination port

8080

on the EC2 instances. This requires an inbound NACL rule allowing TCP port

8080

from

10.0.1.0/24

NACL rules evaluate the destination port of incoming packets to determine if they are allowed into the subnet.

Analyze the outbound response flow from the EC2 instances back to the ELB.

Response packets sent from the EC2 instances target the ELB's ephemeral source ports. This requires an outbound NACL rule allowing TCP destination port range

1024-65535

10.0.1.0/24

Because NACLs are stateless, outbound response traffic must be explicitly allowed. The destination port of the response packet is the source port used by the client (ELB), which falls in the ephemeral port range.

Analyze the outbound initiation flow from the EC2 instances to the vendor's API gateway.

Outbound requests sent to

203.0.113.50/32

target destination port

443

. This requires an outbound NACL rule allowing TCP port

443

203.0.113.50/32

Outbound NACL rules inspect the destination IP and port of traffic leaving the subnet.

Analyze the inbound response flow from the vendor's API gateway back to the EC2 instances.

Response packets from

203.0.113.50/32

target the ephemeral source ports assigned to the EC2 instances' connections. This requires an inbound NACL rule allowing TCP destination port range

1024-65535

from

203.0.113.50/32

Because NACLs are stateless, return packets from external destinations must be allowed through the inbound rules. The destination of these packets is the ephemeral port allocated by the EC2 host for the connection.

Anahtar Kavram

AWS Network Access Control Lists (NACLs) are stateless firewall rules evaluated at the subnet boundary. They evaluate traffic based on the destination port of the packet. For bidirectional communication to succeed, rules must explicitly allow both the request flow (targeting the listener port) and the response flow (targeting the client's ephemeral port range:

1024-65535

Tahmini Süre:3m 0s

Soru 545Soru →

A collaborative document editing SaaS platform uses an Application Load Balancer (ALB) to distribute traffic to Amazon EC2 instances. During a high-profile product release, the platform experiences a distributed HTTP flood attack (Layer 7 DDoS) consisting of rapid, repeating requests from thousands of unique, dynamically changing IP addresses. This attack is bypassing standard network-level protections and exhausting EC2 CPU resources. The platform's operations team needs to mitigate this attack immediately and ensure the ALB only accepts traffic routed through their edge protection layer. Which combination of actions will meet these requirements with the least administrative effort?

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer. Associate an AWS WAF web ACL containing a rate-based rule with the CloudFront distribution. Configure the Application Load Balancer's security group to restrict inbound traffic using the CloudFront managed prefix list.

Enable AWS Shield Standard on the Application Load Balancer. Configure AWS Shield Standard to rate-limit incoming HTTP requests. Restrict the Application Load Balancer's security group to only accept traffic from the Amazon Route 53 IP ranges.

Create a stateless Network Access Control List (NACL) at the subnet level for the Application Load Balancer. Add rules to block the IP addresses originating the HTTP flood. Restrict the EC2 instance security groups to allow traffic only from the ALB.

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer. Enable AWS Shield Advanced on the CloudFront distribution. Rely on the default AWS Shield Advanced infrastructure protection to automatically drop all Layer 7 HTTP flood requests without configuring AWS WAF.

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer. Associate an AWS WAF web ACL containing a rate-based rule with the CloudFront distribution. Configure the Application Load Balancer's security group to restrict inbound traffic using the CloudFront managed prefix list.

Cevap

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, associate an AWS WAF web ACL with a rate-based rule to the distribution, and configure the ALB's security group to restrict inbound traffic to the CloudFront managed prefix list.

The correct option outlines a secure architecture by placing Amazon CloudFront at the edge, leveraging AWS WAF rate-based rules to dynamically block the high-volume HTTP flood at the application layer, and securing the Application Load Balancer origin using the CloudFront managed prefix list to ensure no traffic bypasses the edge defense.

Adım Adım Çözüm

Introduce Amazon CloudFront as the entry point.

Legitimate and malicious traffic is routed through CloudFront's global edge locations instead of directly hitting the Application Load Balancer.

This establishes an edge network layer capable of handling massive volumes of traffic and caching static content.

Deploy AWS WAF with a rate-based rule associated with the CloudFront distribution.

IP addresses that send more requests than the defined threshold within a 5-minute window are automatically blocked at the edge.

Layer 7 HTTP floods must be mitigated dynamically at the application layer before reaching the backend application origin.

Restrict backend access to the Application Load Balancer.

The ALB security group is modified to allow inbound traffic only from the CloudFront managed prefix list.

This prevents malicious users from bypassing CloudFront and AWS WAF by directly targeting the ALB's public IP address or DNS name.

Anahtar Kavram

AWS WAF rate-based rules combined with Amazon CloudFront and ALB security group restrictions provide comprehensive Layer 7 DDoS mitigation and origin cloaking.

Soru 546Soru →

A global telematics provider hosts an API on AWS for smart vehicles to upload telemetry data. The API is hosted on Amazon Elastic Container Service (Amazon ECS) tasks behind an Application Load Balancer (ALB). The provider is experiencing sophisticated Layer 7 HTTP flood attacks that mimic legitimate telemetry traffic, causing database resource exhaustion and high latency. Additionally, the infrastructure has been targeted by massive UDP reflection attacks at Layers 3 and 4. The provider wants to block these attacks at the AWS network edge before they reach the VPC, while ensuring minimal latency for legitimate vehicle traffic worldwide. Which two configurations should a solutions architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and enable AWS Shield Advanced on the CloudFront distribution.

Associate an AWS WAF web ACL with the Amazon CloudFront distribution, and configure a rate-based rule with a custom threshold to block abusive IP addresses.

Enable AWS Shield Standard on the Application Load Balancer, and write custom AWS WAF rules on the ALB to automatically inspect and drop Layer 3/4 UDP reflection traffic.

Configure the Application Load Balancer's security groups to dynamically block source IP addresses identified by AWS Shield Standard.

Implement stateless Network Access Control Lists (NACLs) on the subnets containing the Application Load Balancer to dynamically block traffic from UDP ports and rate-limit HTTP requests.

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and enable AWS Shield Advanced on the CloudFront distribution.; Associate an AWS WAF web ACL with the Amazon CloudFront distribution, and configure a rate-based rule with a custom threshold to block abusive IP addresses.

Cevap

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer with AWS Shield Advanced enabled, and associate an AWS WAF web ACL with the CloudFront distribution containing a custom rate-based rule.

To block attacks at the network edge and minimize latency, Amazon CloudFront must be deployed in front of the Application Load Balancer. CloudFront buffers and distributes traffic across AWS edge locations. Enabling AWS Shield Advanced on CloudFront provides managed Layer 3/4 DDoS protection against attacks such as UDP reflection. Additionally, associating an AWS WAF web ACL with the CloudFront distribution and configuring a rate-based rule prevents Layer 7 HTTP floods by automatically blocking IP addresses that exceed a set threshold of requests within a rolling window.

Adım Adım Çözüm

Analyze the attack vectors and network boundary requirements.

Identify that the solution requires protecting against Layer 3/4 UDP reflection attacks and Layer 7 HTTP floods at the AWS network edge, before traffic reaches the VPC/ALB.

This establishes the need to use edge services like Amazon CloudFront rather than relying solely on VPC-level controls like ALB security groups or subnets.

Evaluate Edge and Layer 3/4 DDoS protection options.

Determine that deploying Amazon CloudFront automatically provides inline Layer 3/4 protection at the AWS edge. Enabling AWS Shield Advanced on the CloudFront distribution offers comprehensive protection against large-scale DDoS attacks, including UDP reflection.

CloudFront routes traffic through global Edge locations, absorbing DDoS attacks before they reach the origin, and Shield Advanced provides specialized mitigation capabilities.

Evaluate Layer 7 HTTP flood mitigation options.

Determine that AWS WAF associated with CloudFront is the best practice for application-layer (Layer 7) protection. Implementing a rate-based rule allows the system to track request rates per IP and temporarily block clients that exceed the configured threshold.

This directly targets HTTP floods mimicking legitimate telemetry traffic without impacting authorized clients that stay within normal usage limits.

Anahtar Kavram

Multi-layered edge security and DDoS mitigation using Amazon CloudFront, AWS Shield Advanced, and AWS WAF.

Soru 547Soru →

A healthcare technology company hosts its core prescription processing application in the us-east-1 Region. The application uses an Amazon Aurora PostgreSQL database cluster. The company needs to design a disaster recovery (DR) strategy in the us-west-2 Region. The design must achieve a Recovery Point Objective (RPO) of less than 5 minutes and a Recovery Time Objective (RTO) of less than 30 minutes. To comply with budget constraints, the strategy must also minimize ongoing infrastructure costs. Which disaster recovery configuration meets these requirements?

Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Deploy an Application Load Balancer and an Auto Scaling group in us-west-2 with the desired and minimum capacity set to 0. During a disaster recovery event, promote the secondary database cluster and scale up the Auto Scaling group.

Deploy a Warm Standby architecture in us-west-2 with an active database cluster of the same size as the primary database, and a fully scaled Application Load Balancer and Auto Scaling group running at identical capacity to the primary region.

Deploy an Amazon RDS for PostgreSQL database instance in us-east-1 with a cross-region Read Replica in us-west-2. Configure an Amazon Route 53 latency routing policy to automatically redirect application traffic to the secondary region's Read Replica in the event of a primary database failure.

Configure daily automated database exports to an Amazon S3 bucket, and use S3 Cross-Region Replication to copy the backups to an S3 Glacier Flexible Retrieval vault in us-west-2. In the event of a disaster, retrieve the backup from S3 Glacier and restore it to a new database instance.

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Deploy an Application Load Balancer and an Auto Scaling group in us-west-2 with the desired and minimum capacity set to 0. During a disaster recovery event, promote the secondary database cluster and scale up the Auto Scaling group.

Cevap

The correct strategy uses Amazon Aurora Global Database to achieve near-zero RPO (sub-second replication) and deploys compute resources scaled to zero in the secondary region to minimize ongoing costs. In the event of a failover, the secondary database is promoted and the compute resources are scaled up, which can easily be completed within the 30-minute RTO. This represents a highly cost-optimized Pilot Light DR pattern.

Adım Adım Çözüm

Analyze RPO and RTO requirements against database replication technologies.

Amazon Aurora Global Database provides sub-second replication latency, which easily satisfies the 5-minute RPO constraint.

Choosing a continuous replication mechanism is necessary because daily snapshots or exports cannot meet a 5-minute RPO.

Evaluate the cost minimization constraint against compute deployment options.

Using a Pilot Light strategy by configuring an Auto Scaling group with a desired/minimum capacity of 0 ensures that compute charges are only incurred during testing or an actual disaster recovery event.

Running a fully scaled Warm Standby configuration continuously is expensive and violates the requirement to minimize ongoing costs.

Verify RTO compliance for promoting the secondary database and scaling compute.

Promoting an Aurora secondary cluster takes less than a minute, and scaling up the Auto Scaling group instances takes a few minutes, fitting well within the 30-minute RTO target.

Ensuring both the database promotion and compute provisioning steps can complete within the RTO budget is critical for the success of the DR plan.

Anahtar Kavram

Disaster Recovery (DR) strategies on AWS involve balancing Recovery Time Objective (RTO), Recovery Point Objective (RPO), and cost. A Pilot Light strategy keeps data replicated and infrastructure definitions ready, but compute resources are turned off or scaled to zero until a failover occurs, making it highly cost-effective.

Soru 548Soru →

A digital publishing company is building an automated newsletter system. When articles are published or updated, metadata events must be processed in sequence to update the search index and subscriber email caches. The publishing rate can spike dramatically during breaking news events, and downstream update workers sometimes experience transient database connection timeouts. The company needs a resilient, decoupled architecture that processes updates in the order they occur per article, buffers traffic spikes, and ensures that failing messages do not block the processing of other articles. Which TWO actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Send the article update events to an Amazon SQS FIFO queue, setting the article ID as the message group ID.

Configure a dead-letter queue (DLQ) on the main Amazon SQS FIFO queue to capture messages that fail to process after the maximum receive count is exceeded.

Send the article update events to an Amazon SQS Standard queue and enable message deduplication using the MessageDeduplicationId parameter.

Send the article update events to an Amazon SQS Standard queue and configure a dead-letter queue (DLQ) to handle failed messages while ensuring ordered delivery by setting the visibility timeout to zero.

Cevabı ve açıklamayı göster

Cevap: Send the article update events to an Amazon SQS FIFO queue, setting the article ID as the message group ID.; Configure a dead-letter queue (DLQ) on the main Amazon SQS FIFO queue to capture messages that fail to process after the maximum receive count is exceeded.

Cevap

To achieve decoupling, order preservation, and fault tolerance, the solution must use an Amazon SQS FIFO queue with the article ID as the MessageGroupId, combined with a Dead-Letter Queue (DLQ) to handle processing failures without blocking other articles.

To decouple the systems while maintaining strict order processing per article, a Solutions Architect should use an Amazon SQS FIFO (First-In-First-Out) queue. By setting the article ID as the MessageGroupId, SQS ensures that messages belonging to the same article are processed sequentially in the order they were received. Setting up a dead-letter queue (DLQ) ensures that poison-pill messages (those that fail repeatedly) are isolated after a specified number of attempts, allowing other messages in the queue to continue processing without blocking the pipeline.

Adım Adım Çözüm

Select the appropriate messaging service that supports ordering.

Amazon SQS FIFO queues are chosen over SQS Standard queues because they guarantee first-in, first-out ordering, which is required to process article updates in sequence.

Standard SQS queues only guarantee best-effort ordering, which does not satisfy the strict sequential requirement.

Configure the message grouping strategy.

Set the MessageGroupId to the article ID on every sent message.

Using the article ID as the MessageGroupId ensures that messages belonging to the same article are processed in order, while messages for different articles can be processed concurrently to improve throughput.

Address transient failures and blockages.

Configure a dead-letter queue (DLQ) to capture messages that exceed the maximum receive count.

If a message fails repeatedly (e.g., due to database timeouts), transferring it to a DLQ unblocks the message group, allowing subsequent updates for that article to proceed.

Anahtar Kavram

Decoupling message processing using SQS FIFO queues and MessageGroupIds to maintain ordering, combined with DLQs to handle poison-pill messages.

Soru 549Soru →

A cloud-native healthcare platform is deploying an analytics processing engine on AWS. The analytics instances reside in a private Analytics Engine Subnet ( $172.20.10.0/24$ ). These instances must run SQL queries against an Amazon RDS PostgreSQL database located in a private Data Warehouse Subnet ( $172.20.20.0/24$ ). Additionally, the analytics instances must fetch hourly compliance updates from an external API endpoint over HTTPS (port $443$ ) via a NAT Gateway located in a public subnet ( $172.20.100.0/24$ ). Strict compliance standards require that Network ACLs at the subnet boundaries enforce the principle of least privilege. Assuming the Security Groups are already configured correctly, which combination of Network ACL configurations for the Analytics Engine Subnet ( $172.20.10.0/24$ ) must be implemented to support this traffic? (Select TWO.)

Geçerli olan tümünü seçin

An outbound Network ACL rule allowing TCP traffic to destination

172.20.20.0/24

on port

5432

, and an outbound Network ACL rule allowing TCP traffic to destination

0.0.0.0/0

on port

443

An inbound Network ACL rule allowing TCP traffic from source

172.20.20.0/24

on source port

5432

to destination ports

1024-65535

, and an inbound Network ACL rule allowing TCP traffic from source

0.0.0.0/0

on source port

443

to destination ports

1024-65535

An inbound Network ACL rule allowing TCP traffic from source

172.20.20.0/24

on destination port

5432

, and an inbound Network ACL rule allowing TCP traffic from source

0.0.0.0/0

on destination port

443

No inbound Network ACL rules are required to allow response traffic from the database or the internet, because Network ACLs are stateful and automatically track connection states.

An outbound Network ACL rule allowing TCP traffic to destination

172.20.20.0/24

on ephemeral ports

1024-65535

, and an outbound Network ACL rule allowing TCP traffic to destination

0.0.0.0/0

on ephemeral ports

1024-65535

Cevabı ve açıklamayı göster

Cevap: An outbound Network ACL rule allowing TCP traffic to destination $172.20.20.0/24$ on port $5432$ , and an outbound Network ACL rule allowing TCP traffic to destination $0.0.0.0/0$ on port $443$ .; An inbound Network ACL rule allowing TCP traffic from source $172.20.20.0/24$ on source port $5432$ to destination ports $1024-65535$ , and an inbound Network ACL rule allowing TCP traffic from source $0.0.0.0/0$ on source port $443$ to destination ports $1024-65535$ .

Cevap

To support this traffic, the Network ACL for the Analytics Engine Subnet must have outbound rules allowing TCP to the database subnet on port

5432

and to the internet on port

443

. It must also have inbound rules allowing TCP from the database subnet on source port

5432

and the internet on source port

443

to destination ephemeral ports

1024-65535

The correct answer combines the outbound rules that allow the initial requests to reach their targets (destination port

5432

for the database and destination port

443

for the internet) with the inbound rules that allow return traffic. Because Network ACLs are stateless, inbound rules must be created to allow response traffic back into the subnet. Since the database and external API act as servers, their response packets will have source ports

5432

and

443

, respectively, and will target the ephemeral port range (

1024-65535

) on the client instances inside the analytics subnet.

Adım Adım Çözüm

Determine the destination ports for outbound requests initiated by the analytics instances.

The analytics instances initiate outbound connections to the database on port

5432

(PostgreSQL) and to the internet on port

443

(HTTPS).

This establishes that the outbound Network ACL rules must target destination ports

5432

and

443

respectively.

Analyze how return traffic behaves across the stateless subnet boundary.

Network ACLs are stateless, meaning return traffic is not automatically tracked or allowed. The response packets coming back from the database have a source port of

5432

, and response packets from the internet have a source port of

443

This dictates that inbound rules must be explicitly created to handle the returning traffic.

Identify the destination ports for the inbound return traffic on the client instances.

The returning packets target the ephemeral port range (

1024-65535

) on the analytics instances.

This means the inbound rules must permit traffic from source ports

5432

and

443

to destination ports

1024-65535

Anahtar Kavram

Statelessness of Network ACLs and the necessity of configuring ephemeral port ranges for return traffic.

Soru 550Soru →

A company hosts a microservice on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The EC2 instances are located in private subnets, and the ALB is in public subnets. The application on the EC2 instances listens on TCP port 8080. A custom Network ACL (NACL) is applied to the private subnets. The solutions architect notices that the ALB target group marks all EC2 instances as unhealthy, and clients receive HTTP 502 Bad Gateway errors. The security groups for both the ALB and the EC2 instances are configured to allow traffic on port 8080. Which configuration change is required to resolve this issue and restore healthy status to the target group?

Add an outbound rule to the EC2 instances' security group allowing TCP traffic on ephemeral ports to the ALB, because security group rules are stateless.

Reconfigure the target group health check port to TCP port 80, as the ALB listener is configured to receive HTTP traffic on port 80.

Add an outbound rule to the private subnet Network ACL that allows TCP traffic on ephemeral ports (1024-65535) to the public subnets.

Modify the Amazon Route 53 routing policy to use Latency Routing with health checks enabled to automatically route the ALB health check probes to healthy instances.

Cevabı ve açıklamayı göster

Cevap: Add an outbound rule to the private subnet Network ACL that allows TCP traffic on ephemeral ports (1024-65535) to the public subnets.

Cevap

Add an outbound rule to the private subnet Network ACL that allows TCP traffic on ephemeral ports (1024-65535) to the public subnets.

The correct option is to add an outbound rule to the private subnet Network ACL that allows TCP traffic on ephemeral ports (1024-65535) to the public subnets. Because Network ACLs are stateless, return traffic from the EC2 instances back to the ALB must be explicitly allowed. When the ALB sends a health check request to port 8080 on the instances, the return traffic from port 8080 goes back to the ALB's ephemeral ports.

Adım Adım Çözüm

Analyze the components and the flow of the health check requests.

The Application Load Balancer (ALB) in the public subnet sends health check requests to the EC2 instances in the private subnet on port 8080.

Health check probes are initiated by the ALB and targeted at the configured port of the backend instances.

Examine the statefulness of the security groups and Network ACLs.

Security groups are stateful and allow return traffic automatically. Network ACLs (NACLs) are stateless, meaning both inbound and outbound traffic must be explicitly allowed.

Since a custom NACL is applied to the private subnets, any return traffic generated by the EC2 instances in response to the health check probes must be allowed explicitly by an outbound NACL rule.

Identify the ports required for the return traffic.

The return traffic from the EC2 instances (destined for the ALB's client request port) must be sent to the ephemeral ports (1024-65535) of the ALB subnets.

When a client or load balancer initiates a connection, it uses an ephemeral port. The server responds back to this ephemeral port, requiring the private subnet's NACL to permit outbound ephemeral traffic.

Anahtar Kavram

Understanding the stateless nature of Network ACLs compared to stateful Security Groups when configuring health checks between an ALB and backend targets.

Soru 551Soru →

A financial services corporation uses AWS Organizations to manage a multi-account environment. A security audit reveals that several development teams have temporarily modified Network Access Control Lists (NACLs) to allow public inbound traffic ( $0.0.0.0/0$ ) on database ports (such as $3306$ and $5432$ ), violating compliance mandates. The security team requires a solution that continuously monitors all accounts, automatically reverts any unauthorized public NACL rules within minutes of creation, and aggregates these compliance findings into a central security account for audit reporting. Which solution meets these security and compliance requirements with the lowest operational overhead?

Configure AWS CloudTrail across all accounts to log API events. Create an Amazon EventBridge rule that detects CreateNetworkAclEntry calls and invokes an AWS Lambda function. The function retrieves the compliance baseline configurations stored as plaintext parameters in AWS Systems Manager Parameter Store, compares them, and reverts unauthorized changes.

Configure AWS Config in all member accounts and deploy an AWS Organizations conformance pack containing a custom Config rule that checks NACL rules. Link the Config rule to an AWS Systems Manager (SSM) Automation runbook as a remediation action to delete non-compliant inbound entries. Direct the Config findings to a delegated administrator AWS Security Hub account.

Enable VPC Flow Logs in all accounts and stream them to a centralized Amazon CloudWatch Logs log group. Set up a metric filter that triggers an AWS Lambda function to modify the Security Groups at the subnet level to block database ports, and send alerts to AWS Security Hub.

Deploy AWS Shield Advanced on all VPC routers and configure AWS WAF rules to inspect all subnet-level traffic. Configure a WAF rule to block unauthorized public inbound database connections at the subnet boundary and trigger an AWS Lambda function to update the route tables.

Cevabı ve açıklamayı göster

Cevap: Configure AWS Config in all member accounts and deploy an AWS Organizations conformance pack containing a custom Config rule that checks NACL rules. Link the Config rule to an AWS Systems Manager (SSM) Automation runbook as a remediation action to delete non-compliant inbound entries. Direct the Config findings to a delegated administrator AWS Security Hub account.

Cevap

The correct solution uses AWS Config in all member accounts, deployed via an AWS Organizations conformance pack, to run a Config rule evaluating NACL configurations. When non-compliant resources are found, an AWS Systems Manager Automation runbook is natively invoked as a remediation action to revert the NACL rule, and all findings are consolidated into the delegated administrator AWS Security Hub account.

The correct solution leverages AWS Config to monitor configuration changes in near real-time. By deploying an AWS Organizations conformance pack, the security rule and its remediation configuration are uniformly distributed across all member accounts. The AWS Systems Manager Automation runbook provides a low-overhead, native method to automatically revert unauthorized changes to Network Access Control Lists (NACLs). Aggregating findings into a delegated administrator account for AWS Security Hub allows the security team to centralize and visualize compliance violations without managing complex custom code.

Adım Adım Çözüm

Analyze the compliance monitoring and remediation requirements.

The solution must detect configuration modifications to Network Access Control Lists (NACLs), revert them automatically with minimal delay, and centralize the logs/alerts across a multi-account environment.

Understanding the requirement defines the tools: AWS Config is designed for configuration history and compliance checks, whereas CloudTrail logs APIs and Flow Logs track network traffic.

Evaluate remediation mechanism and operational overhead.

Using AWS Config rules combined with AWS Systems Manager (SSM) Automation runbooks allows for agentless, automated, and native remediation of non-compliant resources without writing custom Lambda code.

Minimizing operational overhead involves using built-in platform capabilities rather than developing and maintaining custom code.

Ensure secure baseline storage and multi-account visibility.

Deploying conformance packs via AWS Organizations ensures consistent enforcement across accounts, and AWS Security Hub centralizes compliance findings.

This complies with AWS Well-Architected Framework guidelines for centralized security operations and auditing.

Anahtar Kavram

AWS Config Rule Remediation and Multi-Account Security Centralization

Tahmini Süre:3m 0s

Soru 552Soru →

A company is deploying an IoT data processing application on Amazon ECS using the Fargate launch type. The application needs to retrieve two configuration values: a database endpoint address that does not contain sensitive information, and an API password for an external service that must be rotated every 60 days. The solutions architect wants to implement a secure solution that minimizes ongoing operational costs.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Store the database endpoint address as a String parameter in AWS Systems Manager Parameter Store.

Store the API password in AWS Secrets Manager and configure an AWS Lambda function to rotate the secret every 60 days.

Store the database endpoint address in AWS Secrets Manager and enable the default automatic rotation feature.

Store the API password as a String parameter in AWS Systems Manager Parameter Store.

Configure automatic key rotation on the AWS Key Management Service (AWS KMS) customer managed key to automatically rotate the API password value every 60 days.

Cevabı ve açıklamayı göster

Cevap: Store the database endpoint address as a String parameter in AWS Systems Manager Parameter Store.; Store the API password in AWS Secrets Manager and configure an AWS Lambda function to rotate the secret every 60 days.

Cevap

Store the database endpoint address as a String parameter in AWS Systems Manager Parameter Store, and store the API password in AWS Secrets Manager and configure an AWS Lambda function to rotate the secret every 60 days.

The database endpoint is non-sensitive configuration data, meaning it can be stored cost-effectively as a String parameter in AWS Systems Manager Parameter Store without incurring extra charges. The API password, being sensitive and requiring automated rotation every 60 days, must be stored in AWS Secrets Manager. Secrets Manager natively supports automated rotation schedules and can trigger a custom AWS Lambda function to update the credential on the third-party service.

Adım Adım Çözüm

Evaluate the sensitivity of the database endpoint and the API password.

Identify that the database endpoint is non-sensitive configuration data, while the API password is a highly sensitive credential.

Determining data sensitivity helps choose the most cost-effective and secure storage service.

Select the storage service for the non-sensitive database endpoint.

Store the endpoint in AWS Systems Manager Parameter Store as a String parameter.

Parameter Store standard parameters are free of charge, which satisfies the cost minimization requirement for non-sensitive configuration.

Select the storage service and rotation method for the sensitive API password.

Store the API password in AWS Secrets Manager and configure a custom AWS Lambda function for rotation.

AWS Secrets Manager supports encrypted storage and automated rotation, using Lambda to run custom rotation code for third-party APIs.

Anahtar Kavram

Secrets and Parameter Management

Soru 553Soru →

A company hosts a customer-facing web application on Amazon EC2 instances managed by an Auto Scaling group (ASG). The instances are registered with a target group of an Application Load Balancer (ALB). The web application serves user requests on HTTP port 80. However, the application's health status service runs on a dedicated management agent listening on TCP port 8080. The target group health check is configured to query port 8080. Currently, the security group for the EC2 instances allows inbound HTTP traffic on port 80 from the ALB security group. The ALB console reports all EC2 instances as unhealthy, and users are receiving 502 Bad Gateway errors.

Which action should the Solutions Architect take to resolve the issue?

Modify the security group of the EC2 instances to allow inbound traffic on TCP port 8080 from the security group of the ALB.

Modify the subnet Network ACL to allow inbound traffic on port 8080, as security groups are stateless and cannot track the return traffic for the health checks.

Change the target group health check port setting to 'traffic-port' so that the health check automatically queries port 80.

Configure an Amazon Route 53 latency routing policy to route client traffic directly to the elastic network interfaces (ENIs) of the EC2 instances.

Cevabı ve açıklamayı göster

Cevap: Modify the security group of the EC2 instances to allow inbound traffic on TCP port 8080 from the security group of the ALB.

Cevap

Modify the security group of the EC2 instances to allow inbound traffic on TCP port 8080 from the security group of the ALB.

The correct action is to modify the security group of the EC2 instances to allow inbound traffic on TCP port 8080 from the security group of the ALB. Since the target group health check is configured to query port 8080 but the EC2 instances' security group only allows inbound traffic on port 80, the ALB's health check requests are blocked. Enabling port 8080 inbound allows the ALB to reach the health status service, marking the instances as healthy and resolving the service outage.

Adım Adım Çözüm

Analyze the ports used for application traffic and health checks.

User traffic uses port 80, but health checks use port 8080.

This establishes that two separate ports must be accessible by the Application Load Balancer.

Check the security group rules on the target EC2 instances.

Only port 80 is allowed from the ALB's security group; port 8080 is blocked.

This explains why the ALB is reporting the instances as unhealthy despite the application running correctly.

Authorize inbound traffic on port 8080 from the ALB security group to the EC2 instances.

The ALB can now successfully perform health checks, marking the instances as healthy and resuming normal traffic routing.

This resolves the network path blockage specifically for the health check endpoint.

Anahtar Kavram

Auto Scaling and Elastic Load Balancing (ELB) Health Check and Security Group Integration

Soru 554Soru →

An organization is deploying an internal processing application on Amazon EC2 instances in a private subnet (CIDR $10.0.2.0/24$ ). The application must securely consume a proprietary database API hosted by a third-party vendor in another AWS account using an Interface VPC Endpoint. The endpoint network interfaces are located in a separate dedicated subnet (CIDR $10.0.3.0/24$ ) within the same VPC. Traffic is restricted to TCP port $443$ . The VPC uses custom Network Access Control Lists (NACLs) associated with each subnet, both of which are currently configured with a default deny-all rule. To meet security compliance, the EC2 instances must only be allowed to initiate outbound connections to the Interface VPC Endpoint, and no other external traffic is permitted. Which combination of NACL and Security Group configurations will allow this private connection while adhering to the principle of least privilege?

For the application subnet NACL, add an outbound rule allowing TCP port

443

10.0.3.0/24

and an inbound rule allowing TCP ports

1024

65535

from

10.0.3.0/24

. For the endpoint subnet NACL, add an inbound rule allowing TCP port

443

from

10.0.2.0/24

and an outbound rule allowing TCP ports

1024

65535

10.0.2.0/24

. Associate a Security Group with the EC2 instances allowing outbound TCP port

443

to the endpoint Security Group, and associate a Security Group with the Interface Endpoint allowing inbound TCP port

443

from the EC2 Security Group.

For the application subnet NACL, add an outbound rule allowing TCP port

443

10.0.3.0/24

and an inbound rule allowing TCP port

443

from

10.0.3.0/24

. For the endpoint subnet NACL, add an inbound rule allowing TCP port

443

from

10.0.2.0/24

and an outbound rule allowing TCP port

443

10.0.2.0/24

. Associate a Security Group with the EC2 instances allowing outbound TCP port

443

to the endpoint Security Group, and associate a Security Group with the Interface Endpoint allowing inbound TCP port

443

from the EC2 Security Group.

For the application subnet NACL, add an outbound rule allowing TCP port

443

10.0.3.0/24

and an inbound rule allowing TCP ports

1024

65535

from

10.0.3.0/24

. For the endpoint subnet NACL, add an inbound rule allowing TCP port

443

from

10.0.2.0/24

and an outbound rule allowing TCP ports

1024

65535

10.0.2.0/24

. Associate a Security Group with the EC2 instances allowing outbound TCP port

443

and inbound TCP ports

1024

65535

, and associate a Security Group with the Interface Endpoint allowing inbound TCP port

443

and outbound TCP ports

1024

65535

For the application subnet NACL, add an outbound rule allowing TCP port

443

10.0.3.0/24

. For the endpoint subnet NACL, add an inbound rule allowing TCP port

443

from

10.0.2.0/24

. Do not configure inbound application NACL rules or outbound endpoint NACL rules. Associate a Security Group with the EC2 instances allowing outbound TCP port

443

to the endpoint Security Group, and associate a Security Group with the Interface Endpoint allowing inbound TCP port

443

from the EC2 Security Group.

Cevabı ve açıklamayı göster

Cevap: For the application subnet NACL, add an outbound rule allowing TCP port $443$ to $10.0.3.0/24$ and an inbound rule allowing TCP ports $1024$ - $65535$ from $10.0.3.0/24$ . For the endpoint subnet NACL, add an inbound rule allowing TCP port $443$ from $10.0.2.0/24$ and an outbound rule allowing TCP ports $1024$ - $65535$ to $10.0.2.0/24$ . Associate a Security Group with the EC2 instances allowing outbound TCP port $443$ to the endpoint Security Group, and associate a Security Group with the Interface Endpoint allowing inbound TCP port $443$ from the EC2 Security Group.

Cevap

The correct configuration requires setting up stateless NACL rules that permit outbound traffic on port

443

and inbound return traffic on the ephemeral port range (

1024

65535

) for the application subnet, and the inverse rules for the endpoint subnet (inbound on port

443

and outbound on ephemeral ports). The stateful security groups require only the outbound rule from the application instances to the endpoint on port

443

, and the inbound rule on the endpoint from the application instances on port

443

The correct configuration combines stateful security group rules with stateless NACL rules. For the stateful security groups, only a one-way allowance is required: the EC2 instances need outbound access to the endpoint, and the endpoint needs inbound access from the instances. The return traffic is handled automatically by the stateful firewall. For the stateless NACLs, rules must be explicitly created for both request and response traffic. The application subnet NACL must allow outbound traffic on destination port

443

and inbound return traffic on ephemeral ports (

1024

65535

). The endpoint subnet NACL must allow inbound traffic on port

443

and outbound return traffic on ephemeral ports (

1024

65535

Adım Adım Çözüm

Analyze the stateful security group requirements for both the client (EC2 instances) and the destination (Interface VPC Endpoint).

Since security groups are stateful, the client security group only needs an outbound rule to allow TCP port

443

to the endpoint's security group. The endpoint's security group only needs an inbound rule to allow TCP port

443

from the client's security group. Return traffic is tracked and allowed automatically.

Establishing stateful rules prevents unnecessary port exposure, minimizing security risk and following the principle of least privilege.

Determine the stateless Network ACL (NACL) requirements for the application subnet.

The application subnet NACL must allow outbound TCP traffic to the endpoint subnet (

10.0.3.0/24

) on destination port

443

. Additionally, it must allow inbound return traffic from the endpoint subnet (

10.0.3.0/24

) on the client's ephemeral port range (

1024

65535

NACLs are stateless and evaluate traffic in both directions independently; without allowing return traffic on ephemeral ports, TCP handshakes cannot complete.

Determine the stateless Network ACL (NACL) requirements for the endpoint subnet.

The endpoint subnet NACL must allow inbound TCP traffic from the application subnet (

10.0.2.0/24

) on port

443

. It must also allow outbound return traffic to the application subnet (

10.0.2.0/24

) on ephemeral ports (

1024

65535

This matches the counterpart stateless flow, ensuring that incoming packets can be received by the endpoint network interfaces and the responses can leave the subnet.

Anahtar Kavram

Stateless vs Stateful Network Security in AWS VPCs

Soru 555Soru →

An organization stores database backups in an Amazon S3 bucket. The backups are encrypted using an AWS KMS customer managed key. A new regulatory standard mandates that the encryption keys must be rotated annually. Additionally, any historical backups must be immediately re-encrypted with the new key material so that the old key material can be decommissioned and permanently deleted. Which strategy should a solutions architect recommend to meet these requirements?

Create a new customer managed key, configure the backup system to use the new key, copy and re-encrypt the existing historical backups in Amazon S3 using the new key, and delete the old customer managed key.

Enable automatic key rotation on the existing customer managed key, and delete the old key material version from the AWS KMS console.

Enable automatic key rotation on the existing customer managed key, which automatically re-encrypts all historical S3 backups with the new key version, allowing the old key version to be deleted.

Store the encryption key ARN as a plaintext String parameter in AWS Systems Manager Parameter Store, configure the backup application to fetch this parameter, and deploy an AWS Lambda function to update the parameter value with a new key ARN annually.

Cevabı ve açıklamayı göster

Cevap: Create a new customer managed key, configure the backup system to use the new key, copy and re-encrypt the existing historical backups in Amazon S3 using the new key, and delete the old customer managed key.

Cevap

The correct strategy is to create a new customer managed key, update the backup system configuration to point to it, copy and re-encrypt all existing historical backups in S3 using the new key, and then delete the old customer managed key. Since AWS KMS automatic key rotation keeps old key material to decrypt historical data and does not support deleting old key versions or automatically re-encrypting existing objects, manual rotation with active re-encryption is required to decommission the old key material.

Adım Adım Çözüm

Analyze the requirements for rotating KMS keys, re-encrypting existing backups, and deleting/decommissioning the old key material.

Identified that automatic rotation keeps old key material active and does not re-encrypt historical data, whereas manual rotation (creating a new key) allows re-encryption and subsequent deletion of the old key.

Required to determine if manual or automatic rotation fits the constraint of deleting the old key material.

Determine the necessary steps for manual rotation.

A new customer managed key must be created, and the backup system configuration must be updated to use the new key's Amazon Resource Name (ARN).

Ensures that future backups are encrypted with the new key.

Address the historical backups currently encrypted with the old key.

Copy/re-encrypt existing objects in S3 to use the new key. Once all historical objects are encrypted with the new key, the old key can be safely deleted.

Fulfills the requirement that the old key material be decommissioned and permanently deleted.

Anahtar Kavram

Manual KMS Key Rotation and Re-encryption

Soru 556Soru →

A municipal utility company wants to audit its AWS accounts for compliance and threat detection. The security team needs to monitor the environment for unauthorized IAM policy modifications and changes to VPC security groups. Additionally, the team requires near real-time alerts whenever a configuration deviates from the company's security baseline. Which combination of actions should the Solutions Architect recommend to achieve this? (Select TWO.)

Geçerli olan tümünü seçin

Configure AWS Config to continuously record and evaluate configurations of IAM roles, policies, and security groups, and enable AWS CloudTrail in all regions to capture management events.

Create an Amazon EventBridge rule that detects AWS Config non-compliant status changes and specific CloudTrail API calls, and configure it to send notifications to an Amazon Simple Notification Service (Amazon SNS) topic.

Deploy AWS Shield Advanced to monitor network traffic to the AWS Management Console and block unauthorized configuration changes made to the console.

Implement stateless Network ACLs at the subnet level to intercept, inspect, and block unauthorized IAM API call requests.

Deploy AWS WAF to inspect console traffic and block API calls destined for the IAM service endpoints if they originate from outside the corporate subnet.

Cevabı ve açıklamayı göster

Cevap: Configure AWS Config to continuously record and evaluate configurations of IAM roles, policies, and security groups, and enable AWS CloudTrail in all regions to capture management events.; Create an Amazon EventBridge rule that detects AWS Config non-compliant status changes and specific CloudTrail API calls, and configure it to send notifications to an Amazon Simple Notification Service (Amazon SNS) topic.

Cevap

Configuring AWS Config to continuously record and evaluate IAM and security group resource configurations, enabling AWS CloudTrail in all regions to log management events, and creating an Amazon EventBridge rule to route compliance changes and API alerts to an Amazon SNS topic.

To monitor unauthorized changes and ensure compliance, AWS Config tracks configuration modifications of AWS resources (like IAM policies and security groups) and evaluates them against rules. AWS CloudTrail records API calls and management events across all regions. An Amazon EventBridge rule can ingest these events and trigger actions (like sending an SNS notification) in near real-time when changes are detected.

Adım Adım Çözüm

Enable AWS CloudTrail across all regions to capture management events and API calls, and enable AWS Config to record resource configurations and evaluate compliance.

Comprehensive log files of all administrative API calls are created, and configuration baselines for IAM resources and security groups are established.

CloudTrail captures the metadata of API calls, while AWS Config tracks how resource configurations change over time.

Configure an Amazon EventBridge rule that filters for AWS Config compliance status transitions and CloudTrail API patterns representing unauthorized changes.

Events are captured in real-time and mapped to an event target.

EventBridge enables automated, event-driven responses to system changes.

Set the target of the EventBridge rule to an Amazon Simple Notification Service (Amazon SNS) topic subscribed to by the security team.

The security team receives push notifications immediately when security configurations drift or unauthorized changes are made.

Amazon SNS provides scalable pub/sub messaging to deliver notifications via email, SMS, or HTTPS webhooks.

Anahtar Kavram

Centralized configuration compliance auditing and real-time event-driven alerting using AWS Config, AWS CloudTrail, Amazon EventBridge, and Amazon SNS.

Soru 557Soru →

A gaming company hosts a real-time multiplayer application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application recently experienced service degradation due to a large-scale UDP flood attack targeting the ALB. The company needs to implement a solution that automatically mitigates these Layer 3 and Layer 4 DDoS attacks at the edge before they reach the ALB, while ensuring low-latency access for legitimate players. Which solution should a solutions architect recommend?

Deploy Amazon CloudFront in front of the Application Load Balancer. CloudFront provides inherent protection against Layer 3 and Layer 4 attacks at the AWS edge network through integrated AWS Shield Standard.

Create stateless Network Access Control Lists (NACLs) at the subnet level of the ALB to dynamically monitor and block the traffic signatures of the UDP flood.

Deploy AWS WAF and associate it with the Application Load Balancer. Configure an AWS WAF Web ACL with rate-based rules to block the incoming UDP flood traffic.

Configure the security groups associated with the Application Load Balancer to allow only TCP traffic, and configure AWS Route 53 latency routing to distribute UDP traffic across multiple AWS Regions.

Cevabı ve açıklamayı göster

Cevap: Deploy Amazon CloudFront in front of the Application Load Balancer. CloudFront provides inherent protection against Layer 3 and Layer 4 attacks at the AWS edge network through integrated AWS Shield Standard.

Cevap

Deploy Amazon CloudFront in front of the Application Load Balancer to leverage the built-in DDoS protection provided by AWS Shield Standard at the AWS edge network.

Deploying Amazon CloudFront in front of the Application Load Balancer utilizes AWS's global edge locations to absorb and mitigate Layer 3 and Layer 4 DDoS attacks automatically using AWS Shield Standard. This ensures that malicious UDP flood traffic is blocked before reaching the VPC or the ALB, preserving system availability and latency.

Adım Adım Çözüm

Identify the network layer of the DDoS attack.

The UDP flood represents a Layer 3/4 network and transport layer attack.

Classifying the attack layer allows the selection of the correct AWS protection tools, separating infrastructure shielding from web application filtering.

Evaluate perimeter edge services versus internal VPC controls.

Amazon CloudFront intercepts traffic at global edge locations and natively integrates with AWS Shield Standard.

Mitigating attacks at the edge isolates the origin resources and scales horizontally before traffic hits the Application Load Balancer.

Review the inadequacy of Layer 7, DNS, or stateful instance protections.

AWS WAF (Layer 7), security groups, and NACLs are unsuited to drop high-volume UDP floods efficiently at scale.

Discarding incorrect options reinforces why edge infrastructure proxying is the architecturally sound design.

Anahtar Kavram

Edge protection against Layer 3 and Layer 4 DDoS attacks is best achieved using Amazon CloudFront integrated with AWS Shield Standard.

Soru 558Soru →

A company has an on-premises reporting application that must query an Amazon RDS database and write output reports to an Amazon S3 bucket. The application requires database credentials that must be rotated every 30 days. The company's security policy prohibits the use of long-term AWS credentials on-premises and mandates that database passwords must not be stored in plaintext.

Which solution meets these security requirements?

Configure IAM Roles Anywhere to allow the on-premises application to exchange its X.509 certificate for temporary AWS credentials with permissions to write to the S3 bucket. Store the database credentials in AWS Secrets Manager, configure automatic rotation every 30 days, and retrieve the credentials dynamically using the temporary session.

Configure IAM Roles Anywhere to allow the on-premises application to exchange its X.509 certificate for temporary AWS credentials. Store the database credentials as a standard String parameter in AWS Systems Manager Parameter Store, and run an on-premises scheduled script to rotate the database password and update the parameter value in plaintext every 30 days.

Create an IAM user with a policy that allows writing to the S3 bucket. Generate long-term access keys for this IAM user, store them on the on-premises server, and store the database credentials in an encrypted local configuration file that is updated manually every 30 days.

Use the AWS account root user credentials to configure the AWS CLI on the on-premises server to ensure uninterrupted access. Store the database credentials in AWS Secrets Manager, enable automatic rotation every 30 days, and retrieve the database credentials using the root credentials.

Cevabı ve açıklamayı göster

Cevap: Configure IAM Roles Anywhere to allow the on-premises application to exchange its X.509 certificate for temporary AWS credentials with permissions to write to the S3 bucket. Store the database credentials in AWS Secrets Manager, configure automatic rotation every 30 days, and retrieve the credentials dynamically using the temporary session.

Cevap

The solution using IAM Roles Anywhere with X.509 certificates and AWS Secrets Manager with automatic rotation.

The correct solution uses IAM Roles Anywhere, which allows workloads outside of AWS (such as on-premises servers) to use local digital certificates (X.509) to obtain temporary AWS credentials, thus avoiding long-term IAM user access keys. It also uses AWS Secrets Manager, which securely encrypts secrets at rest and supports automatic rotation of database credentials out-of-the-box.

Adım Adım Çözüm

Establish secure, temporary authentication for the on-premises application.

IAM Roles Anywhere exchanges the application's X.509 certificates issued by a trusted Certificate Authority (CA) for temporary, short-lived AWS IAM credentials.

This eliminates the need to store long-term AWS access keys on-premises, satisfying the corporate security policy.

Store and secure the RDS database connection credentials.

The database password is saved securely as an encrypted secret within AWS Secrets Manager.

Secrets Manager integrates with AWS KMS to encrypt the secret at rest and ensures passwords are not stored in plaintext.

Automate credential rotation.

Secrets Manager uses an AWS Lambda function to automatically rotate the database password and update both the database and the secret every 30 days.

This satisfies the requirement for 30-day automated rotation without requiring manual script maintenance or storing plaintext secrets.

Anahtar Kavram

Securing hybrid cloud access using IAM Roles Anywhere to provide temporary credentials to on-premises workloads, combined with AWS Secrets Manager for encrypted secret storage and automated rotation.

Soru 559Soru →

A software company wants to design a disaster recovery (DR) strategy for a non-critical internal application. The company has specified a Recovery Time Objective (RTO) of 24 hours and a Recovery Point Objective (RPO) of 24 hours. The database backups must be stored in a secondary AWS Region, and the primary goal is to minimize ongoing infrastructure costs. Which disaster recovery strategy should a solutions architect recommend to meet these requirements at the lowest cost?

Backup and Restore, by copying database backups to the secondary Region daily and deploying application resources using AWS CloudFormation only during a disaster recovery event.

Pilot Light, by running a scaled-down version of the application servers and database instances in the secondary Region to achieve near-zero failover time.

Backup and Restore, by replicating databases to RDS Read Replicas in the secondary Region to serve as the automatic, immediate failover target.

Backup and Restore, by archiving the database snapshots to Amazon S3 Glacier Flexible Retrieval and using standard retrieval to recover the data within 10 minutes.

Cevabı ve açıklamayı göster

Cevap: Backup and Restore, by copying database backups to the secondary Region daily and deploying application resources using AWS CloudFormation only during a disaster recovery event.

Cevap

Backup and Restore, by copying database backups to the secondary Region daily and deploying application resources using AWS CloudFormation only during a disaster recovery event.

The correct option is the Backup and Restore strategy using AWS CloudFormation. Because the RTO and RPO are both 24 hours, the company does not need active servers or continuous replication running in the disaster recovery region. Storing daily backups in Amazon S3 in the secondary region satisfies the 24-hour RPO. Deploying resources on-demand via CloudFormation templates during an actual disaster easily fits within the 24-hour RTO while minimizing ongoing costs to only S3 storage.

Adım Adım Çözüm

Analyze the RTO and RPO requirements.

The target RTO is 24 hours and RPO is 24 hours.

Identifying these targets helps narrow down the acceptable disaster recovery strategies.

Evaluate the cost constraint.

The primary goal is to minimize ongoing infrastructure costs.

Since the RTO and RPO are lenient (24 hours), we should select the strategy that runs the fewest active resources in the secondary Region.

Select the most cost-effective strategy.

Backup and Restore meets the 24-hour RTO/RPO limits and incurs the lowest ongoing cost because no active compute or database instances run in the DR region until a failover occurs.

Other strategies like Pilot Light or Warm Standby keep active resources running, increasing costs unnecessarily.

Anahtar Kavram

Disaster recovery strategies differ in their RTO, RPO, and cost trade-offs, with Backup and Restore being the most cost-effective but slowest option.

Tahmini Süre:45s

Soru 560Soru →

An enterprise core banking application requires a relational database backend. The database configuration must achieve a Recovery Point Objective (RPO) of $0$ (no data loss) and a Recovery Time Objective (RTO) of less than $30$ seconds during an Availability Zone outage. The architecture must also support scaling read operations for reporting tools without impacting the primary database's write performance. Which database configuration meets these requirements with the lowest RTO and minimal operational effort?

Deploy an Amazon Aurora PostgreSQL DB cluster with a primary DB instance and at least one Aurora Replica in a different Availability Zone. Configure the reporting tools to use the cluster reader endpoint.

Deploy an Amazon RDS for PostgreSQL DB instance in a single Availability Zone. Create a Read Replica in a different Availability Zone, and use an Amazon Route 53 latency routing policy with health checks to automatically route write traffic to the replica during an outage.

Deploy an Amazon RDS for PostgreSQL database in a Multi-AZ DB instance deployment. Configure the reporting tools to connect directly to the standby replica to scale read operations.

Deploy two independent single-AZ Amazon RDS for PostgreSQL DB instances in different Availability Zones. Set up AWS Database Migration Service (AWS DMS) to perform bidirectional replication, and use an Application Load Balancer to distribute read and write traffic.

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon Aurora PostgreSQL DB cluster with a primary DB instance and at least one Aurora Replica in a different Availability Zone. Configure the reporting tools to use the cluster reader endpoint.

Cevap

Deploy an Amazon Aurora PostgreSQL DB cluster with a primary DB instance and at least one Aurora Replica in a different Availability Zone, and configure the reporting tools to use the cluster reader endpoint.

The correct configuration uses Amazon Aurora PostgreSQL with a primary instance and an Aurora Replica in a different Availability Zone. Aurora's storage layer replicates data synchronously across three Availability Zones, ensuring an RPO of

0

(no data loss). If the primary instance fails, failover to the replica is automatic and typically completes in under

30

seconds. Additionally, the reporting tools can use the cluster reader endpoint to query the replica, offloading read operations from the primary writer instance.

Adım Adım Çözüm

Analyze the high availability (HA) and disaster recovery (DR) requirements for RPO and RTO.

The requirements demand an RPO of

0

(no data loss, indicating synchronous replication at the storage or database layer) and an RTO of less than

30

seconds (requiring fast, automated failover).

Establishing these target limits helps filter out database engines or replication methods that rely on asynchronous replication or manual promotion steps.

Evaluate the read-scaling requirement.

The configuration must support offloading reporting queries from the primary write database instance to separate read-only resources.

This rules out configurations like standard RDS Multi-AZ DB instance deployments, which use a passive standby instance that cannot be read from.

Compare Amazon Aurora and Amazon RDS Multi-AZ capability profiles against the constraints.

Amazon Aurora replicates data synchronously across three Availability Zones at the storage layer (RPO of

0

) and can automatically failover to an Aurora Replica in another Availability Zone in less than

30

seconds (RTO <

30

seconds). The Aurora reader endpoint provides built-in load balancing for read scaling.

Aurora matches all RTO, RPO, and read scaling requirements with minimal operational complexity.

Anahtar Kavram

High Availability and Read Scaling in Amazon Aurora and Amazon RDS

ÖncekiSayfa 28 / 74Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram