Tüm alıştırma soruları

1462 soru

Tüm türler1,462 Çoktan seçmeli739 Çoklu seçim723

A digital music streaming provider hosts its platform backend in the us-east-1 Region. The architecture consists of an Application Load Balancer (ALB) and Amazon EC2 instances in an Auto Scaling group, with data stored in an Amazon RDS for PostgreSQL DB instance. The provider wants to implement a disaster recovery (DR) strategy in the us-west-2 Region to achieve a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes. The solution must minimize ongoing infrastructure costs in the secondary region.

Which configuration will meet these requirements?

Configure a cross-region read replica of the RDS DB instance in us-west-2. Deploy a pilot light environment in us-west-2 with an Auto Scaling group set to a minimum capacity of 0. Write a script to promote the read replica, scale up the Auto Scaling group, and configure Amazon Route 53 failover routing.

Configure a cross-region read replica of the RDS DB instance in us-west-2. Deploy a warm standby environment in us-west-2 with an Auto Scaling group running at a reduced capacity of 2 instances. Configure Amazon Route 53 latency routing to route traffic to the region with the lowest latency.

Create hourly snapshots of the RDS DB instance and copy them to us-west-2. Store the snapshots in Amazon S3 Glacier Flexible Retrieval. Deploy a pilot light environment in us-west-2 with an Auto Scaling group set to a minimum capacity of 0. In a failover event, restore the database from the S3 Glacier snapshot.

Deploy a Multi-AZ DB cluster for the RDS PostgreSQL DB instance with the primary in us-east-1 and a standby replica in us-west-2. Configure an Auto Scaling group in us-west-2 to automatically launch EC2 instances when the primary region fails. Configure Amazon Route 53 failover routing.

Cevabı ve açıklamayı göster

Cevap: Configure a cross-region read replica of the RDS DB instance in us-west-2. Deploy a pilot light environment in us-west-2 with an Auto Scaling group set to a minimum capacity of 0. Write a script to promote the read replica, scale up the Auto Scaling group, and configure Amazon Route 53 failover routing.

Cevap

Configure a cross-region read replica of the RDS DB instance in us-west-2, deploy a pilot light environment in us-west-2 with an Auto Scaling group capacity of 0, and use automated scripts to promote the replica, scale up the compute resources, and update Route 53 failover routing.

The correct option uses an Amazon RDS cross-region read replica to satisfy the 5-minute RPO since database replication is asynchronous and near real-time. Deploying a pilot light environment with an Auto Scaling group capacity of 0 ensures that no EC2 instances are running during normal operations, minimizing ongoing costs. In the event of a failover, promoting the replica and scaling up the Auto Scaling group via automated scripts can easily be completed within the 15-minute RTO. Finally, Amazon Route 53 failover routing ensures traffic is redirected to the disaster recovery region.

Adım Adım Çözüm

Select the database replication method that satisfies the 5-minute RPO.

Identify that cross-region read replicas use continuous asynchronous replication, keeping data lag to a few seconds, which satisfies the RPO. Hourly snapshots fail the RPO requirement.

We must ensure database changes are copied to the secondary region fast enough to meet the 5-minute RPO threshold.

Determine the most cost-effective compute deployment in the recovery region.

Choose a Pilot Light configuration where the Auto Scaling group has a minimum capacity of 0. This avoids paying for running EC2 instances during normal operations.

The scenario requires minimizing ongoing infrastructure costs, and a Pilot Light environment is cheaper than a Warm Standby.

Establish the failover mechanism to meet the 15-minute RTO.

Utilize Amazon Route 53 failover routing to automatically detect primary region failure. Write automated scripts to promote the cross-region read replica to a standalone database and scale the EC2 Auto Scaling group from 0 to its target capacity.

Manual promotion and scaling would take too long, so automation is necessary to guarantee recovery within 15 minutes.

Anahtar Kavram

Cross-Region Disaster Recovery (DR) Strategies (Pilot Light vs. Warm Standby) and RDS Replication

Soru 162Soru →

A genomic research organization is establishing a multi-account environment on AWS using AWS Control Tower to isolate clinical datasets. The organization wants to federate user access using their existing on-premises Active Directory identity provider. Additionally, the security policy mandates that no long-term credentials (such as access keys) can be generated for IAM users in any member account, and standard daily administration must not utilize root user credentials.

Which combination of actions will meet these requirements while maintaining centralized governance? (Select TWO.)

Geçerli olan tümünü seçin

Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using an Active Directory Connector to manage user access across the AWS accounts.

Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level that denies iam:CreateUser and iam:CreateAccessKey API calls.

Create individual IAM users in each member account corresponding to Active Directory users and distribute long-term AWS access keys for federated access.

Configure the root user of each member account to run standard administrative tasks, securing the accounts by rotating the root password daily using a custom AWS Lambda function.

Use the root credentials of the management account to create local IAM users with root privileges in each member account for standard administration.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using an Active Directory Connector to manage user access across the AWS accounts.; Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level that denies iam:CreateUser and iam:CreateAccessKey API calls.

Cevap

Configure AWS IAM Identity Center connected to the on-premises Active Directory via an Active Directory Connector, and apply a Service Control Policy (SCP) at the Organizational Unit (OU) level that denies user and access key creation.

The correct combination involves integrating AWS IAM Identity Center with the on-premises Active Directory using an Active Directory Connector, which provides single sign-on access with short-term credentials. Concurrently, a Service Control Policy (SCP) applied at the Organizational Unit level centrally denies the creation of new IAM users and long-term access keys, ensuring strict compliance across all member accounts.

Adım Adım Çözüm

Evaluate the federation requirement.

Identify that AWS IAM Identity Center can integrate with an on-premises Active Directory (using AD Connector) to manage identity federation centralized, avoiding local IAM users.

This meets the federation objective without manual local credential management.

Evaluate the policy to prevent long-term IAM credential generation.

Formulate a Service Control Policy (SCP) that denies iam:CreateUser and iam:CreateAccessKey API actions.

Applying this SCP at the OU level prevents users and administrators in member accounts from creating static credentials.

Ensure root credentials are not used for standard operations.

Rely on AWS IAM Identity Center permission sets mapped to federated roles for daily administrative work instead of logging into root accounts.

This aligns with the AWS well-architected framework for multi-account access governance.

Anahtar Kavram

Multi-Account Security Governance and Identity Federation

Soru 163Soru →

A financial services firm is implementing a multi-account governance strategy using AWS Organizations. The security department requires that no users or roles within any member account, including local administrators, can delete Amazon RDS automated or manual database snapshots. Furthermore, the firm wants to enable employees to access AWS resources using their existing corporate credentials, ensuring that no long-term IAM user credentials are created in individual member accounts. Which strategy should the solutions architect recommend to satisfy these requirements?

Enable AWS IAM Identity Center and integrate it with the corporate identity provider for federated access. Create a Service Control Policy (SCP) that denies the rds:DeleteDBSnapshot and rds:DeleteDBClusterSnapshot actions, and attach the SCP to the organization root or the Organizational Units containing the member accounts.

Create individual IAM users with long-term credentials in each member account for every corporate user. Write an IAM policy that denies RDS snapshot deletion and attach it to each IAM user to prevent unauthorized modifications.

Enable AWS IAM Identity Center and integrate it with the corporate identity provider. Create a Service Control Policy (SCP) that denies the rds:DeleteDBSnapshot and rds:DeleteDBClusterSnapshot actions, and attach it to the organization's management account to enforce restrictions on all administrative actions in both the management and member accounts.

Configure the organization's management account root user credentials to perform all daily administrative tasks in member accounts. Create an IAM policy denying the deletion of RDS snapshots and apply it directly to the management account's root user credentials.

Cevabı ve açıklamayı göster

Cevap: Enable AWS IAM Identity Center and integrate it with the corporate identity provider for federated access. Create a Service Control Policy (SCP) that denies the rds:DeleteDBSnapshot and rds:DeleteDBClusterSnapshot actions, and attach the SCP to the organization root or the Organizational Units containing the member accounts.

Cevap

Enable AWS IAM Identity Center integrated with the corporate identity provider, and apply a Service Control Policy (SCP) denying the database snapshot deletion actions to the organization root or organizational units.

The correct strategy combines AWS IAM Identity Center with a Service Control Policy (SCP) applied at the organization level. AWS IAM Identity Center enables seamless identity federation with the corporate directory, removing the need for local IAM users and long-term access keys. Applying an SCP that denies the database snapshot deletion actions to the organization root or OUs establishes a mandatory security guardrail that cannot be bypassed by any user or role in the member accounts, including local administrators.

Adım Adım Çözüm

Configure identity federation using AWS IAM Identity Center connected to the corporate identity provider.

Users can log in using corporate credentials without creating individual IAM users with long-term security keys in member accounts.

This meets the requirement of centralized single sign-on and adheres to the security principle of not distributing long-term credentials.

Write a Service Control Policy (SCP) with an explicit Deny statement for rds:DeleteDBSnapshot and rds:DeleteDBClusterSnapshot.

A policy document is created that blocks any delete operations on RDS database snapshots.

Explicit denies in SCPs act as guardrails that override any local administrator permissions.

Attach the SCP to the organization root or specific OUs containing the member accounts.

The restriction is enforced across all member accounts within the scope of the organization root or OUs.

This ensures the security guardrail is inherited by all target member accounts, preventing snapshot deletion by any user or role.

Anahtar Kavram

Centralized multi-account governance using AWS IAM Identity Center for identity federation and Service Control Policies (SCPs) for policy enforcement.

Soru 164Soru →

An application developer has deployed a web server on an Amazon EC2 instance inside a public subnet. To control traffic, the developer associates a custom Network Access Control List (NACL) with the subnet. The developer adds an inbound rule allowing TCP traffic on port 80 from any IP address to reach the web server. However, external web clients are unable to load the webpage hosted on the server.

Which configuration change is necessary to allow the web clients to successfully establish a connection?

Verify that the Network Access Control List has a corresponding outbound rule for port 80, as the Network Access Control List will automatically handle the return traffic dynamically.

Configure the outbound rules of the associated Security Group to allow traffic to ephemeral ports, as Security Groups are stateless by default.

Add an outbound rule to the Network Access Control List that allows TCP traffic to ephemeral ports (1024-65535).

Deploy AWS WAF to bypass the Network Access Control List rules and handle the outbound session tracking.

Cevabı ve açıklamayı göster

Cevap: Add an outbound rule to the Network Access Control List that allows TCP traffic to ephemeral ports (1024-65535).

Cevap

Add an outbound rule to the Network Access Control List that allows TCP traffic to ephemeral ports (1024-65535)

Network Access Control Lists are stateless, meaning that outbound response traffic must be explicitly allowed even if the inbound request was permitted. When a client initiates a connection to a web server (port 80), the server sends the response back to a random port in the client's ephemeral port range (typically 1024-65535). Therefore, an outbound rule allowing traffic to these ephemeral ports is required.

Adım Adım Çözüm

Identify the firewall layer causing the block.

The block is happening at the subnet level because of the custom Network Access Control List, which defaults to denying outbound traffic.

We need to determine why traffic is blocked despite the inbound rules being correct.

Analyze the statefulness behavior of the firewall layers.

Security Groups are stateful and automatically allow response traffic, whereas Network Access Control Lists are stateless and require explicit outbound rules for response traffic.

This helps determine whether the configuration needs to happen at the Security Group or Network Access Control List layer.

Determine the destination ports for the outbound return traffic.

Web clients connect using ephemeral ports (1024-65535), so the return traffic from the web server (originating from port 80) is destined for these ephemeral ports.

This ensures the outbound Network Access Control List rule is configured with the correct port range.

Anahtar Kavram

Network Access Control Lists are stateless firewalls at the subnet level, meaning that return traffic must be explicitly allowed via outbound rules, typically targeting the client's ephemeral port range.

Soru 165Soru →

A company has hired an external auditing firm to review sensitive database logs stored in an Amazon S3 bucket. The logs are encrypted with a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS). The audit team uses their own AWS account to manage their IAM users. A solutions architect must design a secure architecture to grant the external auditors temporary, read-only access to the logs. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Create an IAM role in the company's AWS account with a trust policy that trusts the external auditors' AWS account, and attach a read-only S3 permissions policy to the role.

Configure the KMS key policy of the Customer Managed Key (CMK) to grant the external auditors' assumed IAM role decryption permissions.

Create individual IAM users in the company's AWS account for each auditor, and grant them read-only permissions using long-term credentials.

Enable automatic key rotation for the KMS Customer Managed Key (CMK) to automatically re-encrypt the historical logs under a new key version.

Share the AWS account root user credentials with the auditing team to allow direct access to the KMS keys and S3 buckets.

Cevabı ve açıklamayı göster

Cevap: Create an IAM role in the company's AWS account with a trust policy that trusts the external auditors' AWS account, and attach a read-only S3 permissions policy to the role.; Configure the KMS key policy of the Customer Managed Key (CMK) to grant the external auditors' assumed IAM role decryption permissions.

Cevap

Creating an IAM role in the company's AWS account with a trust policy that trusts the external auditors' account while attaching a read-only S3 policy, and updating the KMS key policy of the Customer Managed Key to grant decryption permissions to the auditors' assumed role.

The correct solution requires configuring cross-account access via an IAM role and granting access to the KMS Customer Managed Key used for encrypting the S3 objects. First, creating an IAM role in the trusting account (the company's account) with a trust policy that specifies the trusted account (the auditors' account) allows the auditors to assume the role. Attaching a read-only S3 policy restricts their access to the required resources. Second, since the objects are encrypted using a Customer Managed Key, KMS requires that the key policy itself explicitly trust the assumed IAM role for decryption operations.

Adım Adım Çözüm

Configure trust relationship for cross-account access.

An IAM role is created in the company's account that trusts the auditors' AWS account ID, allowing their IAM users to assume the role.

This establishes a secure trust boundary without creating long-term credentials for external entities.

Assign read-only permissions to the S3 bucket.

An IAM policy is attached to the role granting read-only access to the specific S3 bucket.

This adheres to the principle of least privilege by ensuring the role can only read the logs.

Update the KMS Customer Managed Key policy.

The KMS key policy is modified to grant the assumed role permissions to perform the decrypt operation.

Because the objects are encrypted using a Customer Managed Key, the role needs explicit decryption permissions in the key policy as S3 permissions alone are insufficient.

Anahtar Kavram

AWS KMS key policies and cross-account IAM roles for delegation of access to encrypted S3 resources.

Soru 166Soru →

A solutions architect is designing a multi-account environment using AWS Organizations for a company. The company requires that all employees authenticate using their existing corporate external identity provider (IdP) to access AWS resources. Additionally, the security team mandates that CloudTrail must be enabled in all member accounts, and no administrator in any member account should be able to disable it. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure AWS IAM Identity Center to federate with the external IdP and assign permission sets to manage user access across the member accounts.

Implement a Service Control Policy (SCP) at the organization's root level that denies the cloudtrail:StopLogging action, and apply it to all member organizational units (OUs).

Create individual IAM users in the management account for each corporate employee, generate access keys, and configure cross-account roles to delegate access to member accounts.

Use the AWS Organizations management account root user credentials to configure local IAM users and deploy CloudTrail configurations across all member accounts.

Create an IAM role with administrator access in each member account and configure AD Connector in every member account to synchronize users directly to those roles.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center to federate with the external IdP and assign permission sets to manage user access across the member accounts.; Implement a Service Control Policy (SCP) at the organization's root level that denies the cloudtrail:StopLogging action, and apply it to all member organizational units (OUs).

Cevap

Configure AWS IAM Identity Center to federate with the external IdP and assign permission sets, and implement a Service Control Policy (SCP) at the organization's root level that denies the cloudtrail:StopLogging action.

The correct combination of actions leverages AWS IAM Identity Center for federated identity management and Service Control Policies (SCPs) for centralized account governance. Configuring AWS IAM Identity Center enables staff to log in using the external identity provider (IdP) with role-based access, while applying an SCP that denies the 'cloudtrail:StopLogging' action to the organizational units ensures that member account administrators cannot disable audit logging.

Adım Adım Çözüm

Address the authentication requirement by configuring identity federation.

AWS IAM Identity Center is connected to the corporate external Identity Provider (IdP), enabling single sign-on (SSO) and temporary credentials.

This centralizes authentication and avoids managing individual IAM users with long-term credentials.

Address the governance and auditing requirement by using AWS Organizations policies.

A Service Control Policy (SCP) is created in the management account that denies actions like cloudtrail:StopLogging and applied to member OUs.

This enforces organizational guardrails that cannot be overridden by administrators in member accounts.

Anahtar Kavram

AWS Organizations and AWS IAM Identity Center governance integration

Soru 167Soru →

A startup is hosting a public-facing web application using an Amazon CloudFront distribution as the entry point. The startup needs to protect the application from common web exploits, such as SQL injection, and secure the infrastructure against sophisticated network-layer Distributed Denial of Service (DDoS) attacks. Which TWO actions should the Solutions Architect take to meet these requirements?

Geçerli olan tümünü seçin

Associate an AWS WAF web ACL with the Amazon CloudFront distribution to filter application-layer exploits.

Enable AWS Shield Advanced on the Amazon CloudFront distribution to provide enhanced protection against network and transport layer DDoS attacks.

Configure a security group on the Amazon CloudFront distribution to restrict inbound traffic to specific source IP ranges.

Create stateless Network Access Control List (NACL) rules at the subnet level to automatically block SQL injection and cross-site scripting attacks.

Use AWS Shield Standard to inspect incoming HTTP requests and automatically block cross-site scripting (XSS) attacks.

Cevabı ve açıklamayı göster

Cevap: Associate an AWS WAF web ACL with the Amazon CloudFront distribution to filter application-layer exploits.; Enable AWS Shield Advanced on the Amazon CloudFront distribution to provide enhanced protection against network and transport layer DDoS attacks.

Cevap

Associate an AWS WAF web ACL with the Amazon CloudFront distribution and enable AWS Shield Advanced on the Amazon CloudFront distribution.

The correct options are associating an AWS WAF web ACL with the CloudFront distribution and enabling AWS Shield Advanced on the distribution. AWS WAF provides protection against Layer 7 application exploits like SQL injection by inspecting request payloads. AWS Shield Advanced provides comprehensive protection against Layer 3 and Layer 4 DDoS attacks for CloudFront distributions.

Adım Adım Çözüm

Determine the service needed to block application-layer (Layer 7) exploits such as SQL injection at the edge.

AWS WAF is selected because it integrates with CloudFront to inspect HTTP/HTTPS request bodies and headers.

AWS WAF is designed specifically to prevent application-layer exploits.

Determine the service needed to defend against infrastructure-layer (Layer 3 and 4) DDoS attacks targeting CloudFront.

AWS Shield Advanced is selected to provide advanced network and transport layer DDoS mitigation.

AWS Shield Advanced offers enhanced, tailored protection for edge services compared to AWS Shield Standard.

Anahtar Kavram

Combining AWS WAF for Layer 7 application security and AWS Shield Advanced for Layer 3 and 4 infrastructure DDoS protection at the CloudFront edge.

Tahmini Süre:1m 30s

Soru 168Soru →

A company is deploying an application on Amazon EC2 instances that connects to an Amazon RDS for PostgreSQL database. The company's security policy requires database credentials to be encrypted and rotated every 30 days. Additionally, the master key used to encrypt these credentials must be a customer managed KMS key that is rotated annually. The solutions architect must implement a solution that minimizes administrative overhead and prevents the application from storing credentials in plaintext configuration files.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Store the database credentials in AWS Secrets Manager and configure automatic credentials rotation every 30 days using an AWS Lambda function.

Enable automatic key rotation on the customer managed KMS key to rotate the key material annually without changing the key ARN.

Store the database credentials as a String parameter in AWS Systems Manager Parameter Store to simplify configuration management and rotation.

Create a new customer managed KMS key annually, manually re-encrypt the credentials in Secrets Manager with the new key, and update the application configuration.

Enable automatic rotation on the AWS managed KMS key (aws/secretsmanager) and configure it to rotate the secret every 30 days.

Cevabı ve açıklamayı göster

Cevap: Store the database credentials in AWS Secrets Manager and configure automatic credentials rotation every 30 days using an AWS Lambda function.; Enable automatic key rotation on the customer managed KMS key to rotate the key material annually without changing the key ARN.

Cevap

To secure the database credentials and satisfy the rotation requirements, store the credentials in AWS Secrets Manager and configure automatic rotation every 30 days using an AWS Lambda function, and enable automatic key rotation on the customer managed KMS key to rotate the key material annually without changing the key ARN.

Storing database credentials in AWS Secrets Manager with Lambda-based rotation enables secure, automated credential rotation every 30 days. Additionally, enabling automatic key rotation on the customer managed KMS key meets the requirement for annual key rotation with zero administrative overhead and no change to the key ARN.

Adım Adım Çözüm

Store the database credentials in AWS Secrets Manager.

The credentials are encrypted at rest using a customer managed KMS key and are accessible via the Secrets Manager API.

This avoids storing credentials in plaintext configuration files on the EC2 instances.

Configure automatic rotation for the secret in Secrets Manager.

A predefined AWS Lambda function is configured to rotate the PostgreSQL database credentials every 30 days.

This meets the requirement to rotate the database credentials every 30 days automatically.

Enable automatic key rotation on the customer managed KMS key.

AWS KMS automatically rotates the key material once a year.

This rotates the key material annually while keeping the same key ARN, ensuring no disruption to Secrets Manager or the application.

Anahtar Kavram

Key rotation in AWS KMS is separate from secret rotation in AWS Secrets Manager. KMS automatic rotation rotates the underlying key material without changing the key ARN, while Secrets Manager handles updating credentials in the target database.

Tahmini Süre:2m 0s

Soru 169Soru →

A real estate listing platform needs to process property status update events, such as 'Active', 'Under Contract', and 'Sold'. These events must be processed in strict chronological order per property to prevent data inconsistencies on the website. The volume of events is highly volatile, with massive spikes occurring when new regional properties are listed. Both the search indexing service and the email alert system must receive and process every status update. Which solution meets these requirements with the least operational overhead?

Publish the property status events to a single standard Amazon SQS queue, and configure both the search indexing service and the email alert system to poll this single queue.

Publish the property status events to an Amazon SNS FIFO topic. Subscribe two Amazon SQS FIFO queues to the SNS FIFO topic, with one queue dedicated to the search indexing service and the other to the email alert system.

Publish the property status events to a standard Amazon SNS topic. Subscribe two standard Amazon SQS queues to the SNS topic, with one queue dedicated to the search indexing service and the other to the email alert system.

Publish the property status events to an Amazon SNS topic, and write them to an Amazon DynamoDB table configured with provisioned capacity mode to store and sequence the events for downstream consumption.

Cevabı ve açıklamayı göster

Cevap: Publish the property status events to an Amazon SNS FIFO topic. Subscribe two Amazon SQS FIFO queues to the SNS FIFO topic, with one queue dedicated to the search indexing service and the other to the email alert system.

Cevap

Publish the property status events to an Amazon SNS FIFO topic, and subscribe two Amazon SQS FIFO queues to the topic (one for the search indexing service and one for the email alert system).

The correct solution uses an Amazon SNS FIFO topic to fan out the property status events to two dedicated Amazon SQS FIFO queues. SNS FIFO topics preserve the sequence of messages and can deliver them in-order to subscribed SQS FIFO queues. Having separate SQS FIFO queues for the search indexing service and the email alert system ensures that both applications independently consume every message without competition, while the queues absorb traffic spikes.

Adım Adım Çözüm

Identify the requirement for message fan-out to multiple independent consumer applications.

Two downstream services (search indexing and email alerts) must each receive every property status update.

A pub/sub model using Amazon SNS is required to fan out a single event to multiple destinations.

Determine the ordering requirements for the processed events.

Events must be processed in strict chronological order per property to avoid displaying outdated statuses.

Standard SNS and SQS do not guarantee ordering, so FIFO (First-In-First-Out) configurations must be used for both SNS and SQS.

Evaluate the integration between SNS FIFO and SQS FIFO to manage message delivery and buffering.

Subscribing SQS FIFO queues to an SNS FIFO topic maintains message grouping and ordering while providing a buffer for traffic spikes.

This architecture decouples the services, guarantees ordered delivery per property, and absorbs volatile traffic patterns with minimum operational overhead.

Anahtar Kavram

Decoupling event-driven architectures requiring multi-destination fan-out and strict message ordering.

Tahmini Süre:2m 0s

Soru 170Soru →

A healthcare provider hosts a web application on Amazon EC2 instances in AWS Account A. The application processes sensitive patient files and stores them in an Amazon S3 bucket located in Account A. To comply with regulatory standards, all files must be encrypted at rest using an AWS KMS customer managed key stored in a centralized security account (Account B).

Which combination of configuration steps is required to enable the EC2 instances in Account A to upload encrypted files to the S3 bucket? (Select TWO.)

Geçerli olan tümünü seçin

In Account B, configure the KMS key policy to grant the IAM role associated with the EC2 instances in Account A permissions to perform the kms:GenerateDataKey and kms:Decrypt operations.

In Account A, attach an IAM policy to the EC2 instances' IAM role that grants permissions to perform the kms:GenerateDataKey and kms:Decrypt operations on the key ARN in Account B.

In Account B, configure the KMS key policy to grant administrative access to the root account of Account A, and configure the application to use root credentials for daily encryption tasks.

Store the plaintext KMS key material in the Systems Manager Parameter Store as a String parameter type to allow the EC2 instances to retrieve the key for local encryption.

Enable automatic key rotation on the customer managed key in Account B, which automatically re-encrypts all previously stored objects in Account A when rotation occurs.

Cevabı ve açıklamayı göster

Cevap: In Account B, configure the KMS key policy to grant the IAM role associated with the EC2 instances in Account A permissions to perform the kms:GenerateDataKey and kms:Decrypt operations.; In Account A, attach an IAM policy to the EC2 instances' IAM role that grants permissions to perform the kms:GenerateDataKey and kms:Decrypt operations on the key ARN in Account B.

Cevap

In Account B, configure the KMS key policy to grant the IAM role associated with the EC2 instances in Account A permissions to perform the kms:GenerateDataKey and kms:Decrypt operations, and in Account A, attach an IAM policy to the EC2 instances' IAM role that grants permissions to perform the kms:GenerateDataKey and kms:Decrypt operations on the key ARN in Account B.

To successfully establish cross-account access to an AWS KMS customer managed key, permissions must be granted on both sides of the trust boundary. First, the key policy in Account B (the key owner) must explicitly allow the IAM role of the EC2 instances in Account A to use the key for cryptographic operations. Second, the IAM policy attached to the EC2 instances' IAM role in Account A must grant permission to perform the target actions (specifically generating data keys and decrypting) referencing the full ARN of the KMS key in Account B.

Adım Adım Çözüm

Determine the cross-account encryption requirements.

Identify that the EC2 instances in Account A need to access a customer managed key located in Account B to perform envelope encryption (generate a data key) when writing to Amazon S3.

Since the KMS key and the S3 bucket are in different accounts, cross-account permissions must be explicitly set on both the key policy and IAM policy.

Configure the key policy in the key's host account (Account B).

Modify the key policy to explicitly authorize the IAM role from Account A to perform kms:GenerateDataKey and kms:Decrypt.

By default, customer managed keys are only accessible within the account where they reside unless the key policy explicitly allows cross-account entities.

Configure the IAM policy in the identity's host account (Account A).

Attach an IAM policy to the EC2 instance role in Account A that permits kms:GenerateDataKey and kms:Decrypt targeting the specific ARN of the KMS key in Account B.

For cross-account access, both the trust boundary at the resource (key policy) and the permission boundary at the caller (IAM policy) must allow the interaction.

Anahtar Kavram

Cross-account KMS key access requires trust configuration on both the key policy (resource-based policy) in the owner account and the IAM policy (identity-based policy) in the consumer account.

Soru 171Soru →

An online education platform is migrating its core learning management system (LMS) to AWS. The platform has a multi-account structure managed under AWS Organizations. The company wants to enable its employees to log in to the AWS Management Console across all accounts using their existing corporate credentials, which are managed in an on-premises Microsoft Active Directory. The solutions architect needs to design a solution that minimizes administrative overhead, avoids duplicating user credentials or password hashes in the cloud, and utilizes modern AWS best practices. Which combination of actions should the solutions architect recommend? (Select two.)

Geçerli olan tümünü seçin

Configure AWS Directory Service AD Connector to establish a connection with the on-premises Microsoft Active Directory.

Enable AWS IAM Identity Center and configure it to use the AD Connector directory as the identity source.

Create individual IAM users in each AWS account for every corporate employee and configure a custom synchronization script to duplicate passwords daily.

Use the AWS account root user of each member account to configure SAML 2.0 identity provider relationships with the on-premises Active Directory.

Cevabı ve açıklamayı göster

Cevap: Configure AWS Directory Service AD Connector to establish a connection with the on-premises Microsoft Active Directory.; Enable AWS IAM Identity Center and configure it to use the AD Connector directory as the identity source.

Cevap

Configure AWS Directory Service AD Connector to connect to the on-premises Microsoft Active Directory, and enable AWS IAM Identity Center with the AD Connector directory specified as the identity source.

The correct solution involves configuring the AWS Directory Service AD Connector and enabling AWS IAM Identity Center. AD Connector operates as a proxy to redirect sign-in requests to on-premises Active Directory domain controllers without synchronizing or storing password hashes in AWS. Integrating AD Connector with AWS IAM Identity Center allows users to federate into their respective AWS accounts within AWS Organizations using their corporate credentials, providing a seamless single sign-on experience with minimal administrative overhead.

Adım Adım Çözüm

Identify directory integration requirements

Determine that the customer requires on-premises Active Directory integration without replicating user credentials to AWS, while keeping administrative overhead low.

This rules out solutions requiring directory synchronization or trust relationships that cache database information in the cloud.

Select the directory gateway service

Select AD Connector to proxy authentication requests back to the on-premises Active Directory domain controllers.

AD Connector does not store or replicate user credentials, fulfilling the requirement of keeping passwords on-premises.

Select and configure the identity federation service

Enable AWS IAM Identity Center in the Organizations management account and connect it to the Active Directory using the AD Connector.

This establishes a centralized single sign-on portal for all accounts in the organization, aligning with modern AWS security best practices and minimizing administration compared to legacy manual SAML configurations.

Anahtar Kavram

Active Directory Federation with AWS IAM Identity Center via AD Connector

Tahmini Süre:2m 0s

Soru 172Soru →

An organization is designing a secure two-tier application in a VPC. The application servers reside in a private subnet (Subnet A: $192.168.1.0/24$ ), and the database servers reside in another private subnet (Subnet B: $192.168.2.0/24$ ). A solutions architect must restrict database access so that database instances in Subnet B only receive database traffic on TCP port $5432$ from Subnet A. The security architecture requires utilizing both Network ACLs (NACLs) and Security Groups to enforce this isolation. Which combination of configuration rules meets these requirements while ensuring the database can successfully respond to the application servers?

Configure the database security group with an inbound rule allowing TCP port

5432

from the application security group. Configure the Subnet B NACL with an inbound rule allowing TCP port

5432

from

192.168.1.0/24

and an outbound rule allowing TCP ports

1024-65535

192.168.1.0/24

Configure the database security group with an inbound rule allowing TCP port

5432

from the application security group and an outbound rule allowing TCP ports

1024-65535

to the application security group. Configure the Subnet B NACL with an inbound rule allowing TCP port

5432

from

192.168.1.0/24

Configure the database security group with an inbound rule allowing TCP port

5432

from the application security group and an outbound rule allowing TCP port

5432

to the application security group. Configure the Subnet B NACL with an inbound rule allowing TCP port

5432

from

192.168.1.0/24

and an outbound rule allowing TCP port

5432

192.168.1.0/24

Configure an AWS WAF web ACL associated with the database subnet to inspect and allow incoming PostgreSQL traffic on TCP port

5432

from Subnet A. Configure the database security group with an inbound rule allowing TCP port

5432

from the application security group.

Cevabı ve açıklamayı göster

Cevap: Configure the database security group with an inbound rule allowing TCP port $5432$ from the application security group. Configure the Subnet B NACL with an inbound rule allowing TCP port $5432$ from $192.168.1.0/24$ and an outbound rule allowing TCP ports $1024-65535$ to $192.168.1.0/24$ .

Cevap

Configure the database security group with an inbound rule allowing TCP port 5432 from the application security group, and configure the Subnet B Network ACL with an inbound rule allowing TCP port 5432 from Subnet A's CIDR block and an outbound rule allowing TCP ports 1024-65535 to Subnet A's CIDR block.

The correct answer combines the stateful nature of security groups with the stateless nature of network ACLs. Because security groups are stateful, allowing inbound TCP port 5432 from the application security group is sufficient to allow bidirectional traffic. In contrast, Network ACLs are stateless, requiring both inbound and outbound rules. The inbound rule must allow TCP port 5432 from the application subnet CIDR block (192.168.1.0/24). The outbound rule must allow TCP traffic to the client's ephemeral port range (1024-65535) back to Subnet A's CIDR block.

Adım Adım Çözüm

Analyze Security Group requirements for stateful traffic tracking.

The database security group needs an inbound rule for TCP port 5432 from the application security group. No outbound rule is needed on the security group because security groups are stateful and automatically allow return traffic.

Security groups automatically track connection states, allowing return traffic for established connections.

Analyze Network ACL (NACL) inbound requirements for stateless filtering.

The database subnet NACL (Subnet B) requires an inbound rule allowing TCP port 5432 traffic from the application subnet CIDR block (192.168.1.0/24).

NACLs are stateless and apply at the subnet level, so inbound traffic must be explicitly allowed.

Analyze Network ACL (NACL) outbound requirements for stateless return traffic.

The database subnet NACL (Subnet B) requires an outbound rule allowing TCP traffic to destination ports 1024-65535 back to Subnet A's CIDR block (192.168.1.0/24).

Since NACLs are stateless, return traffic must be explicitly allowed. Because the client application initiated the request from an ephemeral port, the database response is sent to that ephemeral port (range 1024-65535).

Anahtar Kavram

Stateful Security Groups vs Stateless Network ACLs (NACLs) and Ephemeral Ports

Soru 173Soru →

A company wants to share a daily Amazon RDS PostgreSQL database snapshot from its production AWS account (Account A) to a data analytics AWS account (Account B). The production database is encrypted at rest using an AWS KMS key. The solution must ensure that the snapshot is securely shared, decrypted, and restored in Account B while adhering to the principle of least privilege.

Which set of actions will meet these requirements?

Ensure the RDS database is encrypted with the default AWS managed key (aws/rds) in Account A. Modify the KMS key policy in Account A to allow Account B access. Share the DB snapshot with Account B, and then restore the DB instance directly in Account B from the shared snapshot.

Ensure the RDS database is encrypted with a customer managed KMS key in Account A. Store the KMS key ARN in an AWS Systems Manager Parameter Store parameter of type String. Share the DB snapshot with Account B. In Account B, restore the DB instance directly from the shared snapshot by reading the KMS key ARN from the Parameter Store.

Ensure the RDS database is encrypted with a customer managed KMS key in Account A. Modify the key policy of the customer managed key in Account A to grant Account B access. Share the DB snapshot with Account B. In Account B, copy the shared DB snapshot to a new DB snapshot encrypted with a KMS key in Account B, and then restore the DB instance from the copied snapshot.

Ensure the RDS database is encrypted with a customer managed KMS key in Account A. Share the DB snapshot with Account B. In Account B, use the AWS account root user credentials to copy the shared DB snapshot, encrypt it with Account B's KMS key, and restore the DB instance to bypass the KMS key policy requirements in Account A.

Cevabı ve açıklamayı göster

Cevap: Ensure the RDS database is encrypted with a customer managed KMS key in Account A. Modify the key policy of the customer managed key in Account A to grant Account B access. Share the DB snapshot with Account B. In Account B, copy the shared DB snapshot to a new DB snapshot encrypted with a KMS key in Account B, and then restore the DB instance from the copied snapshot.

Cevap

The correct solution uses a customer managed key (CMK) in the source account, grants the target account access to that CMK via its key policy, shares the RDS snapshot, and then copies the snapshot locally in the target account using the target account's KMS key before restoring. This complies with AWS restrictions where AWS managed keys cannot be shared, and encrypted RDS snapshots cannot be directly restored across accounts.

Adım Adım Çözüm

Verify key type and configure policy permissions

The RDS instance in Account A must be encrypted with a Customer Managed Key (CMK) because the default AWS managed key cannot be shared cross-account. The CMK's key policy in Account A is modified to grant Account B the permissions to decrypt and create grants.

Allows Account B to access the cryptographic operations of the key used to encrypt the source snapshot.

Share and copy the database snapshot

The DB snapshot is shared with Account B. Account B initiates a copy of the shared snapshot, specifying a KMS key owned by Account B to encrypt the new copy.

AWS RDS does not support restoring a shared encrypted database snapshot directly across accounts. The snapshot must be copied locally first.

Restore the DB instance in the target account

Account B restores the RDS DB instance from the copied snapshot that is local to Account B.

Completes the recovery process in Account B using local resources and credentials.

Anahtar Kavram

Cross-Account KMS Key Sharing and RDS Snapshot Restore Mechanics

Alternatif Yöntem

Instead of sharing and copying the snapshot directly, an alternative is to export the RDS snapshot data to an Amazon S3 bucket in Account A encrypted with a customer managed KMS key, grant Account B access to the S3 bucket and key, and then import the data into a new RDS DB instance in Account B. However, this is operationally more complex.

Tahmini Süre:2m 30s

Soru 174Soru →

A solutions architect is designing the security and encryption architecture for an Amazon Aurora PostgreSQL DB cluster that will store sensitive financial transactions. The company's compliance policy mandates that data at rest must be encrypted using an AWS Key Management Service (AWS KMS) customer managed key, and the key material must be rotated annually. The DB cluster must remain fully operational, and existing data must be readable without requiring cluster recreation, manual data re-encryption, or database downtime.

Which combination of actions should the solutions architect recommend to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Enable automatic key rotation for the KMS customer managed key.

Enable encryption at rest on the Aurora DB cluster using the customer managed key during cluster creation.

Store the database master credentials as a String parameter in AWS Systems Manager Parameter Store to simplify rotation script access.

Create a new customer managed key each year and update the Aurora DB cluster configuration to point to the new key ARN.

Perform an annual backup and restore of the Aurora DB cluster to a new cluster encrypted with a newly created customer managed key.

Cevabı ve açıklamayı göster

Cevap: Enable automatic key rotation for the KMS customer managed key.; Enable encryption at rest on the Aurora DB cluster using the customer managed key during cluster creation.

Cevap

Enable automatic key rotation for the KMS customer managed key, and enable encryption at rest on the Aurora DB cluster using the customer managed key during cluster creation.

To encrypt the database cluster with a customer managed key, encryption must be enabled at cluster creation since encryption cannot be enabled on an existing unencrypted database. Enabling automatic key rotation in AWS KMS generates a new backing key every year while keeping the same key ARN. AWS KMS automatically uses the correct backing key version to decrypt existing data, which avoids database downtime or any need to re-encrypt old data manually.

Adım Adım Çözüm

Ensure the database cluster is encrypted at creation using the customer managed key.

The database cluster is provisioned with encryption enabled, securing all database volumes and backups.

Encryption at rest for an Amazon Aurora DB cluster cannot be enabled after creation.

Enable automatic key rotation for the KMS customer managed key.

AWS KMS automatically rotates the backing key material every year without changing the key ARN.

This avoids the need to update database configuration, prevents database downtime, and does not require re-encrypting existing data.

Anahtar Kavram

AWS KMS Automatic Key Rotation and DB Cluster Encryption

Soru 175Soru →

An energy infrastructure company is deploying a multi-account AWS environment managed by AWS Organizations. The company uses Microsoft Entra ID as its central identity provider. The security team requires that cloud engineers be able to sign in to the AWS Management Console and AWS CLI using their existing corporate credentials. Additionally, user access and group memberships must automatically provision and deprovision from Microsoft Entra ID to AWS. Which solution meets these requirements with the least operational overhead?

Manually create individual IAM users with long-term access keys in each AWS account for every cloud engineer, and write a custom synchronization script to update their credentials when they change in Microsoft Entra ID.

Configure AWS IAM Identity Center to federate with Microsoft Entra ID using SAML 2.0, and enable automatic provisioning using the System for Cross-domain Identity Management (SCIM) protocol.

Set up a SAML 2.0 identity provider individually in IAM for each AWS account, establish trust with Microsoft Entra ID, and create individual IAM users in the management account to distribute long-term AWS CLI credentials.

Configure cloud engineers to log in to the AWS Organizations management account using the root user credentials, and utilize cross-account IAM roles to access member accounts.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center to federate with Microsoft Entra ID using SAML 2.0, and enable automatic provisioning using the System for Cross-domain Identity Management (SCIM) protocol.

Cevap

Configure AWS IAM Identity Center to federate with Microsoft Entra ID using SAML 2.0, and enable automatic provisioning using the System for Cross-domain Identity Management (SCIM) protocol.

Configuring AWS IAM Identity Center to federate with Microsoft Entra ID using SAML 2.0 and enabling automatic provisioning via SCIM satisfies all authentication and synchronization requirements. This configuration delegates credential verification to the corporate identity provider while ensuring that access is automatically terminated in AWS when a user is deprovisioned in Entra ID, minimizing administrative overhead across multiple AWS accounts.

Adım Adım Çözüm

Identify the central identity source and single sign-on requirement.

Microsoft Entra ID is the corporate identity source, and AWS IAM Identity Center is selected to centralize multi-account access control.

AWS IAM Identity Center is the modern and recommended service to configure single sign-on across all member accounts in AWS Organizations.

Select the correct integration protocol for authentication and directory synchronization.

Configure SAML 2.0 federation for single sign-on and enable the SCIM protocol for identity synchronization.

SAML 2.0 allows federated authentication, while SCIM automates the provisioning and deprovisioning of users and groups from the external IdP without manual overhead.

Anahtar Kavram

AWS IAM Identity Center Federation with SCIM

Soru 176Soru →

A financial company separates its auditing workloads in Subnet A ( $10.0.1.0/24$ ) and production workloads in Subnet B ( $10.0.2.0/24$ ) within the same VPC. Security regulations dictate that auditing instances in Subnet A must be allowed to initiate SSH connections (port 22) to production workloads in Subnet B. However, production workloads must be prevented from initiating any connection back to the auditing workloads. To provide defense-in-depth, the network architect must configure Network Access Control Lists (Network ACLs) on both subnets to permit only this specific traffic flow and its return packets. Which configuration of Network ACL rules for Subnet A and Subnet B will correctly allow the auditing traffic while following the principle of least privilege?

Subnet A: Outbound rule allowing TCP port 22 to

10.0.2.0/24

with no inbound rules. Subnet B: Inbound rule allowing TCP port 22 from

10.0.1.0/24

with no outbound rules.

Subnet A: Outbound rule allowing TCP port 22 to

10.0.2.0/24

, and Inbound rule allowing TCP port 22 from

10.0.2.0/24

. Subnet B: Inbound rule allowing TCP port 22 from

10.0.1.0/24

, and Outbound rule allowing TCP port 22 to

10.0.1.0/24

Subnet A: Outbound rule allowing TCP port 22 to

10.0.2.0/24

, and Inbound rule allowing TCP ports 1024-65535 from

10.0.2.0/24

. Subnet B: Inbound rule allowing TCP port 22 from

10.0.1.0/24

, and Outbound rule allowing TCP ports 1024-65535 to

10.0.1.0/24

Subnet A: Inbound rule allowing TCP port 22 from

10.0.2.0/24

, and Outbound rule allowing TCP ports 1024-65535 to

10.0.2.0/24

. Subnet B: Outbound rule allowing TCP port 22 to

10.0.1.0/24

, and Inbound rule allowing TCP ports 1024-65535 from

10.0.1.0/24

Cevabı ve açıklamayı göster

Cevap: Subnet A: Outbound rule allowing TCP port 22 to $10.0.2.0/24$ , and Inbound rule allowing TCP ports 1024-65535 from $10.0.2.0/24$ . Subnet B: Inbound rule allowing TCP port 22 from $10.0.1.0/24$ , and Outbound rule allowing TCP ports 1024-65535 to $10.0.1.0/24$ .

Cevap

Subnet A: Outbound rule allowing TCP port 22 to

10.0.2.0/24

, and Inbound rule allowing TCP ports 1024-65535 from

10.0.2.0/24

. Subnet B: Inbound rule allowing TCP port 22 from

10.0.1.0/24

, and Outbound rule allowing TCP ports 1024-65535 to

10.0.1.0/24

Network ACLs are stateless network-filtering boundaries. When an EC2 instance in Subnet A initiates an SSH connection to an EC2 instance in Subnet B, the outgoing request leaves Subnet A on port 22 and reaches Subnet B on port 22. Thus, Subnet A needs an outbound rule for port 22, and Subnet B needs an inbound rule for port 22. The return packets from Subnet B are sent from port 22 back to the ephemeral port range (1024-65535) allocated by the client in Subnet A. Because Network ACLs do not automatically track session state, Subnet B must have an outbound rule to allow traffic to the ephemeral ports of Subnet A, and Subnet A must have an inbound rule to allow traffic on the ephemeral ports from Subnet B.

Adım Adım Çözüm

Analyze the direction of the initiation flow.

The connection is initiated from Subnet A (source) to Subnet B (destination) on TCP port 22.

This establishes that Subnet A needs outbound TCP port 22 allowed, and Subnet B needs inbound TCP port 22 allowed.

Determine return traffic behavior for stateless firewalls.

Network ACLs are stateless, meaning the returning traffic must be explicitly allowed in the reverse direction.

Because the SSH client allocates an ephemeral port (typically 1024-65535) to receive the response, the return traffic flows from Subnet B's ephemeral ports back to Subnet A's ephemeral ports.

Formulate the exact inbound and outbound rules for both subnets.

Subnet A needs outbound port 22 and inbound ephemeral ports 1024-65535. Subnet B needs inbound port 22 and outbound ephemeral ports 1024-65535.

This guarantees that the initial request and the response packets are both permitted through the stateless boundaries of both subnets.

Anahtar Kavram

VPC Network Security and Stateless Network ACL Rules

Soru 177Soru →

A solutions architect is designing a security strategy for a financial services company. The company requires customer-managed keys (CMKs) in AWS Key Management Service (AWS KMS) to encrypt sensitive data stored in Amazon S3 buckets. The company's compliance policy mandates that the key material must be rotated annually. However, historical data must remain readable, and administrative overhead must be minimized.

Which TWO statements accurately describe the mechanics and implications of enabling automatic key rotation for these customer-managed keys?

Geçerli olan tümünü seçin

AWS KMS automatically retains all previous versions of the key material to ensure that historical data can still be decrypted.

Enabling automatic key rotation does not automatically re-encrypt existing S3 objects that were encrypted using the older key material.

Rotating the key material automatically initiates an AWS Batch job to decrypt and re-encrypt all historical data with the new key version.

To simplify key administration, the database credentials used by applications that access the encrypted S3 buckets should be stored as plain String parameters in AWS Systems Manager Parameter Store.

To decrypt older S3 objects after rotation, the solutions architect must manually create and configure a unique KMS key alias for each retired version of the key material.

Cevabı ve açıklamayı göster

Cevap: AWS KMS automatically retains all previous versions of the key material to ensure that historical data can still be decrypted.; Enabling automatic key rotation does not automatically re-encrypt existing S3 objects that were encrypted using the older key material.

Cevap

AWS KMS automatically retains all previous versions of the key material to ensure that historical data can still be decrypted, and enabling automatic key rotation does not automatically re-encrypt existing S3 objects that were encrypted using the older key material.

The correct options accurately describe how AWS KMS handles key rotation. First, AWS KMS automatically retains all previous versions of the key material, allowing the service to seamlessly decrypt historical data without manual configuration. Second, rotating key material does not automatically re-encrypt existing S3 objects, which remain encrypted under their original key material version.

Adım Adım Çözüm

Analyze AWS KMS key rotation behavior for customer-managed keys.

Identified that automatic rotation generates a new version of key material annually while retaining previous versions.

To determine how historical data remains accessible without administrative intervention.

Evaluate the impact of rotation on existing S3 objects.

Understood that existing objects are not automatically re-encrypted with the new key material; they continue to use the version of the key material active at their creation.

To rule out misconceptions about automatic background re-encryption of historical data.

Assess secret storage and alias management requirements.

Confirmed that no manual alias configurations are needed for old versions and that credentials should never be stored as plaintext String parameters.

To ensure compliance with security best practices and eliminate incorrect options.

Anahtar Kavram

AWS KMS Customer Managed Key automatic rotation mechanics and behavior.

Soru 178Soru →

An e-commerce company runs an order processing application on Amazon EC2 instances in private subnets. The instances must download software updates from an external repository on the internet and securely access an Amazon DynamoDB table in the same AWS Region. The company's security policy requires that DynamoDB traffic must not traverse the public internet, and the EC2 instances must not be directly reachable from the public internet. Which TWO configurations should a solutions architect implement to meet these requirements securely and cost-effectively? (Select TWO.)

Geçerli olan tümünü seçin

Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the route table of the private subnets.

Deploy a NAT Gateway in a public subnet, and configure the route table of the private subnets to route internet-bound traffic (

0.0.0.0/0

) to the NAT Gateway.

Create an Interface VPC Endpoint for Amazon DynamoDB and configure it to handle all DynamoDB traffic from the private subnets.

Configure the Network ACL for the private subnets to allow inbound traffic only on TCP ports

80

and

443

to receive response packets from the update repository.

Deploy a NAT Instance inside the private subnets to route outbound software update traffic directly to the internet.

Cevabı ve açıklamayı göster

Cevap: Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the route table of the private subnets.; Deploy a NAT Gateway in a public subnet, and configure the route table of the private subnets to route internet-bound traffic ( $0.0.0.0/0$ ) to the NAT Gateway.

Cevap

To secure DynamoDB traffic cost-effectively without public internet routing, associate a Gateway VPC Endpoint for DynamoDB with the private subnets' route table. To enable secure outbound internet access for updates, deploy a NAT Gateway in a public subnet and update the private subnets' route table to direct all

0.0.0.0/0

traffic through the NAT Gateway.

The correct answer combines a Gateway VPC Endpoint for Amazon DynamoDB and a NAT Gateway in a public subnet. The Gateway VPC Endpoint routes DynamoDB traffic privately over the AWS backbone network without traversing the public internet, doing so without any hourly or data processing charges. The NAT Gateway provides secure, one-way outbound connectivity to the internet for downloading updates, ensuring the instances remain unreachable from inbound internet traffic.

Adım Adım Çözüm

Analyze the access requirement for DynamoDB and evaluate cost-optimal network isolation paths.

Identify that Gateway VPC Endpoints are free and direct DynamoDB traffic privately, fulfilling the security and cost-efficiency criteria.

VPC endpoints keep traffic within the AWS network, and Gateway endpoints for DynamoDB do not incur charges.

Analyze the outbound internet requirements for software updates on private EC2 instances.

Determine that a NAT Gateway deployed in a public subnet allows outbound-initiated traffic and blocks unsolicited inbound traffic, which satisfies the security policy.

EC2 instances in private subnets cannot have public IP addresses or route directly to an Internet Gateway.

Evaluate the incorrect options regarding stateless Network ACL behavior, incorrect NAT placement, and non-optimal endpoint selection.

Eliminate the Interface VPC Endpoint option due to higher cost, the stateless Network ACL rule option because it blocks ephemeral return traffic, and the private NAT Instance option because NAT devices must reside in public subnets.

This ensures the final architecture is correct, highly available, secure, and cost-effective.

Anahtar Kavram

VPC Network Security and Egress Routing Control

Soru 179Soru →

A healthcare provider hosts a web portal on AWS that stores patient medical imaging files in an Amazon S3 bucket and patient metadata in an Amazon Aurora PostgreSQL database. The provider's compliance policy mandates that all data at rest must be encrypted using customer managed keys in AWS Key Management Service (AWS KMS). The cryptographic key material must be updated annually, but existing data must not be actively re-encrypted. Additionally, the database credentials must be rotated every 30 days without causing database connection issues or application downtime. Which combination of actions will meet these requirements in the most secure manner? (Select TWO.)

Geçerli olan tümünü seçin

Enable automatic key rotation on the customer managed keys in AWS KMS.

Store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function every 30 days.

Store the database credentials as a String parameter in AWS Systems Manager Parameter Store and write a custom script to rotate the password.

Enable automatic key rotation in AWS KMS and execute an AWS Batch job to immediately re-encrypt all existing data with the new key version.

Manually create a new customer managed key annually to replace the active key, and delete the previous customer managed key to prevent its unauthorized use.

Cevabı ve açıklamayı göster

Cevap: Enable automatic key rotation on the customer managed keys in AWS KMS.; Store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function every 30 days.

Cevap

Enable automatic key rotation on the customer managed keys in AWS KMS, and store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function every 30 days.

Enabling automatic key rotation for customer managed keys satisfies the annual rotation requirement without re-encrypting existing data because AWS KMS automatically retains older key versions to decrypt historical data. Storing database credentials in AWS Secrets Manager and using an AWS Lambda function to rotate the credentials every 30 days satisfies the rotation requirement while avoiding application downtime or connection issues.

Adım Adım Çözüm

Address the KMS key rotation requirement.

Enable automatic key rotation on the customer managed keys in AWS KMS. This rotates key material annually and retains old key material to decrypt old data without re-encryption.

This complies with the policy of rotating keys annually without actively re-encrypting existing data.

Address the database credential security and rotation requirement.

Store the database credentials in AWS Secrets Manager and set up automatic 30-day rotation via an AWS Lambda function.

Secrets Manager securely stores secrets and supports seamless rotation for RDS/Aurora databases without causing downtime.

Anahtar Kavram

AWS KMS Automatic Key Rotation and AWS Secrets Manager Credential Rotation

Tahmini Süre:2m 0s

Soru 180Soru →

A retail company is migrating its workloads to a multi-account AWS environment managed by AWS Organizations. The company wants to enable its 500 corporate employees to access their respective AWS accounts using their existing on-premises Active Directory (AD) credentials. The solution must minimize operational overhead, avoid replicating user credentials or directory metadata to the cloud, and provide centralized access control. Which solution meets these requirements?

Create individual IAM users in each target AWS account for all 500 corporate employees. Distribute access keys and configure a custom script to synchronize their on-premises Active Directory passwords to their IAM profiles.

Configure AWS IAM Identity Center. Export corporate user names and passwords from the on-premises Active Directory and store them as plaintext parameters in Systems Manager Parameter Store to allow AWS to authenticate the users.

Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector. Define permission sets in IAM Identity Center to centrally manage access to the AWS accounts.

Use the AWS account root user credentials to log in to each AWS account, then configure a SAML 2.0 integration directly with the on-premises Active Directory to allow administrative access.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector. Define permission sets in IAM Identity Center to centrally manage access to the AWS accounts.

Cevap

Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector, then define permission sets in IAM Identity Center to centrally manage access to the AWS accounts.

The correct solution uses AWS IAM Identity Center integrated with the on-premises Active Directory via AWS Directory Service AD Connector. AD Connector is a directory gateway that redirects directory requests to the on-premises Active Directory without caching or replicating credentials in the cloud. Using permission sets in IAM Identity Center allows administrators to centrally assign and manage permissions across the multi-account environment, minimizing operational overhead.

Adım Adım Çözüm

Establish network connectivity and directory integration.

Connect AWS IAM Identity Center to the on-premises Active Directory by deploying AWS Directory Service AD Connector as a proxy gateway, which forwards authentication requests without local credential replication.

This establishes federated login capabilities using existing corporate credentials without storing or replicating passwords in AWS, satisfying the security and overhead requirements.

Configure AWS Organizations integration.

Enable AWS IAM Identity Center within the organization's management account to centrally oversee multi-account access.

Centralized governance via IAM Identity Center reduces operational overhead compared to configuring individual IAM configurations in each member account.

Define and assign permissions.

Create permission sets based on job functions and assign them to Active Directory groups to grant users access to specific AWS accounts.

This allows for role-based access control managed centrally, ensuring least privilege and simple access revocation.

Anahtar Kavram

Federating identity from an on-premises Active Directory to AWS using AWS Directory Service AD Connector and AWS IAM Identity Center to minimize operational overhead and avoid credential replication.

ÖncekiSayfa 9 / 74Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Alternatif Yöntem

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm