Tüm alıştırma soruları

1462 soru

Tüm türler1,462 Çoktan seçmeli739 Çoklu seçim723

A company is deploying a microservices application on Amazon EC2 instances inside a private subnet of a VPC. The application must read and write data to an Amazon DynamoDB table and retrieve credentials from AWS Secrets Manager. Company security policy dictates that no traffic from the private subnet is allowed to traverse the public internet, and NAT gateways cannot be used.

Which combination of steps should a solutions architect take to configure network routing and access control to meet these requirements securely? (Select TWO.)

Geçerli olan tümünü seçin

Create a gateway VPC endpoint for Amazon DynamoDB, and associate the endpoint with the route table of the private subnet.

Create an interface VPC endpoint for AWS Secrets Manager, and associate a security group with the endpoint that allows inbound HTTPS traffic on port

443

from the microservices' security group.

Create an interface VPC endpoint for Amazon DynamoDB, and configure the private subnet's Network ACL to allow outbound traffic to the endpoint without configuring any inbound rules, relying on the Network ACL's stateful nature to permit the return traffic.

Create a gateway VPC endpoint for AWS Secrets Manager, and add a route pointing to the Secrets Manager endpoint in the private subnet's route table.

Deploy AWS Shield Standard on the AWS Secrets Manager endpoint to inspect and block Layer

7

SQL injection attempts from the microservices.

Cevabı ve açıklamayı göster

Cevap: Create a gateway VPC endpoint for Amazon DynamoDB, and associate the endpoint with the route table of the private subnet.; Create an interface VPC endpoint for AWS Secrets Manager, and associate a security group with the endpoint that allows inbound HTTPS traffic on port $443$ from the microservices' security group.

Cevap

Create a gateway VPC endpoint for Amazon DynamoDB, and associate the endpoint with the route table of the private subnet; and create an interface VPC endpoint for AWS Secrets Manager, and associate a security group with the endpoint that allows inbound HTTPS traffic on port

443

from the microservices' security group.

To connect to Amazon DynamoDB and AWS Secrets Manager privately, the solutions architect must use VPC endpoints. For DynamoDB, a gateway VPC endpoint is created and associated with the subnet's route table. For AWS Secrets Manager, an interface VPC endpoint is created, which provisions an ENI with a private IP. This interface endpoint is secured with a security group that permits inbound HTTPS traffic on port

443

from the microservices.

Adım Adım Çözüm

Identify the endpoint types supported by the destination services.

Amazon DynamoDB supports gateway VPC endpoints. AWS Secrets Manager supports interface VPC endpoints.

Gateway endpoints are route-based and free, whereas interface endpoints use elastic network interfaces (ENIs) and require security groups.

Configure routing for the gateway endpoint.

Associate the DynamoDB gateway endpoint with the private subnet's route table.

This automatically adds a route pointing DynamoDB-bound traffic to the endpoint without crossing the public internet.

Configure security for the interface endpoint.

Create an interface endpoint for Secrets Manager and attach a security group allowing inbound HTTPS (port

443

) traffic from the microservices' security group.

Since interface endpoints use ENIs with private IP addresses, they act like resources inside the VPC and must be secured using stateful security groups.

Anahtar Kavram

VPC endpoints allow private connection between a VPC and supported AWS services without requiring an internet gateway, NAT gateway, VPN, or Direct Connect connection. Gateway endpoints are used for S3 and DynamoDB by modifying route tables. Interface endpoints use AWS PrivateLink, requiring security groups to control inbound HTTPS traffic.

Tahmini Süre:2m 0s

Soru 1442Soru →

A company is migrating a high-performance transactional database to an Amazon Aurora MySQL DB cluster. The database contains personally identifiable information (PII) that must be encrypted at rest. The company's security policy requires that the KMS key used for database encryption must be rotated annually. Additionally, the database connection credentials must be rotated every 30 days. These requirements must be met with minimal manual intervention and no database downtime. Which combination of actions will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Create a customer managed key (CMK) in AWS KMS, enable automatic key rotation, and select this key for Aurora encryption at rest.

Store the database connection credentials in AWS Secrets Manager, and configure automatic rotation with a rotation interval of 30 days.

Store the database credentials in AWS Systems Manager Parameter Store as a String parameter, and write a custom AWS Lambda function to rotate the credentials every 30 days.

Configure the Aurora database cluster to use the AWS managed key (aws/rds) for encryption, and schedule a manual key rotation event in AWS KMS every 30 days.

Enable automatic key rotation for the customer managed key, and schedule a monthly maintenance window to decrypt and re-encrypt the Aurora database storage volumes under the new key version.

Cevabı ve açıklamayı göster

Cevap: Create a customer managed key (CMK) in AWS KMS, enable automatic key rotation, and select this key for Aurora encryption at rest.; Store the database connection credentials in AWS Secrets Manager, and configure automatic rotation with a rotation interval of 30 days.

Cevap

Create a customer managed key (CMK) in AWS KMS, enable automatic key rotation, and select this key for Aurora encryption at rest. Additionally, store the database connection credentials in AWS Secrets Manager, and configure automatic rotation with a rotation interval of 30 days.

To satisfy the annual rotation requirement without database downtime, a customer managed key (CMK) must be created in AWS KMS with automatic key rotation enabled. AWS KMS automatically rotates CMKs every year and retains older key versions to seamlessly decrypt historical data. To rotate the database credentials every 30 days without manual effort, AWS Secrets Manager should be used, as it integrates directly with Amazon Aurora to handle credential rotation.

Adım Adım Çözüm

Address database encryption at rest and the annual key rotation requirement.

Create a customer managed key (CMK) in AWS KMS and enable automatic key rotation. Since CMKs rotate annually by default and retain older backing keys, the database remains readable without manual intervention or downtime.

AWS managed keys rotate every three years, which does not satisfy the company's annual rotation policy. Customer managed keys support annual automatic rotation.

Address secure storage and automatic rotation of database credentials.

Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.

AWS Secrets Manager has built-in integration to rotate RDS/Aurora credentials automatically using a Lambda function, avoiding plaintext parameter storage risks.

Anahtar Kavram

AWS KMS customer managed keys support annual automatic key rotation while preserving historical backing keys to decrypt existing data. AWS Secrets Manager provides native, secure, and automated credential rotation for Amazon RDS/Aurora databases.

Soru 1443Soru →

An online medical ticketing platform processes patient consultation logs using an application running on Amazon ECS. The platform must store these logs in an Amazon DynamoDB table. The compliance team mandates that the logs at rest be encrypted using a customer managed key (CMK) in AWS KMS, with the encryption key automatically rotated on an annual basis. In addition, a third-party medical API access token used by the application must be kept secure and hidden from plain sight. Which architecture configuration will satisfy these requirements?

Configure the DynamoDB table to encrypt data at rest using a customer managed KMS key with automatic key rotation enabled. Store the API access token as a SecureString parameter in AWS Systems Manager Parameter Store.

Configure the DynamoDB table to encrypt data at rest using a customer managed KMS key with automatic key rotation enabled. Store the API access token as a standard String parameter in AWS Systems Manager Parameter Store.

Configure the DynamoDB table to encrypt data at rest using a customer managed KMS key. Set up an annual AWS Lambda function to rotate the key and re-encrypt all historical table records using the new key material.

Log in with the AWS account root user to configure DynamoDB table encryption with an AWS managed key. Store the API access token as a plaintext environment variable inside the ECS task definition.

Cevabı ve açıklamayı göster

Cevap: Configure the DynamoDB table to encrypt data at rest using a customer managed KMS key with automatic key rotation enabled. Store the API access token as a SecureString parameter in AWS Systems Manager Parameter Store.

Cevap

Configure the DynamoDB table to encrypt data at rest using a customer managed KMS key with automatic key rotation enabled, and store the API access token as a SecureString parameter in AWS Systems Manager Parameter Store.

Using a customer managed KMS key with automatic key rotation enabled meets the encryption and rotation requirements. When a customer managed key is automatically rotated, AWS KMS automatically generates new key material annually. KMS retains all historical versions of the key material to decrypt data encrypted with those versions, so there is no need to manually decrypt and re-encrypt existing DynamoDB table data. Storing the sensitive API access token as a SecureString parameter in Systems Manager Parameter Store ensures the credential is encrypted at rest and not stored in plaintext.

Adım Adım Çözüm

Select the correct encryption key type and configuration

A customer managed KMS key is selected with automatic key rotation enabled.

This satisfies the security requirement to use a customer managed key (CMK) and automates the annual rotation without requiring manual script intervention or key material management.

Address key rotation and historical data access mechanics

Identify that AWS KMS automatically manages decryption of older records.

AWS KMS retains older versions of rotated key material to decrypt data encrypted with those versions, eliminating the need to decrypt and re-encrypt historical data.

Choose the secure storage option for the API token

The token is stored as a SecureString in AWS Systems Manager Parameter Store.

A SecureString parameter encrypts the sensitive token at rest using a KMS key, satisfying the requirement to keep the secret secure and hidden from plain sight.

Anahtar Kavram

AWS KMS key rotation mechanics allow automatic annual generation of new key material for customer managed keys without requiring re-encryption of existing data. Sensitive configuration data should be stored securely using SSM Parameter Store SecureString parameters or AWS Secrets Manager to prevent exposure in plaintext.

Tahmini Süre:1m 30s

Soru 1444Soru →

A company runs a backend database tier on Amazon EC2 instances in a private database subnet with CIDR block $10.0.3.0/24$ . The database instances receive incoming MySQL connections on TCP port $3306$ from application servers in a separate private application subnet with CIDR block $10.0.2.0/24$ . Additionally, the database instances must periodically initiate outbound connections to download software updates from an external repository over HTTPS (TCP port $443$ ) via a NAT gateway located in the public subnet (CIDR block $10.0.1.0/24$ ). A solutions architect is configuring a custom network ACL (NACL) for the database subnet to enforce strict security boundaries.

Which configuration changes must the solutions architect apply to the database subnet's custom NACL to allow these connections? (Select TWO.)

Geçerli olan tümünü seçin

An inbound rule allowing TCP traffic on port range

1024-65535

from source

0.0.0.0/0

An outbound rule allowing TCP traffic on port range

1024-65535

to destination

10.0.2.0/24

An inbound rule allowing TCP traffic on port

443

from source

0.0.0.0/0

An outbound rule allowing TCP traffic on port

3306

to destination

10.0.2.0/24

An inbound rule allowing TCP traffic on port

3306

from source

10.0.1.0/24

Cevabı ve açıklamayı göster

Cevap: An inbound rule allowing TCP traffic on port range $1024-65535$ from source $0.0.0.0/0$ ; An outbound rule allowing TCP traffic on port range $1024-65535$ to destination $10.0.2.0/24$

Cevap

An inbound rule allowing TCP traffic on port range

1024-65535

from source

0.0.0.0/0

and an outbound rule allowing TCP traffic on port range

1024-65535

to destination

10.0.2.0/24

Network ACLs (NACLs) are stateless, meaning that outbound response traffic must be explicitly allowed by outbound rules, and inbound response traffic must be explicitly allowed by inbound rules. For the database tier to accept MySQL traffic from the application tier, the inbound rule must allow port

3306

from the application subnet CIDR, and the outbound rule must allow return traffic to the application subnet CIDR on the ephemeral ports (

1024-65535

). For the database tier to download updates from the internet over HTTPS (destination port

443

), the outbound rule must allow traffic to port

443

for destination

0.0.0.0/0

, and the inbound rule must allow return traffic from source

0.0.0.0/0

on the ephemeral ports (

1024-65535

). Therefore, the two correct configurations are the inbound rule allowing ephemeral ports from the internet, and the outbound rule allowing ephemeral ports to the application subnet.

Adım Adım Çözüm

Analyze the database subnet traffic flows and determine their state characteristics.

Identify two inbound flows (MySQL requests from

10.0.2.0/24

on port

3306

, and HTTPS return traffic from

0.0.0.0/0

on ephemeral ports) and two outbound flows (MySQL responses to

10.0.2.0/24

on ephemeral ports, and HTTPS requests to

0.0.0.0/0

on port

443

Because Network ACLs are stateless, both the request and response directions of any connection must be explicitly configured.

Determine the correct inbound NACL rules required.

Inbound TCP port

3306

from source

10.0.2.0/24

must be allowed for incoming requests. Inbound TCP ports

1024-65535

from source

0.0.0.0/0

must be allowed for update responses.

The external update server sends response packets back to the ephemeral ports (

1024-65535

) allocated by the database instances, so these ports must be opened inbound.

Determine the correct outbound NACL rules required.

Outbound TCP port

443

to destination

0.0.0.0/0

must be allowed for requests. Outbound TCP ports

1024-65535

to destination

10.0.2.0/24

must be allowed for database responses.

The database instances send MySQL response packets back to the application servers on their ephemeral ports (

1024-65535

), which requires an outbound NACL rule.

Anahtar Kavram

Network ACLs are stateless firewalls operating at the subnet level. They require rules to be configured for both inbound and outbound traffic paths, including allowing return traffic on ephemeral port ranges (

1024-65535

Tahmini Süre:2m 0s

Soru 1445Soru →

A company has a central logging Amazon S3 bucket in AWS Account A. Applications running on Amazon EC2 instances within an Auto Scaling group in AWS Account B must write application logs directly to this S3 bucket. The logs must be encrypted at rest using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS) located in Account A. The security team requires that the encryption key is rotated automatically every year and that access to the key follows the principle of least privilege. Which combination of actions must the solutions architect take to configure this secure cross-account encryption setup? (Select TWO.)

Geçerli olan tümünü seçin

Configure the key policy of the Customer Managed Key in Account A to grant the IAM role in Account B permissions to perform the kms:GenerateDataKey and kms:Decrypt actions.

Configure the IAM policy of the application role in Account B to grant s3:PutObject permissions on the S3 bucket in Account A and kms:GenerateDataKey permissions on the KMS key in Account A.

Enable automatic annual key rotation on the Customer Managed Key in Account A, which will automatically re-encrypt all historically stored log objects in the S3 bucket using the new key material.

Store the credentials of an IAM user from Account A inside Systems Manager Parameter Store as a plain String parameter in Account B to authenticate the logging requests.

Configure the applications in Account B to authenticate using the AWS account root user credentials of Account A to bypass KMS cross-account key policy restrictions.

Cevabı ve açıklamayı göster

Cevap: Configure the key policy of the Customer Managed Key in Account A to grant the IAM role in Account B permissions to perform the kms:GenerateDataKey and kms:Decrypt actions.; Configure the IAM policy of the application role in Account B to grant s3:PutObject permissions on the S3 bucket in Account A and kms:GenerateDataKey permissions on the KMS key in Account A.

Cevap

Configure the key policy of the Customer Managed Key in Account A to trust the IAM role in Account B, and configure the IAM policy of the application role in Account B to grant put object permissions on the S3 bucket and generate data key permissions on the KMS key.

For secure cross-account logging to an S3 bucket encrypted with SSE-KMS, the application's IAM role in Account B must be granted permissions to generate the data key from Account A's KMS key and write to the S3 bucket. Additionally, the Customer Managed Key policy in Account A must explicitly allow the IAM role in Account B to use the key.

Adım Adım Çözüm

Configure the destination resource policies in Account A.

The KMS key policy is updated to allow Account B's role to perform kms:GenerateDataKey and kms:Decrypt, and the S3 bucket policy is updated to allow Account B's role to perform s3:PutObject.

Resource-based policies must authorize cross-account entities to access resources directly.

Configure the client-side IAM policy in Account B.

The IAM policy attached to the EC2 instance role in Account B is updated to permit s3:PutObject on the Account A bucket and kms:GenerateDataKey on the Account A KMS key.

An IAM entity performing cross-account actions must have local identity-based permissions allowing access to target external resources.

Anahtar Kavram

Cross-account access with SSE-KMS requires explicit authorization in both the source IAM policy and the destination resource policies (S3 bucket policy and KMS key policy).

Soru 1446Soru →

A company stores highly sensitive audit reports in an Amazon S3 bucket. The data is encrypted at rest using an AWS KMS Customer Managed Key (CMK). To comply with updated industry regulations, the security team must rotate the encryption key every year. The team wants to ensure that all historical audit reports can still be accessed and decrypted seamlessly, without requiring manual updates to applications or re-encrypting existing data. Which action should the solutions architect recommend to meet these requirements with the least operational effort?

Create a new Customer Managed Key annually, update the S3 bucket policy to reference the new key, and manually re-encrypt all existing objects using a custom AWS Lambda function.

Enable automatic key rotation for the Customer Managed Key, which generates new key material annually while preserving the older key material to decrypt existing objects.

Enable automatic key rotation for the Customer Managed Key and configure an AWS Batch job to immediately decrypt and re-encrypt all historical S3 objects using the new key version.

Store the key material as a plaintext parameter in AWS Systems Manager Parameter Store, and write a scheduled script to generate new key material and update the parameter annually.

Cevabı ve açıklamayı göster

Cevap: Enable automatic key rotation for the Customer Managed Key, which generates new key material annually while preserving the older key material to decrypt existing objects.

Cevap

Enable automatic key rotation for the Customer Managed Key, which generates new key material annually while preserving the older key material to decrypt existing objects.

Enabling automatic key rotation for the Customer Managed Key is the most efficient solution. AWS KMS automatically creates new key material every year while keeping the older key material available for decrypting objects that were encrypted with previous key versions. This process requires zero configuration changes or manual re-encryption.

Adım Adım Çözüm

Identify the encryption requirement and the constraint regarding historical data access.

The audit reports are encrypted using a Customer Managed Key (CMK) and must be rotated annually with minimal operational effort and without re-encrypting historical data.

This establishes the baseline requirements for standard key rotation behavior in AWS KMS.

Evaluate AWS KMS automatic key rotation capabilities.

Enabling automatic key rotation for a CMK automatically generates new key material every year while keeping historical key versions intact to decrypt existing objects.

This eliminates the need for manual key rotation, updating policies, or re-encrypting historical data, satisfying the least operational effort requirement.

Select the option that configures automatic key rotation without initiating redundant re-encryption tasks or using insecure parameter configurations.

Enabling automatic key rotation alone meets all criteria.

No other service modifications or data rewrites are required, securing the correct solution.

Anahtar Kavram

AWS KMS Automatic Key Rotation Mechanics

Soru 1447Soru →

A company has deployed two applications in separate VPCs within the same AWS Region and AWS account. VPC A uses the CIDR block $10.1.0.0/16$ and hosts a web application on Amazon EC2 instances. VPC B uses the CIDR block $10.2.0.0/16$ and hosts a PostgreSQL database on Amazon EC2 instances. The two VPCs are connected via a VPC peering connection, and route tables are correctly configured to route traffic between the subnets. The company's security policy requires that the PostgreSQL database in VPC B must only accept traffic from the specific EC2 instances hosting the web application in VPC A. Which configuration meets this requirement with the least administrative overhead?

In the security group for the database instances in VPC B, add an inbound rule that allows TCP port

5432

traffic and references the security group ID of the web application instances in VPC A as the source.

In the security group for the database instances in VPC B, add an inbound rule that allows TCP port

5432

traffic and references the CIDR block of VPC A (

10.1.0.0/16

) as the source.

In the Network ACL for the database subnet in VPC B, add an inbound rule that allows TCP port

5432

traffic and references the security group ID of the web application instances in VPC A as the source.

In the security group for the database instances in VPC B, add an inbound rule that allows TCP port

5432

traffic and references the public IP addresses of the web application instances in VPC A as the source.

Cevabı ve açıklamayı göster

Cevap: In the security group for the database instances in VPC B, add an inbound rule that allows TCP port $5432$ traffic and references the security group ID of the web application instances in VPC A as the source.

Cevap

In the security group for the database instances in VPC B, add an inbound rule that allows TCP port

5432

traffic and references the security group ID of the web application instances in VPC A as the source.

The correct configuration is to reference the security group ID of the web application instances in VPC A in the database's security group inbound rules. AWS allows security groups to reference other security groups across peered VPCs in the same region. This ensures that only the instances associated with the web application security group can access the PostgreSQL database, achieving least-privilege security without the need to maintain IP addresses manually.

Adım Adım Çözüm

Identify the communication channel between the two VPCs.

The VPCs are peered, meaning instances communicate using their private IP addresses.

This rules out any configurations that rely on public IP addresses.

Evaluate the security requirements against the capabilities of Security Groups and Network ACLs.

The requirement is to limit access to specific EC2 instances (least privilege). Security groups can be referenced across VPC peering connections as sources, whereas Network ACLs can only reference CIDR blocks.

This eliminates using Network ACLs for instance-level filtering and directs the solution to security groups.

Select the security group source that restricts traffic to only the web application instances rather than the entire subnet or VPC.

Referencing the web application's security group ID limits access strictly to those instances, while using the VPC A CIDR block (

10.1.0.0/16

) would be too permissive.

This confirms the correct configuration option.

Anahtar Kavram

Security Group Referencing across VPC Peering

Soru 1448Soru →

A company is deploying a three-tier application on Amazon EC2. The database password must be stored securely and retrieved dynamically by the application. Additionally, the application's Amazon EBS volumes must be encrypted at rest using an AWS KMS customer managed key that undergoes automatic annual rotation, while ensuring that all existing snapshots remain readable. Which combination of actions will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Store the database password in AWS Systems Manager Parameter Store as a parameter of type String.

Store the database password in AWS Systems Manager Parameter Store as a parameter of type SecureString.

Enable automatic key rotation for the customer managed key in AWS KMS.

Manually create a new customer managed key each year, associate it with the EBS volumes, and re-encrypt all historical snapshots.

Use the default AWS managed key aws/ebs for volume encryption and enable automatic rotation on it.

Cevabı ve açıklamayı göster

Cevap: Store the database password in AWS Systems Manager Parameter Store as a parameter of type SecureString.; Enable automatic key rotation for the customer managed key in AWS KMS.

Cevap

Storing the database password as a SecureString parameter in Systems Manager Parameter Store, and enabling automatic key rotation on the KMS customer managed key used for EBS volume encryption.

Storing the database password as a SecureString parameter in Systems Manager Parameter Store ensures that the password is encrypted at rest using a KMS key. Enabling automatic key rotation for the customer managed key in AWS KMS automatically rotates the key material annually. AWS KMS retains all historical backing key versions, allowing the system to seamlessly decrypt older snapshots encrypted with previous key versions without any manual re-encryption or reconfiguration.

Adım Adım Çözüm

Configure secure storage for the database credentials using Systems Manager Parameter Store.

Create a parameter of type SecureString, which encrypts the password at rest using a KMS key.

This protects the sensitive credential from being stored in plaintext while allowing application instances to retrieve it dynamically.

Configure encryption at rest for the Amazon EBS volumes using a customer managed key.

Encrypt the EBS volumes using the specified customer managed key.

This meets the architectural requirement to use customer-managed encryption keys for storage volumes.

Enable automatic annual key rotation on the customer managed key in AWS KMS.

The KMS key material is rotated automatically every year, while keeping previous backing keys active.

This satisfies the rotation policy without requiring manual key updates or manual re-encryption of existing snapshots.

Anahtar Kavram

AWS KMS Customer Managed Key rotation mechanics and secure parameter storage using Systems Manager Parameter Store

Soru 1449Soru →

A solutions architect is configuring network security for a new cache tier in a VPC. A cluster of Redis instances is deployed in a private subnet ( $10.0.2.0/24$ ) and must accept inbound cache requests on TCP port $6379$ from web application servers located in a public subnet ( $10.0.1.0/24$ ). The solutions architect configures a custom Network Access Control List (Network ACL) for the private subnet with the following rules:

* Inbound: Rule $100$ – Allow TCP port $6379$ from $10.0.1.0/24$
* Outbound: Rule $100$ – Allow TCP port $6379$ to $10.0.1.0/24$
* Both inbound and outbound default rules (Rule $*$ ) are set to deny all other traffic.

The web application servers are unable to establish a connection to the Redis instances. Which configuration change to the private subnet's Network ACL will resolve this issue?

Change the outbound rule to allow TCP traffic to

10.0.1.0/24

on ports

1024-65535

Change the inbound rule to allow TCP traffic from

10.0.1.0/24

on ports

1024-65535

Configure the security group of the Redis instances to allow outbound TCP traffic to

10.0.1.0/24

on ports

1024-65535

Remove the outbound Network ACL rule entirely, as Network ACLs are stateful and automatically permit return traffic.

Cevabı ve açıklamayı göster

Cevap: Change the outbound rule to allow TCP traffic to $10.0.1.0/24$ on ports $1024-65535$ .

Cevap

Change the outbound rule to allow TCP traffic to the public subnet on the ephemeral port range (

1024-65535

The correct option is the one recommending changing the outbound Network ACL rule to allow TCP traffic to the public subnet on the ephemeral port range. Because Network ACLs are stateless, they do not automatically allow return traffic. When the web application servers connect to Redis on port

6379

, they use a client-side ephemeral port (in the range

1024-65535

) for the source. The response from Redis is sent from source port

6379

to the destination ephemeral port on the web server. Therefore, the private subnet's outbound Network ACL must permit TCP traffic to the public subnet's CIDR block on ports

1024-65535

Adım Adım Çözüm

Analyze the statefulness of the network security components in the VPC.

Security groups are stateful, but Network ACLs are stateless and evaluate traffic in both directions independently.

Understanding statelessness is critical because return traffic must be explicitly allowed by the Network ACL.

Identify the port mapping for the client-server communication.

The client (web application server) initiates a connection to the server (Redis) on port

6379

. The return traffic from Redis is sent from port

6379

to the client's ephemeral port range (

1024-65535

This determines which ports must be opened in each direction of the Network ACL.

Verify the private subnet's Network ACL rules against this port mapping.

The inbound rule correctly allows traffic to destination port

6379

. However, the outbound rule only allows destination port

6379

, which blocks the return traffic destined for the client's ephemeral ports (

1024-65535

Identifying this mismatch pinpoints the root cause of the connection failure.

Determine the required modification to resolve the block.

Update the outbound rule of the private subnet's Network ACL to allow TCP traffic to

10.0.1.0/24

on ports

1024-65535

This permits the stateless Network ACL to pass the response traffic back to the web servers.

Anahtar Kavram

Stateless nature of Network ACLs requiring return traffic on ephemeral ports

Tahmini Süre:1m 30s

Soru 1450Soru →

A financial services company stores daily transaction reports in an Amazon S3 bucket. The company's security policy requires that all reports be encrypted at rest using AWS KMS Customer Managed Keys (CMKs) with automatic annual rotation enabled. The operations team is concerned that rotating the key will render historical reports encrypted under the previous key version unreadable. Which of the following describes the behavior of AWS KMS key rotation in this scenario?

AWS KMS automatically initiates a background job to re-encrypt all historical reports in the S3 bucket using the new backing key version.

The operations team must manually update the application code to specify the new key version ID when retrieving reports created after the rotation date.

AWS KMS automatically retains older versions of the backing key, allowing historical reports to be decrypted seamlessly without any manual configuration.

The operations team must store the key rotation metadata as a plaintext parameter in AWS Systems Manager Parameter Store to track which key version decrypts each report.

Cevabı ve açıklamayı göster

Cevap: AWS KMS automatically retains older versions of the backing key, allowing historical reports to be decrypted seamlessly without any manual configuration.

Cevap

AWS KMS automatically retains older versions of the backing key, allowing historical reports to be decrypted seamlessly without any manual configuration.

The correct answer states that AWS KMS automatically retains older versions of the backing key. When automatic key rotation is enabled, AWS KMS generates a new backing key for encryption operations but keeps previous versions of the backing key active so that ciphertexts encrypted with them can still be decrypted. The decryption process remains completely seamless and requires no manual key selection, rotation tracking, or code changes.

Adım Adım Çözüm

Analyze how AWS KMS handles automatic key rotation for Customer Managed Keys (CMKs).

Confirm that automatic rotation generates a new backing key version for encryption, while preserving older versions of the backing key.

Allows older ciphertexts to remain decryptable using the corresponding key version under which they were originally encrypted.

Evaluate the decryption process for historical files after key rotation.

Identify that the metadata embedded within the ciphertext allows AWS KMS to automatically select the correct backing key version for decryption.

Eliminates the need for manual tracking, database mappings, or code changes in application decryption calls.

Cross-reference against security best practices and alternative systems.

Verify that re-encryption is not triggered automatically (which would be resource-intensive and unnecessary) and that storing metadata in plaintext in Parameter Store is a security anti-pattern.

Ensures the selected architecture adheres to least privilege and native AWS service mechanics.

Anahtar Kavram

AWS KMS Automatic Key Rotation and Backing Key Management

Tahmini Süre:1m 30s

Soru 1451Soru →

A company is hosting a reporting application on Amazon EC2 instances in a private subnet with CIDR block $10.0.4.0/24$ . The database tier runs on EC2 instances in a separate private subnet with CIDR block $10.0.5.0/24$ . The reporting application must initiate queries to the database on TCP port $5432$ . The company's security policy requires using both security groups and network ACLs to enforce strict isolation. The database must not be allowed to initiate any connections back to the reporting application. Which combination of actions will allow this traffic while maintaining the required security boundaries? (Select TWO.)

Geçerli olan tümünü seçin

Configure the database security group to allow inbound traffic on TCP port

5432

from the reporting application's security group.

Configure the network ACL associated with the database subnet to allow inbound traffic on TCP port

5432

from

10.0.4.0/24

and outbound traffic on TCP ports

1024-65535

10.0.4.0/24

Configure the database security group to allow inbound traffic on TCP port

5432

from the reporting application's security group, and add an outbound rule to allow return traffic on ephemeral ports.

Configure the network ACL associated with the database subnet to allow inbound traffic on TCP port

5432

from

10.0.4.0/24

, and rely on the stateful nature of network ACLs to permit the return database response.

Associate an AWS WAF Web ACL with the database subnet to inspect incoming database traffic and block unauthorized queries from the reporting subnet.

Cevabı ve açıklamayı göster

Cevap: Configure the database security group to allow inbound traffic on TCP port $5432$ from the reporting application's security group.; Configure the network ACL associated with the database subnet to allow inbound traffic on TCP port $5432$ from $10.0.4.0/24$ and outbound traffic on TCP ports $1024-65535$ to $10.0.4.0/24$ .

Cevap

Configure the database security group to allow inbound traffic on TCP port

5432

from the reporting application's security group, and configure the network ACL associated with the database subnet to allow inbound traffic on TCP port

5432

from

10.0.4.0/24

and outbound traffic on TCP ports

1024-65535

10.0.4.0/24

The correct architecture requires a combination of stateful security group rules and stateless network ACL rules. The database security group must allow inbound traffic on TCP port

5432

from the source security group; because security groups are stateful, return traffic is automatically allowed. The database subnet's network ACL must allow inbound traffic on port

5432

from the reporting subnet CIDR block, and since network ACLs are stateless, an outbound rule must also be configured to allow return traffic on the ephemeral port range (

1024-65535

) back to the reporting subnet.

Adım Adım Çözüm

Configure the stateful firewall (Security Group) for the database.

Create an inbound rule allowing TCP port

5432

from the reporting security group. No outbound rule is needed since security groups are stateful and track connection state.

Security groups evaluate traffic at the instance level and automatically allow return traffic for established sessions.

Configure the stateless firewall (Network ACL) rules for the database subnet.

Add an inbound rule allowing TCP port

5432

from the reporting subnet (

10.0.4.0/24

) and an outbound rule allowing TCP ports

1024-65535

to the reporting subnet (

10.0.4.0/24

Network ACLs operate at the subnet boundary and are stateless. Return traffic must be explicitly allowed using the ephemeral port range of the initiator.

Anahtar Kavram

Stateful vs. Stateless VPC Filtering

Tahmini Süre:1m 30s

Soru 1452Soru →

A company is migrating a legacy payment processing application to Amazon EC2. The database for the application stores sensitive cardholder data on Amazon EBS volumes. The company's security policy requires that all EBS volumes be encrypted at rest using a customer managed key in AWS KMS. Additionally, the policy mandates that the encryption keys be rotated annually, and that all existing volumes and snapshots remain decryptable without manual intervention or data re-encryption. Which two steps should a solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Enable automatic key rotation for the customer managed key in AWS KMS.

Configure Amazon EBS encryption to use the customer managed key when creating the volumes.

Create a new customer managed key annually and update the EC2 launch templates to reference the new key ARN.

Create a script to copy all existing EBS snapshots and re-encrypt them under the new key version after rotation.

Store the KMS key material as a plain String parameter in Systems Manager Parameter Store for the application to mount the volumes.

Cevabı ve açıklamayı göster

Cevap: Enable automatic key rotation for the customer managed key in AWS KMS.; Configure Amazon EBS encryption to use the customer managed key when creating the volumes.

Cevap

Configure Amazon EBS encryption to use the customer managed key when creating the volumes, and enable automatic key rotation for the customer managed key in AWS KMS.

To encrypt the EBS volumes securely with a customer managed key, Amazon EBS encryption must be configured to use the specified customer managed key. Enabling automatic key rotation in AWS KMS ensures that the key material is rotated annually without changing the key ARN or requiring any configuration updates. AWS KMS automatically retains the older key material so that existing volumes and snapshots can be decrypted transparently.

Adım Adım Çözüm

Identify the encryption requirement for the EBS volumes.

Determine that the volumes must be encrypted with a Customer Managed Key (CMK) in AWS KMS.

This satisfies the requirement to encrypt volumes using a customer managed key rather than the default AWS managed key.

Address the annual rotation requirement without manual intervention or re-encryption.

Enable automatic key rotation on the customer managed key in AWS KMS.

AWS KMS automatic key rotation generates new key material annually while retaining the old key material. This allows existing snapshots and volumes to be decrypted seamlessly without any manual re-encryption.

Anahtar Kavram

AWS KMS Customer Managed Key automatic rotation and EBS encryption integration.

Soru 1453Soru →

A company runs a critical data ingestion service on Amazon EC2 instances in a private subnet ( $172.31.20.0/24$ ). The instances must download software updates from a specific external HTTPS endpoint at $198.51.100.45/32$ . The VPC routes internet-bound traffic from the private subnet through a NAT Gateway located in a public subnet. The company requires strict restriction of traffic at the private subnet boundary. A solutions architect is configuring the Network ACL (NACL) associated with the private subnet. Which configuration will allow the EC2 instances to successfully download the updates while maintaining the most secure posture?

Configure an outbound NACL rule allowing TCP traffic to destination

198.51.100.45/32

on port

443

, and an inbound NACL rule allowing TCP traffic from source

198.51.100.45/32

on ports

1024

65535

Configure an outbound NACL rule allowing TCP traffic to destination

198.51.100.45/32

on port

443

. No inbound rule is required because Network ACLs automatically track connections and allow return traffic.

Configure an outbound NACL rule allowing TCP traffic to destination

198.51.100.45/32

on ports

1024

65535

, and an inbound NACL rule allowing TCP traffic from source

198.51.100.45/32

on port

443

Configure an outbound NACL rule allowing TCP traffic to the private IP address of the NAT Gateway on port

443

, and an inbound NACL rule allowing TCP traffic from the private IP address of the NAT Gateway on ports

1024

65535

Cevabı ve açıklamayı göster

Cevap: Configure an outbound NACL rule allowing TCP traffic to destination $198.51.100.45/32$ on port $443$ , and an inbound NACL rule allowing TCP traffic from source $198.51.100.45/32$ on ports $1024$ - $65535$ .

Cevap

Configure an outbound NACL rule allowing TCP traffic to destination

198.51.100.45/32

on port

443

, and an inbound NACL rule allowing TCP traffic from source

198.51.100.45/32

on ports

1024

65535

The correct configuration consists of an outbound NACL rule to TCP port 443 with the destination of the external server's IP address, and an inbound NACL rule from the external server's IP address targeting the ephemeral port range (1024-65535). Because Network ACLs (NACLs) are stateless, they do not track connection state, meaning separate rules must allow both the initial outgoing request and the incoming response. Additionally, since the NACL is evaluated at the private subnet boundary before the traffic reaches the NAT Gateway in the public subnet, the destination IP on the outbound rule must be the external server's public IP.

Adım Adım Çözüm

Analyze the direction and ports of the initial connection.

The connection is initiated by the EC2 instances in the private subnet targeting the external server's HTTPS port. The outbound packet has a destination IP of

198.51.100.45

and destination port

443

(HTTPS). The source port is a randomly allocated ephemeral port (typically

1024

65535

To allow the initial handshake to go out, the private subnet's NACL must permit outbound TCP traffic to the target IP on port 443.

Analyze the return traffic flow and evaluate NACL statelessness.

The external server responds by sending packets back. The inbound packet has a source IP of

198.51.100.45

, source port

443

, and a destination port in the ephemeral range (

1024

65535

). Since Network ACLs are stateless, they do not track connection state and require a rule to allow this inbound return traffic.

To prevent the return packets from being dropped at the private subnet boundary, an inbound rule permitting traffic from the target IP on ephemeral ports must be added.

Determine the impact of NAT Gateway routing on IP headers at the subnet boundary.

Although the traffic is routed through a NAT Gateway, the translation of the source IP address occurs at the NAT Gateway within the public subnet. At the private subnet boundary where the private subnet's NACL is evaluated, the destination IP on outbound packets remains the public IP of the external server (

198.51.100.45/32

The NACL rules must reference the external destination IP rather than the NAT Gateway's IP address.

Anahtar Kavram

Network ACLs (NACLs) act as stateless firewalls at the subnet level. Because they are stateless, any allowed outbound traffic must have a corresponding inbound rule to permit the return traffic, which typically targets the client's ephemeral port range (TCP 1024-65535). Furthermore, NACL rules are evaluated before NAT processing occurs, so they must target the final destination IP address.

Tahmini Süre:1m 30s

Soru 1454Soru →

A financial services firm hosts a transaction processing application on Amazon EC2 instances in private subnets of a VPC. The instances must retrieve database credentials from AWS Secrets Manager and write transaction logs to an Amazon DynamoDB table. The architecture must prevent all traffic to these services from traversing the public internet, and data transfer costs must be minimized. Which TWO actions should a solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Create an interface VPC endpoint for AWS Secrets Manager in the private subnets and enable private DNS.

Create a gateway VPC endpoint for Amazon DynamoDB and associate it with the private subnet route tables.

Deploy a NAT Gateway in a public subnet, and route all DynamoDB traffic through the NAT Gateway.

Configure a security group for the Amazon DynamoDB table that allows inbound HTTPS traffic from the EC2 instances' security group.

Associate a security group with the gateway VPC endpoint for DynamoDB to restrict traffic to the EC2 instances.

Cevabı ve açıklamayı göster

Cevap: Create an interface VPC endpoint for AWS Secrets Manager in the private subnets and enable private DNS.; Create a gateway VPC endpoint for Amazon DynamoDB and associate it with the private subnet route tables.

Cevap

The correct configurations are to create an interface VPC endpoint for AWS Secrets Manager with private DNS enabled, and to create a gateway VPC endpoint for Amazon DynamoDB associated with the private subnet route tables.

Creating an interface VPC endpoint for AWS Secrets Manager provides secure, private connectivity via PrivateLink and private DNS. Creating a gateway VPC endpoint for DynamoDB provides a secure, cost-free route to DynamoDB that is managed directly via the private subnet route tables, fulfilling both the isolation and cost-minimization requirements.

Adım Adım Çözüm

Analyze the access requirements for AWS Secrets Manager.

Secrets Manager requires an interface VPC endpoint (AWS PrivateLink) to allow private access without internet traversal.

Secrets Manager is a VPC-external service that does not support gateway endpoints, and interface endpoints with private DNS enable seamless private access.

Analyze the access and cost requirements for Amazon DynamoDB.

DynamoDB supports both gateway and interface VPC endpoints, but a gateway endpoint is free of hourly and data processing charges.

Using a gateway endpoint meets the cost minimization requirement while keeping all traffic internal within the AWS network.

Anahtar Kavram

Private VPC access to AWS services using VPC endpoints (Gateway and Interface types) to secure traffic and optimize costs.

Soru 1455Soru →

An e-commerce business needs to secure its application backend. The application requires access to a relational database, and its credentials must be rotated every 30 days. Additionally, the transaction data is stored in an Amazon DynamoDB table and must be encrypted at rest using an AWS Key Management Service (AWS KMS) customer managed key that undergoes automatic annual rotation. Which combination of actions will satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Store the database credentials in AWS Secrets Manager and configure Secrets Manager to automatically rotate the credentials every 30 days using an AWS Lambda function.

Store the database credentials in AWS Systems Manager Parameter Store as a String parameter, and configure a scheduled Amazon EventBridge rule to update the parameter value every 30 days.

Create a symmetric customer managed key in AWS KMS, enable automatic key rotation, and configure the DynamoDB table to use this customer managed key.

Create a symmetric customer managed key in AWS KMS, enable automatic key rotation, and implement a custom AWS Lambda function to re-encrypt all existing DynamoDB items using the new key version immediately after each rotation.

Store the database credentials in AWS Secrets Manager, and configure the AWS account root user to execute the rotation Lambda function every 30 days.

Cevabı ve açıklamayı göster

Cevap: Store the database credentials in AWS Secrets Manager and configure Secrets Manager to automatically rotate the credentials every 30 days using an AWS Lambda function.; Create a symmetric customer managed key in AWS KMS, enable automatic key rotation, and configure the DynamoDB table to use this customer managed key.

Cevap

To meet the security requirements, the database credentials should be stored in AWS Secrets Manager with automatic rotation enabled every 30 days using an AWS Lambda function. Additionally, a symmetric customer managed key should be created in AWS KMS with automatic key rotation enabled, and the DynamoDB table should be configured to use this key.

The correct solution involves two main parts. First, database credentials must be stored in AWS Secrets Manager, which natively supports automatic rotation every 30 days using an AWS Lambda function. Second, the DynamoDB table must be encrypted using a symmetric customer managed key created in AWS KMS, with automatic key rotation enabled. This ensures that AWS KMS automatically rotates the backing key material every year without affecting the application or requiring manual re-encryption of the data.

Adım Adım Çözüm

Store the database credentials securely and enable automated rotation.

AWS Secrets Manager is configured with a rotation interval of 30 days, utilizing an AWS Lambda function to update the database credentials without downtime.

AWS Secrets Manager is designed for storing secrets such as database credentials and provides built-in rotation integration with AWS Lambda.

Configure encryption at rest for the DynamoDB table using a customer managed key.

A symmetric customer managed key in AWS KMS is created with automatic key rotation enabled, and DynamoDB is configured to encrypt the table data using this key.

Using a customer managed key with automatic rotation enabled meets the requirement of annual key rotation while ensuring DynamoDB encrypts all data at rest securely.

Anahtar Kavram

Securing sensitive application credentials using AWS Secrets Manager with automated rotation, and encrypting DynamoDB data at rest using a customer managed key in AWS KMS with automatic rotation.

Soru 1456Soru →

A company runs an internal reporting service on Amazon EC2 instances in a management subnet, and a database indexing service on EC2 instances in a data subnet within the same VPC. A solutions architect must configure the VPC network security to meet the following requirements:
1. The reporting service must be able to initiate TCP connections to the database indexing service on port $8080$ .
2. The database indexing service must be prevented from initiating any connections to the reporting service.
3. Both services must be able to send responses to any successfully established connections.

Which security group configuration will meet these requirements with the least administrative effort?

Configure the reporting service security group with an outbound rule allowing TCP traffic to the database indexing service security group on port

8080

. Configure the database indexing service security group with an inbound rule allowing TCP traffic from the reporting service security group on port

8080

. Do not add any inbound rules to the reporting service security group or outbound rules to the database indexing service security group.

Configure the reporting service security group with an outbound rule allowing TCP traffic to the database indexing service security group on port

8080

and an inbound rule allowing return TCP traffic from it. Configure the database indexing service security group with an inbound rule allowing TCP traffic from the reporting service security group on port

8080

and an outbound rule allowing return TCP traffic to it.

Configure a Network ACL on the management subnet to allow outbound TCP traffic to the data subnet on port

8080

, and configure a Network ACL on the data subnet to allow inbound TCP traffic from the management subnet on port

8080

. Remove all security group rules to simplify configuration.

Deploy AWS WAF in both subnets. Configure Web ACL rules on the management subnet to block all incoming web requests from the data subnet, and configure Web ACL rules on the data subnet to allow incoming requests from the management subnet on port

8080

Cevabı ve açıklamayı göster

Cevap: Configure the reporting service security group with an outbound rule allowing TCP traffic to the database indexing service security group on port $8080$ . Configure the database indexing service security group with an inbound rule allowing TCP traffic from the reporting service security group on port $8080$ . Do not add any inbound rules to the reporting service security group or outbound rules to the database indexing service security group.

Cevap

Configure the security group of the initiating service with an outbound rule pointing to the destination service's security group, and configure the destination service's security group with an inbound rule allowing traffic from the initiating service's security group.

AWS Security Groups are stateful. When a rule allows outbound traffic to proceed (such as the reporting service connecting to the database indexing service), the return response traffic is automatically permitted regardless of any inbound rules. Similarly, when an inbound rule allows traffic to reach the database indexing service, the outbound response is automatically allowed. Therefore, configuring only the outbound rule on the initiator and the inbound rule on the receiver is the most secure configuration with the least administrative effort.

Adım Adım Çözüm

Analyze connection requirements

The reporting service is the initiator (requires outbound permission on port

8080

). The database indexing service is the receiver (requires inbound permission on port

8080

Security group rules must be aligned with connection initiation direction.

Leverage security group statefulness

Since security groups are stateful, response traffic is automatically allowed. Explicit inbound rules for return traffic on the reporting service and outbound rules for return traffic on the database indexing service are not required.

This minimizes the number of security group rules and administrative overhead.

Apply least privilege rules to security groups

Allow outbound TCP on port

8080

from the reporting service security group to the database indexing service security group. Allow inbound TCP on port

8080

to the database indexing service security group from the reporting service security group.

This configuration secures the communication path without exposing either service to unauthorized connection initiations.

Anahtar Kavram

Stateful behavior of AWS Security Groups

Tahmini Süre:1m 30s

Soru 1457Soru →

A company stores database backups on Amazon EBS volumes. The volumes must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS. Regulatory compliance requires that the key be rotated every year, and historical data must remain accessible without requiring manual re-encryption of the volumes. Which configuration meets these requirements with the least administrative effort?

Enable automatic key rotation for the CMK in AWS KMS. AWS KMS will generate a new backing key annually while keeping previous backing keys active to decrypt existing volumes.

Enable automatic key rotation for the CMK. Once the rotation occurs, AWS KMS will automatically re-encrypt all existing EBS volumes and snapshots using the new key version.

Create a new CMK manually each year, store the key parameters and configuration details as plaintext parameters in Systems Manager Parameter Store, and run a script to update the EBS volume encryption keys.

Manually create a new CMK annually, associate the new CMK with the EBS volumes, and delete the old CMK to ensure that only the latest key is used for encryption and decryption.

Cevabı ve açıklamayı göster

Cevap: Enable automatic key rotation for the CMK in AWS KMS. AWS KMS will generate a new backing key annually while keeping previous backing keys active to decrypt existing volumes.

Cevap

Enable automatic key rotation for the CMK in AWS KMS. AWS KMS will generate a new backing key annually while keeping previous backing keys active to decrypt existing volumes.

Enabling automatic key rotation for a Customer Managed Key (CMK) in AWS KMS is the most efficient way to meet the requirements. It automatically rotates the backing key annually without needing manual configuration updates. When data is written, it is encrypted using the new backing key. When older data (historical backups) is read, AWS KMS automatically uses the corresponding older backing key that encrypted it, avoiding any need to re-encrypt the historical EBS volumes.

Adım Adım Çözüm

Select the Customer Managed Key (CMK) in the AWS KMS console or use the AWS CLI/API.

Identify the key used for EBS volume encryption.

This is the target key that requires rotation configuration.

Enable automatic key rotation on the selected CMK.

AWS KMS configures the key to rotate its backing key automatically once per year.

This satisfies the annual rotation requirement with zero ongoing administrative effort.

Keep the previous backing keys active within AWS KMS.

Historical EBS volume backups remain decryptable.

AWS KMS automatically manages the mapping of rotated keys, allowing old data to be read transparently while new data uses the new backing key.

Anahtar Kavram

AWS KMS Customer Managed Key automatic key rotation mechanics and how it affects historical data decryption without re-encryption.

Soru 1458Soru →

A company is deploying a two-tier application in a VPC. The application tier runs on Amazon EC2 instances in a private subnet with CIDR block $10.0.1.0/24$ . The database tier runs on an Amazon RDS for SQL Server DB instance in a separate database subnet with CIDR block $10.0.2.0/24$ . The database instance listens on TCP port $1433$ . The network architecture requires using a custom Network Access Control List (Network ACL) for the database subnet to restrict traffic. Which combination of Network ACL rules must be applied to the database subnet to allow the application tier to connect to the database?

An inbound rule that allows TCP traffic on port

1433

from

10.0.1.0/24

, and an outbound rule that allows TCP traffic on ports

1024-65535

10.0.1.0/24

An inbound rule that allows TCP traffic on port

1433

from

10.0.1.0/24

, and an outbound rule that allows TCP traffic on port

1433

10.0.1.0/24

An inbound rule that allows TCP traffic on port

1433

from

10.0.1.0/24

, with no outbound rules required because Network ACLs automatically track connection state.

An inbound rule that allows TCP traffic on port

1433

from the Security Group ID of the application tier EC2 instances, and an outbound rule that allows all traffic to

0.0.0.0/0

Cevabı ve açıklamayı göster

Cevap: An inbound rule that allows TCP traffic on port $1433$ from $10.0.1.0/24$ , and an outbound rule that allows TCP traffic on ports $1024-65535$ to $10.0.1.0/24$ .

Cevap

An inbound rule that allows TCP traffic on port

1433

from

10.0.1.0/24

, and an outbound rule that allows TCP traffic on ports

1024-65535

10.0.1.0/24

Network ACLs are stateless filters that apply to subnets. A database connection requires an inbound rule to allow traffic from the application subnet to the database port (

1433

). Because Network ACLs do not track connection states, a corresponding outbound rule must be created to allow the database's responses back to the application subnet. Since clients initiate connections from a random port within their ephemeral port range (

1024-65535

), the outbound rule must allow traffic to this destination port range.

Adım Adım Çözüm

Determine the stateless nature of Network ACLs

Identify that both inbound traffic (requests) and outbound traffic (responses) must be explicitly allowed by the Network ACL.

Unlike security groups, Network ACLs do not automatically permit return traffic.

Determine the traffic ports for the inbound request

Allow inbound TCP traffic on port

1433

(SQL Server) originating from the application subnet CIDR

10.0.1.0/24

This allows the application instances to initiate a connection to the SQL Server database.

Identify the return port range for outbound responses

Allow outbound TCP traffic to the client's ephemeral port range

1024-65535

destined for the application subnet

10.0.1.0/24

When a client establishes a connection, it uses an ephemeral port as the source port. The database responds back to this port range, which must be allowed through the stateless Network ACL.

Anahtar Kavram

VPC Network ACL Statelessness and Ephemeral Ports

Tahmini Süre:1m 30s

Soru 1459Soru →

A solutions architect is designing the network security for a three-tier application. Web servers are located in a public subnet, application servers are in private subnet A, and a database cluster is hosted in private subnet B. The database cluster only needs to receive incoming database queries from the application servers over TCP port 5432. All other network traffic to the database cluster must be blocked. Which configuration should the solutions architect implement to meet these requirements with the minimum administrative overhead?

Associate a security group with the database cluster that allows inbound traffic on TCP port 5432 from the security group associated with the application servers.

Associate a security group with the database cluster that allows inbound traffic on TCP port 5432 from the security group of the application servers, and configure an outbound security group rule to allow traffic back to the application servers on ephemeral TCP ports.

Configure a network ACL for private subnet B that allows inbound traffic on TCP port 5432 from the CIDR range of private subnet A, without adding any outbound rules.

Associate an AWS WAF web ACL with the database instances to inspect incoming traffic and block any request not originating from the application servers on TCP port 5432.

Cevabı ve açıklamayı göster

Cevap: Associate a security group with the database cluster that allows inbound traffic on TCP port 5432 from the security group associated with the application servers.

Cevap

Associate a security group with the database cluster that allows inbound traffic on TCP port 5432 from the security group associated with the application servers.

Allowing inbound traffic on TCP port 5432 from the application server's security group is correct because security groups are stateful; return traffic is allowed automatically. Referencing the application security group directly provides dynamic, minimal administrative control.

Adım Adım Çözüm

Analyze the stateful nature of Security Groups and stateless nature of Network ACLs.

Identify that Security Groups automatically track connections, making manual outbound rules for return traffic unnecessary, while Network ACLs require explicit rules for both directions.

This determines whether outbound rules for ephemeral port return traffic are needed.

Evaluate the administrative overhead of using CIDR ranges vs. security group references.

Referencing the application server's security group allows the configuration to dynamically scale without modifying rules when instances are added or replaced.

This meets the requirement of 'minimum administrative overhead' and provides least-privilege access control.

Verify if the correct AWS security tool is being proposed for the traffic type.

AWS WAF is inappropriate because database connection requests on port 5432 do not use the HTTP/HTTPS protocols that WAF filters.

This rules out using WAF for database port filtering.

Anahtar Kavram

Security groups are stateful and support referencing other security groups as traffic sources to enable least-privilege, dynamic network access control.

Soru 1460Soru →

A company has a three-tier web application hosted in a VPC. The database tier resides in a private subnet and needs to retrieve software patches from an external repository on the internet, while blocking all other outbound and inbound traffic. A NAT gateway has been deployed in a public subnet to facilitate outbound internet access. Which configurations should a solutions architect implement to secure this network path while ensuring successful patch downloads? (Select TWO.)

Geçerli olan tümünü seçin

Configure the database instances' security group to allow outbound HTTP and HTTPS traffic to the destination IP range of the external repository.

Configure the network ACL of the database subnet to allow outbound HTTP and HTTPS traffic to the public subnet, and allow inbound traffic on ephemeral ports (1024-65535) from the public subnet.

Configure the network ACL of the database subnet to allow outbound HTTP and HTTPS traffic to the public subnet, relying on the stateful nature of network ACLs to permit the return traffic.

Associate a security group directly with the NAT gateway to allow inbound traffic from the database subnet on ports 80 and 443.

Configure the database instances' security group to allow inbound traffic from the external repository on ephemeral ports (1024-65535) to receive the patch responses.

Cevabı ve açıklamayı göster

Cevap: Configure the database instances' security group to allow outbound HTTP and HTTPS traffic to the destination IP range of the external repository.; Configure the network ACL of the database subnet to allow outbound HTTP and HTTPS traffic to the public subnet, and allow inbound traffic on ephemeral ports (1024-65535) from the public subnet.

Cevap

Configure the database instances' security group to allow outbound HTTP/HTTPS traffic to the destination IP range, and configure the database subnet's network ACL to allow outbound HTTP/HTTPS traffic to the public subnet while allowing inbound traffic on ephemeral ports (1024-65535) from the public subnet.

The correct configurations are to configure the database instances' security group to allow outbound HTTP/HTTPS traffic, and configure the database subnet's network ACL to allow outbound HTTP/HTTPS traffic as well as inbound ephemeral port traffic. Because security groups are stateful, they automatically track connections and allow return traffic without an explicit inbound rule. Because network ACLs are stateless, they require explicit rules for both outbound request traffic and inbound response traffic.

Adım Adım Çözüm

Evaluate security group statefulness.

The security group associated with the database EC2 instances must permit outbound HTTP/HTTPS traffic. Since security groups are stateful, return traffic on ephemeral ports is automatically allowed without requiring an inbound rule.

To allow the outbound connection initiation from the database to the external repository.

Evaluate network ACL statelessness.

The network ACL associated with the database subnet must allow outbound HTTP/HTTPS traffic to the public subnet. Because network ACLs are stateless, a corresponding inbound rule must also be configured to allow return traffic on ephemeral ports (1024-65535) from the public subnet.

To permit both the outgoing request and the incoming response across the stateless subnet boundary.

Eliminate incorrect options based on service limitations and firewall state characteristics.

NAT gateways do not support security groups. Outbound security group rules do not require matching inbound ephemeral rules due to statefulness. Network ACLs do not track state, so outbound-only rules will block return traffic.

To rule out invalid configurations that violate AWS platform features or firewall behaviors.

Anahtar Kavram

VPC Network Security

ÖncekiSayfa 73 / 74Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram