Design Secure Architectures

438 soru

Tüm türler438 Çoktan seçmeli214 Çoklu seçim224

A financial services company hosts its customer-facing portal on AWS using a multi-tier architecture. The portal is fronted by an Application Load Balancer (ALB) that routes traffic to Amazon EC2 instances in private subnets. The security team needs to implement a solution to centrally monitor and aggregate security findings across all AWS accounts in the organization, continuously evaluate AWS resource configurations against security best practices (specifically checking for public S3 buckets and overly permissive security groups), and protect the web application from SQL injection attacks and HTTP flood attacks at the application layer. Which combination of AWS services should a solutions architect recommend to meet these requirements with the least operational overhead?

Deploy AWS Shield Standard on the Application Load Balancer to inspect incoming HTTP request bodies for SQL injection patterns and block request floods. Enable AWS Systems Manager to record security group changes, and configure AWS Config to aggregate findings across the organization.

Enable AWS Security Hub across all accounts in the AWS Organization to aggregate findings in a central security administrator account. Enable AWS Config in all accounts to continuously audit security group and Amazon S3 bucket configurations. Deploy AWS WAF on the Application Load Balancer with managed rules to block SQL injection and HTTP flood attacks.

Enable AWS Security Hub to aggregate findings across all accounts. Configure Network ACLs to statefully filter port 22 and port 3389 traffic at the subnet level, and configure AWS Config to track Security Groups applied to subnets. Deploy AWS WAF on the Application Load Balancer.

Deploy AWS Shield Standard on the Application Load Balancer to mitigate application-layer threat patterns. Configure stateless Security Groups at the subnet level to inspect and block unauthorized administrative traffic, and use AWS Config to record compliance findings.

Cevabı ve açıklamayı göster

Cevap: Enable AWS Security Hub across all accounts in the AWS Organization to aggregate findings in a central security administrator account. Enable AWS Config in all accounts to continuously audit security group and Amazon S3 bucket configurations. Deploy AWS WAF on the Application Load Balancer with managed rules to block SQL injection and HTTP flood attacks.

Cevap

The configuration that enables AWS Security Hub for centralized aggregation, AWS Config for configuration compliance auditing, and AWS WAF on the Application Load Balancer for application-layer protection.

The correct architecture uses AWS Security Hub to consolidate security findings across all AWS accounts in the organization, enabling a unified view of the security posture. AWS Config continuously records resource configuration changes and evaluates them against rules (such as checking for public S3 buckets and restricted ports in security groups). To protect the portal against SQL injection and HTTP flood attacks, AWS WAF is deployed on the Application Load Balancer to inspect incoming HTTP/HTTPS traffic at Layer 7.

Adım Adım Çözüm

Analyze requirements for application-layer threat protection, continuous resource configuration monitoring, and centralized security aggregation.

Identify that SQL injection and HTTP flood attacks require Layer 7 traffic inspection, configuration auditing requires continuous compliance checking, and centralization requires multi-account findings aggregation.

This establishes the functional boundary for selecting the correct AWS services.

Evaluate candidate services for Layer 7 web security.

Determine that AWS WAF is the correct service to block SQL injection and HTTP floods via managed rules, whereas AWS Shield Standard only handles Layer 3 and 4 DDoS protection.

This filters out distractors using Shield Standard for application-layer inspection.

Evaluate options for configuration auditing and multi-account compliance monitoring.

Determine that AWS Config audits resource configurations continuously, and AWS Security Hub integrates with AWS Organizations to aggregate these findings into a central administrator account.

This completes the required SAA architecture by leveraging AWS native integration features.

Anahtar Kavram

Centralized security monitoring and application-layer threat detection utilizing AWS Security Hub, AWS Config, and AWS WAF.

Soru 2Soru →

A financial services firm hosts a customer-facing web application on AWS behind an Application Load Balancer (ALB). The security team needs to implement a solution to monitor for and automatically block SQL injection attacks at the application layer. Additionally, they must ensure that all administrative and management API actions across the entire AWS account are recorded and audited for regulatory compliance. Which combination of actions should a solutions architect recommend to meet these requirements?

Deploy AWS WAF on the Application Load Balancer with a rule group to detect and block SQL injection attacks, and configure AWS CloudTrail with a multi-region trail to log all API activity to a secure Amazon S3 bucket.

Enable AWS Shield Standard to inspect incoming requests and block SQL injection attacks on the Application Load Balancer, and enable AWS CloudTrail to log administrative API activity to an Amazon S3 bucket.

Deploy stateful rules in the subnet-level Network Access Control Lists (NACLs) to inspect HTTP payload content and block SQL injection traffic, and configure AWS Config to record all administrative API actions.

Deploy AWS WAF on the Application Load Balancer to mitigate SQL injection attacks, and use the AWS account root user credentials to configure a daily cron job that downloads and logs administrative activity.

Cevabı ve açıklamayı göster

Cevap: Deploy AWS WAF on the Application Load Balancer with a rule group to detect and block SQL injection attacks, and configure AWS CloudTrail with a multi-region trail to log all API activity to a secure Amazon S3 bucket.

Cevap

The correct answer combines AWS WAF, which inspects HTTP/S traffic at Layer 7 to block SQL injection attacks, with AWS CloudTrail, which logs API and management console activities for compliant security monitoring.

Adım Adım Çözüm

Determine the correct service to monitor and mitigate Layer 7 application exploits.

AWS WAF is selected because it is designed to analyze HTTP payloads and block SQL injection attacks at the Application Load Balancer.

Other services like AWS Shield Standard or Network ACLs operate at network layers and cannot perform application payload inspection.

Select the appropriate compliance logging mechanism for AWS account administrative API activity.

AWS CloudTrail is chosen to record API calls and management events.

CloudTrail provides standard auditing logs for all management console, CLI, and SDK operations.

Combine into a secure, Well-Architected solution.

WAF is attached to the ALB, and a multi-region CloudTrail logs all API activity to a secure Amazon S3 bucket.

This guarantees real-time mitigation of application exploits and audit records stored securely for compliance.

Anahtar Kavram

Application-layer threat detection and compliance logging on AWS

Tahmini Süre:2m 0s

Soru 3Soru →

A financial technology startup recently deployed an application on AWS. The security team needs to establish continuous monitoring of resource configurations to ensure compliance with security standards. Specifically, they must detect when any Security Group allows unrestricted ingress traffic on port 22 or port 3389, and they must automatically remediate these non-compliant configurations by reverting the rules. Additionally, they need to centralize security alerts and compliance statuses across all AWS accounts in the organization. Which combination of AWS services and configurations should the solutions architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Implement AWS Config rules to monitor Security Group configurations and configure remediation using an AWS Systems Manager Automation document to remove non-compliant ingress rules.

Enable AWS Security Hub in the management account and configure it to aggregate compliance findings and security alerts from AWS Config across all accounts in the organization.

Deploy AWS WAF at the subnet level to inspect inbound traffic and automatically block unauthorized SSH and RDP connection attempts.

Configure stateful Network ACLs (NACLs) at the subnet level to monitor configuration changes and automatically block port 22 and port 3389 traffic.

Enable AWS Shield Advanced to continuously scan security group rules for compliance and automatically rotate security keys when unauthorized ports are open.

Cevabı ve açıklamayı göster

Cevap: Implement AWS Config rules to monitor Security Group configurations and configure remediation using an AWS Systems Manager Automation document to remove non-compliant ingress rules.; Enable AWS Security Hub in the management account and configure it to aggregate compliance findings and security alerts from AWS Config across all accounts in the organization.

Cevap

Implement AWS Config rules to monitor and automatically remediate security groups using Systems Manager Automation, and use AWS Security Hub to centralize the aggregated findings across the organization.

AWS Config rules evaluate the configuration settings of AWS resources, detecting open ports in security groups and triggering automated remediation via AWS Systems Manager Automation. AWS Security Hub aggregates compliance data and security findings from AWS Config and other services across the organization into a centralized dashboard.

Adım Adım Çözüm

Select AWS Config to track Security Group changes and configure automatic remediation.

AWS Config monitors configurations and triggers Systems Manager Automation to revert non-compliant rules.

AWS Config is the primary tool for monitoring configuration compliance, and AWS Systems Manager Automation provides remediation scripts.

Select AWS Security Hub to aggregate and centralize alerts.

AWS Security Hub acts as the centralized console to gather findings across the organization.

AWS Security Hub is designed to centralize and prioritize security alerts and compliance statuses across multiple AWS services and accounts.

Anahtar Kavram

Centralized compliance monitoring, configuration auditing, and automated remediation using AWS Config and AWS Security Hub.

Tahmini Süre:2m 0s

Soru 4Soru →

A global digital healthcare platform provides telehealth services through an Application Load Balancer (ALB) in the us-east-1 Region. The platform is experiencing intermittent latency due to a surge in malicious traffic, including distributed denial of service (DDoS) attempts at the network layer and SQL injection attempts at the application layer. The company needs to implement a solution that caches static healthcare resources at the edge, mitigates L3/L4 DDoS attacks, and blocks L7 malicious exploits before they reach the ALB. Which combination of configurations should a solutions architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer to cache static assets and utilize built-in AWS Shield Standard for Layer 3 and Layer 4 protection.

Create an AWS WAF web ACL with SQL injection protection rules and associate it with the Amazon CloudFront distribution.

Enable AWS Shield Standard on the Application Load Balancer and configure it to inspect and block Layer 7 SQL injection attacks.

Configure stateless Network Access Control Lists (NACLs) at the subnet level to perform deep packet inspection and filter out SQL injection patterns.

Configure the Application Load Balancer security groups to block traffic originating from outside the local VPC CIDR block.

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer to cache static assets and utilize built-in AWS Shield Standard for Layer 3 and Layer 4 protection.; Create an AWS WAF web ACL with SQL injection protection rules and associate it with the Amazon CloudFront distribution.

Cevap

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer and associate an AWS WAF web ACL with the CloudFront distribution.

Deploying an Amazon CloudFront distribution provides global edge caching and automatically includes AWS Shield Standard protection to mitigate Layer 3 and Layer 4 DDoS attacks. Associating an AWS WAF web ACL with the CloudFront distribution allows the inspection of incoming HTTP requests at the edge, blocking Layer 7 exploits such as SQL injection before they reach the origin Application Load Balancer.

Adım Adım Çözüm

Address caching and Layer 3/4 DDoS protection at the edge.

Amazon CloudFront is deployed to cache static content at edge locations. Traffic routed through CloudFront is automatically protected by AWS Shield Standard against infrastructure DDoS attacks.

This offloads traffic from the Application Load Balancer and mitigates L3/L4 network-layer threats before they hit internal systems.

Address Layer 7 SQL injection protection.

An AWS WAF web ACL is created with rules to detect SQL injection and is associated with the Amazon CloudFront distribution.

AWS WAF provides the deep packet inspection capabilities needed to inspect HTTP request bodies and block SQL injection attempts at the edge network.

Evaluate and eliminate incorrect firewall configurations.

Reject subnet Network ACLs and security groups as solutions for SQL injection protection.

NACLs and security groups operate at Layer 4 and cannot inspect Layer 7 payload content. Additionally, blocking external traffic via security groups would make the public platform inaccessible.

Anahtar Kavram

Combining Amazon CloudFront, AWS Shield Standard, and AWS WAF at the AWS edge to protect applications against Layer 3/4 DDoS and Layer 7 exploits.

Soru 5Soru →

A company is hosting a financial transaction processing application on Amazon EC2 instances in a private subnet (CIDR block $10.0.1.0/24$ ) within a VPC. The instances must meet the following network connectivity and security requirements:

1. Securely access Amazon S3 buckets to store transaction logs without traversing the public internet and without incurring data processing fees.
2. Establish outbound HTTPS connections to an external credit score API (destination IP address $203.0.113.50/32$ on TCP port $443$ ) while blocking all other outbound internet traffic.
3. Allow the return traffic from the external credit score API back to the EC2 instances.

A solutions architect has deployed a NAT gateway in a public subnet to handle internet egress. Which combination of network configuration steps must the solutions architect implement to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route table of the private subnet.

Configure the private subnet's Network ACL with an outbound rule allowing TCP port

443

203.0.113.50/32

. Do not configure an inbound rule for the return traffic, as Network ACLs are stateful and will automatically permit the response traffic.

Route all outbound traffic, including requests to Amazon S3, through the NAT gateway, and configure an Amazon S3 Interface VPC Endpoint in the public subnet to eliminate data processing fees.

Configure the private subnet's Network ACL with an outbound rule allowing TCP port

443

203.0.113.50/32

, and an inbound rule allowing TCP ports

1024-65535

from

203.0.113.50/32

Configure the security group attached to the EC2 instances with an inbound rule allowing TCP ports

1024-65535

from

203.0.113.50/32

to permit return traffic from the external credit score API.

Cevabı ve açıklamayı göster

Cevap: Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route table of the private subnet.; Configure the private subnet's Network ACL with an outbound rule allowing TCP port $443$ to $203.0.113.50/32$ , and an inbound rule allowing TCP ports $1024-65535$ from $203.0.113.50/32$ .

Cevap

To secure the VPC network configuration, the solutions architect must create a Gateway VPC Endpoint for Amazon S3 associated with the private subnet's route table, and configure the private subnet's Network ACL with an outbound rule allowing TCP port 443 to the target API IP and an inbound rule allowing TCP ports 1024-65535 from the target API IP.

The correct architecture combines a Gateway VPC Endpoint for Amazon S3 with a stateless Network ACL configuration. First, using a Gateway VPC Endpoint for S3 is a free service that prevents S3 traffic from routing through the NAT gateway, thereby avoiding NAT data processing fees. Second, because Network ACLs are stateless, they require both an outbound rule to permit the request to the third-party API on port

443

and an inbound rule to permit the return traffic on the client's ephemeral port range (

1024-65535

) from the API's IP address.

Adım Adım Çözüm

Address the S3 connectivity requirement by evaluating Gateway vs Interface endpoints.

Creating a Gateway VPC Endpoint for Amazon S3 is free, does not traverse the NAT gateway, and automatically updates the private subnet's route table to direct S3-destined traffic through the endpoint.

This satisfies the requirement to access Amazon S3 securely without using the internet or incurring data transfer costs.

Address the stateless filtering layer (Network ACLs) for the third-party API traffic.

An outbound Network ACL rule must allow traffic to

203.0.113.50/32

on port

443

. A corresponding inbound Network ACL rule must allow return traffic from

203.0.113.50/32

on ephemeral ports

1024-65535

Network ACLs are stateless; they do not track connection state, so return traffic must be explicitly permitted.

Address the stateful filtering layer (Security Groups) for the third-party API traffic.

The security group only needs an outbound rule allowing TCP port

443

203.0.113.50/32

. No inbound rule is needed.

Security groups are stateful; once outbound traffic is allowed, return traffic is dynamically permitted.

Anahtar Kavram

Stateless Network ACLs require explicit configuration for both outbound request traffic and inbound ephemeral return traffic, whereas stateful Security Groups handle return traffic automatically.

Tahmini Süre:3m 0s

Soru 6Soru →

A company has an on-premises Active Directory and is migrating its web application to AWS. The application runs on Amazon EC2 instances. The solutions architect must ensure that:
1. Corporate employees can access the AWS Management Console using their existing credentials, without creating individual IAM users.
2. The EC2 instances can securely access a private Amazon S3 bucket without using long-term credentials.
3. Administrative operations in the AWS account must be restricted to standard IAM administrative roles, ensuring the root user is not used for daily activities.

Which combination of steps should the solutions architect implement to meet these security requirements?

Create individual IAM users for each employee and run a script to synchronize passwords from Active Directory. Store the S3 access keys in a plaintext String parameter in AWS Systems Manager Parameter Store for the EC2 instances to retrieve. Use the AWS account root user credentials for daily administrative tasks.

Configure AWS IAM Identity Center to federate the on-premises Active Directory. Generate a dedicated IAM user with long-term credentials, configure S3 access permissions on this user, and distribute the access keys to the EC2 instances. Enable automatic key rotation for the customer managed KMS key encrypting the S3 bucket, assuming it will immediately re-encrypt all existing bucket data.

Configure AWS IAM Identity Center to federate the on-premises Active Directory. Attach an IAM role with an instance profile to the EC2 instances to grant temporary permissions to access the S3 bucket. Create a dedicated IAM role with administrative policies for daily cloud administration instead of using the AWS account root user.

Create individual IAM users for each employee in the AWS account. Attach an IAM role with an instance profile to the EC2 instances to grant temporary permissions to access the S3 bucket. Configure the AWS account root user to perform daily administrative tasks, ensuring Multi-Factor Authentication (MFA) is enabled on the root user.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center to federate the on-premises Active Directory. Attach an IAM role with an instance profile to the EC2 instances to grant temporary permissions to access the S3 bucket. Create a dedicated IAM role with administrative policies for daily cloud administration instead of using the AWS account root user.

Cevap

Configure AWS IAM Identity Center to federate the Active Directory, use an IAM role with an instance profile for EC2 S3 access, and use a dedicated administrative IAM role for daily tasks instead of the root user.

The correct solution uses AWS IAM Identity Center to federate Active Directory identities, which fulfills the requirement of single sign-on without manual IAM user overhead. It employs an IAM role with an instance profile to supply temporary credentials to EC2 instances, adhering to credential management best practices. Finally, it uses a dedicated administrative IAM role for daily tasks rather than exposing the root user account.

Adım Adım Çözüm

Configure AWS IAM Identity Center to federate Active Directory.

Employees can log in with corporate credentials without creating duplicate IAM users in AWS.

Allows centralized identity management and avoids the creation of static IAM users.

Assign an IAM role with an instance profile to the EC2 instances.

The application automatically obtains temporary AWS security credentials to access S3.

Eliminates the risk of hardcoded, static credentials on the EC2 instances.

Deploy a dedicated IAM role for administrator duties.

Administrative operations are performed securely without using the AWS account root user.

Protects the root account by restricting daily administrative actions to standard IAM roles.

Anahtar Kavram

Identity Federation, IAM Roles, and Least Privilege Account Management

Soru 7Soru →

An enterprise is migrating its multi-account environment to AWS Organizations. The security team needs to enforce compliance by preventing any member account under the `Prod-Workloads` OU from deleting or modifying administrative IAM roles prefixed with `SecurityGov-`. Additionally, the enterprise requires centralized access management integrated with their Microsoft Entra ID identity provider. The solution must ensure that administrative tasks in member accounts do not require local IAM user credentials. Which strategy should a Solutions Architect implement to meet these requirements?

Configure federated access using AWS IAM Identity Center integrated with Microsoft Entra ID. Attach an SCP to the `Prod-Workloads` OU that denies `iam:DeleteRole`, `iam:PutRolePolicy`, and `iam:AttachRolePolicy` actions for any resource prefixed with `SecurityGov-`, except when the principal is the IAM Identity Center administrative role.

Create individual IAM users in each member account under the `Prod-Workloads` OU to represent the enterprise directory users, configuring SAML federation for each user. Apply an SCP to the OU that denies all IAM role modifications for all principals.

Configure federated access using AWS IAM Identity Center integrated with Microsoft Entra ID. Attach an SCP to the organization's root to restrict the management account and all member accounts from modifying any IAM roles prefixed with `SecurityGov-`.

Configure Entra ID integration by enabling SAML federation with the management account. Use the management account's root credentials to perform administrative tasks in the member accounts, and attach an SCP to the `Prod-Workloads` OU to deny all local role updates.

Cevabı ve açıklamayı göster

Cevap: Configure federated access using AWS IAM Identity Center integrated with Microsoft Entra ID. Attach an SCP to the `Prod-Workloads` OU that denies `iam:DeleteRole`, `iam:PutRolePolicy`, and `iam:AttachRolePolicy` actions for any resource prefixed with `SecurityGov-`, except when the principal is the IAM Identity Center administrative role.

Cevap

Configure federated access using AWS IAM Identity Center integrated with Microsoft Entra ID, and attach an SCP to the target OU denying modification of security roles with an exception for the admin role.

The correct strategy integrates Microsoft Entra ID with AWS IAM Identity Center for centralized access without requiring local IAM users. Using an SCP applied to the `Prod-Workloads` OU enforces the security guardrails on member accounts while exempting the admin role to allow legitimate updates to the security roles.

Adım Adım Çözüm

Analyze identity requirements

Determine that centralized federation using AWS IAM Identity Center is required to integrate with Microsoft Entra ID and avoid local credentials.

This simplifies credential management and aligns with AWS best practices for identity federation.

Analyze guardrail requirements

Establish that an SCP (Service Control Policy) attached to the `Prod-Workloads` OU is the correct mechanism to restrict role modification globally across the target member accounts.

SCPs enforce controls across accounts in an OU regardless of local administrator permissions.

Define SCP exceptions

Write the SCP to deny IAM modifications on the `SecurityGov-` role prefix, adding a condition that exempts the IAM Identity Center administrative role to allow legitimate changes.

A strict deny would block all users, including the central administrators, from managing the resources.

Anahtar Kavram

Centralized identity federation and multi-account guardrail enforcement using Service Control Policies (SCPs).

Soru 8Soru →

A company has an application running on Amazon EC2 instances in AWS Account A (Development) that requires read-only access to an Amazon DynamoDB table located in AWS Account B (Production). According to security best practices, the application must not store long-term credentials on the EC2 instances. Which combination of actions should the solutions architect take to configure this access securely? (Select TWO.)

Geçerli olan tümünü seçin

Create an IAM role in Account B with a trust policy that allows Account A to assume the role, and attach a permissions policy that grants read-only access to the DynamoDB table.

Configure an IAM role in Account A, attach it to the EC2 instances as an instance profile, and authorize the role to perform the sts:AssumeRole action on the Account B role.

Create access keys for the AWS account root user of Account B, and configure the application to retrieve them using instance metadata.

Create an IAM user in Account B, and configure the application to retrieve the user's access keys from a plaintext Systems Manager Parameter Store parameter of type String.

Create individual IAM users in Account B for the EC2 instances in Account A to use for federated access to the DynamoDB table.

Cevabı ve açıklamayı göster

Cevap: Create an IAM role in Account B with a trust policy that allows Account A to assume the role, and attach a permissions policy that grants read-only access to the DynamoDB table.; Configure an IAM role in Account A, attach it to the EC2 instances as an instance profile, and authorize the role to perform the sts:AssumeRole action on the Account B role.

Cevap

Create an IAM role in Account B with a trust policy that allows Account A to assume the role, and configure an IAM role in Account A attached to the EC2 instances to authorize the sts:AssumeRole action on the Account B role.

The correct architecture uses cross-account role delegation. A role in Account B defines a trust relationship allowing Account A to assume it and carries the permission to read the DynamoDB table. The EC2 instances in Account A are assigned an instance profile with an IAM role that permits calling the sts:AssumeRole API on the role in Account B. This removes the need for long-term credentials on the instances.

Adım Adım Çözüm

Define cross-account access trust in the target account

An IAM role is created in Account B with a trust policy allowing Account A to assume it, and a permission policy granting DynamoDB read permissions.

This establishes the target permissions and delegates trust to the source account.

Grant the EC2 instances permission to assume the cross-account role

An IAM role is created in Account A, attached as an EC2 instance profile, with policies allowing sts:AssumeRole on the role in Account B.

This enables the EC2 instances to dynamically request temporary credentials from STS for Account B.

Anahtar Kavram

Cross-account IAM role assumption and delegate trust pattern

Tahmini Süre:2m 0s

Soru 9Soru →

A digital publishing company serves personalized web content to a global audience. The content is hosted on origin servers in an on-premises data center, which is connected to AWS via an AWS Direct Connect connection. During major news events, the platform experiences sudden HTTP flood attacks (Layer 7) that exhaust the bandwidth on the Direct Connect connection, causing severe outages for legitimate users. The company needs to implement a solution to block these attacks at the AWS network edge before they reach the Direct Connect connection and the on-premises infrastructure. Which solution will meet these requirements?

Deploy an Application Load Balancer in the VPC, and configure stateful Network Access Control Lists (NACLs) to automatically block the attacking IP addresses at the subnet level before the traffic is routed over the Direct Connect link.

Configure Amazon Route 53 with latency-based routing to resolve queries to the on-premises servers, and rely on AWS Shield Standard to automatically detect and mitigate Layer 7 HTTP flood attacks at the DNS layer.

Create an Amazon CloudFront distribution with the on-premises origin servers configured as the origin. Associate an AWS WAF web ACL with the CloudFront distribution, configure rate-based rules, and enable AWS Shield Advanced on the CloudFront distribution.

Enable AWS Shield Standard on the Direct Connect gateway, and configure AWS WAF rules to inspect and filter traffic directly on the on-premises origin servers.

Cevabı ve açıklamayı göster

Cevap: Create an Amazon CloudFront distribution with the on-premises origin servers configured as the origin. Associate an AWS WAF web ACL with the CloudFront distribution, configure rate-based rules, and enable AWS Shield Advanced on the CloudFront distribution.

Cevap

Create an Amazon CloudFront distribution with the on-premises origin servers configured as the origin, associate an AWS WAF web ACL with rate-based rules, and enable AWS Shield Advanced.

The correct solution uses Amazon CloudFront to intercept traffic at the AWS edge, which prevents malicious HTTP requests from traversing the Direct Connect link and exhausting the bandwidth of the on-premises origin. Associating an AWS WAF web ACL with rate-based rules blocks the Layer 7 HTTP flood attacks, and enabling AWS Shield Advanced on the CloudFront distribution provides advanced monitoring and automated Layer 7 mitigation.

Adım Adım Çözüm

Analyze the entry point of the network traffic and identify where the bottleneck occurs.

The traffic traverses a Direct Connect connection to the on-premises origin, meaning any DDoS mitigation must happen at the AWS edge before entering the Direct Connect path.

This determines that resources inside the VPC or on-premises cannot protect the Direct Connect link bandwidth.

Select an AWS service that can act as a global entry point at the edge and integrate with layer 7 protection.

Amazon CloudFront can cache content, serve as the public entry point, and support AWS WAF and AWS Shield Advanced.

CloudFront routes traffic through the global AWS edge network, isolating the origin from direct internet exposure.

Apply Layer 7 mitigation to block HTTP flood attacks.

AWS WAF with rate-based rules blocks anomalous IP request rates, and AWS Shield Advanced provides automated Layer 7 protection.

Layer 7 attacks mimic real traffic, requiring application-layer analysis and rate-limiting to mitigate without blocking legitimate traffic.

Anahtar Kavram

Edge protection and DDoS mitigation for hybrid architectures

Tahmini Süre:2m 30s

Soru 10Soru →

An online retail application hosted on AWS Lambda requires access to an external payment gateway API key that must be rotated every 30 days. The application also requires access to several non-sensitive configuration settings, including timeout values and API endpoints. The architecture must minimize cost while ensuring that the sensitive API key is encrypted at rest and rotated automatically without manual intervention. Which parameter management strategy should a solutions architect implement to meet these requirements with the lowest operational overhead?

Store the non-sensitive parameters as Standard parameters in AWS Systems Manager Parameter Store. Store the payment gateway API key in AWS Secrets Manager, and configure automatic rotation using an AWS Lambda function.

Store the payment gateway API key as a SecureString parameter in AWS Systems Manager Parameter Store. Enable automatic key rotation on the associated AWS Key Management Service (AWS KMS) customer managed key to automatically rotate the payment gateway API key value every 30 days.

Store both the non-sensitive configuration settings and the payment gateway API key as Standard plaintext String parameters in AWS Systems Manager Parameter Store, using a scheduled AWS Lambda function to update the values.

Store all configuration settings and the payment gateway API key in AWS Systems Manager Parameter Store as StringList parameters, enabling AWS KMS encryption on the parameter path to secure the sensitive values without incurring Secrets Manager costs.

Cevabı ve açıklamayı göster

Cevap: Store the non-sensitive parameters as Standard parameters in AWS Systems Manager Parameter Store. Store the payment gateway API key in AWS Secrets Manager, and configure automatic rotation using an AWS Lambda function.

Cevap

Store the non-sensitive parameters as Standard parameters in AWS Systems Manager Parameter Store, store the payment gateway API key in AWS Secrets Manager, and configure automatic rotation using an AWS Lambda function.

The correct solution uses AWS Systems Manager Parameter Store for non-sensitive parameters, which is cost-effective, and AWS Secrets Manager for the sensitive API key. Secrets Manager supports automatic rotation natively through integration with AWS Lambda, ensuring that the 30-day rotation requirement is met with minimal custom development or operational maintenance.

Adım Adım Çözüm

Identify parameter types and security requirements.

Non-sensitive settings (timeout, endpoints) do not require encryption or rotation. The payment gateway API key requires encryption at rest and automatic rotation every 30 days.

This determines the appropriate service for each parameter class to optimize cost and security.

Select the parameter storage service based on cost and capability constraints.

Use Systems Manager Parameter Store Standard parameters for non-sensitive settings to avoid cost. Use AWS Secrets Manager for the API key to utilize its native rotation integration.

Parameter Store standard parameters are free, whereas Secrets Manager charges per secret but provides built-in rotation management.

Configure automatic rotation for the API key.

Configure AWS Secrets Manager to rotate the API key every 30 days using a rotation AWS Lambda function.

This automates the rotation lifecycle of the external API key, meeting the security mandate with the least operational overhead.

Anahtar Kavram

Secrets Manager vs Parameter Store Trade-offs

Tahmini Süre:1m 30s

Soru 11Soru →

An enterprise application hosted on Amazon ECS tasks in a private VPC must connect to a legacy PostgreSQL database hosted on-premises via an AWS Direct Connect connection. The database credentials must be rotated every 30 days to comply with security regulations. The rotation process must be automated, secure at rest, and must not require changes to the application deployment pipeline. Which database credential management solution meets these security requirements with the least operational overhead?

Store the database credentials in AWS Secrets Manager. Configure a 30-day rotation schedule for the secret and deploy a custom AWS Lambda function within the VPC to update the credentials on both the PostgreSQL database and the Secrets Manager secret.

Store the database credentials as a String parameter in AWS Systems Manager Parameter Store. Configure an Amazon EventBridge rule that triggers an AWS Lambda function every 30 days to rotate the database password and update the parameter value.

Store the database credentials in AWS Secrets Manager encrypted with an AWS KMS Customer Managed Key (CMK). Enable automatic annual rotation on the CMK and set the rotation window to 30 days to automatically rotate the database password.

Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter. Rely on the automatic rotation feature of the associated AWS KMS Customer Managed Key (CMK) to automatically regenerate the credential value and rotate it on the on-premises database every 30 days.

Cevabı ve açıklamayı göster

Cevap: Store the database credentials in AWS Secrets Manager. Configure a 30-day rotation schedule for the secret and deploy a custom AWS Lambda function within the VPC to update the credentials on both the PostgreSQL database and the Secrets Manager secret.

Cevap

Store the database credentials in AWS Secrets Manager, configuring a 30-day rotation schedule along with a custom AWS Lambda function in the VPC to update the credentials in both the database and the secret.

The correct solution uses AWS Secrets Manager, which natively orchestrates credential rotation. Because the target PostgreSQL database is legacy and on-premises, a custom Lambda function running in the private VPC is required to bridge the connectivity over AWS Direct Connect and safely update both the database password and the secrets store.

Adım Adım Çözüm

Select a secrets management service that supports secure storage and automated rotation.

AWS Secrets Manager is chosen over Systems Manager Parameter Store because Secrets Manager has built-in integration for automated rotation schedules.

Parameter Store lacks native credential rotation orchestration and requires building custom schedulers and notification flows.

Ensure network connectivity for the rotation mechanism.

The Lambda rotation function must be associated with the VPC to route traffic over the AWS Direct Connect connection to the on-premises database.

Since the database is private on-premises, a Lambda function running outside the VPC cannot resolve or connect to the database endpoints.

Configure rotation mechanics using the rotation Lambda function.

The Lambda function updates the credential on the PostgreSQL database first, verifies connectivity, and then calls the Secrets Manager API to update the secret value.

This guarantees that the credential in the secret manager is always synchronized with the database, avoiding service disruption.

Anahtar Kavram

Secrets Manager vs Parameter Store Rotation and Encryption Mechanics

Soru 12Soru →

A company is using AWS Organizations to manage a multi-account environment. The security team wants to implement a centralized identity management solution that allows corporate employees to authenticate using their existing external Identity Provider (IdP) credentials and access resources across multiple AWS accounts. Additionally, the security team needs to prevent individual member accounts from disabling AWS CloudTrail logging. Which solution meets these requirements with the least operational overhead?

Use the AWS Organizations management account root user credentials to establish a direct SAML 2.0 federation with the external IdP. Apply a Service Control Policy (SCP) to the management account itself to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.

Create individual IAM users in each member account and configure AWS IAM Identity Center to map external IdP users to these IAM users. Write a custom AWS Lambda function that triggers on AWS CloudTrail configuration changes in member accounts to automatically re-enable logging.

Configure AWS IAM Identity Center to federate with the external IdP. Assign permission sets to users and groups for AWS Organizations member accounts. Apply a Service Control Policy (SCP) at the root level of the organization that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions on all member Organizational Units (OUs).

Create individual IAM users in the management account with long-term credentials for each external IdP user, and configure cross-account roles in member accounts. Use resource-based policies on the AWS CloudTrail Amazon S3 buckets in member accounts to restrict administrative access.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center to federate with the external IdP. Assign permission sets to users and groups for AWS Organizations member accounts. Apply a Service Control Policy (SCP) at the root level of the organization that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions on all member Organizational Units (OUs).

Cevap

Configure AWS IAM Identity Center to federate with the external Identity Provider (IdP), assign permission sets to users and groups for AWS Organizations member accounts, and apply a Service Control Policy (SCP) at the root level of the organization to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail actions on all member Organizational Units (OUs).

The correct solution uses AWS IAM Identity Center to establish federation with the external Identity Provider, enabling centralized authentication without creating individual IAM users. By applying a Service Control Policy at the Organization root level, the policy is inherited by all member accounts and organizational units, preventing administrators in member accounts from stopping or deleting AWS CloudTrail.

Adım Adım Çözüm

Configure AWS IAM Identity Center to federate with the external Identity Provider (IdP).

Establishes a single sign-on (SSO) gateway allowing enterprise users to access AWS accounts using their existing corporate credentials without local IAM user provisioning.

Reduces operational overhead and centralizes identity management by delegating authentication to the external IdP.

Create permission sets and assign them to users and groups across the organization accounts.

Users and groups receive permissions defined by the permission sets in specific AWS accounts.

Allows fine-grained access control across multiple accounts in AWS Organizations.

Create and attach a Service Control Policy (SCP) to the organization's root or member OUs that denies CloudTrail deletion and stop logging actions.

Ensures all member accounts inherit the policy, prohibiting users (including account administrators) from stopping or deleting trails.

Enforces governance and compliance controls uniformly across all member accounts in a multi-account organization.

Anahtar Kavram

Centralized federation and organization-wide governance policies using AWS IAM Identity Center and Service Control Policies (SCPs).

Tahmini Süre:2m 0s

Soru 13Soru →

A company is designing a secure architecture for an application running on Amazon EC2 instances. The application needs to retrieve data from an Amazon RDS database and store reports in an Amazon S3 bucket. The security policy mandates that:

1. The EC2 instances must use short-term credentials to access the S3 bucket.
2. The database credentials must be rotated every 30 days without downtime.
3. The AWS KMS Customer Managed Key (CMK) used to encrypt S3 reports must be rotated annually without interrupting access to historical reports.

Which combination of actions should the company perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Attach an IAM role to the EC2 instances to grant S3 permissions, and use AWS Secrets Manager to store and automatically rotate the database credentials every 30 days.

Enable automatic annual rotation for the KMS Customer Managed Key, which creates a new backing key version for new writes while keeping old versions available for decryption.

Create an IAM user, store the long-term credentials in a configuration file on the EC2 instances, and store the database credentials as plaintext parameters in Systems Manager Parameter Store.

Enable automatic key rotation for the KMS key, and execute a custom script to immediately decrypt and re-encrypt all existing S3 reports with the new key version.

Log in to the AWS account root user to configure the database credentials in AWS Secrets Manager and to manually trigger the annual rotation of the KMS key.

Cevabı ve açıklamayı göster

Cevap: Attach an IAM role to the EC2 instances to grant S3 permissions, and use AWS Secrets Manager to store and automatically rotate the database credentials every 30 days.; Enable automatic annual rotation for the KMS Customer Managed Key, which creates a new backing key version for new writes while keeping old versions available for decryption.

Cevap

The correct options are the ones suggesting to attach an IAM role to the EC2 instances and store database credentials in AWS Secrets Manager, and to enable automatic annual rotation for the KMS Customer Managed Key.

Attaching an IAM role to the EC2 instances allows them to retrieve temporary credentials to access the S3 bucket safely. AWS Secrets Manager can store database credentials and rotate them automatically without downtime. Enabling automatic annual key rotation on KMS Customer Managed Keys manages the backing keys seamlessly: it uses the new backing key for encryption, while keeping older backing key versions available to decrypt historical data without needing manual re-encryption or application updates.

Adım Adım Çözüm

Address the requirement for secure, temporary credentials for the EC2 instances.

Attach an IAM role to the EC2 instances instead of using long-term IAM user access keys.

IAM roles utilize AWS Security Token Service (STS) to provide temporary security credentials, reducing credential leakage risks.

Address the requirement for database credential storage and automated rotation.

Use AWS Secrets Manager to store credentials and configure a 30-day automatic rotation schedule.

AWS Secrets Manager natively integrates with RDS to rotate credentials using Lambda without application downtime.

Address the requirement for KMS Customer Managed Key rotation.

Enable automatic annual rotation for the customer managed key.

Automatic KMS key rotation generates a new backing key for encryption while preserving older backing key versions for seamless decryption of historical data, requiring no manual re-encryption.

Anahtar Kavram

AWS Identity and Access Management (IAM) Roles, Secrets Manager rotation integration, and AWS KMS automatic key rotation mechanics.

Soru 14Soru →

An organization operates a multi-account AWS environment managed under AWS Organizations. An application running on Amazon EC2 instances in a production member account must securely access and decrypt highly confidential financial data stored in an Amazon S3 bucket within a shared services account. The S3 bucket is encrypted with an AWS KMS customer managed key located in the shared services account. The solution must also retrieve database credentials that require rotation every $30$ days.

Which design should a solutions architect implement to meet these security requirements?

Attach an IAM instance profile to the EC2 instances that references an IAM role. Configure the KMS key policy and the S3 bucket policy in the shared services account to grant permissions to the EC2 role. Store the database credentials in AWS Secrets Manager and enable automatic rotation every

30

days using an AWS Lambda function.

Use the production account's root user access keys configured in a local credential file on the EC2 instances to access the shared S3 bucket. Store the database credentials in AWS Systems Manager Parameter Store as a Standard parameter, and write a custom script on the EC2 instances to rotate the password every

30

days using the root credentials.

Create a cross-account IAM role for the EC2 instances. Store the database credentials as a plaintext String parameter in AWS Systems Manager Parameter Store to allow EC2 instances to retrieve them, and configure an Amazon EventBridge rule to trigger a Lambda function to update the parameter value every

30

days.

Attach an IAM role to the EC2 instances with cross-account S3 access. Enable automatic key rotation for the KMS customer managed key in the shared services account, which will immediately re-encrypt all historical S3 data under the new key version, and store the database credentials in Systems Manager Parameter Store as a SecureString.

Cevabı ve açıklamayı göster

Cevap: Attach an IAM instance profile to the EC2 instances that references an IAM role. Configure the KMS key policy and the S3 bucket policy in the shared services account to grant permissions to the EC2 role. Store the database credentials in AWS Secrets Manager and enable automatic rotation every $30$ days using an AWS Lambda function.

Cevap

Attach an IAM instance profile to the EC2 instances that references an IAM role, configure cross-account permissions in the shared services account's S3 bucket policy and KMS key policy to trust the role, and store and automatically rotate the credentials in AWS Secrets Manager using a Lambda function.

The correct solution uses an IAM instance profile to assign temporary credentials to the EC2 instances. For cross-account access to S3 and KMS in the shared services account, both the S3 bucket policy and the KMS key policy must trust the EC2 role from the production account. Storing and rotating database credentials every

30

days is a native capability of AWS Secrets Manager using AWS Lambda, representing the most secure and low-overhead solution.

Adım Adım Çözüm

Configure the identity foundation for the EC2 instances using temporary credentials.

Create an IAM role and associate it with an IAM instance profile attached to the EC2 instances, eliminating the need for hardcoded credentials.

This follows the security principle of least privilege and avoids storing long-term credentials on EC2 instances.

Establish trust and permissions across AWS accounts.

Update the S3 bucket policy and KMS key policy in the shared services account to grant the required permissions (such as s3:GetObject and kms:Decrypt) to the ARN of the IAM role in the production account.

For cross-account access, both the IAM policy in the source account and the resource policies in the target account must allow the operations.

Securely store and automate rotation of the database credentials.

Store the database credentials in AWS Secrets Manager, and configure the built-in rotation mechanism with an AWS Lambda function set to trigger every

30

days.

AWS Secrets Manager is designed to manage database secrets securely and provides out-of-the-box integration with AWS Lambda to rotate credentials automatically.

Anahtar Kavram

Cross-account resource access using IAM roles combined with secure secrets management and rotation.

Tahmini Süre:2m 30s

Soru 15Soru →

A company is deploying a secure database client application on Amazon EC2 instances in a private application subnet (CIDR $10.100.2.0/24$ ) of a VPC. The application must securely query an AWS service using an Interface VPC Endpoint. To enhance security boundaries, the Interface VPC Endpoint is deployed in a separate dedicated endpoint subnet (CIDR $10.100.10.0/24$ ). Both subnets are associated with custom Network Access Control Lists (NACLs) that deny all inbound and outbound traffic by default. The EC2 instances must initiate HTTPS connections on port $443$ to the Interface VPC Endpoint. Which configuration steps must be implemented to allow this communication while maintaining the principle of least privilege? (Select TWO.)

Geçerli olan tümünü seçin

In the Network ACL associated with the private application subnet, add an outbound rule that allows outbound TCP traffic on port

443

to the destination CIDR

10.100.10.0/24

, and an inbound rule that allows inbound TCP traffic on ports

1024-65535

from the source CIDR

10.100.10.0/24

In the Network ACL associated with the VPC endpoint subnet, add an inbound rule that allows inbound TCP traffic on port

443

from the source CIDR

10.100.2.0/24

, and an outbound rule that allows outbound TCP traffic on ports

1024-65535

to the destination CIDR

10.100.2.0/24

In the Network ACL associated with the private application subnet, add an outbound rule that allows outbound TCP traffic on port

443

to the destination CIDR

10.100.10.0/24

. No corresponding inbound rule is required because Network ACLs automatically allow return traffic.

In the security group attached to the EC2 instances, add an outbound rule allowing TCP traffic on port

443

to the Interface VPC Endpoint's security group, and an inbound rule allowing TCP traffic on ports

1024-65535

from the Interface VPC Endpoint's security group.

In the security group attached to the Interface VPC Endpoint, add an inbound rule allowing TCP traffic on port

443

from the EC2 instances' security group. No security group rules are required on the EC2 instances because security groups are applied at the subnet boundary.

Cevabı ve açıklamayı göster

Cevap: In the Network ACL associated with the private application subnet, add an outbound rule that allows outbound TCP traffic on port $443$ to the destination CIDR $10.100.10.0/24$ , and an inbound rule that allows inbound TCP traffic on ports $1024-65535$ from the source CIDR $10.100.10.0/24$ .; In the Network ACL associated with the VPC endpoint subnet, add an inbound rule that allows inbound TCP traffic on port $443$ from the source CIDR $10.100.2.0/24$ , and an outbound rule that allows outbound TCP traffic on ports $1024-65535$ to the destination CIDR $10.100.2.0/24$ .

Cevap

To establish communication under a default-deny Network ACL architecture, the Network ACL for the application subnet must allow outbound traffic on port

443

and inbound traffic on ephemeral ports

1024-65535

. Concurrently, the Network ACL for the endpoint subnet must allow inbound traffic on port

443

and outbound traffic on ephemeral ports

1024-65535

Because Network ACLs are stateless, they evaluate traffic in each direction independently. Since the EC2 client initiates an HTTPS request to the Interface VPC Endpoint across subnet boundaries, the application subnet's Network ACL must permit outbound TCP traffic on port

443

and inbound return traffic on the ephemeral port range (

1024-65535

). Reciprocally, the endpoint subnet's Network ACL must permit inbound TCP traffic on port

443

and outbound return traffic on the ephemeral port range (

1024-65535

) back to the application subnet.

Adım Adım Çözüm

Analyze the statefulness of the firewalls involved.

Security groups are stateful (automatically tracking connections), whereas Network ACLs are stateless (requiring separate rules for inbound and outbound traffic).

This determines whether return traffic rules are required for each layer.

Determine the necessary rules for the stateless Network ACL in the client application subnet.

An outbound rule allowing destination port

443

to the endpoint subnet, and an inbound rule allowing source ephemeral ports

1024-65535

from the endpoint subnet.

Since the client initiates the connection, outbound traffic leaves on port

443

and returns on ephemeral ports.

Determine the necessary rules for the stateless Network ACL in the VPC endpoint subnet.

An inbound rule allowing destination port

443

from the application subnet, and an outbound rule allowing target ephemeral ports

1024-65535

to the application subnet.

Since the VPC endpoint receives the connection, inbound traffic enters on port

443

and return traffic is sent back to the client's ephemeral port range.

Anahtar Kavram

The stateless nature of Network ACLs requiring explicit configuration for both request and response traffic paths, compared to the stateful nature of Security Groups.

Tahmini Süre:2m 30s

Soru 16Soru →

A data processing application is deployed on Amazon EC2 instances in a private subnet (Subnet A: $10.0.2.0/24$ ). The application must initiate outbound database queries to an Amazon RDS PostgreSQL DB instance in another private subnet (Subnet B: $10.0.3.0/24$ ) on port $5432$ . The application must also download external software updates over HTTPS (port $443$ ) through a NAT Gateway located in a public subnet (Subnet C: $10.0.1.0/24$ ). Custom Network Access Control Lists (NACLs) are used to secure the subnets. Which configuration of NACL rules for Subnet A will allow the required traffic while following the principle of least privilege?

Inbound: Allow traffic from Source

10.0.3.0/24

on Port

5432

and from Source

0.0.0.0/0

on Port

443

. Outbound: Allow traffic to Destination

10.0.3.0/24

on Port

5432

and to Destination

0.0.0.0/0

on Port

443

Inbound: Allow traffic from Source

0.0.0.0/0

on Port Range

1024-65535

. Outbound: Allow traffic to Destination

10.0.3.0/24

on Port

5432

and to Destination

0.0.0.0/0

on Port

443

Inbound: No inbound rules are required because Security Groups are stateful and will automatically allow return traffic. Outbound: Allow traffic to Destination

10.0.3.0/24

on Port

5432

and to Destination

0.0.0.0/0

on Port

443

Inbound: No inbound rules are required. Outbound: Allow traffic to Destination

10.0.3.0/24

on Port

5432

, and configure AWS WAF at the boundary of Subnet A to inspect and allow outbound HTTPS traffic and its associated return traffic.

Cevabı ve açıklamayı göster

Cevap: Inbound: Allow traffic from Source $0.0.0.0/0$ on Port Range $1024-65535$ . Outbound: Allow traffic to Destination $10.0.3.0/24$ on Port $5432$ and to Destination $0.0.0.0/0$ on Port $443$ .

Cevap

Inbound: Allow traffic from Source

0.0.0.0/0

on Port Range

1024-65535

. Outbound: Allow traffic to Destination

10.0.3.0/24

on Port

5432

and to Destination

0.0.0.0/0

on Port

443

Network Access Control Lists (NACLs) are stateless network filters applied at the subnet boundary. Because they are stateless, both outbound request traffic and inbound response traffic must be explicitly permitted. When the EC2 instances in Subnet A initiate outbound connections to the database (port

5432

) and the external update repository (port

443

), they select a random source port from the ephemeral port range (

1024-65535

). The returning packets from these services will target these ephemeral ports on the EC2 instances. Therefore, the inbound NACL rules must allow return traffic from any source (

0.0.0.0/0

) targeting the ephemeral port range (

1024-65535

Adım Adım Çözüm

Analyze the traffic requirements and directions for the EC2 instances in Subnet A.

Outbound traffic consists of database queries to Subnet B (

10.0.3.0/24

) on port

5432

and HTTPS requests to the internet (via NAT Gateway) on port

443

Understanding the traffic destination and ports determines the outbound NACL rules.

Determine how the stateless nature of NACLs impacts return traffic.

Return traffic from both the database and the internet will target the ephemeral port range (

1024-65535

) on the EC2 instances in Subnet A.

NACLs are stateless, so return traffic must be explicitly allowed by inbound rules.

Select the minimum required NACL rules to allow both outbound and inbound traffic.

Outbound rules must permit port

5432

10.0.3.0/24

and port

443

0.0.0.0/0

. Inbound rules must permit port range

1024-65535

from

0.0.0.0/0

This configuration allows initiating requests and receiving responses while keeping other ports blocked.

Anahtar Kavram

Stateless behavior of Network Access Control Lists (NACLs) and ephemeral port configurations

Tahmini Süre:2m 0s

Soru 17Soru →

A company is designing the access control mechanism for its development team. The developers need to access AWS resources to deploy applications. The security team mandates that developers must use their existing corporate directory credentials to log in, and no long-term AWS credentials should be stored on developer machines. Additionally, sensitive database credentials used by the applications must be stored securely and rotated automatically every 30 days. Which combination of AWS services and configurations should a solutions architect recommend to meet these requirements?

Configure AWS IAM Identity Center to federate with the corporate directory, allowing developers to assume short-term IAM roles. Use AWS Secrets Manager to store the database credentials and configure automatic rotation.

Create individual IAM users in the AWS account for each developer, generate long-term access keys for local development, and configure AWS Secrets Manager to store and rotate the database credentials.

Enable multi-factor authentication (MFA) on the AWS account root user, share the root login credentials with the lead developers for deployments, and store the database credentials as a SecureString parameter in Systems Manager Parameter Store.

Configure AWS IAM Identity Center to federate with the corporate directory. Store the database credentials as a plaintext String parameter in Systems Manager Parameter Store, and write a custom script to rotate the parameter.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center to federate with the corporate directory, allowing developers to assume short-term IAM roles. Use AWS Secrets Manager to store the database credentials and configure automatic rotation.

Cevap

The correct configuration uses AWS IAM Identity Center to federate with the corporate directory, allowing developers to authenticate with their existing credentials and assume short-term roles instead of using long-term credentials. Additionally, using AWS Secrets Manager to store and automatically rotate the database credentials satisfies the security policy for encrypting and rotating sensitive data.

Adım Adım Çözüm

Address the federated access requirement by configuring AWS IAM Identity Center to integrate with the corporate directory, which enables single sign-on using corporate credentials without creating permanent IAM users.

Developers can authenticate using their existing corporate credentials and obtain short-term credentials via IAM roles.

This removes the need to store long-term access keys on developer machines, meeting the primary security constraint.

Address the sensitive database credentials requirement by storing them in AWS Secrets Manager.

Credentials are encrypted at rest and can be retrieved programmatically.

Secrets Manager provides native support for encrypting secrets and automatically rotating them using built-in integration with databases.

Anahtar Kavram

AWS identity federation using IAM Identity Center combined with secure secrets management using AWS Secrets Manager.

Soru 18Soru →

A logistics company hosts a shipment tracking portal on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The portal has recently experienced HTTP flood attacks targeting the search endpoint, which overloads the ALB and causes application downtime. A solutions architect must design a secure architecture that mitigates these Layer 7 DDoS attacks at the AWS edge network before they reach the ALB.

Which solution meets these requirements?

Deploy an Amazon CloudFront distribution in front of the ALB. Create an AWS WAF web ACL with a rate-based rule and associate it with the CloudFront distribution.

Rely on AWS Shield Standard enabled on the ALB to automatically detect and block the Layer 7 HTTP flood attacks.

Configure the security group attached to the ALB to dynamically detect and block the IP addresses sending the HTTP flood traffic.

Create stateless network access control lists (NACLs) on the subnets of the ALB to rate-limit requests from the attacking IP addresses.

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon CloudFront distribution in front of the ALB. Create an AWS WAF web ACL with a rate-based rule and associate it with the CloudFront distribution.

Cevap

Deploy an Amazon CloudFront distribution in front of the ALB. Create an AWS WAF web ACL with a rate-based rule and associate it with the CloudFront distribution.

The correct option is to deploy Amazon CloudFront in front of the ALB and associate it with an AWS WAF web ACL configured with a rate-based rule. AWS WAF rate-based rules track the number of requests from each originating IP address and block requests that exceed a defined threshold. Deploying this at the CloudFront distribution leverages the AWS edge network, stopping the DDoS traffic before it reaches the backend infrastructure.

Adım Adım Çözüm

Shift the application entry point to the AWS edge network by deploying Amazon CloudFront.

Inbound user traffic is routed through AWS edge locations rather than directly hitting the ALB.

This establishes an edge protection layer and absorbs traffic closer to the users.

Create an AWS WAF web ACL with a rate-based rule.

A security rule is established that tracks the rate of requests from individual IP addresses over a rolling 5-minute period.

Rate-limiting is the standard mechanism to mitigate HTTP flood attacks at the application layer.

Associate the AWS WAF web ACL with the CloudFront distribution.

Excessive requests are blocked at the edge network, ensuring only legitimate traffic is forwarded to the ALB.

This prevents malicious Layer 7 traffic from consuming ALB resources or reaching the EC2 origin servers.

Anahtar Kavram

Mitigating Layer 7 DDoS attacks at the edge using Amazon CloudFront and AWS WAF rate-based rules.

Soru 19Soru →

A retail technology startup has a multi-account AWS environment managed under AWS Organizations. The startup uses Okta as its central Identity Provider (IdP) for employee authentication. The security team wants to grant developers single sign-on (SSO) access to their respective AWS accounts. The solution must ensure that user access is automatically provisioned and deprovisioned when users are added or removed in Okta, while minimizing operational complexity and eliminating the use of long-term credentials. Which solution meets these requirements?

Create individual IAM users with long-term credentials in each AWS account for the developers, and write a nightly synchronization script using the AWS SDK to create or delete IAM users based on changes in Okta.

Enable AWS IAM Identity Center, configure Okta as an external identity provider (IdP) using SAML 2.0, and configure automatic provisioning using the System for Cross-domain Identity Management (SCIM) v2.0 protocol.

Enable access keys for the AWS Organizations management account root user, and write a centralized script that uses these keys to assume cross-account IAM roles in the member accounts for the developers.

Store the developers' Okta credentials as plaintext parameters in Systems Manager Parameter Store, and trigger an AWS Lambda function to provision temporary IAM users on demand.

Cevabı ve açıklamayı göster

Cevap: Enable AWS IAM Identity Center, configure Okta as an external identity provider (IdP) using SAML 2.0, and configure automatic provisioning using the System for Cross-domain Identity Management (SCIM) v2.0 protocol.

Cevap

The correct solution uses AWS IAM Identity Center to federate Okta as an external Identity Provider (IdP) via SAML 2.0. This allows users to authenticate using their corporate credentials. Enabling System for Cross-domain Identity Management (SCIM) v2.0 ensures that user provisioning and deprovisioning are handled automatically when accounts are modified in Okta, meeting the requirement to minimize operational complexity without using long-term credentials.

Adım Adım Çözüm

Select AWS IAM Identity Center as the central service for managing SSO access across multiple accounts in AWS Organizations.

Establishes a centralized identity hub that eliminates the need to configure IAM resources individually in every account.

Reduces operational complexity and simplifies management.

Configure SAML 2.0 federation between AWS IAM Identity Center and Okta.

Enables single sign-on using Okta as the authoritative identity provider.

Allows developers to authenticate with their existing corporate credentials without using long-term AWS IAM credentials.

Enable and configure automatic provisioning using the SCIM v2.0 protocol in AWS IAM Identity Center and Okta.

Automatically synchronizes user accounts, group memberships, and status updates.

Ensures that when a user is added to or removed from Okta, their access in AWS is immediately granted or revoked, maintaining security and compliance.

Anahtar Kavram

Centralized Identity Federation with Automatic SCIM Provisioning

Tahmini Süre:1m 30s

Soru 20Soru →

A game development studio is migrating its build pipelines and testing environments to AWS. The studio manages all employees using an on-premises Microsoft Active Directory domain. The solutions architect must implement a single sign-on (SSO) solution that allows developers to access their respective AWS accounts within AWS Organizations using their existing on-premises credentials. The solution must minimize operational overhead, require no password replication to the cloud, and avoid manually managing long-term AWS credentials. Which two actions should the solutions architect take to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Deploy an AWS Directory Service AD Connector to establish a gateway that redirects directory requests to the on-premises Active Directory.

Enable AWS IAM Identity Center and configure the identity source to use the Active Directory directory connected via AD Connector.

Manually create individual IAM users in each AWS account for the developers and configure them to federate with the on-premises Active Directory.

Use the AWS Organizations management account root user to set up a shared cross-account role and distribute the root credentials to senior developers.

Cevabı ve açıklamayı göster

Cevap: Deploy an AWS Directory Service AD Connector to establish a gateway that redirects directory requests to the on-premises Active Directory.; Enable AWS IAM Identity Center and configure the identity source to use the Active Directory directory connected via AD Connector.

Cevap

Deploy an AWS Directory Service AD Connector to redirect directory requests to the on-premises Active Directory, and configure AWS IAM Identity Center to use that directory as the identity source.

To integrate an on-premises Microsoft Active Directory with AWS for user access without replicating password hashes, the best approach is to deploy an AD Connector. The AD Connector acts as a proxy, directing authentication requests back to the on-premises directory. By enabling AWS IAM Identity Center and configuring it to point to the AD Connector directory, users can sign in using their corporate credentials and gain access to their assigned AWS accounts seamlessly.

Adım Adım Çözüm

Deploy an AWS Directory Service AD Connector.

This establishes a directory gateway that connects AWS services to the on-premises Active Directory without duplicating credentials or password hashes.

This meets the requirement of not replicating passwords to the cloud while keeping operational overhead low.

Enable AWS IAM Identity Center and select the Active Directory directory as the identity source.

Developers can now sign in using their existing on-premises credentials via the AWS access portal.

This enables centralized SSO access to multiple AWS accounts within the organization without managing individual IAM users.

Anahtar Kavram

AWS Directory Service AD Connector and AWS IAM Identity Center integration for hybrid directory federation

Sayfa 1 / 22Sonraki

Design Secure Architectures

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram