Tüm alıştırma soruları

1462 soru

Tüm türler1,462 Çoktan seçmeli739 Çoklu seçim723

A company is developing a new mobile application that allows users to upload profile pictures directly to an Amazon S3 bucket. The application developers need to establish a mechanism to authenticate users and authorize S3 write access without embedding long-term credentials in the mobile application package. Which solution meets these security requirements with the least administrative overhead?

Configure Amazon Cognito Identity Pools to authenticate users through public identity providers and exchange the identity tokens for temporary AWS credentials using an IAM role.

Generate AWS Account Root User access keys and embed them in the mobile application configuration file to sign all S3 API requests.

Create a dedicated IAM user for each mobile application user, generate long-term access keys, and distribute them to the mobile devices during registration.

Store a single administrative IAM user's credentials in AWS Systems Manager Parameter Store as a plaintext String parameter and configure the mobile app to fetch it via a public API.

Cevabı ve açıklamayı göster

Cevap: Configure Amazon Cognito Identity Pools to authenticate users through public identity providers and exchange the identity tokens for temporary AWS credentials using an IAM role.

Cevap

Configure Amazon Cognito Identity Pools to authenticate users through public identity providers and exchange the identity tokens for temporary AWS credentials using an IAM role.

The correct solution uses Amazon Cognito Identity Pools to exchange tokens from public identity providers for temporary, scoped AWS credentials. This approach allows the mobile application to upload profile pictures directly to S3 by assuming an IAM role with limited permissions, eliminating the need to distribute or store long-term keys on the devices.

Adım Adım Çözüm

Analyze the requirements for external mobile application users requesting write access to Amazon S3.

Identify that the solution must avoid using long-term credentials, scale dynamically for external users, and run with the least administrative overhead.

Storing static IAM credentials on untrusted client devices violates the principle of least privilege and introduces security risks.

Evaluate identity federation mechanisms to delegate access to AWS resources.

Determine that Amazon Cognito Identity Pools (Federated Identities) is the native AWS service built to authenticate external users and issue temporary AWS Security Token Service (STS) credentials.

This allows the application to assume a specific IAM role containing a policy that grants permission only to write to the S3 bucket.

Anahtar Kavram

Temporary Security Credentials and Mobile Client Identity Federation

Tahmini Süre:1m 30s

Soru 1402Soru →

A company stores database backups in an Amazon S3 bucket. The backups are encrypted at rest using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS). The company's security policy requires that the encryption keys be rotated annually. Which of the following actions should the solutions architect take to meet these requirements with the least operational overhead?

Enable automatic key rotation for the Customer Managed Key in AWS KMS, which automatically generates new key material annually while preserving the older key material for decryption.

Enable automatic key rotation for the Customer Managed Key in AWS KMS, and schedule an AWS Batch job to immediately decrypt and re-encrypt all existing database backups in the S3 bucket under the new key version.

Manually create a new Customer Managed Key each year, configure the S3 bucket default encryption to use the new key, and delete the previous key immediately to prevent unauthorized access.

Store the encryption key material as a plaintext string parameter in AWS Systems Manager Parameter Store, and configure an AWS Lambda function to update and rotate the parameter annually.

Cevabı ve açıklamayı göster

Cevap: Enable automatic key rotation for the Customer Managed Key in AWS KMS, which automatically generates new key material annually while preserving the older key material for decryption.

Cevap

Enable automatic key rotation for the Customer Managed Key in AWS KMS, which automatically generates new key material annually while preserving the older key material for decryption.

Enabling automatic key rotation on an AWS KMS Customer Managed Key (CMK) is the most operationally efficient method to meet annual rotation requirements. When enabled, AWS KMS automatically generates new key material for the CMK every year. It keeps all older versions of the key material active so that AWS KMS can decrypt any data previously encrypted with those versions. The key ID remains unchanged, meaning application code and S3 bucket configurations do not need to be updated.

Adım Adım Çözüm

Analyze the requirement for annual encryption key rotation with minimal operational overhead for S3 backups.

Identify that AWS KMS Customer Managed Keys support native, automated annual rotation.

Using native managed features minimizes operational overhead compared to manual key creation and rotation scripts.

Evaluate the behavior of AWS KMS key rotation concerning existing data decryption.

Recall that KMS preserves the older key material backing the same key ID to automatically decrypt older objects without requiring re-encryption.

This behavior eliminates the need to run data migration or re-encryption tasks on existing S3 backups.

Discard insecure options that store secrets in plaintext or delete key material needed for historical decryption.

Eliminate the options that advocate deleting old keys or storing secrets as plaintext parameters.

Deleting older key material causes data loss for older backups, and storing keys in plaintext violates basic AWS security best practices.

Anahtar Kavram

AWS KMS Automatic Key Rotation

Soru 1403Soru →

A media streaming platform serves static content and an interactive API via an Amazon CloudFront distribution. The API traffic is routed to an Application Load Balancer (ALB) acting as the origin. During a recent event, the platform experienced a massive distributed HTTP flood attack targeting the login endpoint (/login), which overwhelmed the backend EC2 instances. The security team needs a solution to automatically detect and block these application-layer attacks at the edge with minimal administrative overhead. Which solution meets these requirements?

Create an AWS WAF web ACL, define a rate-based rule that targets the /login path, and associate the web ACL with the CloudFront distribution.

Enable AWS Shield Standard to automatically detect and mitigate the application-layer HTTP flood attacks targeting the /login path.

Configure a stateless Network Access Control List (NACL) rule on the ALB's subnets to block the incoming traffic from the attacker IP addresses.

Configure the CloudFront cache behavior for the /login path with a Time to Live (TTL) of zero to block the unauthorized requests at the edge.

Cevabı ve açıklamayı göster

Cevap: Create an AWS WAF web ACL, define a rate-based rule that targets the /login path, and associate the web ACL with the CloudFront distribution.

Cevap

Create an AWS WAF web ACL, define a rate-based rule that targets the /login path, and associate the web ACL with the CloudFront distribution.

AWS WAF provides Layer 7 protection and allows you to create rate-based rules. When associated with an Amazon CloudFront distribution, AWS WAF inspects requests at the edge and automatically blocks IP addresses that exceed a defined threshold of requests within a rolling 5-minute window. This stops the HTTP flood from reaching the origin Application Load Balancer and the backend instances.

Adım Adım Çözüm

Analyze the attack type and target layer.

The attack is a distributed HTTP flood targeting a specific application path (/login), which is a Layer 7 (application-layer) attack.

Correct security tools must operate at the application layer to inspect URI paths and request rates.

Select the appropriate AWS security service for Layer 7 mitigation.

AWS WAF is chosen because it allows inspection of HTTP/HTTPS parameters and supports rate-limiting rules.

AWS Shield Standard is restricted to Layer 3/4 protection, and Network ACLs lack application-layer visibility and automated rate detection.

Deploy the protection at the edge to protect the origin.

Associate the AWS WAF web ACL with the Amazon CloudFront distribution.

Blocking malicious traffic at the edge prevents it from traversing the AWS network and consuming ALB and EC2 resources.

Anahtar Kavram

Mitigating Layer 7 HTTP flood attacks at the edge using AWS WAF rate-based rules associated with Amazon CloudFront.

Soru 1404Soru →

An organization is deploying an auditing application on Amazon ECS tasks running on AWS Fargate. The Fargate tasks are located in private subnets with a CIDR block of $172.16.10.0/24$ within a VPC. The tasks must access an Amazon Aurora PostgreSQL database in a dedicated database subnet with a CIDR block of $172.16.20.0/24$ , download compliance data securely from Amazon S3, and occasionally connect to an external auditing API hosted on the public internet.

To align with security policies:
1. Data transfers to Amazon S3 must remain within the AWS network and must not incur data processing charges.
2. Direct outbound internet access is prohibited; instead, internet traffic must go through NAT Gateways located in public subnets.
3. Network Access Control Lists (Network ACLs) on the Fargate private subnets must implement a least-privilege configuration.

Which combination of configurations will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Create an Amazon S3 Gateway VPC Endpoint and associate it with the Fargate private subnet route tables. Add a route for

0.0.0.0/0

pointing to the NAT Gateways in the public subnets.

In the Fargate subnet Network ACL, configure an outbound rule allowing traffic to

0.0.0.0/0

on TCP port

443

, and an inbound rule allowing traffic from

0.0.0.0/0

on TCP ports

1024-65535

Create an Amazon S3 Interface VPC Endpoint in the Fargate subnets, and configure the Fargate subnet route table to target the endpoint's elastic network interfaces for all S3 traffic.

In the Fargate subnet Network ACL, configure an outbound rule allowing TCP port

443

with a destination of the Amazon S3 prefix list.

In the Fargate Security Group, configure an inbound rule allowing TCP port

443

from the NAT Gateway public IP addresses to permit return traffic from the external compliance API.

Cevabı ve açıklamayı göster

Cevap: Create an Amazon S3 Gateway VPC Endpoint and associate it with the Fargate private subnet route tables. Add a route for $0.0.0.0/0$ pointing to the NAT Gateways in the public subnets.; In the Fargate subnet Network ACL, configure an outbound rule allowing traffic to $0.0.0.0/0$ on TCP port $443$ , and an inbound rule allowing traffic from $0.0.0.0/0$ on TCP ports $1024-65535$ .

Cevap

To meet the requirements, the solutions architect should create an Amazon S3 Gateway VPC Endpoint and associate it with the Fargate private subnet route tables, routing other internet traffic to the NAT Gateways. Additionally, the Fargate subnet Network ACL must be configured to allow outbound traffic to all destinations on TCP port

443

and inbound return traffic from all destinations on TCP ports

1024-65535

Creating a Gateway VPC Endpoint for S3 and associating it with the Fargate private subnet route tables ensures that S3 data transfer is routed within the AWS network without incurring data processing fees. The route table also successfully routes all other external internet traffic to the NAT Gateways via the default route. Because Network ACLs are stateless, they require both an outbound rule (allowing HTTPS traffic on port

443

to establish the connection) and an inbound rule (allowing response traffic on ephemeral ports

1024-65535

from the destination) to work correctly.

Adım Adım Çözüm

Select the correct endpoint type for Amazon S3.

Identify that Gateway VPC Endpoints are free of data processing charges, whereas Interface VPC Endpoints (PrivateLink) incur both hourly and data processing charges.

This fulfills the cost requirement that S3 transfers must not incur data processing charges.

Configure the route table for the Fargate subnets.

Associate the Gateway VPC Endpoint with the private subnet route tables (which adds the S3 prefix list route) and configure a default route (

0.0.0.0/0

) pointing to the NAT Gateways in the public subnets.

This establishes path-routing for S3 traffic directly to the endpoint and external internet traffic to the NAT Gateways.

Design stateless Network ACL rules for Fargate tasks.

Allow outbound HTTPS traffic (port

443

) to

0.0.0.0/0

to cover both S3 and the external compliance API, and allow inbound traffic from

0.0.0.0/0

on ephemeral ports (

1024-65535

) to allow return packets.

Because Network ACLs are stateless, return traffic must be explicitly allowed. Since S3 and the external API use public IP addresses,

0.0.0.0/0

must be used (especially because Network ACLs do not support prefix lists).

Anahtar Kavram

VPC Network Security using NAT Gateways, Gateway VPC Endpoints, stateful Security Groups, and stateless Network ACLs.

Soru 1405Soru →

An enterprise has migrated its identity management to an external SAML-based identity provider (IdP). The security team wants to implement a dynamic access control mechanism for developers who access AWS resources through federated roles. Developers should only be allowed to manage (start, stop, and terminate) Amazon EC2 instances that are tagged with a `Project` tag value matching their department's project assignment in the IdP. The solution must scale automatically without requiring IAM policy updates when new projects are created.

Which TWO actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure AWS IAM Identity Center to map the project attribute from the identity provider as a principal tag in the AWS federated session.

Attach an IAM policy to the developers' permission set that allows EC2 actions only when the `aws:ResourceTag/Project` condition key matches the `aws:PrincipalTag/Project` key.

Create individual IAM users for each developer, organize them into IAM groups named after each project, and attach inline policies to each group restricting access to specific EC2 instance IDs.

Store project tag mappings and developer usernames as plaintext in Systems Manager Parameter Store, and configure a cron job to update IAM group memberships accordingly.

Use the AWS account root user credentials to run a scheduled Lambda function that periodically checks if EC2 instances have the correct project tags and deletes non-compliant resources.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center to map the project attribute from the identity provider as a principal tag in the AWS federated session.; Attach an IAM policy to the developers' permission set that allows EC2 actions only when the `aws:ResourceTag/Project` condition key matches the `aws:PrincipalTag/Project` key.

Cevap

Configure AWS IAM Identity Center to map the project attribute from the identity provider as a principal tag, and attach an IAM policy that allows EC2 actions only when the `aws:ResourceTag/Project` key matches the `aws:PrincipalTag/Project` key.

Mapping the project attribute to a principal tag via IAM Identity Center enables Attribute-Based Access Control (ABAC). When combined with an IAM policy that requires the instance's `Project` tag to match the user's principal tag, access is granted dynamically. This eliminates the need to update policies for new projects.

Adım Adım Çözüm

Enable attribute mapping in AWS IAM Identity Center.

User attributes from the SAML IdP are mapped to AWS session tags (principal tags), making them available in the AWS authorization context.

This establishes the identity attribute (project assignment) on the federated user session dynamically.

Create an Attribute-Based Access Control (ABAC) IAM policy.

An IAM policy is created using the condition key `aws:ResourceTag/Project` compared with `${aws:PrincipalTag/Project}`.

This enforces that a user can only perform actions on resources that share the same project value as their identity.

Attach the ABAC policy to the permission set assigned to the developers.

Developers receive dynamic permissions based on their IdP attributes when federating into the AWS console or CLI.

This ensures the security policy is applied to all developer federated sessions without manually updating policies for new projects.

Anahtar Kavram

Attribute-Based Access Control (ABAC) and Identity Federation with IAM Identity Center

Tahmini Süre:2m 0s

Soru 1406Soru →

An application running on Amazon EC2 instances in Account A ( $111122223333$ ) must write daily transaction records to an Amazon S3 bucket located in Account B ( $444455556666$ ). The security policy mandates that all data in the S3 bucket must be encrypted at rest using a Customer Managed Key (CMK) stored in Account B's AWS Key Management Service (AWS KMS). The company requires that cross-account access is configured using the principle of least privilege. Which combination of actions must the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure the key policy of the Customer Managed Key in Account B to grant the EC2 IAM role in Account A permissions for the kms:GenerateDataKey and kms:Decrypt actions.

Attach an IAM policy to the EC2 role in Account A that allows the s3:PutObject action on the S3 bucket in Account B and the kms:GenerateDataKey action on the KMS key in Account B.

Enable automatic key rotation on the KMS key in Account B, which will automatically re-encrypt all previously uploaded historical transaction records in the S3 bucket with the new key version.

Store the database credentials and the KMS key ARN as a plaintext String parameter in AWS Systems Manager Parameter Store in Account A to allow the application to retrieve them programmatically.

Configure the S3 bucket policy in Account B to allow the root account of Account A full access, and use the default AWS managed key aws/s3 in Account B for the cross-account encryption.

Cevabı ve açıklamayı göster

Cevap: Configure the key policy of the Customer Managed Key in Account B to grant the EC2 IAM role in Account A permissions for the kms:GenerateDataKey and kms:Decrypt actions.; Attach an IAM policy to the EC2 role in Account A that allows the s3:PutObject action on the S3 bucket in Account B and the kms:GenerateDataKey action on the KMS key in Account B.

Cevap

To configure secure cross-account S3 uploads with KMS encryption, the solutions architect must configure the Customer Managed Key's policy in Account B to grant access to the EC2 IAM role in Account A, and attach an IAM policy to the EC2 IAM role in Account A that permits writing to the bucket and generating data keys using the cross-account KMS key.

The correct combination of actions consists of configuring the key policy in Account B to grant key usage permissions to the external IAM role in Account A, and attaching an IAM policy to the EC2 IAM role in Account A to authorize access to both the target S3 bucket and the KMS key. Because AWS managed keys cannot be edited, a Customer Managed Key (CMK) must be used. Additionally, for cross-account resource access, both the resource-based policy (the KMS key policy in Account B) and the identity-based policy (the IAM policy in Account A) must explicitly permit the operations.

Adım Adım Çözüm

Analyze the requirements for cross-account KMS and S3 permissions.

Identify that for Account A's IAM role to write to Account B's KMS-encrypted S3 bucket, permissions must be granted on both the KMS key policy (in Account B) and the IAM policy (in Account A).

In AWS, cross-account access requires explicit permission from both the resource owner (via resource-based policies) and the trust delegation from the principal's account (via identity-based policies).

Determine the specific KMS permissions required for writing encrypted data to S3.

The IAM role needs kms:GenerateDataKey to generate the encryption key for new objects and kms:Decrypt for multipart uploads or reading.

Amazon S3 uses envelope encryption via KMS where the uploader needs permissions to generate the data key from the master key.

Configure the identity-based policy in Account A.

Attach an IAM policy to the EC2 role allowing s3:PutObject on the S3 bucket in Account B and kms:GenerateDataKey on the KMS key in Account B.

The EC2 role needs local IAM permission to target the external resources in Account B.

Anahtar Kavram

Cross-account access to KMS-encrypted S3 buckets requires resource policies on the destination side (S3 bucket policy and KMS key policy) to trust the source principal, and an identity-based IAM policy on the source side to authorize the actions.

Soru 1407Soru →

A flight booking aggregator application hosts its primary infrastructure in the us-east-1 Region. The architecture consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer, and a Multi-AZ Amazon RDS for MySQL database. The company needs to design a cross-region disaster recovery (DR) plan to a secondary AWS region. The DR solution must achieve a Recovery Time Objective (RTO) of $4$ hours and a Recovery Point Objective (RPO) of $15$ minutes while minimizing ongoing infrastructure running costs. Which solution meets these requirements?

Configure the RDS database with Multi-AZ deployment and use an Auto Scaling group across multiple Availability Zones in the primary region. Configure Amazon Route 53 latency routing to automatically direct traffic.

Configure a cross-region read replica of the RDS database in the secondary region. Store pre-baked AMIs of the EC2 instances in both regions. In the event of a disaster, promote the read replica to a standalone database and launch the EC2 instances in the secondary region using the AMIs.

Export database backups every

15

minutes to Amazon S3 Glacier Flexible Retrieval and configure S3 Cross-Region Replication to copy the backups to the secondary region. In the event of a disaster, retrieve the backups from Glacier to restore the database and launch the EC2 instances.

Deploy a scaled-down active version of the application stack, including a running, smaller RDS database instance and an active EC2 instance in the secondary region, and scale up the environment during a failover event.

Cevabı ve açıklamayı göster

Cevap: Configure a cross-region read replica of the RDS database in the secondary region. Store pre-baked AMIs of the EC2 instances in both regions. In the event of a disaster, promote the read replica to a standalone database and launch the EC2 instances in the secondary region using the AMIs.

Cevap

The correct solution configures a cross-region read replica of the RDS database to meet the RPO and stores pre-baked AMIs to launch EC2 instances in the secondary region during a disaster to meet the RTO while minimizing ongoing costs.

The correct solution uses a Pilot Light disaster recovery strategy. Creating a cross-region read replica of the Amazon RDS database ensures that data is continuously replicated asynchronously to the secondary region, which achieves a Recovery Point Objective (RPO) of minutes, well within the

15

-minute limit. Storing pre-baked AMIs of the EC2 instances allows them to be launched quickly during a failover event, which easily meets the Recovery Time Objective (RTO) of

4

hours. Because the EC2 instances are not running in the secondary region until a disaster occurs, this approach minimizes ongoing infrastructure running costs.

Adım Adım Çözüm

Analyze the disaster recovery constraints: RTO must be under

4

hours, RPO must be under

15

minutes, and ongoing running costs must be minimized.

The RPO constraint requires a data replication mechanism that lag is less than

15

minutes. The RTO constraint allows up to

4

hours to bring the system online. Cost minimization suggests keeping compute resources offline (Pilot Light) rather than scaled down and active (Warm Standby).

Identifying the target recovery objectives determines the boundary between acceptable DR strategies (Backup & Restore, Pilot Light, Warm Standby, Active-Active).

Evaluate database replication options for Amazon RDS for MySQL.

A cross-region read replica replicates data asynchronously, typically within seconds or minutes, satisfying the

15

-minute RPO. Restoring from S3 Glacier backups fails the RTO due to retrieval times.

Ensuring the selected replication technology satisfies the RPO requirement.

Evaluate the compute environment configuration for the recovery region.

Storing pre-baked AMIs and launching EC2 instances in the recovery region only when a disaster occurs keeps ongoing compute costs at zero, meeting the cost optimization goal while easily completing the failover within

4

hours.

Selecting the most cost-efficient compute strategy that still satisfies the recovery timeline.

Anahtar Kavram

AWS Disaster Recovery Strategies: Pilot Light vs. Warm Standby

Soru 1408Soru →

A global food delivery marketplace hosts its customer-facing application on AWS. The architecture uses an Amazon CloudFront distribution to serve static and dynamic content, which is backed by an Application Load Balancer (ALB) and Amazon EC2 instances in an Auto Scaling group. The company needs to protect the application from Layer 3 and Layer 4 Distributed Denial of Service (DDoS) attacks and mitigate application-layer (Layer 7) HTTP flood attacks that target the API endpoints. Which combination of actions will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Associate an AWS WAF web ACL with the Amazon CloudFront distribution and configure a rate-based rule to limit requests from individual client IP addresses.

Enable AWS Shield Advanced on the Amazon CloudFront distribution to protect against Layer 3 and Layer 4 infrastructure-level attacks.

Configure custom rate-limiting rules within AWS Shield Standard to inspect incoming request headers and block HTTP flood attacks.

Deploy a stateless Network Access Control List (Network ACL) on the subnets containing the Application Load Balancer to dynamically inspect and block malicious Layer 7 HTTP request headers.

Attach a stateful security group to the Amazon CloudFront distribution that blocks all traffic except from known malicious IP addresses.

Cevabı ve açıklamayı göster

Cevap: Associate an AWS WAF web ACL with the Amazon CloudFront distribution and configure a rate-based rule to limit requests from individual client IP addresses.; Enable AWS Shield Advanced on the Amazon CloudFront distribution to protect against Layer 3 and Layer 4 infrastructure-level attacks.

Cevap

Associate an AWS WAF web ACL with the Amazon CloudFront distribution and configure a rate-based rule to limit requests from individual client IP addresses, and enable AWS Shield Advanced on the Amazon CloudFront distribution to protect against Layer 3 and Layer 4 infrastructure-level attacks.

The solution requires protecting the application at both the infrastructure (Layer 3/4) and application (Layer 7) levels. Associating an AWS WAF web ACL with the Amazon CloudFront distribution and configuring a rate-based rule successfully mitigates HTTP floods by counting requests from specific client IP addresses and blocking them if they exceed limits. Enabling AWS Shield Advanced on the CloudFront distribution provides specialized protection against infrastructure-level (Layer 3 and 4) DDoS attacks at the AWS edge.

Adım Adım Çözüm

Analyze the threat types and required defense layers.

Identified Layer 3/4 infrastructure DDoS threats and Layer 7 application-level HTTP flood threats targeting dynamic APIs.

This determines which security services are appropriate for each threat vector.

Select the edge services designed for application-layer (Layer 7) filtering and rate limiting.

Selected AWS WAF associated with CloudFront to enforce rate-limiting rules.

AWS WAF is designed to inspect Layer 7 traffic and enforce rate limits, whereas lower-layer tools cannot parse HTTP headers or track request rates.

Select the service for Layer 3/4 infrastructure-level DDoS mitigation.

Selected AWS Shield Advanced on the CloudFront distribution.

AWS Shield Advanced offers robust Layer 3/4 protection at the AWS edge network (CloudFront) and provides advanced mitigation capabilities.

Anahtar Kavram

AWS edge security architecture relies on combining AWS WAF for application-layer filtering/rate-limiting and AWS Shield Advanced for comprehensive infrastructure DDoS protection.

Tahmini Süre:2m 0s

Soru 1409Soru →

A startup is deploying a new application that integrates with a third-party payment provider. The application needs to retrieve a payment gateway API key. The startup's security policy requires the API key to be encrypted at rest, and all decryption events must be audited. Which solution meets these requirements securely?

Store the API key as a SecureString parameter in AWS Systems Manager Parameter Store, using a Customer Managed Key in AWS Key Management Service (AWS KMS).

Store the API key as a plain text String parameter in AWS Systems Manager Parameter Store, and restrict access using IAM policies.

Store the API key on the application's root EBS volume, using the AWS account root user credentials to encrypt the volume.

Store the API key in an Amazon S3 bucket using default encryption with a KMS Customer Managed Key, and rely on automatic key rotation to immediately re-encrypt the stored files.

Cevabı ve açıklamayı göster

Cevap: Store the API key as a SecureString parameter in AWS Systems Manager Parameter Store, using a Customer Managed Key in AWS Key Management Service (AWS KMS).

Cevap

Store the API key as a SecureString parameter in AWS Systems Manager Parameter Store, using a Customer Managed Key in AWS Key Management Service (AWS KMS).

Storing the API key as a SecureString parameter in AWS Systems Manager Parameter Store ensures that the data is encrypted at rest using AWS KMS. In addition, AWS KMS logs all decryption requests to AWS CloudTrail, satisfying the auditing requirement.

Adım Adım Çözüm

Determine the storage service that supports encryption of sensitive variables.

AWS Systems Manager Parameter Store with the SecureString parameter type is selected because it integrates with AWS KMS for encryption.

This meets the requirement of encrypting the sensitive API key at rest.

Configure encryption with a Customer Managed Key (CMK) in AWS KMS.

The API key is encrypted using the CMK, and access permissions are managed via key policies and IAM.

Using a CMK allows fine-grained access control and key rotation management.

Verify that auditing requirements are met.

AWS KMS logs all key usage, including Decrypt API calls, to AWS CloudTrail.

This provides a complete audit trail of when and by whom the API key was decrypted.

Anahtar Kavram

Storing sensitive information securely using Systems Manager Parameter Store SecureString parameters and KMS encryption with auditing.

Soru 1410Soru →

A company stores financial records in an Amazon S3 bucket. The records are encrypted using an AWS KMS Customer Managed Key (CMK). Compliance guidelines require the company to rotate the encryption key annually. Furthermore, to adhere to a security policy regarding legacy key retirement, any data encrypted with a retired key version must be re-encrypted using the new key version within 30 days of rotation, allowing the old key version to be safely disabled. Which strategy should the solutions architect recommend to satisfy these requirements?

Enable automatic key rotation for the existing Customer Managed Key. Once rotated, initiate a re-encryption job by specifying the newly generated backing key version ID in the KMS API calls for all historical S3 objects.

Store the database encryption key in AWS Systems Manager Parameter Store as a plaintext String parameter. Configure a scheduled AWS Lambda function to rotate this key parameter annually and use the plaintext parameter to re-encrypt the S3 objects.

Create a new Customer Managed Key (CMK) annually, update the S3 bucket default encryption settings to use the new CMK, and use Amazon S3 Batch Operations to copy the existing objects in place to re-encrypt them with the new key. Disable the old CMK after 30 days.

Enable automatic key rotation for the existing Customer Managed Key. AWS KMS will automatically re-encrypt all historical S3 objects with the new backing key version, allowing the old backing key version to be safely deleted after 30 days.

Cevabı ve açıklamayı göster

Cevap: Create a new Customer Managed Key (CMK) annually, update the S3 bucket default encryption settings to use the new CMK, and use Amazon S3 Batch Operations to copy the existing objects in place to re-encrypt them with the new key. Disable the old CMK after 30 days.

Cevap

The correct strategy requires manual key rotation (creating a new Customer Managed Key) because automatic KMS key rotation keeps old backing keys active to decrypt existing ciphertexts, making it impossible to disable or retire the old version. By creating a new CMK and updating S3 default encryption, new objects are secured with the new key. Running Amazon S3 Batch Operations with a copy job in-place re-encrypts historical objects under the new key, which permits safely disabling the legacy key after the 30-day period.

Adım Adım Çözüm

Differentiate key rotation behaviors

Automatic rotation keeps older backing keys active for decryption, which prevents deletion or disabling of old versions. Manual rotation is needed.

The scenario requires retiring and disabling the old key version within 30 days, which cannot be achieved if the old version must remain active transparently for decryption under the same key ARN.

Plan rotation and configure new key defaults

Create a new Customer Managed Key (CMK) annually and update the Amazon S3 bucket default encryption settings.

This ensures that all new write operations to the S3 bucket automatically use the new CMK.

Address historical objects

Run an Amazon S3 Batch Operations copy job on the existing objects in the bucket.

S3 Batch Operations copy jobs can copy objects in-place, triggering S3 to encrypt them with the new default KMS key, thereby performing the necessary re-encryption.

Retire the legacy key

Disable the old Customer Managed Key after 30 days.

Once all historical objects are re-encrypted with the new key, the old key is no longer needed for decryption and can be safely disabled to satisfy the compliance requirement.

Anahtar Kavram

Manual KMS key rotation vs. automatic rotation and bulk object re-encryption via S3 Batch Operations

Tahmini Süre:2m 0s

Soru 1411Soru →

A company is developing a serverless application that processes highly sensitive client records stored in an Amazon S3 bucket. The records must be encrypted at rest using an AWS KMS customer managed key. The company's compliance policy requires that the encryption key be rotated every 90 days. Additionally, legacy records encrypted with older versions of the key must remain accessible for read operations without manual administrative intervention. The security team also requires that access to the KMS key be restricted using the principle of least privilege, ensuring that even the AWS account root user cannot access the key unless explicitly permitted.

Which two actions should a solutions architect take to meet these requirements?

Geçerli olan tümünü seçin

Enable automatic key rotation on the customer managed key and configure the rotation period to 90 days.

Create a new customer managed key every 90 days, update the S3 bucket configuration to use the new key, and run an S3 Batch Operations job to re-encrypt all historical records.

Modify the KMS key policy to remove the default policy statement that grants the AWS account root user access to the key, and explicitly list the authorized IAM roles.

Enable automatic key rotation on the customer managed key, and configure a Lambda function to decrypt and re-encrypt all existing S3 objects under the new key version immediately after rotation.

Store the KMS key credentials as a plaintext String parameter in AWS Systems Manager Parameter Store to allow administrative access while bypassing the key policy.

Cevabı ve açıklamayı göster

Cevap: Enable automatic key rotation on the customer managed key and configure the rotation period to 90 days.; Modify the KMS key policy to remove the default policy statement that grants the AWS account root user access to the key, and explicitly list the authorized IAM roles.

Cevap

Enable automatic key rotation on the customer managed key with a 90-day rotation period, and modify the KMS key policy to remove the default statement that delegates access to the account root user while explicitly defining authorized IAM roles.

Enabling automatic key rotation with a 90-day period meets the compliance timeline while keeping older key material available for automatic decryption. Removing the default root statement from the KMS key policy ensures that access is governed strictly by the key policy itself and cannot be bypassed via IAM policies.

Adım Adım Çözüm

Configure the rotation parameters of the AWS KMS customer managed key.

Enable automatic key rotation and customize the rotation period to 90 days.

This satisfies the 90-day rotation compliance rule. AWS KMS keeps all historical key versions, so S3 can automatically decrypt older objects without administrative effort.

Analyze the default KMS key policy structure.

Identify the default statement that grants root account permissions (arn:aws:iam::account-id:root).

By default, KMS keys delegate access control to the account's IAM policies through this root statement.

Modify the key policy to implement least privilege.

Remove the default root user permission statement and define explicit IAM roles that are allowed to perform decryption and encryption operations.

Removing the default statement ensures that IAM policies alone cannot grant access to the KMS key, thereby preventing the root user or unauthorized administrators from using the key unless explicitly permitted by the key policy.

Anahtar Kavram

AWS KMS Key Policies and Automatic Rotation Mechanics

Soru 1412Soru →

An enterprise project management SaaS platform hosts its application on AWS. The frontend is served via an Amazon S3 bucket behind an Amazon CloudFront distribution, and the backend APIs run on Amazon EC2 instances behind an Application Load Balancer (ALB). The platform recently suffered from a HTTP flood attack targeting the backend APIs, which degraded performance for users, as well as a series of SQL injection attempts.

The solutions architect must design a secure architecture that provides comprehensive DDoS protection and mitigates application-layer exploits. The solution must minimize origin exposure and block unauthorized HTTP traffic before it reaches the backend.

Which combination of actions should the solutions architect take? (Select TWO.)

Geçerli olan tümünü seçin

Associate an AWS WAF web ACL with the Amazon CloudFront distribution, and configure a rate-based rule along with AWS Managed Rules for SQL injection.

Configure the Application Load Balancer's security group to only accept inbound traffic from the Amazon CloudFront distribution using the CloudFront managed prefix list.

Enable AWS Shield Advanced on the Application Load Balancer to inspect and block application-layer SQL injection attempts before they reach the backend EC2 instances.

Apply a stateful Network ACL to the subnets of the Application Load Balancer to restrict inbound traffic to the IP address ranges of the Amazon CloudFront distribution.

Configure a rate-limiting rule within AWS Shield Standard to automatically drop traffic from IP addresses that exceed request thresholds.

Cevabı ve açıklamayı göster

Cevap: Associate an AWS WAF web ACL with the Amazon CloudFront distribution, and configure a rate-based rule along with AWS Managed Rules for SQL injection.; Configure the Application Load Balancer's security group to only accept inbound traffic from the Amazon CloudFront distribution using the CloudFront managed prefix list.

Cevap

Associate an AWS WAF web ACL with the Amazon CloudFront distribution, and configure the Application Load Balancer's security group to only accept inbound traffic from the CloudFront managed prefix list.

Associating an AWS WAF web ACL with the Amazon CloudFront distribution provides application-layer protection directly at the edge, allowing the system to inspect and filter out HTTP floods and SQL injection attempts before they reach the backend. Combining this with an Application Load Balancer security group configured to only accept traffic from the CloudFront managed prefix list prevents users from bypassing CloudFront to access the origin directly.

Adım Adım Çözüm

Analyze the security requirements for the application.

The application requires protection against Layer 7 exploits (SQL injection), HTTP flood attacks (Layer 7 DDoS), and origin protection (minimizing direct exposure of the Application Load Balancer).

This establishes the scope of security controls needed at the edge and resource level.

Select the appropriate service for Layer 7 mitigation.

AWS WAF associated with Amazon CloudFront provides rate limiting to block HTTP floods and managed rule sets to block SQL injection at the edge.

AWS WAF is designed for application-layer (Layer 7) filtering and protection, whereas AWS Shield Standard/Advanced primarily protects Layers 3 and 4.

Restrict access to the Application Load Balancer.

Configure the security group of the ALB to permit traffic only from the Amazon CloudFront distribution by referencing the CloudFront managed prefix list.

This prevents attackers from bypassing the CloudFront distribution and AWS WAF to hit the origin directly, while leveraging stateful security groups.

Anahtar Kavram

Mitigating web application-layer attacks (Layer 7) using AWS WAF on CloudFront and securing origin resources using security groups with managed prefix lists.

Soru 1413Soru →

A company is designing the security architecture for a new financial application. The application stores sensitive transaction records in an Amazon S3 bucket and connects to an Amazon RDS database. The company's compliance policy mandates the following security controls:
1. The database credentials must be rotated automatically every 30 days.
2. The S3 bucket objects must be encrypted at rest using a KMS Customer Managed Key (CMK) that is rotated annually.
3. Historical S3 objects must remain decryptable without manual intervention or data re-encryption.

Which combination of configurations will meet these security requirements with the least operational overhead?

Store the database credentials in AWS Secrets Manager and configure automatic rotation. For the S3 bucket, configure default encryption using a Customer Managed Key (CMK) and enable automatic key rotation.

Store the database credentials as a standard String parameter in AWS Systems Manager Parameter Store. For the S3 bucket, configure default encryption using a Customer Managed Key (CMK) and enable automatic key rotation.

Store the database credentials in AWS Secrets Manager and configure automatic rotation. For the S3 bucket, configure default encryption using a Customer Managed Key (CMK), manually rotate the key annually by creating a new CMK, and delete the previous CMK.

Store the database credentials in AWS Secrets Manager. Use the AWS account root user credentials to configure a custom script that rotates the database credentials. For the S3 bucket, configure default encryption using the AWS managed key (aws/s3) and enable automatic key rotation.

Cevabı ve açıklamayı göster

Cevap: Store the database credentials in AWS Secrets Manager and configure automatic rotation. For the S3 bucket, configure default encryption using a Customer Managed Key (CMK) and enable automatic key rotation.

Cevap

The correct solution stores the database credentials in AWS Secrets Manager, which natively manages automatic rotation. For S3, utilizing an AWS KMS Customer Managed Key (CMK) with automatic rotation enabled satisfies the annual rotation requirement. When automatic key rotation is enabled, AWS KMS rotates the backing key material annually while keeping the same key ARN. Crucially, AWS KMS retains older backing key material to decrypt historical objects, ensuring that older files remain decryptable without manual intervention or data re-encryption.

Adım Adım Çözüm

Evaluate database credentials security and rotation requirements.

AWS Secrets Manager is chosen to store the database credentials, enabling native automatic rotation (e.g., every 30 days) using an integrated AWS Lambda function.

This meets the automatic credential rotation requirement securely and with low operational overhead compared to custom scripts or plaintext parameters.

Select the encryption method and key management approach for the Amazon S3 bucket.

Configure default S3 bucket encryption using an AWS KMS Customer Managed Key (CMK) and enable automatic key rotation.

Automatic key rotation satisfies the annual rotation mandate. It maintains the same key ARN and key policies, while AWS KMS automatically retains old key material to decrypt historical S3 objects without manual intervention.

Avoid security practices that violate least privilege or compromise key recoverability.

Ensure that the root user is not used for configuration scripts, and that manual key deletion is avoided to prevent permanent loss of decryption capabilities for historical data.

This guarantees compliance with AWS security best practices and the requirement to keep historical backups readable.

Anahtar Kavram

AWS KMS Customer Managed Key automatic rotation mechanics and AWS Secrets Manager integration for database credentials rotation.

Soru 1414Soru →

A SaaS company hosts an online learning platform on AWS. The application uses Amazon EC2 instances behind an Application Load Balancer (ALB). During peak registration periods, the platform experiences HTTP flood attacks targeting the user login URI, which causes application downtime. The company wants to implement a scalable, cost-effective solution to mitigate these Layer 7 attacks without impacting legitimate users. Which two actions should the solutions architect take to meet these requirements? (Select TWO).

Geçerli olan tümünü seçin

Configure an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL with the CloudFront distribution.

Create an AWS WAF rate-based rule targeting the login URI to block requests from clients exceeding a request threshold.

Associate an AWS Shield Standard subscription with the Application Load Balancer to automatically mitigate application-layer (Layer 7) HTTP flood attacks.

Configure a stateless Network Access Control List (NACL) at the subnet level to dynamically filter and inspect the payloads of incoming HTTP requests.

Add rules to the Application Load Balancer's security group to track client connection rates and drop traffic from offending IP addresses.

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL with the CloudFront distribution.; Create an AWS WAF rate-based rule targeting the login URI to block requests from clients exceeding a request threshold.

Cevap

To protect the application from Layer 7 HTTP flood attacks targeting a specific login URI, the solutions architect should deploy Amazon CloudFront in front of the Application Load Balancer and associate an AWS WAF web ACL. Within the web ACL, a rate-based rule should be configured targeting the specific login URI path to limit the rate of requests from any single IP address.

Deploying Amazon CloudFront in front of the Application Load Balancer allows traffic to be distributed across AWS edge locations. By attaching AWS WAF to the CloudFront distribution, requests are inspected before they reach the ALB origin. Designing a rate-based rule within AWS WAF that targets the login path allows the system to block traffic from IP addresses that exceed a specified threshold of requests within a five-minute window, effectively mitigating the HTTP flood.

Adım Adım Çözüm

Deploy edge protection by placing Amazon CloudFront in front of the Application Load Balancer.

This distributes incoming traffic across edge locations and absorbs bulk traffic at the AWS perimeter.

DDoS protection should be handled as close to the user as possible to avoid overloading origin resources.

Associate AWS WAF with the CloudFront distribution.

Enables Layer 7 application-layer inspection and security rule enforcement at AWS edge locations.

HTTP flood attacks operate at Layer 7, requiring AWS WAF to inspect specific HTTP headers, methods, and paths.

Create a rate-based rule in AWS WAF targeting the login URI.

Monitors the frequency of incoming requests to the login endpoint and blocks or challenges clients exceeding the threshold.

This mitigates the attack at the targeted endpoint while allowing legitimate traffic to other parts of the application.

Anahtar Kavram

Implementing Layer 7 DDoS mitigation at the edge using Amazon CloudFront and AWS WAF rate-based rules.

Tahmini Süre:2m 0s

Soru 1415Soru →

A financial services company is migrating its Microsoft SQL Server databases and SharePoint servers to AWS. The company maintains an on-premises Microsoft Active Directory domain containing all employee user accounts. The company deploys AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) in a new AWS VPC. The solutions architect must configure a solution that allows employees to access the AWS-hosted SharePoint servers using their existing on-premises credentials.

Which combination of actions should the solutions architect take to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Establish network connectivity between the VPC and the on-premises network, and configure conditional DNS forwarders on both the on-premises DNS servers and the AWS Managed Microsoft AD domain controllers.

Configure a forest trust relationship between the on-premises Active Directory domain and the AWS Managed Microsoft AD domain.

Create individual IAM users in the AWS account for each on-premises employee to enable console and API access.

Use the AWS account root user credentials to manage the Active Directory domain controllers and delegate access rights.

Store the on-premises Active Directory domain administrator credentials as a plaintext parameter in Systems Manager Parameter Store to automate trust verification.

Cevabı ve açıklamayı göster

Cevap: Establish network connectivity between the VPC and the on-premises network, and configure conditional DNS forwarders on both the on-premises DNS servers and the AWS Managed Microsoft AD domain controllers.; Configure a forest trust relationship between the on-premises Active Directory domain and the AWS Managed Microsoft AD domain.

Cevap

Establishing network connectivity and DNS forwarders between the networks, and configuring a forest trust relationship between the on-premises Active Directory domain and the AWS Managed Microsoft AD domain.

To integrate an on-premises Active Directory with AWS Managed Microsoft AD using a forest trust, you must first establish network connectivity (via Site-to-Site VPN or AWS Direct Connect) and configure conditional DNS forwarders on both sides so that the domains can resolve each other. After these prerequisites are satisfied, configuring a forest trust allows authentication requests to be securely routed from AWS Managed Microsoft AD to the on-premises domain controllers, enabling on-premises users to access the AWS-hosted resources with their current credentials.

Adım Adım Çözüm

Configure network routing and DNS resolution.

Domain controllers in both the on-premises network and the AWS VPC can communicate over the network and resolve each other's fully qualified domain names.

A trust relationship requires DNS resolution of the partner domain name and active network pathways (such as VPN or Direct Connect) to route LDAP traffic.

Establish the forest trust relationship.

A secure trust relationship is configured on both sides to allow users in the on-premises domain to authenticate to services joined to the AWS Managed Microsoft AD domain.

This trust enables AWS Managed Microsoft AD to delegate user authentication back to the on-premises Active Directory without needing to replicate passwords.

Anahtar Kavram

Establishing a hybrid identity model using AWS Managed Microsoft AD forest trust relationships.

Tahmini Süre:2m 0s

Soru 1416Soru →

A company runs a data processing application on Amazon EC2 instances in a private subnet (CIDR $10.0.2.0/24$ ) of a VPC. The application needs to download datasets from an Amazon S3 bucket in the same AWS Region using an S3 Gateway Endpoint. Additionally, the application must upload logs to an external partner's HTTPS service hosted at the static IP address $198.51.100.50$ . The EC2 instances initiate all connections using ephemeral ports ( $1024-65535$ ).

A solutions architect must configure the VPC security groups and Network Access Control Lists (NACLs) to enforce the principle of least privilege.

Which combination of actions will allow the required traffic while restricting all other access? (Select TWO.)

Geçerli olan tümünü seçin

Configure the security group attached to the EC2 instances with outbound rules that allow TCP traffic on port 443 to the Amazon S3 prefix list and to

198.51.100.50/32

Configure the security group attached to the EC2 instances with outbound rules allowing TCP traffic on port 443 to the Amazon S3 prefix list and

198.51.100.50/32

, and inbound rules allowing TCP traffic on ports

1024-65535

from both destinations.

Configure the subnet NACL with outbound rules allowing TCP traffic on port 443 to

198.51.100.50/32

and

0.0.0.0/0

, and inbound rules allowing TCP traffic on ports

1024-65535

from

198.51.100.50/32

and

0.0.0.0/0

Configure the subnet NACL with outbound rules allowing TCP traffic on port 443 to

198.51.100.50/32

and the Amazon S3 prefix list, and inbound rules allowing TCP traffic on ports

1024-65535

from both destinations.

Configure the private subnet's route table with a default route (

0.0.0.0/0

) pointing to the S3 Gateway Endpoint to route both S3 and external HTTPS traffic.

Cevabı ve açıklamayı göster

Cevap: Configure the security group attached to the EC2 instances with outbound rules that allow TCP traffic on port 443 to the Amazon S3 prefix list and to $198.51.100.50/32$ .; Configure the subnet NACL with outbound rules allowing TCP traffic on port 443 to $198.51.100.50/32$ and $0.0.0.0/0$ , and inbound rules allowing TCP traffic on ports $1024-65535$ from $198.51.100.50/32$ and $0.0.0.0/0$ .

Cevap

Configure the security group with outbound rules allowing TCP traffic on port 443 to the S3 prefix list and the partner's IP, and configure the subnet NACL with outbound rules to those destinations on port 443 and inbound rules allowing return traffic on ephemeral ports (using

0.0.0.0/0

for S3 since NACLs do not support prefix lists).

The correct combination requires understanding stateful vs. stateless traffic filtering and the platform limitations of NACLs and Security Groups. First, the option configuring the security group with outbound rules to the S3 prefix list and the partner's IP on port 443 is correct because security groups are stateful and automatically allow return traffic on ephemeral ports. Second, the option configuring the subnet NACL with outbound rules on port 443 to the partner IP and

0.0.0.0/0

, along with inbound rules on ephemeral ports, is correct because NACLs are stateless and do not support VPC prefix lists.

Adım Adım Çözüm

Analyze security group requirements for stateful evaluation.

Since security groups are stateful, only outbound rules to the target destinations (the S3 prefix list and the partner IP address) on port 443 are needed. Inbound rules for ephemeral return ports are not required.

This establishes least-privilege egress access at the instance level.

Determine NACL capabilities and rule requirements.

NACLs are stateless and evaluate traffic in both directions. Inbound rules must be created to allow return traffic on ephemeral ports (

1024-65535

). Additionally, NACLs do not support referencing VPC prefix lists, so a CIDR block of

0.0.0.0/0

must be used to cover Amazon S3 IP addresses.

This ensures the stateless subnet boundary allows the return traffic for initiated connections.

Verify route table configuration constraints.

Gateway Endpoints modify route tables with specific prefix list routes but cannot be used as a target for a default route (

0.0.0.0/0

) to route external API traffic.

This confirms that route tables must be configured with a NAT Gateway or similar virtual private gateway route for the partner API.

Anahtar Kavram

Stateful vs. Stateless network filtering and resource limitations within VPC security structures.

Tahmini Süre:2m 0s

Soru 1417Soru →

A company is deploying a secure database tier on Amazon EC2 instances in a private subnet (Subnet B: $10.0.2.0/24$ ) of a VPC. The database instances run PostgreSQL. The application tier runs on EC2 instances in a different private subnet (Subnet A: $10.0.1.0/24$ ). The database instances must only allow inbound database traffic from the application instances. The database instances must be blocked from initiating any outbound connections to the internet, but they must be able to securely connect to AWS Systems Manager (SSM) via interface VPC endpoints to download software updates.

Which TWO configurations must a solutions architect implement to meet these requirements with least privilege? (Select TWO.)

Geçerli olan tümünü seçin

Configure the database security group to allow inbound TCP port 5432 from the application security group, and outbound TCP port 443 to the SSM VPC endpoint security group, removing the default outbound rule that allows all traffic.

Configure the VPC endpoint security group to allow inbound TCP port 443 from the database security group.

Associate the database security group with Subnet B to enforce traffic filtering at the subnet boundary, ensuring no outbound traffic is allowed to route to the internet.

Configure the Network ACL for Subnet B to allow inbound TCP port 5432 from Subnet A, relying on the stateful nature of Network ACLs to automatically permit return traffic to the application tier.

Configure the database security group to allow outbound TCP port 443 to

0.0.0.0/0

so that the patch requests can be inspected by AWS WAF before being routed to AWS Systems Manager.

Cevabı ve açıklamayı göster

Cevap: Configure the database security group to allow inbound TCP port 5432 from the application security group, and outbound TCP port 443 to the SSM VPC endpoint security group, removing the default outbound rule that allows all traffic.; Configure the VPC endpoint security group to allow inbound TCP port 443 from the database security group.

Cevap

To meet the requirements, the database security group must be configured to allow inbound TCP port 5432 from the application security group and outbound TCP port 443 to the SSM VPC endpoint security group (with the default outbound rule removed). Additionally, the VPC endpoint security group must allow inbound TCP port 443 from the database security group.

The database security group must allow inbound database traffic on port 5432 from the application security group and outbound HTTPS traffic on port 443 to the security group of the SSM VPC endpoint, with the default outbound rule removed to prevent any other outbound traffic. The VPC endpoint security group must allow inbound HTTPS traffic on port 443 from the database security group. Since security groups are stateful, return traffic for both connections is automatically permitted.

Adım Adım Çözüm

Analyze the communication flow and stateful nature of security groups.

Database instances must receive inbound connections from application instances on port 5432. Since security groups are stateful, allowing inbound port 5432 from the application security group automatically allows the return database traffic. To block database instances from initiating general internet traffic while allowing them to connect to Systems Manager, we must remove the default 'allow all outbound' rule and add a specific outbound rule for TCP port 443 pointing to the target SSM VPC endpoint.

This implements the principle of least privilege at the instance level.

Configure the interface VPC endpoint security group.

Interface endpoints use Elastic Network Interfaces (ENIs) which are protected by security groups. To allow the database instances to successfully connect, the endpoint's security group must permit inbound HTTPS (TCP 443) traffic from the database security group.

VPC interface endpoints require explicit inbound security group rules to accept incoming traffic from VPC clients.

Evaluate subnet-level versus instance-level security controls.

Confirm that Network ACLs are stateless and apply at the subnet level, meaning they would require both inbound and outbound rules, whereas security groups are stateful and apply to network interfaces. This rules out options that confuse Network ACL statelessness or associate security groups directly with subnets.

Avoiding common configuration errors ensures a secure and functional network architecture.

Anahtar Kavram

VPC Network Security using stateful Security Groups and Interface VPC Endpoints

Tahmini Süre:2m 0s

Soru 1418Soru →

An organization is deploying a microservices-based application on Amazon ECS. The services require access to a third-party payment gateway API token. The security policy dictates that the API token must be stored securely, encrypted at rest, and automatically rotated every 30 days to mitigate credential exposure risks.

Which solution should a solutions architect recommend to satisfy these requirements with the least operational overhead?

Store the API token in AWS Secrets Manager. Configure automatic rotation using a custom or template AWS Lambda function on a 30-day schedule, and update the ECS tasks to retrieve the token dynamically.

Store the API token in AWS Systems Manager Parameter Store as a standard String parameter. Configure an Amazon EventBridge rule and an AWS Lambda function to update the parameter value every 30 days.

Store the API token in AWS Systems Manager Parameter Store as a SecureString parameter, and enable the native automatic 30-day key rotation option directly in the Parameter Store console.

Store the API token in an Amazon S3 bucket encrypted with an AWS KMS Customer Managed Key. Enable automatic annual rotation on the KMS key to rotate the API token every 30 days.

Cevabı ve açıklamayı göster

Cevap: Store the API token in AWS Secrets Manager. Configure automatic rotation using a custom or template AWS Lambda function on a 30-day schedule, and update the ECS tasks to retrieve the token dynamically.

Cevap

Store the API token in AWS Secrets Manager, configure automatic rotation using an AWS Lambda function, and retrieve it dynamically within the ECS tasks.

Storing the API token in AWS Secrets Manager is the correct approach because Secrets Manager is designed specifically for managing secrets and natively integrates with AWS Lambda to rotate credentials automatically. It encrypts secrets at rest using AWS KMS and allows ECS tasks to retrieve the values dynamically via IAM roles, ensuring security and low operational overhead.

Adım Adım Çözüm

Identify the primary requirement for storing sensitive data (an API token) securely with automatic rotation and minimal operational overhead.

Secrets must be encrypted at rest, and the storage service should ideally have built-in support for scheduled rotation.

This narrows down the service choices to those supporting encryption and rotation, such as AWS Secrets Manager.

Compare AWS Secrets Manager and AWS Systems Manager Parameter Store.

AWS Secrets Manager natively supports automatic rotation using AWS Lambda out-of-the-box. Systems Manager Parameter Store supports encryption (SecureString) but does not have a built-in rotation scheduler or lifecycle management for parameters.

Using Secrets Manager minimizes operational overhead since you do not need to build and maintain custom orchestrators for rotation.

Evaluate the S3 and KMS key rotation options.

KMS key rotation only rotates the KMS key material; it does not rotate application-level secrets or files stored in S3.

This eliminates options that confuse KMS key rotation with secret credential rotation.

Anahtar Kavram

AWS Secrets Manager vs Systems Manager Parameter Store for Secret Rotation

Soru 1419Soru →

A company has an application running on Amazon EC2 instances in a private subnet. The application must communicate with an external third-party service over HTTPS (port 443). The network security team requires that no traffic is allowed to exit or enter the VPC except what is strictly required for this application to communicate with the external service's public IP range ( $203.0.113.0/24$ ). The subnets use a custom Network ACL (NACL) and the EC2 instances use a custom Security Group.

Which configuration of Security Groups and Network ACLs will securely allow this communication while maintaining the principle of least privilege?

Configure the Security Group with an outbound rule allowing HTTPS (port 443) to

203.0.113.0/24

, and no inbound rules. Configure the Network ACL with an outbound rule allowing HTTPS (port 443) to

203.0.113.0/24

, and an inbound rule allowing TCP traffic on ephemeral ports (

1024-65535

) from

203.0.113.0/24

Configure the Security Group with an outbound rule allowing HTTPS (port 443) to

203.0.113.0/24

, and an inbound rule allowing TCP traffic on ephemeral ports (

1024-65535

) from

203.0.113.0/24

. Configure the Network ACL with an outbound rule allowing HTTPS (port 443) to

203.0.113.0/24

, and no inbound rules.

Configure the Security Group with an outbound rule allowing HTTPS (port 443) to

203.0.113.0/24

, and no inbound rules. Configure the Network ACL with an outbound rule allowing HTTPS (port 443) to

203.0.113.0/24

, and an inbound rule allowing HTTPS (port 443) from

203.0.113.0/24

Configure the Security Group with an outbound rule allowing HTTPS (port 443) to

203.0.113.0/24

, and no inbound rules. Configure the Network ACL with an outbound rule allowing all traffic (

0.0.0.0/0

) and configure AWS WAF on the subnet to restrict outbound traffic destinations to

203.0.113.0/24

Cevabı ve açıklamayı göster

Cevap: Configure the Security Group with an outbound rule allowing HTTPS (port 443) to $203.0.113.0/24$ , and no inbound rules. Configure the Network ACL with an outbound rule allowing HTTPS (port 443) to $203.0.113.0/24$ , and an inbound rule allowing TCP traffic on ephemeral ports ( $1024-65535$ ) from $203.0.113.0/24$ .

Cevap

Configure the Security Group with an outbound rule allowing HTTPS (port 443) to the destination IP range, and configure the Network ACL with an outbound rule allowing HTTPS (port 443) to the destination IP range and an inbound rule allowing TCP traffic on ephemeral ports from the destination IP range.

The correct option correctly applies the stateful nature of Security Groups and the stateless nature of Network ACLs. Security Groups only require an outbound rule for port 443 because they are stateful and automatically track and allow the return traffic. Network ACLs, being stateless, require rules in both directions: an outbound rule to allow traffic to the service on port 443, and an inbound rule to allow the return traffic from the service back to the client's ephemeral ports (

1024-65535

Adım Adım Çözüm

Determine the required Security Group configuration for the EC2 instances.

Since Security Groups are stateful, configuring an outbound rule to allow HTTPS (port 443) to

203.0.113.0/24

is sufficient. Return traffic is tracked and permitted automatically, so no inbound rules are required.

To grant outbound-only access while minimizing the attack surface by leaving inbound rules empty.

Determine the required Network ACL outbound configuration for the subnet.

Since Network ACLs are stateless, configure an outbound rule allowing TCP port 443 traffic to

203.0.113.0/24

To allow the outbound connection request to reach the external service.

Determine the required Network ACL inbound configuration for the subnet.

Configure an inbound rule allowing TCP traffic from

203.0.113.0/24

on ephemeral ports (

1024-65535

Since Network ACLs are stateless, the return traffic sent by the external service to the client's ephemeral ports must be explicitly allowed.

Anahtar Kavram

Stateful vs. Stateless Filtering in VPC Network Security

Tahmini Süre:1m 30s

Soru 1420Soru →

A company stores financial records in an Amazon S3 bucket. The objects are encrypted at rest using Server-Side Encryption with AWS KMS keys (SSE-KMS) and a Customer Managed Key (CMK). To comply with new regulatory requirements, the security team mandates that the KMS key must be rotated every 90 days. Furthermore, all existing historical records in the S3 bucket must be immediately re-encrypted using the new key material as soon as the key is rotated. Which combination of actions will meet these requirements with the least operational overhead?

Enable automatic key rotation for the Customer Managed Key with a 90-day interval. Rely on AWS KMS to automatically and immediately re-encrypt all historical S3 objects in the background once the key rotation completes.

Manually generate a new Customer Managed Key every 90 days and store the new key ARN as a plaintext String parameter in Systems Manager Parameter Store. Write an AWS Lambda function to update the default bucket encryption settings and re-encrypt the historical objects using the Parameter Store value.

Configure the Customer Managed Key with automatic key rotation set to a 90-day interval. Execute an Amazon S3 Batch Operations job using a copy operation to duplicate the existing objects in-place under the same key.

Log in to the AWS account root user every 90 days. Disable the active Customer Managed Key, create a new Customer Managed Key, and use the root user credentials to run an S3 Batch Operations copy job to re-encrypt all historical objects.

Cevabı ve açıklamayı göster

Cevap: Configure the Customer Managed Key with automatic key rotation set to a 90-day interval. Execute an Amazon S3 Batch Operations job using a copy operation to duplicate the existing objects in-place under the same key.

Cevap

Configuring the Customer Managed Key with automatic key rotation set to a 90-day interval and executing an Amazon S3 Batch Operations job to copy the objects in-place under the same key is the most operationally efficient solution.

Configuring automatic key rotation with a 90-day interval on the Customer Managed Key (CMK) allows AWS KMS to handle the rotation of key material natively. To address the requirement of re-encrypting historical objects in S3, running an S3 Batch Operations job with a copy operation to copy the objects onto themselves (in-place) forces S3 to decrypt the objects using the old key material and re-encrypt them with the newly rotated key material under the same key ID. This approach completely avoids manual key management, credential exposure, or the need to update bucket policies or application configurations.

Adım Adım Çözüm

Enable automatic key rotation on the Customer Managed Key with a rotation period of 90 days.

AWS KMS will automatically rotate the key material every 90 days, retaining older key material for decryption.

To meet the regulatory requirement of rotating keys every 90 days natively without manual rotation script overhead.

Create and execute an Amazon S3 Batch Operations copy job targeting the bucket's objects, specifying the destination as the same bucket and key.

Objects are read (decrypted with the old key material) and written back (encrypted with the newly rotated key material).

To force the immediate re-encryption of all historical objects in the bucket using the new key version with minimal manual effort.

Anahtar Kavram

KMS Key Rotation Mechanics and S3 Batch Re-encryption

ÖncekiSayfa 71 / 74Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram