Examkin

Design Secure Architectures

438 soru

Tüm türler438Çoktan seçmeli214Çoklu seçim224
Soru 401Soru →

A digital marketing agency with 250 employees uses Google Workspace as its central identity provider. The agency has recently adopted a multi-account AWS environment managed under AWS Organizations to isolate client projects. The agency's solutions architect must implement a single sign-on (SSO) solution that allows developers to access their respective AWS accounts using their Google Workspace credentials. The solution must minimize operational complexity, avoid managing separate IAM users, and automatically synchronize user accounts when developers join or leave the agency.

Which solution should the solutions architect recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Enable and configure AWS IAM Identity Center, set Google Workspace as an external identity provider using SAML 2.0, and configure automatic provisioning using the System for Cross-domain Identity Management (SCIM) protocol.

Cevap

Enable and configure AWS IAM Identity Center, set Google Workspace as an external identity provider using SAML 2.0, and configure automatic provisioning using the System for Cross-domain Identity Management (SCIM) protocol.
AWS IAM Identity Center is the modern, recommended service for managing single sign-on access across a multi-account AWS environment. By integrating with Google Workspace as an external identity provider using SAML 2.0, developers can authenticate securely with their existing corporate credentials. Furthermore, configuring SCIM automatic provisioning automates user lifecycle management (creation, updates, and deletion), directly fulfilling the requirement to minimize operational complexity and automate user synchronization.

Adım Adım Çözüm

1
Enable AWS IAM Identity Center in the AWS Organizations management account.
Centralized identity and access management is initialized across the entire multi-account environment.
This establishes a centralized management point for user access across all AWS accounts in the organization.
2
Configure SAML 2.0 federation between AWS IAM Identity Center and Google Workspace.
A trust relationship is established, allowing users to authenticate via their Google Workspace credentials.
SAML 2.0 enables secure single sign-on (SSO) federation, eliminating the need to manage duplicate passwords or long-term credentials in AWS.
3
Configure automatic user provisioning using the SCIM protocol between Google Workspace and AWS IAM Identity Center.
Users and groups are automatically synchronized from Google Workspace to AWS.
SCIM handles the lifecycle of users automatically, ensuring that when developers join or leave the agency, their AWS access is provisioned or revoked without manual intervention.

Anahtar Kavram

Centralized identity federation using AWS IAM Identity Center integrated with an external identity provider and automatic provisioning via SCIM.
Tahmini Süre:1m 30s
Soru 402Soru →

An enterprise is migrating a containerized microservice backend to Amazon ECS on AWS Fargate. The Fargate tasks are launched in private subnets of a VPC and must securely download container images from Amazon Elastic Container Registry (ECR) without routing traffic over the public internet. The company security policy mandates that no internet gateway or NAT gateway should be configured in this VPC. Which combination of VPC network security components should the solutions architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create interface VPC endpoints for ECR and attach a security group to them that allows inbound HTTPS traffic from the Fargate tasks' security group.; Create a gateway VPC endpoint for Amazon S3 and associate it with the route tables of the private subnets containing the Fargate tasks.

Cevap

Create interface VPC endpoints for ECR with a security group allowing HTTPS traffic from the Fargate tasks, and create a gateway VPC endpoint for Amazon S3 associated with the private subnet route tables.
To pull container images from Amazon ECR without sending traffic over the internet or using a NAT gateway, the VPC must connect privately to the AWS services. Interface VPC endpoints must be created for ECR (both the API and Docker registry endpoints), and their security groups must permit inbound HTTPS (port 443) traffic from the Fargate tasks. Because ECR stores image layers in S3, a gateway VPC endpoint for Amazon S3 must also be created and associated with the private subnet route tables to enable private download of the image layers.

Adım Adım Çözüm

1
Determine the network path requirements for pulling container images privately.
Identify that ECS Fargate tasks need private access to the ECR API endpoints and the underlying S3 buckets where ECR stores its image layers.
Since the VPC is isolated (no NAT Gateway or Internet Gateway), all traffic to AWS services must remain inside the AWS private network.
2
Configure the ECR endpoints.
Establish interface VPC endpoints for ECR and attach a security group that permits HTTPS traffic from the container tasks.
Interface endpoints provide private IP addresses for the ECR registry and API, allowing secure communication via private DNS.
3
Configure the S3 endpoint for layer retrieval.
Create an S3 gateway VPC endpoint and attach it to the route tables of the Fargate subnets.
ECR layers are stored in S3. Without the S3 gateway endpoint, the Fargate tasks will fail to retrieve the image layers even if they can authenticate with ECR.

Anahtar Kavram

VPC Endpoints (Interface vs. Gateway) and Security Groups for private AWS service communication
Soru 403Soru →

A company is deploying a containerized application on Amazon ECS that requires access to an Amazon RDS for MySQL database. The security policy mandates that the database credentials must be rotated automatically every 30 days, and the database storage must be encrypted at rest using an AWS KMS customer managed key that is rotated annually. The solutions architect must implement a solution that requires the least operational effort and does not interrupt application availability or require manual re-encryption of historical data. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the database credentials in AWS Secrets Manager, and configure automatic rotation with a schedule of 30 days using the built-in AWS Lambda rotation template.; Enable automatic key rotation on the customer managed key in AWS KMS to rotate the key material annually.

Cevap

Store the database credentials in AWS Secrets Manager with automatic 30-day rotation enabled, and enable automatic key rotation on the KMS customer managed key.
The correct solution involves storing sensitive database credentials in AWS Secrets Manager and enabling automatic rotation, which natively manages 30-day cycles using a Lambda function. Additionally, enabling automatic key rotation on the KMS customer managed key allows AWS to rotate the cryptographic material annually without disrupting access to historical data or requiring re-encryption.

Adım Adım Çözüm

1
Select AWS Secrets Manager to store the database credentials securely, and configure its built-in rotation schedule to 30 days using the provided AWS Lambda rotation function.
Database credentials are automatically changed in both Secrets Manager and the RDS instance every 30 days without application downtime.
This satisfies the requirement for automatic, secure credential rotation with the least operational effort.
2
Enable automatic key rotation on the AWS KMS customer managed key used for encrypting the RDS storage.
The key material is rotated annually by AWS KMS while keeping all historical versions active.
This satisfies the annual rotation requirement without needing manual re-encryption of existing data or snapshots, ensuring high availability.

Anahtar Kavram

AWS KMS customer managed key automatic rotation mechanics and AWS Secrets Manager integration for secure, automated credential rotation.
Tahmini Süre:2m 30s
Soru 404Soru →

A company is deploying a new web application on Amazon EC2 instances. The application requires access to a database password and must encrypt configuration files at rest using an AWS Key Management Service (AWS KMS) customer managed key (CMK). The security team requires that the database password be stored securely, the CMK automatically rotate every year, and historical files encrypted with the CMK remain decryptable without manual key management or re-encryption. Which configuration meets these requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: Store the database password in AWS Secrets Manager. Enable automatic rotation on the KMS customer managed key (CMK).

Cevap

Store the database password in AWS Secrets Manager, and enable automatic rotation on the KMS customer managed key (CMK).
Storing the database password in AWS Secrets Manager satisfies the requirement for secure credential storage. Enabling automatic key rotation on the KMS customer managed key (CMK) automatically creates a new backing key every year while preserving the previous backing key versions. This allows the application to seamlessly decrypt older files without manual intervention, script execution, or code changes.

Adım Adım Çözüm

1
Select a secure storage mechanism for the database password.
AWS Secrets Manager is selected to securely store the database password.
Secrets Manager encrypts secrets at rest and supports automatic rotation, unlike standard String parameters in Systems Manager Parameter Store which store secrets in plaintext.
2
Configure key rotation for the customer managed key (CMK).
Enable automatic key rotation for the KMS CMK.
Enabling automatic key rotation provides hands-off key management where AWS KMS generates a new backing key every year.
3
Evaluate decryption requirements for historical data.
Confirm that KMS transparently retains previous backing key versions.
When automatic key rotation is enabled, AWS KMS keeps all older backing key versions active for decryption. There is no need to re-encrypt old data or update application code with new CMK ARNs.

Anahtar Kavram

AWS KMS Automatic Key Rotation and Secrets Management
Soru 405Soru →

A biotechnology enterprise needs to grant its laboratory researchers single sign-on (SSO) access to multiple AWS accounts and several external third-party SaaS applications. The researchers currently authenticate using an on-premises Active Directory. The proposed architecture must minimize operational overhead, avoid replicating user passwords to the cloud, and enforce centralized access management. Which configuration meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Enable AWS IAM Identity Center, connect it to the on-premises Active Directory using an AD Connector, and integrate both the AWS accounts and the SaaS applications with IAM Identity Center.

Cevap

Enable AWS IAM Identity Center, connect it to the on-premises Active Directory using an AD Connector, and integrate both the AWS accounts and the SaaS applications with IAM Identity Center.
Connecting AWS IAM Identity Center to the on-premises Active Directory via AD Connector provides centralized authentication without replicating password data. Furthermore, IAM Identity Center natively supports single sign-on (SSO) to both AWS accounts and SaaS applications, meeting all design constraints while keeping operational overhead low.

Adım Adım Çözüm

1
Connect on-premises Active Directory to AWS.
Use an AD Connector to redirect directory requests to the on-premises Active Directory without copying password data to AWS.
This satisfies the requirement to avoid replicating user credentials to the cloud.
2
Enable AWS IAM Identity Center.
Configure IAM Identity Center to use the Active Directory connection as its identity source.
This provides a centralized location to manage portal access, single sign-on, and permissions.
3
Integrate target systems.
Assign access to AWS accounts and register third-party SaaS applications within the IAM Identity Center application catalog.
This fulfills the SSO requirement for both cloud infrastructure and external software, minimizing administrative overhead.

Anahtar Kavram

Centralized multi-account and SaaS identity federation using AWS IAM Identity Center connected to on-premises Active Directory via AD Connector.
Tahmini Süre:1m 30s
Soru 406Soru →

An application running on Amazon EC2 instances in a private subnet needs to read and write sensitive data to a specific Amazon S3 bucket. The company's security policy requires that all traffic to Amazon S3 must remain within the AWS network. Additionally, to prevent data exfiltration, the EC2 instances must be blocked from accessing any other Amazon S3 buckets, including those in other AWS accounts.

Which solution should a solutions architect implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Create a gateway VPC endpoint for Amazon S3. Attach an endpoint policy to the gateway endpoint that allows actions only on the specific S3 bucket. Update the route table of the private subnet to direct S3 traffic through the gateway endpoint.

Cevap

Create a gateway VPC endpoint for Amazon S3, attach a restricted VPC endpoint policy, and update the private subnet's route table.
The correct solution involves deploying a gateway VPC endpoint for Amazon S3, attaching a VPC endpoint policy that limits access to only the specific bucket, and routing S3 traffic through this endpoint by updating the private subnet route table. This ensures the traffic does not traverse the public internet and effectively prevents data exfiltration to unauthorized buckets.

Adım Adım Çözüm

1
Create a Gateway VPC Endpoint for Amazon S3 in the VPC.
The VPC endpoint provides private connectivity to S3 without requiring an internet gateway or NAT gateway.
This satisfies the requirement that all traffic to Amazon S3 must remain within the AWS network.
2
Attach a custom VPC endpoint policy to the Gateway VPC Endpoint.
The policy restricts the endpoint to only allow actions targeting the specific S3 bucket.
This prevents data exfiltration by blocking the instances from accessing any other S3 buckets, even if they are in other AWS accounts.
3
Update the route table of the private subnet to include a route pointing to the Gateway VPC Endpoint.
Traffic destined for S3 from the private subnet is automatically routed through the gateway endpoint.
This establishes the routing rule required for the EC2 instances in the private subnet to use the gateway endpoint.

Anahtar Kavram

VPC Endpoint Routing and Policies for Data Exfiltration Prevention
Soru 407Soru →

A company is designing a serverless application using AWS Lambda that needs to retrieve a database password to access an Amazon RDS DB instance. The company also uses an AWS Key Management Service (AWS KMS) customer managed key to encrypt sensitive configuration files stored in Amazon S3. The security team requires that the database password be rotated every 30 days and the KMS key be rotated annually, while ensuring that all historically encrypted data remains accessible.

Which of the following actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the database password in AWS Secrets Manager and configure automatic rotation for the secret every 30 days using an AWS Lambda function.; Enable automatic key rotation on the KMS customer managed key, which creates a new key version annually and retains older versions to decrypt existing data.

Cevap

Store the database password in AWS Secrets Manager with automatic 30-day rotation, and enable automatic key rotation on the customer managed key to rotate key material annually while retaining older versions.
The correct architecture stores the database password in AWS Secrets Manager with automated rotation via an AWS Lambda function, and enables automatic key rotation on the customer managed key. Secrets Manager secure storage prevents exposure of credentials and automates rotation. KMS automatic key rotation creates a new key version annually but preserves all previous key material, allowing transparent decryption of existing files without manual re-encryption.

Adım Adım Çözüm

1
Select the secure storage and rotation mechanism for database credentials.
Determine that AWS Secrets Manager should be used for the database password, as it natively supports automatic rotation every 30 days using AWS Lambda.
AWS Secrets Manager is built for database secrets and integrates with RDS for automated rotation, whereas Systems Manager Parameter Store String parameters expose secrets in plaintext.
2
Select the rotation mechanism for the customer managed key that preserves decryptability of historical data.
Enable AWS KMS automatic key rotation for the customer managed key.
KMS automatic key rotation generates new key material annually but keeps older versions active so that existing encrypted objects can be decrypted transparently without manual re-encryption or key deletion.

Anahtar Kavram

AWS KMS key rotation mechanisms and AWS Secrets Manager credential rotation
Soru 408Soru →

A solutions architect is configuring network security for a database migration. An application running on Amazon EC2 instances in Subnet A (10.0.1.0/2410.0.1.0/24) must connect to an Amazon RDS for PostgreSQL database located in Subnet B (10.0.2.0/2410.0.2.0/24) within the same VPC. The company's security policy requires the use of Network Access Control Lists (Network ACLs) with a strict default-deny rule for both inbound and outbound traffic on all subnets. Which of the following Network ACL configurations will allow the application to connect to the database on the default PostgreSQL port while maintaining least privilege?

Cevabı ve açıklamayı göster

Cevap: Configure the Network ACL for Subnet A to allow outbound traffic to Subnet B (10.0.2.0/2410.0.2.0/24) on TCP port 5432 and inbound traffic from Subnet B (10.0.2.0/2410.0.2.0/24) on TCP ports 1024–65535. Configure the Network ACL for Subnet B to allow inbound traffic from Subnet A (10.0.1.0/2410.0.1.0/24) on TCP port 5432 and outbound traffic to Subnet A (10.0.1.0/2410.0.1.0/24) on TCP ports 1024–65535.

Cevap

Configure the Network ACL for Subnet A to allow outbound traffic to Subnet B on TCP port 5432 and inbound traffic from Subnet B on TCP ports 1024–65535, and configure the Network ACL for Subnet B to allow inbound traffic from Subnet A on TCP port 5432 and outbound traffic to Subnet A on TCP ports 1024–65535.
The correct configuration acknowledges that Network ACLs are stateless and require rules for both inbound and outbound traffic. Because a client initiates a connection to the PostgreSQL database on TCP port 5432 using an ephemeral source port, the network path must allow outbound traffic on destination port 5432 from the client subnet and inbound traffic on the same port at the database subnet. To allow the response, the database subnet must allow outbound traffic to the ephemeral port range (10241024–6553565535) and the client subnet must allow inbound traffic on those same ports.

Adım Adım Çözüm

1
Determine client-to-server traffic requirements.
Subnet A (client) must allow outbound TCP traffic to Subnet B (server) CIDR on the destination port 5432. Subnet B must allow inbound TCP traffic from Subnet A CIDR on destination port 5432.
This establishes the forward connection path from the application to the database.
2
Determine server-to-client return traffic requirements considering statelessness.
Subnet B must allow outbound TCP traffic to Subnet A CIDR on destination ephemeral ports (1024–65535). Subnet A must allow inbound TCP traffic from Subnet B CIDR on destination ephemeral ports (1024–65535).
Since Network ACLs are stateless, return traffic is not tracked automatically and must be explicitly allowed on the ephemeral ports allocated by the client OS.

Anahtar Kavram

Statelessness of Network Access Control Lists (NACLs) and the requirement of ephemeral port ranges for return traffic.
Soru 409Soru →

A global consulting firm is establishing a multi-account environment in AWS Organizations. The firm wants to grant its consultants access to client-specific AWS accounts. The firm manages its employee identities in an on-premises Active Directory. The solution must support single sign-on (SSO), minimize administrative overhead, and avoid replicating user credentials or passwords to AWS.

Which combination of actions should a solutions architect recommend to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using an AWS Directory Service AD Connector.; Create permission sets in AWS IAM Identity Center and map them to Active Directory groups to control access to specific AWS accounts.

Cevap

Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using an AWS Directory Service AD Connector, and create permission sets in AWS IAM Identity Center and map them to Active Directory groups to control access.
Connecting AWS IAM Identity Center to the on-premises Active Directory using an AD Connector provides a seamless directory gateway that forwards authentication requests to the on-premises directory, satisfying the requirements to avoid password replication and minimize operational overhead. Creating permission sets in AWS IAM Identity Center and mapping them to Active Directory groups allows centralized, role-based access control across multiple AWS accounts.

Adım Adım Çözüm

1
Select the identity source in AWS IAM Identity Center.
AWS IAM Identity Center is configured to use an external identity provider or directory.
This establishes a centralized single sign-on mechanism for the multi-account AWS environment.
2
Connect the on-premises Active Directory using AWS Directory Service AD Connector.
Authentication requests are redirected to the on-premises Active Directory without copying credentials.
Using AD Connector avoids password replication and minimizes operational overhead by acting as a directory gateway.
3
Create permission sets in AWS IAM Identity Center and map them to Active Directory groups.
Consultants are granted access to specific AWS accounts based on their existing group memberships.
This automates user provisioning and ensures least-privilege access is maintained dynamically.

Anahtar Kavram

Centralized identity federation using AWS IAM Identity Center and AD Connector to federate on-premises directory users without password replication.
Soru 410Soru →

A company stores large archives in an Amazon S3 bucket. The data is encrypted at rest using an AWS KMS Customer Managed Key (CMK). A new compliance policy requires that the encryption keys be rotated annually. The security team wants to ensure that all historical data remains readable without manual intervention, while new data is encrypted using the rotated key material.

Which configuration meets these requirements with the least administrative effort?

Cevabı ve açıklamayı göster

Cevap: Enable automatic key rotation for the existing Customer Managed Key.

Cevap

Enable automatic key rotation for the existing Customer Managed Key.
Enabling automatic key rotation on an AWS KMS Customer Managed Key (CMK) automatically schedules rotation of the backing key material once a year. When this occurs, AWS KMS keeps all older key material active so it can decrypt any historical ciphertexts. Newly written files will automatically be encrypted using the newly generated key material. This achieves compliance with zero management overhead and zero downtime.

Adım Adım Çözüm

1
Identify the primary requirement for annual rotation of a Customer Managed Key (CMK) in AWS KMS.
The requirement is to rotate the key annually, ensure historical data remains readable, and minimize administrative overhead.
Establishing the objective allows selecting the solution with the lowest management overhead and highest compliance.
2
Evaluate the native rotation mechanism of AWS KMS Customer Managed Keys.
Enabling automatic key rotation on a CMK generates a new key version annually. AWS KMS retains older key material indefinitely to decrypt historical ciphertexts automatically.
This shows that re-encryption of historical data or updating the bucket configurations is not required.
3
Compare against options involving manual rotation, deletion, and Parameter Store.
Deleting old keys causes data loss, manually re-encrypting historical data introduces high cost and complexity, and exporting key material to plaintext Parameter Store parameters introduces major security risks.
By eliminating complex or insecure workarounds, the native KMS automatic rotation is confirmed as the correct path.

Anahtar Kavram

AWS KMS Automatic Key Rotation
Tahmini Süre:1m 30s
Soru 411Soru →

A media production company uses PingFederate as its central Identity Provider (IdP). The company is setting up a multi-account structure in AWS Organizations and wants to enable its remote editors to log in to specific AWS accounts using their existing corporate credentials. The solution must support central permissions management and automatically synchronize user accounts and group memberships from PingFederate to AWS without manual user creation.

Which combination of actions should a solutions architect perform to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure SAML 2.0 federation between PingFederate and AWS IAM Identity Center by exchanging metadata.; Enable System for Cross-domain Identity Management (SCIM) provisioning in AWS IAM Identity Center, and configure the SCIM endpoint and access token in PingFederate.

Cevap

Configure SAML 2.0 federation between PingFederate and AWS IAM Identity Center by exchanging metadata, and enable System for Cross-domain Identity Management (SCIM) provisioning in AWS IAM Identity Center and configure the SCIM endpoint and access token in PingFederate.
To integrate an external Identity Provider (IdP) like PingFederate with AWS IAM Identity Center, you first establish federated single sign-on (SSO) trust by exchanging SAML 2.0 metadata between the provider and AWS. To automate user and group provisioning without manual setup, you enable SCIM in AWS IAM Identity Center and configure the SCIM endpoint and bearer token in PingFederate to sync directory changes automatically.

Adım Adım Çözüm

1
Establish a SAML 2.0 trust relationship
Federated authentication is enabled between PingFederate and AWS IAM Identity Center by exchanging the metadata XML files.
This allows remote editors to authenticate using their existing corporate credentials.
2
Enable and configure SCIM provisioning
Automatic identity synchronization is established using the SCIM endpoint URL and bearer token provided by AWS IAM Identity Center.
This automates user and group management without requiring manual user creation or custom replication scripts.

Anahtar Kavram

Centralized identity federation and automatic provisioning using AWS IAM Identity Center with SAML 2.0 and SCIM.
Soru 412Soru →

A logistics company is designing a security architecture for its new multi-account AWS environment managed by AWS Organizations. The company manages all corporate identities in an on-premises Microsoft Active Directory. The security team wants to grant employees single sign-on (SSO) access to the AWS Management Console. The solution must authenticate users against the on-premises directory without replicating any Active Directory data to AWS, must avoid the creation of individual IAM users, and must minimize administrative effort. Which solution meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center and connect it to the on-premises directory by deploying an AD Connector.

Cevap

Configure AWS IAM Identity Center and connect it to the on-premises directory by deploying an AD Connector.
Deploying an AD Connector as a proxy between AWS IAM Identity Center and the on-premises Microsoft Active Directory satisfies all security and operational requirements. AD Connector redirects authentication requests directly to the on-premises domain controllers, ensuring that directory data is never replicated to the cloud. AWS IAM Identity Center provides centralized single sign-on access control across all accounts within the AWS Organizations structure, eliminating the need to manage individual IAM users or credentials.

Adım Adım Çözüm

1
Analyze directory replication constraints.
Identify that AD Connector is the only directory gateway service that acts as a proxy/redirector without replicating or caching Active Directory database data in the AWS cloud.
The scenario requires that no Active Directory data is replicated to AWS.
2
Select the centralized authentication interface for multiple AWS accounts.
Choose AWS IAM Identity Center (formerly AWS Single Sign-On) integrated with the AD Connector.
This centralizes user access management across the AWS Organizations multi-account structure, avoiding the need to configure federation or IAM users in each individual account.

Anahtar Kavram

Federating on-premises Active Directory to AWS Organizations using AD Connector and AWS IAM Identity Center to prevent data replication and minimize management overhead.
Tahmini Süre:1m 30s
Soru 413Soru →

A company is deploying an application on Amazon ECS using AWS Fargate within private subnets of a VPC. The application needs to retrieve sensitive configuration data from AWS Systems Manager Parameter Store. Due to strict security policies, the VPC does not have an internet gateway or a NAT gateway, and all traffic must remain within the AWS network. A solutions architect creates interface VPC endpoints for Systems Manager in the private subnets. However, the ECS tasks are failing to retrieve the configuration data. Which network security configuration is required to resolve this issue while maintaining the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: Configure the security group attached to the interface VPC endpoints to allow inbound HTTPS traffic on port 443 from the security group attached to the ECS tasks.

Cevap

Configure the security group attached to the interface VPC endpoints to allow inbound HTTPS traffic on port 443 from the security group attached to the ECS tasks.
The correct configuration is to modify the security group attached to the interface VPC endpoint (which creates ENIs in the private subnets) to permit inbound HTTPS (port 443) traffic originating from the security group of the ECS Fargate tasks. Because security groups are stateful, this rule automatically allows the return traffic back to the ECS tasks.

Adım Adım Çözüm

1
Analyze how AWS Fargate tasks resolve and connect to AWS Systems Manager in a private VPC without internet access.
The Fargate tasks use private DNS associated with the interface VPC endpoints to resolve the Systems Manager service endpoint to the private IP addresses of the endpoint's elastic network interfaces (ENIs).
Since there is no internet gateway or NAT gateway, all traffic must remain within the VPC using PrivateLink.
2
Determine the firewall requirements for the interface VPC endpoint ENIs.
The security group associated with the interface VPC endpoint must allow inbound traffic on port 443 (HTTPS) because Systems Manager APIs are HTTPS-based.
Security groups are stateful and act at the instance/ENI level, controlling incoming traffic to the endpoint.
3
Apply the principle of least privilege to the inbound rule.
Restrict the source of the inbound HTTPS rule on the endpoint's security group to the security group of the ECS Fargate tasks.
This ensures only authorized container tasks can access the Systems Manager Parameter Store via the endpoint.

Anahtar Kavram

Interface VPC Endpoints (AWS PrivateLink) require appropriate security group configurations to allow inbound traffic from the client resources. Unlike Gateway Endpoints, they do not use route tables; they rely on DNS resolution and stateful security groups.
Tahmini Süre:1m 30s
Soru 414Soru →

A solutions architect is designing the network security for a new application running on Amazon EC2 instances in private subnets. The application must download configuration objects from Amazon S3 and publish event messages to Amazon Simple Notification Service (Amazon SNS). The company’s security policy strictly prohibits the private subnets from having any routing to the public internet, including through NAT gateways. Which combination of steps should the solutions architect take to securely establish this connectivity? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a gateway VPC endpoint for Amazon S3, and associate it with the route tables of the private subnets.; Create an interface VPC endpoint for Amazon SNS, and configure the security group of the SNS endpoint to allow inbound HTTPS traffic on TCP port 443443 from the EC2 instances' security group.

Cevap

The correct steps are to create a gateway VPC endpoint for Amazon S3 and associate it with the private subnet route tables, and to create an interface VPC endpoint for Amazon SNS with its security group configured to allow inbound HTTPS traffic on TCP port 443443 from the EC2 instances.
To satisfy the security requirement of accessing Amazon S3 and Amazon SNS without internet routing (including NAT gateways), VPC endpoints must be used. For Amazon S3, a Gateway VPC endpoint is created and associated with the route tables of the private subnets. For Amazon SNS, an Interface VPC endpoint (AWS PrivateLink) is deployed, which assigns a private IP address within the subnet to the service. The interface endpoint is secured with a security group that must allow inbound HTTPS traffic on port 443443 from the EC2 instances.

Adım Adım Çözüm

1
Identify the endpoint type required for Amazon S3.
Determine that Amazon S3 supports Gateway VPC endpoints, which are free of charge and integrate directly with route tables.
VPC Gateway endpoints are the standard, secure, and cost-effective way to access Amazon S3 from private subnets without public internet routing.
2
Identify the endpoint type required for Amazon SNS.
Determine that Amazon SNS only supports Interface VPC endpoints (AWS PrivateLink).
AWS PrivateLink exposes the service as an Elastic Network Interface (ENI) within the subnet with a private IP address.
3
Configure the security controls for the Interface endpoint.
Configure the security group attached to the Amazon SNS Interface endpoint to allow inbound traffic on TCP port 443443 (HTTPS) from the security group of the EC2 instances.
Interface endpoints use security groups for stateful access control, and communications to AWS APIs are conducted over HTTPS.

Anahtar Kavram

VPC Endpoints and Security Group Management
Tahmini Süre:2m 0s
Soru 415Soru →

A company is deploying a three-tier web application on Amazon EC2 instances. The application needs to retrieve a database password to connect to an Amazon RDS DB instance, as well as an external API key that does not support automated rotation. Security requirements dictate that all credentials must be encrypted at rest, and the database password must be rotated every 30 days.

Which solution meets these requirements with the least administrative effort?

Cevabı ve açıklamayı göster

Cevap: Store the database password in AWS Secrets Manager and enable automatic rotation every 30 days using the built-in integration for Amazon RDS. Store the external API key as a SecureString parameter in AWS Systems Manager Parameter Store.

Cevap

Store the database password in AWS Secrets Manager with automatic RDS rotation, and store the API key as a SecureString parameter in Systems Manager Parameter Store.
The correct solution stores the database password in AWS Secrets Manager because it has built-in integration to automatically rotate RDS credentials. The external API key is stored as a SecureString parameter in Systems Manager Parameter Store, which encrypts the value at rest using AWS KMS, meeting all security requirements with the least operational effort.

Adım Adım Çözüm

1
Analyze the requirements for the database credentials.
The database password needs to be encrypted at rest and rotated every 30 days. AWS Secrets Manager offers native, automated integration to rotate database credentials for Amazon RDS instances.
Secrets Manager can automatically manage the lifecycle of database secrets without writing custom rotation logic, reducing operational overhead.
2
Analyze the requirements for the external API key.
The API key must be encrypted at rest but does not require rotation. AWS Systems Manager Parameter Store using the SecureString parameter type can encrypt the parameter using AWS KMS.
SecureString parameters provide a cost-effective, secure storage mechanism for secrets that do not require lifecycle management or automatic rotation.
3
Evaluate KMS key rotation behavior versus credential rotation.
Confirm that KMS key rotation only affects the backing key material used to generate new data keys and does not rotate the actual database password or update database user accounts.
Understanding key rotation mechanics prevents the misconception that key rotation solves application-level credential rotation.

Anahtar Kavram

Distinction between AWS Secrets Manager and Systems Manager Parameter Store, and the operational behavior of KMS key rotation vs credential rotation.
Soru 416Soru →

A company's backend application runs on Amazon EC2 instances inside a private subnet. The application is required to call a partner's external API endpoint at a static public IP address (203.0.113.50203.0.113.50) using HTTPS. The private subnet is associated with a custom network ACL (NACL) that currently denies all inbound and outbound traffic. The security groups associated with the EC2 instances already allow all outbound HTTPS traffic.

Which configuration of rules must be added to the custom NACL to allow the EC2 instances to successfully establish connections to the external API?

Cevabı ve açıklamayı göster

Cevap: An outbound rule allowing traffic to destination 203.0.113.50/32203.0.113.50/32 on TCP port 443443, and an inbound rule allowing traffic from source 203.0.113.50/32203.0.113.50/32 on TCP ports 1024−655351024-65535.

Cevap

An outbound rule allowing traffic to destination 203.0.113.50/32203.0.113.50/32 on TCP port 443443, and an inbound rule allowing traffic from source 203.0.113.50/32203.0.113.50/32 on TCP ports 1024−655351024-65535.
The correct configuration requires allowing outbound traffic to the destination IP address on TCP port 443443, because the EC2 instances are initiating HTTPS requests. Since network ACLs are stateless, they do not automatically track connections or allow return traffic. Therefore, an inbound rule is also required. This inbound rule must allow traffic from the partner's IP address (acting as the source) on TCP source port 443443 returning to the EC2 instances' ephemeral destination ports (TCP 1024−655351024-65535).

Adım Adım Çözüm

1
Analyze the direction and target ports of the initial request.
The EC2 instances initiate outbound HTTPS connections. This requires an outbound NACL rule allowing traffic to the destination IP address 203.0.113.50/32203.0.113.50/32 on destination TCP port 443443.
Network ACLs are stateless, so both the initiating request and the return response must be explicitly permitted by distinct rules.
2
Determine the destination ports for the returning network traffic.
When a client initiates a TCP connection, the operating system allocates an ephemeral source port from the range 1024−655351024-65535. The remote server sends the response back to this ephemeral port.
To allow the response to enter the subnet, an inbound NACL rule must permit traffic from the source IP address 203.0.113.50/32203.0.113.50/32 originating from source port 443443 and targeting the destination ephemeral port range 1024−655351024-65535 on the EC2 instances.
3
Combine the rules to form the complete stateless configuration.
The final network ACL configuration must contain the outbound port 443443 rule and the inbound ephemeral ports rule.
Without both rules, either the connection request will be blocked on egress, or the return response will be blocked on ingress.

Anahtar Kavram

Stateless Network ACLs and Ephemeral Ports
Tahmini Süre:1m 30s
Soru 417Soru →

A company is deploying a microservices application on Amazon EC2 instances inside a private subnet of a VPC. The application must read and write data to an Amazon DynamoDB table and retrieve credentials from AWS Secrets Manager. Company security policy dictates that no traffic from the private subnet is allowed to traverse the public internet, and NAT gateways cannot be used.

Which combination of steps should a solutions architect take to configure network routing and access control to meet these requirements securely? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a gateway VPC endpoint for Amazon DynamoDB, and associate the endpoint with the route table of the private subnet.; Create an interface VPC endpoint for AWS Secrets Manager, and associate a security group with the endpoint that allows inbound HTTPS traffic on port 443443 from the microservices' security group.

Cevap

Create a gateway VPC endpoint for Amazon DynamoDB, and associate the endpoint with the route table of the private subnet; and create an interface VPC endpoint for AWS Secrets Manager, and associate a security group with the endpoint that allows inbound HTTPS traffic on port 443443 from the microservices' security group.
To connect to Amazon DynamoDB and AWS Secrets Manager privately, the solutions architect must use VPC endpoints. For DynamoDB, a gateway VPC endpoint is created and associated with the subnet's route table. For AWS Secrets Manager, an interface VPC endpoint is created, which provisions an ENI with a private IP. This interface endpoint is secured with a security group that permits inbound HTTPS traffic on port 443443 from the microservices.

Adım Adım Çözüm

1
Identify the endpoint types supported by the destination services.
Amazon DynamoDB supports gateway VPC endpoints. AWS Secrets Manager supports interface VPC endpoints.
Gateway endpoints are route-based and free, whereas interface endpoints use elastic network interfaces (ENIs) and require security groups.
2
Configure routing for the gateway endpoint.
Associate the DynamoDB gateway endpoint with the private subnet's route table.
This automatically adds a route pointing DynamoDB-bound traffic to the endpoint without crossing the public internet.
3
Configure security for the interface endpoint.
Create an interface endpoint for Secrets Manager and attach a security group allowing inbound HTTPS (port 443443) traffic from the microservices' security group.
Since interface endpoints use ENIs with private IP addresses, they act like resources inside the VPC and must be secured using stateful security groups.

Anahtar Kavram

VPC endpoints allow private connection between a VPC and supported AWS services without requiring an internet gateway, NAT gateway, VPN, or Direct Connect connection. Gateway endpoints are used for S3 and DynamoDB by modifying route tables. Interface endpoints use AWS PrivateLink, requiring security groups to control inbound HTTPS traffic.
Tahmini Süre:2m 0s
Soru 418Soru →

A company is migrating a high-performance transactional database to an Amazon Aurora MySQL DB cluster. The database contains personally identifiable information (PII) that must be encrypted at rest. The company's security policy requires that the KMS key used for database encryption must be rotated annually. Additionally, the database connection credentials must be rotated every 30 days. These requirements must be met with minimal manual intervention and no database downtime. Which combination of actions will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a customer managed key (CMK) in AWS KMS, enable automatic key rotation, and select this key for Aurora encryption at rest.; Store the database connection credentials in AWS Secrets Manager, and configure automatic rotation with a rotation interval of 30 days.

Cevap

Create a customer managed key (CMK) in AWS KMS, enable automatic key rotation, and select this key for Aurora encryption at rest. Additionally, store the database connection credentials in AWS Secrets Manager, and configure automatic rotation with a rotation interval of 30 days.
To satisfy the annual rotation requirement without database downtime, a customer managed key (CMK) must be created in AWS KMS with automatic key rotation enabled. AWS KMS automatically rotates CMKs every year and retains older key versions to seamlessly decrypt historical data. To rotate the database credentials every 30 days without manual effort, AWS Secrets Manager should be used, as it integrates directly with Amazon Aurora to handle credential rotation.

Adım Adım Çözüm

1
Address database encryption at rest and the annual key rotation requirement.
Create a customer managed key (CMK) in AWS KMS and enable automatic key rotation. Since CMKs rotate annually by default and retain older backing keys, the database remains readable without manual intervention or downtime.
AWS managed keys rotate every three years, which does not satisfy the company's annual rotation policy. Customer managed keys support annual automatic rotation.
2
Address secure storage and automatic rotation of database credentials.
Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.
AWS Secrets Manager has built-in integration to rotate RDS/Aurora credentials automatically using a Lambda function, avoiding plaintext parameter storage risks.

Anahtar Kavram

AWS KMS customer managed keys support annual automatic key rotation while preserving historical backing keys to decrypt existing data. AWS Secrets Manager provides native, secure, and automated credential rotation for Amazon RDS/Aurora databases.
Soru 419Soru →

An online medical ticketing platform processes patient consultation logs using an application running on Amazon ECS. The platform must store these logs in an Amazon DynamoDB table. The compliance team mandates that the logs at rest be encrypted using a customer managed key (CMK) in AWS KMS, with the encryption key automatically rotated on an annual basis. In addition, a third-party medical API access token used by the application must be kept secure and hidden from plain sight. Which architecture configuration will satisfy these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure the DynamoDB table to encrypt data at rest using a customer managed KMS key with automatic key rotation enabled. Store the API access token as a SecureString parameter in AWS Systems Manager Parameter Store.

Cevap

Configure the DynamoDB table to encrypt data at rest using a customer managed KMS key with automatic key rotation enabled, and store the API access token as a SecureString parameter in AWS Systems Manager Parameter Store.
Using a customer managed KMS key with automatic key rotation enabled meets the encryption and rotation requirements. When a customer managed key is automatically rotated, AWS KMS automatically generates new key material annually. KMS retains all historical versions of the key material to decrypt data encrypted with those versions, so there is no need to manually decrypt and re-encrypt existing DynamoDB table data. Storing the sensitive API access token as a SecureString parameter in Systems Manager Parameter Store ensures the credential is encrypted at rest and not stored in plaintext.

Adım Adım Çözüm

1
Select the correct encryption key type and configuration
A customer managed KMS key is selected with automatic key rotation enabled.
This satisfies the security requirement to use a customer managed key (CMK) and automates the annual rotation without requiring manual script intervention or key material management.
2
Address key rotation and historical data access mechanics
Identify that AWS KMS automatically manages decryption of older records.
AWS KMS retains older versions of rotated key material to decrypt data encrypted with those versions, eliminating the need to decrypt and re-encrypt historical data.
3
Choose the secure storage option for the API token
The token is stored as a SecureString in AWS Systems Manager Parameter Store.
A SecureString parameter encrypts the sensitive token at rest using a KMS key, satisfying the requirement to keep the secret secure and hidden from plain sight.

Anahtar Kavram

AWS KMS key rotation mechanics allow automatic annual generation of new key material for customer managed keys without requiring re-encryption of existing data. Sensitive configuration data should be stored securely using SSM Parameter Store SecureString parameters or AWS Secrets Manager to prevent exposure in plaintext.
Tahmini Süre:1m 30s
Soru 420Soru →

A company runs a backend database tier on Amazon EC2 instances in a private database subnet with CIDR block 10.0.3.0/2410.0.3.0/24. The database instances receive incoming MySQL connections on TCP port 33063306 from application servers in a separate private application subnet with CIDR block 10.0.2.0/2410.0.2.0/24. Additionally, the database instances must periodically initiate outbound connections to download software updates from an external repository over HTTPS (TCP port 443443) via a NAT gateway located in the public subnet (CIDR block 10.0.1.0/2410.0.1.0/24). A solutions architect is configuring a custom network ACL (NACL) for the database subnet to enforce strict security boundaries.

Which configuration changes must the solutions architect apply to the database subnet's custom NACL to allow these connections? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: An inbound rule allowing TCP traffic on port range 1024−655351024-65535 from source 0.0.0.0/00.0.0.0/0; An outbound rule allowing TCP traffic on port range 1024−655351024-65535 to destination 10.0.2.0/2410.0.2.0/24

Cevap

An inbound rule allowing TCP traffic on port range 1024−655351024-65535 from source 0.0.0.0/00.0.0.0/0 and an outbound rule allowing TCP traffic on port range 1024−655351024-65535 to destination 10.0.2.0/2410.0.2.0/24.
Network ACLs (NACLs) are stateless, meaning that outbound response traffic must be explicitly allowed by outbound rules, and inbound response traffic must be explicitly allowed by inbound rules. For the database tier to accept MySQL traffic from the application tier, the inbound rule must allow port 33063306 from the application subnet CIDR, and the outbound rule must allow return traffic to the application subnet CIDR on the ephemeral ports (1024−655351024-65535). For the database tier to download updates from the internet over HTTPS (destination port 443443), the outbound rule must allow traffic to port 443443 for destination 0.0.0.0/00.0.0.0/0, and the inbound rule must allow return traffic from source 0.0.0.0/00.0.0.0/0 on the ephemeral ports (1024−655351024-65535). Therefore, the two correct configurations are the inbound rule allowing ephemeral ports from the internet, and the outbound rule allowing ephemeral ports to the application subnet.

Adım Adım Çözüm

1
Analyze the database subnet traffic flows and determine their state characteristics.
Identify two inbound flows (MySQL requests from 10.0.2.0/2410.0.2.0/24 on port 33063306, and HTTPS return traffic from 0.0.0.0/00.0.0.0/0 on ephemeral ports) and two outbound flows (MySQL responses to 10.0.2.0/2410.0.2.0/24 on ephemeral ports, and HTTPS requests to 0.0.0.0/00.0.0.0/0 on port 443443).
Because Network ACLs are stateless, both the request and response directions of any connection must be explicitly configured.
2
Determine the correct inbound NACL rules required.
Inbound TCP port 33063306 from source 10.0.2.0/2410.0.2.0/24 must be allowed for incoming requests. Inbound TCP ports 1024−655351024-65535 from source 0.0.0.0/00.0.0.0/0 must be allowed for update responses.
The external update server sends response packets back to the ephemeral ports (1024−655351024-65535) allocated by the database instances, so these ports must be opened inbound.
3
Determine the correct outbound NACL rules required.
Outbound TCP port 443443 to destination 0.0.0.0/00.0.0.0/0 must be allowed for requests. Outbound TCP ports 1024−655351024-65535 to destination 10.0.2.0/2410.0.2.0/24 must be allowed for database responses.
The database instances send MySQL response packets back to the application servers on their ephemeral ports (1024−655351024-65535), which requires an outbound NACL rule.

Anahtar Kavram

Network ACLs are stateless firewalls operating at the subnet level. They require rules to be configured for both inbound and outbound traffic paths, including allowing return traffic on ephemeral port ranges (1024−655351024-65535).
Tahmini Süre:2m 0s
ÖncekiSayfa 21 / 22Sonraki
Design Secure Architectures Alıştırma Soruları — AWS Certified Solutions Architect - Associate — Sayfa 21 | Examkin