Examkin

Tüm alıştırma soruları

1462 soru

Tüm türler1,462Çoktan seçmeli739Çoklu seçim723
Soru 1381Soru →

A municipal transit agency hosts its online ticketing application on AWS using an Application Load Balancer (ALB) to distribute traffic to Amazon EC2 instances. Recently, the application has experienced intermittent outages caused by HTTP flood attacks that mimic legitimate user login requests. The agency needs to implement a solution that mitigates these Layer 7 attacks at the AWS edge before they reach the ALB, without requiring changes to the application code. Which architecture should a solutions architect recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL with the distribution using a rate-based rule.

Cevap

Deploying an Amazon CloudFront distribution in front of the Application Load Balancer, and associating an AWS WAF web ACL with the distribution using a rate-based rule.
The correct solution uses Amazon CloudFront to cache and distribute traffic, and integrates it with AWS WAF at the AWS edge. A rate-based rule in the WAF web ACL automatically counts requests from individual IP addresses and blocks them when they exceed the defined limit, mitigating Layer 7 HTTP flood attacks before they reach the Application Load Balancer.

Adım Adım Çözüm

1
Analyze the attack vector and mitigation requirements.
Identify that the attack is a Layer 7 (HTTP flood) attack causing outages at the application layer, requiring a solution that operates at the AWS edge and offers rate-limiting.
Layer 7 attacks cannot be mitigated by standard network-level firewalls alone and must be inspected for request patterns.
2
Select the correct edge and application security services.
Amazon CloudFront distributes traffic via edge locations globally, and AWS WAF integrates with CloudFront to block malicious Layer 7 traffic before it reaches the backend infrastructure.
Filtering traffic at the edge reduces the load on the Application Load Balancer and downstream application servers.
3
Configure AWS WAF rules for request control.
Implement an AWS WAF rate-based rule to automatically track request rates from individual client IPs and temporarily block IPs exceeding the threshold.
Rate-limiting is the standard, code-free method to protect against HTTP flood attacks that mimic legitimate login requests.

Anahtar Kavram

Mitigating Layer 7 DDoS attacks using Amazon CloudFront and AWS WAF rate-based rules at the AWS edge.
Tahmini Süre:1m 30s
Soru 1382Soru →

A logistics telemetry company hosts its fleet tracking application in the us-east-1 Region. The architecture consists of Amazon EC2 instances in an Auto Scaling Group behind an Application Load Balancer, and a primary Amazon RDS for PostgreSQL database instance. The company needs to design a disaster recovery (DR) plan in the us-west-2 Region. The DR plan must support a Recovery Time Objective (RTO) of 1515 minutes, a Recovery Point Objective (RPO) of 55 minutes, and minimize ongoing infrastructure costs. Which DR strategy meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Establish a Pilot Light recovery environment in us-west-2. Configure an RDS cross-region read replica in us-west-2. Deploy an Elastic Load Balancer and an Auto Scaling Group with a desired capacity of 00. During a disaster, promote the read replica to a standalone database and scale the Auto Scaling Group to the required production capacity.

Cevap

Establish a Pilot Light recovery environment in us-west-2 by configuring an RDS cross-region read replica and an Auto Scaling Group with a desired capacity of 00, then promoting the replica and scaling the Auto Scaling Group during a disaster.
The correct strategy uses Pilot Light. An Amazon RDS cross-region read replica provides asynchronous replication with very low lag (usually seconds), easily meeting the 55-minute RPO. In the event of a disaster, the replica is promoted to a primary database, and the Auto Scaling Group is scaled up from 00 to the required capacity. This sequence completes within the 1515-minute RTO. Because no EC2 instances run in the recovery region during normal operation, this approach minimizes ongoing costs.

Adım Adım Çözüm

1
Evaluate the RTO and RPO requirements against the DR strategies.
An RPO of 55 minutes requires active database replication. S3 backups copied hourly (with Glacier retrieval times) fail the RPO. An RTO of 1515 minutes allows for either Warm Standby or Pilot Light, as both can scale up or promote databases within this window.
Eliminates Backup and Restore options which cannot meet the RPO of 55 minutes or the RTO of 1515 minutes.
2
Evaluate the database replication capability across AWS regions.
RDS Multi-AZ is a single-region high-availability feature and cannot place a standby replica in a different AWS region.
Eliminates the option proposing cross-region Multi-AZ standby replication.
3
Compare Pilot Light and Warm Standby based on the cost minimization constraint.
Pilot Light keeps the application tier shutdown (desired capacity of 00 for ASG), which incurs zero EC2 compute costs during idle periods. Warm Standby keeps a minimum number of EC2 instances running, incurring continuous compute costs. Route 53 latency routing also fails to provide failover without health checks.
Identifies the Pilot Light option as the most cost-effective solution that meets all constraints.

Anahtar Kavram

Disaster Recovery (DR) strategies using Pilot Light with cross-region read replicas to meet tight RTO/RPO targets while minimizing idle costs.
Tahmini Süre:2m 0s
Soru 1383Soru →

A global event ticketing platform hosts its high-traffic booking application on AWS using Amazon EC2 instances behind an Application Load Balancer (ALB). During major ticket releases, the platform experiences sudden spikes in malicious traffic, including Layer 7 HTTP flood attacks that exhaust web server resources, and periodic SQL injection attempts. The solutions architect needs to secure the architecture to mitigate these threats at the network edge while minimizing administrative overhead and ensuring only legitimate users can complete purchases. Which combination of steps should the solutions architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL containing rate-based rules and SQL injection matching conditions with the CloudFront distribution.; Subscribe to AWS Shield Advanced, associate it with the Amazon CloudFront distribution, and enable automatic application-layer DDoS mitigation.

Cevap

Deploy an Amazon CloudFront distribution in front of the ALB and associate it with an AWS WAF web ACL containing rate-based and SQL injection rules, while subscribing to AWS Shield Advanced and enabling automatic application-layer DDoS mitigation on the distribution.
The combination of deploying Amazon CloudFront with AWS WAF and subscribing to AWS Shield Advanced with automatic application-layer DDoS mitigation represents the AWS-recommended best practice for edge protection. CloudFront moves the application perimeter to the edge, AWS WAF provides Layer 7 payload filtering (such as SQL injection patterns and rate limiting), and Shield Advanced automates WAF rule creation and mitigation during an active DDoS attack, thereby reducing operational overhead.

Adım Adım Çözüm

1
Shift the application entry point to the edge by deploying an Amazon CloudFront distribution in front of the Application Load Balancer.
Dynamic and static traffic is routed through AWS edge locations, caching static content and providing a global scale capable of absorbing Layer 3 and Layer 4 infrastructure DDoS attacks.
Protecting the Application Load Balancer from direct internet exposure ensures that attacks are inspected and mitigated before reaching the core infrastructure.
2
Associate an AWS WAF web ACL with the Amazon CloudFront distribution and define rate-based rules along with SQL injection protection rules.
Layer 7 traffic is inspected at the edge. Request rates per IP are monitored to block HTTP floods, and payloads are analyzed to filter SQL injection attempts before forwarding traffic to the ALB.
AWS WAF provides application-layer visibility and control, preventing malicious payloads and resource exhaustion at the edge.
3
Enable AWS Shield Advanced on the Amazon CloudFront distribution and turn on automatic application-layer DDoS mitigation.
AWS Shield Advanced analyzes historical traffic baselines and automatically deploys custom WAF rules when an application-layer DDoS attack is detected.
This automates the mitigation process, minimizing administrative overhead and reducing the time to respond to complex, changing attack vectors.

Anahtar Kavram

Mitigating Layer 7 application attacks and DDoS at the edge using Amazon CloudFront, AWS WAF, and AWS Shield Advanced.
Tahmini Süre:2m 30s
Soru 1384Soru →

A company wants to encrypt sensitive documents stored in an Amazon S3 bucket using AWS Key Management Service (AWS KMS). The security team requires the use of a customer managed key that must be rotated automatically every year. The solutions architect must ensure that previously uploaded documents can still be decrypted after key rotation without any manual re-encryption. Which TWO actions should the solutions architect take to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable automatic key rotation on the AWS KMS customer managed key.; Configure the Amazon S3 bucket to use server-side encryption with AWS KMS keys (SSE-KMS) using the customer managed key.

Cevap

Enable automatic key rotation on the customer managed key and configure the S3 bucket to use server-side encryption with AWS KMS keys (SSE-KMS).
Enabling automatic key rotation on the customer managed key ensures that the key material is rotated annually without manual configuration. Configuring the S3 bucket to use SSE-KMS with the customer managed key ensures all documents uploaded to the bucket are secure. When KMS key rotation occurs, AWS KMS retains the historical key material so that older files can still be decrypted seamlessly.

Adım Adım Çözüm

1
Enable automatic key rotation on the customer managed key.
AWS KMS will automatically rotate the key material annually without manual action.
To satisfy the security requirement of rotating keys on a yearly schedule.
2
Configure server-side encryption with AWS KMS (SSE-KMS) on the S3 bucket.
Objects uploaded to the bucket are automatically encrypted using the specified key.
To ensure that S3 objects are encrypted at rest with the designated customer managed key.
3
Understand the retention behavior of historical key material in AWS KMS.
AWS KMS keeps older key material active to decrypt previously encrypted data.
To ensure that previously uploaded documents remain decryptable without manual re-encryption.

Anahtar Kavram

AWS KMS automatic key rotation updates the backing key material annually, while retaining older versions of the key material to allow the seamless decryption of historical data.
Tahmini Süre:1m 0s
Soru 1385Soru →

A digital ticketing platform experiences massive traffic spikes when tickets for popular events go on sale. The platform must process ticket reservation requests in the exact order they are received to prevent overbooking. The platform's relational database cannot handle the sudden spike in write requests directly. Which solution decouples the ingestion layer from the database while maintaining strict message ordering?

Cevabı ve açıklamayı göster

Cevap: Use an Amazon SQS FIFO queue to buffer the reservation requests, and configure an AWS Lambda function to process the messages and update the database.

Cevap

Use an Amazon SQS FIFO queue to buffer the reservation requests, and configure an AWS Lambda function to process the messages and update the database.
The correct solution uses an Amazon SQS FIFO queue to buffer reservation requests. SQS FIFO queues guarantee that messages are processed in the exact order they are received and prevent duplicates. An AWS Lambda function can poll the queue to process messages at a controlled rate, successfully protecting the database from write spikes while maintaining transaction ordering.

Adım Adım Çözüm

1
Analyze ordering requirements
Identify that the system requires strict first-in, first-out (FIFO) delivery to ensure reservations are processed in order and prevent overbooking.
Correctly identifying ordering requirements guides the choice between standard and FIFO services.
2
Analyze decoupling and buffering requirements
Determine that the database cannot handle sudden write spikes, requiring a queuing mechanism that supports message buffering.
Decoupling with a queue protects downstream databases from throttling and performance degradation.
3
Select the correct integration pattern
Choose Amazon SQS FIFO queue combined with AWS Lambda to process the buffered messages in order.
SQS FIFO guarantees ordering and deduplication, while Lambda consumes messages sequentially within the message group.

Anahtar Kavram

Using Amazon SQS FIFO queues to guarantee strict order processing and decouple components under heavy load.
Tahmini Süre:1m 30s
Soru 1386Soru →

A global pharmaceutical company hosts a clinical trial portal on AWS. The portal consists of static media assets stored in an Amazon S3 bucket served via Amazon CloudFront, and a dynamic telemetry ingestion API hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). During a recent test, the portal was targeted by a distributed HTTP flood (Layer 7 DDoS attack) that degraded the API's performance. A solutions architect must design a secure architecture that protects both the static assets and the API from Layer 7 attacks, and ensures that the EC2 instances only accept traffic originating from CloudFront. Which combination of security controls should the solutions architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Associate AWS WAF with the Amazon CloudFront distribution, and configure a rate-based rule to block IP addresses that exceed a request threshold.; Configure the Application Load Balancer's security group to only allow traffic from the Amazon CloudFront IP ranges using the AWS-managed prefix list.

Cevap

The correct combination of security controls is to associate AWS WAF with the Amazon CloudFront distribution and configure a rate-based rule to block IPs exceeding a threshold, and to configure the Application Load Balancer's security group to only allow traffic from the Amazon CloudFront IP ranges using the AWS-managed prefix list.
The correct response implements a multi-layered defense. First, attaching AWS WAF to CloudFront with rate-based rules mitigates Layer 7 HTTP floods at the edge. Second, configuring the load balancer's security group to only accept traffic from CloudFront's IP ranges (using the AWS-managed prefix list) prevents attackers from bypassing CloudFront and attacking the Application Load Balancer directly.

Adım Adım Çözüm

1
Protect the application layer (Layer 7) at the edge from HTTP flood attacks.
AWS WAF is associated with the Amazon CloudFront distribution, and a rate-based rule is configured to block IPs exceeding request limits.
This blocks malicious Layer 7 traffic at the CloudFront edge locations before it reaches the backend origin, mitigating resource exhaustion.
2
Prevent attackers from bypassing edge protections by attacking the origin directly.
The Application Load Balancer's security group is restricted to inbound traffic from the Amazon CloudFront AWS-managed prefix list.
This ensures that all incoming HTTP/HTTPS traffic must pass through CloudFront and AWS WAF, preventing direct attacks on the load balancer.

Anahtar Kavram

Layer 7 DDoS protection using AWS WAF rate-based rules combined with origin shielding by restricting Application Load Balancer access to CloudFront IP ranges using the AWS-managed prefix list.
Soru 1387Soru →

A systems administrator is configuring a security group for an Amazon EC2 instance hosting a web server. The administrator adds an inbound rule to allow HTTP traffic on port 80 from any source. What additional configuration is required in the security group to allow the web server to send outbound HTTP responses back to the clients?

Cevabı ve açıklamayı göster

Cevap: No additional configuration is required because security groups are stateful, meaning return traffic is automatically allowed.

Cevap

No additional configuration is required because security groups are stateful, meaning return traffic is automatically allowed.
The correct answer is correct because AWS security groups are stateful. When an inbound rule allows traffic on port 80, the security group tracks the connection and automatically allows the web server to send outbound responses back to the client, requiring no outbound security group rules for this communication.

Adım Adım Çözüm

1
Analyze the resource type and rule requirements.
The resource is a security group, which operates at the instance level.
Security groups are stateful firewalls in AWS VPC networking.
2
Determine the behavior of stateful firewalls regarding return traffic.
Since security groups are stateful, any inbound traffic that is allowed will automatically have its return traffic allowed outbound.
Stateful connection tracking permits return packets without checking outbound rules.

Anahtar Kavram

VPC Security Group Statefulness
Soru 1388Soru →

A company is hiring an external consulting firm to perform a compliance audit of data stored in an Amazon S3 bucket. The consulting firm has its own AWS account. The solutions architect must grant the consultants read-only access to the S3 bucket for the duration of the audit. The security team specifies that no long-term IAM credentials or new IAM users can be created, and the consultants must access the resources securely using temporary credentials. Which solution should the solutions architect implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Create an IAM role in the company's AWS account with a trust policy that allows the consulting firm's AWS account to assume the role. Attach an IAM policy to the role that grants read-only permissions to the S3 bucket. Instruct the consultants to assume this role using AWS Security Token Service (AWS STS).

Cevap

Create an IAM role in the company's AWS account with a trust policy that allows the consulting firm's AWS account to assume the role, attaching a read-only S3 policy, and having the consultants assume the role using AWS STS.
The correct answer is correct because defining an IAM role with a trust policy that trusts the external consulting firm's AWS account allows the consultants to assume the role via AWS STS. This gives them temporary security credentials to access the target Amazon S3 bucket, meeting the security criteria of avoiding long-term access keys or the creation of local IAM users.

Adım Adım Çözüm

1
Analyze the access requirements, identifying that cross-account access is needed between two distinct AWS accounts (the company's account and the consulting firm's account).
Identified the need for secure delegation of access across accounts.
Establishing cross-account boundaries helps define where trust policies and permission policies must be applied.
2
Configure an IAM role with a trust policy that specifies the principal as the consulting firm's AWS account ID, allowing users in that account to call the AssumeRole API.
Created a trusted relationship between the two accounts without creating local IAM users.
Trust policies govern which external entities are allowed to assume the role and obtain temporary credentials.
3
Attach a permissions policy to the IAM role that limits access to read-only actions (such as s3:GetObject and s3:ListBucket) on the target S3 bucket.
Enforced the principle of least privilege for the external auditors.
Permissions policies define what actions the trusted entity can perform once they assume the role.
4
Instruct the external consultants to use AWS Security Token Service (AWS STS) to assume the role, which provides them with short-lived, temporary security credentials.
Provided access to the resources without generating long-term IAM access keys.
AWS STS facilitates the secure exchange of cross-account trust into temporary session credentials.

Anahtar Kavram

Cross-Account IAM Roles and AWS STS Federation
Soru 1389Soru →

A financial technology company runs a payment validation service on Amazon EC2 instances within a private subnet. The instances must make outbound HTTPS requests to an external credit bureau API on port 443443 to verify transaction details. The security group associated with the EC2 instances allows outbound traffic to 0.0.0.0/00.0.0.0/0 on port 443443 and has no inbound rules. To comply with security audits, the solutions architect must configure the private subnet's Network Access Control List (Network ACL) with the most restrictive rules possible to support this traffic. Which Network ACL configuration should the solutions architect apply to the private subnet to allow the validation traffic to flow successfully?

Cevabı ve açıklamayı göster

Cevap: Outbound rule: Allow TCP port 443443 to 0.0.0.0/00.0.0.0/0. Inbound rule: Allow TCP ports 1024−655351024 - 65535 from 0.0.0.0/00.0.0.0/0.

Cevap

Configure an outbound Network ACL rule allowing TCP port 443 to anywhere, and an inbound Network ACL rule allowing TCP ports 1024 to 65535 from anywhere.
The correct configuration requires allowing outbound traffic to port 443 because the EC2 instances are initiating HTTPS requests to the external API. Because Network ACLs are stateless, they do not track connection state; therefore, a separate inbound rule must be configured to allow the return traffic. The return traffic is sent from the external API back to the ephemeral ports (TCP 1024 - 65535) allocated by the EC2 client instances.

Adım Adım Çözüm

1
Analyze the stateful nature of Security Groups.
The security group is stateful, so allowing outbound port 443 traffic automatically permits the corresponding inbound response traffic at the instance level.
Security groups track connections and permit response traffic regardless of inbound rules.
2
Analyze the stateless nature of Network ACLs (NACLs).
NACLs operate at the subnet boundary and are stateless. Outbound requests and inbound responses must be explicitly allowed.
Unlike security groups, NACLs do not track connection state and evaluate every packet independently.
3
Identify the ports utilized by the outbound request and its response.
The outbound request goes to destination port 443 (HTTPS). The returning traffic from the external server is sent to the ephemeral source ports (typically 1024 - 65535) allocated by the client EC2 instances.
Client OS TCP/IP stacks allocate ephemeral ports for outbound connections to receive returning responses.
4
Synthesize the correct NACL rules.
An outbound rule allowing destination port 443 to anywhere, and an inbound rule allowing destination ephemeral ports (1024 - 65535) from anywhere.
This matches the traffic direction and port requirements for both components of the TCP handshake and data transfer.

Anahtar Kavram

Stateless Network ACLs require explicit inbound rules for response traffic on ephemeral ports.
Soru 1390Soru →

A company is deploying an application on Amazon EC2 instances in a private subnet (CIDR: 10.10.2.0/2410.10.2.0/24) of a VPC. The application must securely query a PostgreSQL database (TCPTCP port 54325432) hosted by a partner vendor. The partner has exposed their database service using an AWS PrivateLink VPC endpoint service. A solutions architect creates an Interface VPC endpoint in the private subnet to connect to the partner service. Which configuration of security groups will allow the application to query the database while maintaining the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: Associate a security group with the EC2 instances that allows outbound TCP traffic on port 54325432 to the security group of the Interface VPC endpoint. Associate a security group with the Interface VPC endpoint that allows inbound TCP traffic on port 54325432 from the security group of the EC2 instances.

Cevap

Associate a security group with the EC2 instances that allows outbound TCP traffic on port 54325432 to the security group of the Interface VPC endpoint. Associate a security group with the Interface VPC endpoint that allows inbound TCP traffic on port 54325432 from the security group of the EC2 instances.
The correct option establishes the most secure, least-privilege connection by allowing outbound traffic from the EC2 instances specifically to the VPC endpoint's security group, and inbound traffic to the VPC endpoint specifically from the EC2 instances' security group. Because security groups are stateful, the return traffic does not require additional rules.

Adım Adım Çözüm

1
Analyze the traffic initiation path and destination port.
The EC2 instances initiate a TCP connection on port 54325432 to the Interface VPC endpoint.
To allow the initial connection, the security group of the EC2 instances must have an outbound rule allowing TCP port 54325432 destined for the Interface VPC endpoint's security group.
2
Determine the required inbound rules at the destination network interface.
The Interface VPC endpoint's security group must allow inbound TCP port 54325432 from the EC2 instances' security group.
This allows the incoming request to reach the endpoint network interface.
3
Evaluate the stateful nature of security groups for return traffic.
No inbound rules on the EC2 instances or outbound rules on the VPC endpoint are needed.
Security groups are stateful; once a connection is allowed outbound from the EC2 instance or inbound to the VPC endpoint, the corresponding return traffic is automatically allowed.

Anahtar Kavram

VPC Interface Endpoints and Stateful Security Groups
Soru 1391Soru →

A SaaS company hosts an enterprise human resources (HR) portal in the ap-southeast-2 Region. The architecture consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer, and an Amazon RDS for PostgreSQL database. The company needs to design a disaster recovery (DR) plan in the ap-southeast-1 Region. The DR plan must support a recovery time objective (RTO) of 30 minutes and a recovery point objective (RPO) of 5 minutes, while minimizing ongoing running costs.

Which combination of steps should a solutions architect recommend to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Amazon RDS for PostgreSQL cross-region read replica in the disaster recovery region.; Replicate the application server Amazon Machine Images (AMIs) to the disaster recovery region, and create an Auto Scaling group with a desired capacity of zero.

Cevap

To meet the requirements, the solutions architect must configure an Amazon RDS cross-region read replica in the disaster recovery region and replicate the application AMIs to set up an Auto Scaling group with a desired capacity of zero.
The correct options implement a cost-effective Pilot Light strategy. The RPO of 5 minutes is met by creating an Amazon RDS cross-region read replica, which continuously replicates database transactions asynchronously with minimal lag. The RTO of 30 minutes allows the application tier to remain offline (zero running instances) to minimize costs. In a disaster recovery event, the read replica is promoted to a primary database and the Auto Scaling group is scaled up from zero using the replicated AMIs, completing the entire failover well within the 30-minute window.

Adım Adım Çözüm

1
Configure database replication for low RPO.
Create a cross-region read replica of the PostgreSQL DB in the ap-southeast-1 region.
Asynchronous cross-region read replicas satisfy the 5-minute RPO by keeping the recovery database up-to-date with minimal replication lag.
2
Minimize recovery region compute costs.
Copy application AMIs to the target region and deploy an Auto Scaling group set to zero instances.
Setting the capacity to zero ensures no running instances are billed during normal operations, implementing a cost-optimized Pilot Light disaster recovery strategy.
3
Define failover procedures.
Create a runbook to promote the read replica to standalone status and scale the Auto Scaling group capacity up during a disaster.
Promoting a replica and booting EC2 instances from AMIs can be completed well within the 30-minute RTO.

Anahtar Kavram

A Pilot Light disaster recovery strategy minimizes running costs by keeping compute capacity scaled to zero while maintaining active, asynchronous database replication via cross-region read replicas to meet low recovery point objectives.
Tahmini Süre:2m 0s
Soru 1392Soru →

A company runs a financial analytics application on Amazon ECS that queries an Amazon Aurora PostgreSQL database. The application encrypts generated PDF reports using an AWS KMS customer managed key (CMK) and stores them in an Amazon S3 bucket. The security policy mandates that the database credentials must be rotated every 15 days, and the KMS CMK used to encrypt the S3 bucket must be rotated automatically every year. The security team is concerned that rotating the CMK will make the older PDF reports in the S3 bucket unreadable.

Which configuration will meet these security requirements with the LEAST operational overhead?

Cevabı ve açıklamayı göster

Cevap: Store the database credentials in AWS Secrets Manager with automatic rotation configured for every 15 days. Enable automatic key rotation for the customer managed key in AWS KMS.

Cevap

Store the database credentials in AWS Secrets Manager with automatic rotation configured for every 15 days. Enable automatic key rotation for the customer managed key in AWS KMS.
The correct solution uses AWS Secrets Manager to handle the 15-day database credential rotation natively and securely. For the KMS Customer Managed Key (CMK), enabling automatic rotation is the most operationally efficient choice because it retains the same key ARN and automatically preserves older key versions. When applications request decryption of older PDF reports, AWS KMS automatically uses the corresponding older key version, eliminating the need to re-encrypt historical reports.

Adım Adım Çözüm

1
Select AWS Secrets Manager to store and rotate the database credentials.
Database credentials are rotated automatically every 15 days using a built-in or custom Lambda function, ensuring security without manual script maintenance.
AWS Secrets Manager is specifically designed to store secrets and integrate with Amazon RDS and Aurora to handle automatic credential rotation natively.
2
Enable automatic key rotation on the AWS KMS customer managed key (CMK).
The CMK will have its backing key material automatically rotated once per year by AWS KMS, keeping the same key ARN.
Automatic key rotation eliminates the operational overhead of manually updating key ARNs in application code, IAM policies, and bucket policies.
3
Leave historical PDF reports in the S3 bucket as-is.
Historical PDF reports remain readable because AWS KMS preserves older key versions to decrypt data encrypted by those versions.
AWS KMS automatically manages the mapping between the encrypted ciphertext and the key version used to encrypt it, so no data re-encryption is required when automatic key rotation is enabled.

Anahtar Kavram

AWS KMS automatic key rotation retains older key versions to decrypt historical data without changing the key ARN, while AWS Secrets Manager manages DB credential rotation.
Soru 1393Soru →

An online multiplayer gaming company hosts its matchmaking and leaderboard platform in the us-east-1 Region. The backend application runs on Amazon EC2 instances behind an Application Load Balancer (ALB), and data is stored in an Amazon RDS for PostgreSQL database. The company wants to establish a disaster recovery (DR) plan in the us-west-2 Region. The solution must meet a 3030-minute Recovery Time Objective (RTO) and a 55-minute Recovery Point Objective (RPO) while minimizing ongoing infrastructure costs. Which strategy should a solutions architect recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Implement a Pilot Light recovery strategy in the us-west-2 Region. Set up Amazon RDS cross-region replication to continuously replicate database writes. Keep application servers stopped or deploy them dynamically via AWS CloudFormation and pre-configured Amazon Machine Images (AMIs) during a failover event.

Cevap

Implement a Pilot Light recovery strategy in the us-west-2 Region by setting up Amazon RDS cross-region replication to continuously replicate database writes, and keeping application servers stopped or deploying them dynamically via AWS CloudFormation and pre-configured AMIs during a failover event.
The correct strategy is the Pilot Light setup. This option meets the 55-minute RPO by continuously replicating the primary database to the disaster recovery region using Amazon RDS cross-region replication. It also meets the 3030-minute RTO because application servers can be started or provisioned from pre-configured AMIs and CloudFormation templates within that time frame. Because the application compute resources are kept shut down or unprovisioned until failover, ongoing operational costs are minimized.

Adım Adım Çözüm

1
Analyze the RTO and RPO requirements.
The target RTO is 3030 minutes (maximum acceptable downtime) and the target RPO is 55 minutes (maximum acceptable data loss).
This determines which DR strategy and replication technologies are viable.
2
Evaluate replication methods for the database to meet the 55-minute RPO constraint.
AWS Backup with daily backups fails the RPO. Amazon RDS cross-region read replicas continuously replicate data asynchronously, keeping data lag typically under a few minutes, which satisfies the 55-minute RPO.
Continuous database replication is required to avoid losing more than 55 minutes of data.
3
Select the most cost-effective compute deployment that satisfies the 3030-minute RTO.
A Pilot Light strategy allows compute resources (EC2 instances) to remain turned off or unprovisioned, and then started or created from AMIs within 3030 minutes. This is more cost-effective than Warm Standby, which keeps scaled-down instances running continuously.
Since the RTO is 3030 minutes, there is sufficient time to spin up instances dynamically, avoiding the cost of idle running instances.

Anahtar Kavram

Disaster Recovery strategies (Pilot Light vs. Warm Standby) and cross-region replication capabilities.
Soru 1394Soru →

An application deployed on Amazon EC2 instances in a private VPC subnet must upload large datasets to Amazon S3. The application must also connect to an external payment gateway API over the internet to process transactions. A solutions architect needs to design a secure and cost-effective network architecture that satisfies these requirements.

Which TWO configurations should the solutions architect implement? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a gateway VPC endpoint for Amazon S3 and associate it with the route table of the private subnet.; Deploy a NAT gateway in a public subnet, and configure the private subnet's route table to route outbound traffic destined for the internet (0.0.0.0/00.0.0.0/0) to the NAT gateway.

Cevap

Create a gateway VPC endpoint for Amazon S3 and associate it with the route table of the private subnet, and deploy a NAT gateway in a public subnet, configuring the private subnet's route table to route outbound internet traffic (0.0.0.0/00.0.0.0/0) to the NAT gateway.
Establishing a gateway VPC endpoint for Amazon S3 provides direct, private connectivity to S3 without traversing the public internet or incurring NAT Gateway data processing charges, making it highly secure and cost-effective. For the external payment gateway API, deploying a NAT gateway in a public subnet allows the private instances to safely route outbound internet traffic without exposing them to inbound connections.

Adım Adım Çözüm

1
Analyze the destinations required by the application.
The application needs access to Amazon S3 (an AWS service) and an external payment gateway (a public internet API).
Different network path options exist for AWS services versus public internet destinations.
2
Evaluate the most cost-effective and secure way to access Amazon S3.
Create a Gateway VPC Endpoint for Amazon S3, which routes traffic directly and privately to S3 without data processing costs.
A Gateway endpoint is free of charge and keeps traffic within the AWS network.
3
Evaluate the secure way to access the external payment gateway API.
Deploy a NAT Gateway in a public subnet and route outbound internet traffic (0.0.0.0/00.0.0.0/0) from the private subnet to it.
NAT Gateways allow private instances to initiate outbound connections to the internet while blocking inbound traffic from the internet.

Anahtar Kavram

Combining S3 Gateway Endpoints for internal AWS traffic and NAT Gateways for external internet egress to optimize VPC security and data transfer costs.
Tahmini Süre:2m 0s
Soru 1395Soru →

A security architect is designing a multi-account reporting pipeline. A business application running on Amazon EC2 instances in Account A must write encrypted transactional logs to an Amazon S3 bucket located in Account B. The database credentials used by the application must be rotated every 30 days, and under no circumstances should they be stored in plaintext. Furthermore, the encryption key used for S3 objects must be rotated automatically every year without requiring administrative overhead to re-encrypt existing objects or manually track key versions.

Which two actions should the solutions architect take to meet these security requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the database credentials in AWS Secrets Manager in Account A, configure automatic rotation every 30 days using an AWS Lambda function, and grant the EC2 instance role permissions to retrieve the secret.; Create a Customer Managed Key (CMK) in Account B, configure its key policy to allow the IAM role of the EC2 instances in Account A to perform kms:GenerateDataKey and kms:Decrypt operations, enable automatic key rotation, and write the logs using this CMK.

Cevap

Store the database credentials in AWS Secrets Manager with automatic 30-day rotation, and create a Customer Managed Key in Account B with a cross-account key policy allowing the Account A EC2 role access while enabling automatic annual key rotation.
Storing database credentials in AWS Secrets Manager and enabling automatic rotation every 30 days meets the credential security requirements. To secure S3 objects across accounts, using a Customer Managed Key in Account B with a key policy allowing the application's IAM role in Account A to use the key ensures the destination account retains ownership of the encrypted objects. Enabling automatic rotation on this CMK rotates the key material annually without needing to re-encrypt old objects, as AWS KMS retains previous key material for decryption.

Adım Adım Çözüm

1
Evaluate secret storage requirements.
Database credentials cannot be stored in plaintext. AWS Secrets Manager is selected because it encrypts secrets at rest and natively supports automatic rotation every 30 days via Lambda.
This meets the security requirement for rotating database credentials without storing them as plaintext parameters.
2
Determine key location for cross-account S3 writing.
The Customer Managed Key (CMK) must be created in Account B (the destination account) so that Account B retains ownership of the encrypted objects written by Account A.
Creating the key in Account B ensures the bucket owner can manage access to the encrypted data.
3
Configure the key policy for cross-account access.
The key policy in Account B must be updated to grant the IAM role of the EC2 instances in Account A permissions to perform 'kms:GenerateDataKey' and 'kms:Decrypt' operations.
This allows the application in Account A to perform envelope encryption on S3 uploads.
4
Address key rotation requirements.
Enable automatic key rotation on the CMK in Account B. AWS KMS rotates the backing key material every year and retains historical backing keys to decrypt older logs.
This satisfies the requirement to rotate keys annually without re-encrypting older data or incurring administrative overhead.

Anahtar Kavram

AWS KMS key rotation and cross-account key policies allow for seamless annual rotation of key material without re-encrypting historical data, while AWS Secrets Manager provides secure storage and rotation of credentials.
Tahmini Süre:3m 0s
Soru 1396Soru →

A company has on-premises servers that need to securely upload log files to an Amazon S3 bucket. The company's security policy strictly prohibits the storage or use of long-term AWS security credentials, such as IAM user access keys, on the on-premises servers. A solutions architect must design an authorization solution that enables these servers to dynamically request temporary AWS security credentials.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a trust anchor in AWS IAM Roles Anywhere by establishing trust with a supported private or public Certificate Authority (CA).; Install and configure the AWS IAM Roles Anywhere credential helper tool on the on-premises servers to retrieve credentials from AWS Security Token Service (STS).

Cevap

The solutions architect should create a trust anchor in AWS IAM Roles Anywhere by establishing trust with a supported Certificate Authority (CA), and install and configure the AWS IAM Roles Anywhere credential helper tool on the on-premises servers to retrieve credentials from AWS Security Token Service (STS).
To secure communications from on-premises workloads without managing long-term AWS credentials, AWS IAM Roles Anywhere is the recommended service. Implementing this requires creating a trust anchor in AWS IAM Roles Anywhere linked to a Certificate Authority (CA) and running the IAM Roles Anywhere credential helper on the server to handle certificate exchange for temporary security credentials.

Adım Adım Çözüm

1
Identify the service suited for assigning temporary AWS credentials to workloads running outside of AWS.
AWS IAM Roles Anywhere is identified as the correct service to establish trust and issue temporary credentials using X.509 digital certificates.
The security policy forbids long-term credentials, meaning standard IAM user access keys cannot be used on-premises.
2
Establish the root of trust on the AWS side.
Create a trust anchor in AWS IAM Roles Anywhere that points to the organization's existing Certificate Authority (CA) or AWS Private CA.
A trust anchor defines the CA that IAM Roles Anywhere trusts to sign client certificates presented by the servers.
3
Configure the client-side authentication on the on-premises servers.
Deploy the IAM Roles Anywhere credential helper on the servers to manage certificate-based requests to the AWS Security Token Service (STS) endpoint.
The credential helper integrates with the AWS CLI and SDKs, handling the signature generation and credential retrieval transparently without hardcoding keys.

Anahtar Kavram

AWS IAM Roles Anywhere allows workloads outside of AWS (like physical or virtual servers on-premises) to use X.509 certificates to obtain temporary AWS security credentials, removing the need to manage long-term IAM access keys.
Soru 1397Soru →

A food delivery platform is designing a resilient, event-driven system to process order status updates (such as 'Order Placed', 'Out for Delivery', and 'Delivered'). The order status updates for each individual order must be processed in the exact chronological sequence they occur to ensure the customer dashboard displays accurate updates. A marketing analytics service also needs to receive these updates to track daily delivery metrics, but ordering is not critical for this service. Which combination of actions should a solutions architect take to meet these requirements with the least operational overhead? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Amazon SNS FIFO topic to receive the updates, and use the order ID as the message group ID.; Create an Amazon SQS FIFO queue for the customer dashboard service, and subscribe it to the SNS FIFO topic.

Cevap

To decouple the systems and maintain chronological ordering, create an Amazon SNS FIFO topic using the order ID as the message group ID, and subscribe an Amazon SQS FIFO queue for the customer dashboard service to the SNS FIFO topic.
To satisfy the strict chronological ordering requirement with minimal operational overhead, the solution must implement FIFO messaging end-to-end. Creating an Amazon SNS FIFO topic and specifying the order ID as the message group ID ensures that events for a specific order are partitioned and ordered correctly. Subscribing an Amazon SQS FIFO queue to this SNS FIFO topic ensures that the customer dashboard service consumes these updates in order. The marketing analytics service (which does not require ordering) can also subscribe to the SNS FIFO topic using its own SQS FIFO queue, since SNS FIFO only supports SQS FIFO subscriptions.

Adım Adım Çözüm

1
Analyze the ordering requirement.
Order status updates for individual orders must be processed chronologically, requiring first-in, first-out (FIFO) delivery semantics.
Standard messaging services do not guarantee strict ordering, so FIFO-enabled services are required.
2
Select the appropriate fan-out and messaging decoupling components.
An Amazon SNS FIFO topic is selected for event fan-out, and an Amazon SQS FIFO queue is selected for the order-sensitive customer dashboard subscriber.
SNS FIFO topics support SQS FIFO queues as subscribers to guarantee end-to-end message ordering and deduplication.
3
Configure the message grouping strategy.
The order ID is specified as the message group ID for the SNS FIFO topic.
The message group ID determines the ordering scope, ensuring updates for the same order are processed sequentially without impacting other concurrent orders.

Anahtar Kavram

Preserving message ordering end-to-end in event-driven systems using Amazon SNS FIFO and Amazon SQS FIFO integration.
Soru 1398Soru →

A global smart home IoT provider receives telemetry data from millions of connected devices. The ingestion endpoint is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). Recently, the ingestion endpoint experienced a sudden influx of malicious Layer 4 TCP SYN flood attacks, along with a distributed Layer 7 HTTP POST flood attack that simulates device telemetry uploads. The provider needs a solution that automatically mitigates the infrastructure-layer attacks and allows them to rate-limit and filter the malicious HTTP POST requests. Which solution meets these requirements with the least administrative effort?

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer (ALB). Associate an AWS WAF Web ACL with the CloudFront distribution, and configure a rate-based rule targeting the HTTP POST telemetry endpoint.

Cevap

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer (ALB). Associate an AWS WAF Web ACL with the CloudFront distribution, and configure a rate-based rule targeting the HTTP POST telemetry endpoint.
The correct solution uses Amazon CloudFront to absorb Layer 3/4 TCP SYN flood attacks at the edge locations using AWS Shield Standard. It then attaches AWS WAF to the CloudFront distribution to inspect Layer 7 traffic and enforce rate-limiting rules on HTTP POST requests, protecting the origin ALB and EC2 instances from resource exhaustion.

Adım Adım Çözüm

1
Analyze the attack vectors targeting the IoT provider's endpoints.
Identified a Layer 4 TCP SYN flood (infrastructure layer) and a Layer 7 HTTP POST flood (application layer).
Different layers of the OSI model require different mitigation strategies under the AWS Shared Responsibility Model.
2
Address the Layer 4 infrastructure attacks at the network edge.
Place Amazon CloudFront in front of the Application Load Balancer (ALB) to leverage AWS Shield Standard.
CloudFront locations absorb Layer 3 and 4 attacks automatically, keeping the load from reaching the origin ALB.
3
Mitigate the Layer 7 HTTP POST flood attacks.
Associate AWS WAF with CloudFront and configure a rate-based rule targeting the POST endpoint.
AWS WAF inspects application-layer HTTP requests and applies rate-limiting rules to block IP addresses exceeding the defined threshold.

Anahtar Kavram

AWS Edge services (Amazon CloudFront and AWS Shield Standard) automatically mitigate Layer 3/4 infrastructure attacks, while AWS WAF provides Layer 7 application-layer filtering and rate-limiting.
Tahmini Süre:1m 30s
Soru 1399Soru →

A company is developing a new application that stores customer data in an Amazon S3 bucket. The security policy requires that all data stored in the S3 bucket must be encrypted at rest using server-side encryption with AWS Key Management Service (SSE-KMS) keys. Additionally, database credentials used by the application must be securely stored and automatically rotated every 30 days. Which TWO actions should a solutions architect take to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the Amazon S3 bucket to use server-side encryption with AWS Key Management Service (SSE-KMS) using a customer managed key.; Store the database credentials in AWS Secrets Manager and configure a rotation schedule.

Cevap

Configure the Amazon S3 bucket to use server-side encryption with AWS Key Management Service (SSE-KMS) using a customer managed key, and store the database credentials in AWS Secrets Manager with a rotation schedule configured.
The correct solution involves configuring S3 server-side encryption using a customer managed key (SSE-KMS) to protect stored files, and using AWS Secrets Manager to store database credentials securely with automatic rotation configured. These actions meet the encryption and automated credentials management requirements following AWS best practices.

Adım Adım Çözüm

1
Address S3 bucket encryption at rest.
Configure server-side encryption with AWS Key Management Service (SSE-KMS) on the S3 bucket using a customer managed key.
This satisfies the requirement to encrypt all stored data at rest using KMS keys while keeping control over the key policies.
2
Address database credential storage and rotation.
Store database credentials in AWS Secrets Manager and enable automatic rotation.
AWS Secrets Manager natively supports the secure storage of sensitive secrets and provides built-in rotation functionality for database credentials.

Anahtar Kavram

AWS KMS key management and secure secrets storage with automated rotation.
Tahmini Süre:1m 0s
Soru 1400Soru →

A global financial services company is deploying a real-time trading API on AWS. The API must be deployed across multiple AWS Regions to ensure low latency for users worldwide. The architecture uses Application Load Balancers (ALBs) in each Region to distribute traffic to Amazon EC2 instances. The company needs a secure edge routing solution that provides static IP addresses, routes traffic over the AWS global network, protects against Layer 3 and Layer 4 DDoS attacks, and mitigates Layer 7 HTTP flood attacks.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an accelerator using AWS Global Accelerator, register the Application Load Balancers in each Region as endpoints, and enable AWS Shield Advanced on the accelerator.; Associate an AWS WAF web ACL containing a rate-based rule with the Application Load Balancer in each Region.

Cevap

To meet the requirements, the solutions architect should create an accelerator using AWS Global Accelerator, register the Application Load Balancers in each Region as endpoints, enable AWS Shield Advanced on the accelerator, and associate an AWS WAF web ACL containing a rate-based rule with the Application Load Balancer in each Region.
The correct actions are to deploy AWS Global Accelerator with AWS Shield Advanced enabled and to associate AWS WAF web ACLs with the Application Load Balancers. AWS Global Accelerator provides static IP addresses and routes traffic over the AWS global network to endpoints (such as ALBs) in multiple Regions, and Shield Advanced can be applied to the accelerator to defend against Layer 3 and Layer 4 DDoS attacks. To protect against Layer 7 HTTP flood attacks, AWS WAF web ACLs with rate-based rules must be associated with the regional ALBs.

Adım Adım Çözüm

1
Identify the routing and network-layer protection requirements.
Determine that AWS Global Accelerator satisfies the requirement for multi-region routing with static IP addresses over the AWS global backbone. AWS Shield Advanced is then enabled on the accelerator to defend against Layer 3 and Layer 4 DDoS attacks.
This establishes a secure, low-latency entry point into the AWS network while protecting the infrastructure layer.
2
Identify the application-layer (Layer 7) protection requirements.
Determine that AWS WAF web ACLs with rate-based rules must be associated with the Application Load Balancers in each Region.
This inspects application traffic at the load balancing tier and mitigates HTTP flood attacks before they impact the backend EC2 instances.

Anahtar Kavram

Integrating AWS Global Accelerator, AWS Shield Advanced, and AWS WAF to secure multi-region web applications at both the infrastructure (Layer 3/4) and application (Layer 7) layers.
ÖncekiSayfa 70 / 74Sonraki