Examkin

Design Secure Architectures

438 soru

Tüm türler438Çoktan seçmeli214Çoklu seçim224
Soru 101Soru →

A Solutions Architect is designing a secure multi-account environment using AWS Organizations. The company needs to centrally manage single sign-on access for all employees across the accounts. Additionally, the security team must enforce compliance policies to prevent member accounts from disabling logging. Which combination of AWS services or features should the Solutions Architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS IAM Identity Center to configure centralized single sign-on access.; SCPs in AWS Organizations to prevent member accounts from disabling logging.

Cevap

AWS IAM Identity Center to configure centralized single sign-on access, and SCPs in AWS Organizations to prevent member accounts from disabling logging.
Centralizing access is best achieved via AWS IAM Identity Center, while enforcing cross-account configuration constraints is the primary function of SCPs applied via AWS Organizations.

Adım Adım Çözüm

1
Identify the identity management requirements.
AWS IAM Identity Center provides federated single sign-on across the organization.
This satisfies the requirement for central access control without manual user management in individual accounts.
2
Identify the governance policy requirements.
SCPs in AWS Organizations act as permission guardrails for member accounts.
This allows the security team to block actions like disabling logging at the organizational unit or account level.

Anahtar Kavram

AWS multi-account governance using AWS IAM Identity Center for centralized access and SCPs in AWS Organizations for compliance enforcement.
Soru 102Soru →

A company runs an application on an Amazon EC2 instance. The application needs to read and write items in an Amazon DynamoDB table. According to AWS security best practices, which approach should a solutions architect use to grant the application access to the DynamoDB table?

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with the required DynamoDB permissions and attach it to the EC2 instance profile.

Cevap

Create an IAM role with the required DynamoDB permissions and attach it to the EC2 instance profile.
Creating an IAM role and attaching it to the EC2 instance profile allows the application to automatically and securely obtain temporary credentials. This eliminates the need to manage, distribute, or rotate long-term credentials, adhering to AWS security best practices.

Adım Adım Çözüm

1
Define an IAM policy that grants the required read and write actions on the specific DynamoDB table.
An IAM policy document containing the necessary DynamoDB permissions is created.
This enforces the principle of least privilege by restricting access to only the necessary table and actions.
2
Create an IAM role and attach the DynamoDB policy to it.
An IAM role with the correct permissions is created.
Roles are designed to be assumed by AWS services, allowing them to obtain temporary credentials.
3
Attach the IAM role to an EC2 instance profile and associate the instance profile with the EC2 instance.
The EC2 instance is configured with the IAM role.
This allows the application running on the EC2 instance to automatically retrieve temporary credentials via the Instance Metadata Service (IMDS).

Anahtar Kavram

AWS service authentication using IAM roles and instance profiles to avoid long-term credentials.
Soru 103Soru →

An enterprise architecture uses a centralized logging account (Account A) containing an Amazon S3 bucket for security audit logs. The bucket is encrypted using an AWS KMS customer managed key owned by Account A. A security auditing application runs on Amazon EC2 instances in a production account (Account B) and must write compliance reports directly to the S3 bucket in Account A.

Which combination of configuration steps will allow the application to securely write reports to the bucket while adhering to the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: Configure the S3 bucket policy in Account A to allow the IAM role of the EC2 instances in Account B to perform the s3:PutObject action. Configure the KMS key policy in Account A to allow the EC2 instances' IAM role to perform the kms:GenerateDataKey action. Attach an identity-based policy to the EC2 instance IAM role in Account B that grants permissions for both actions.

Cevap

Configure the S3 bucket policy in Account A to allow the IAM role of the EC2 instances in Account B to perform the s3:PutObject action. Configure the KMS key policy in Account A to allow the EC2 instances' IAM role to perform the kms:GenerateDataKey action. Attach an identity-based policy to the EC2 instance IAM role in Account B that grants permissions for both actions.
For cross-account access where the target S3 bucket is encrypted using a Customer Managed Key, two conditions must be met: both the identity-based policy (in the caller's account) and the resource-based policies (S3 bucket policy and KMS key policy in the target account) must allow the actions. The EC2 instance role in Account B must be granted permissions to perform 's3:PutObject' and 'kms:GenerateDataKey'. Correspondingly, Account A's S3 bucket policy and KMS key policy must trust and allow the EC2 role from Account B to perform these actions.

Adım Adım Çözüm

1
Analyze cross-account S3 access requirements.
Identify that the destination S3 bucket is in Account A and the source EC2 instance is in Account B. To allow access, we need both a resource-based policy (S3 bucket policy in Account A) allowing the external entity, and an identity-based policy (IAM role in Account B) allowing the action.
For cross-account access, AWS evaluates permissions in both the truster and trustee accounts; both must explicitly allow the action.
2
Analyze KMS encryption requirements for cross-account S3 uploads.
Determine that since the bucket uses a Customer Managed Key in Account A, the S3 client must generate a data key. This requires kms:GenerateDataKey permissions. Both the KMS key policy in Account A and the IAM role in Account B must allow this action.
When writing to a KMS-encrypted S3 bucket, S3 requires the caller to possess permissions to interact with the KMS key for data key generation.
3
Compare credential management and security best practices.
Confirm that using an EC2 instance profile (IAM role) is the most secure method because it automatically handles rotation of temporary credentials. Reject options that use IAM user long-term credentials or root user credentials, and reject storing sensitive keys in plaintext.
This adheres to the AWS Well-Architected Framework security pillar, specifically the principle of least privilege and avoiding long-term credentials.

Anahtar Kavram

Cross-Account IAM and Resource Policy Evaluation with KMS Encryption
Soru 104Soru →

An enterprise application running on Amazon ECS tasks in AWS Account A (111111111111111111111111) must retrieve sensitive daily reports from an Amazon S3 bucket located in AWS Account B (222222222222222222222222). The S3 bucket is encrypted using an AWS KMS customer managed key (CMK) in Account B. The solution must ensure that only the ECS tasks can access the data, adhere strictly to the principle of least privilege, and avoid the use of long-term credentials. Which combination of configurations will securely meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure the ECS task role in Account A with permissions to perform `s3:GetObject` on the S3 bucket and `kms:Decrypt` on the KMS key. In Account B, update the S3 bucket policy and the KMS key policy to explicitly grant `s3:GetObject` and `kms:Decrypt` permissions to the specific ECS task role ARN from Account A.

Cevap

Configure the ECS task role in Account A with S3 and KMS permissions, and explicitly grant access to this task role in both the S3 bucket policy and the KMS key policy of Account B.
The correct solution uses an IAM Task Role to supply temporary credentials to the ECS tasks. S3 cross-account access requires the bucket policy in Account B to trust the Task Role ARN from Account A, and the Task Role's identity policy to allow `s3:GetObject`. Crucially, because the bucket is encrypted with a customer managed key, the KMS key policy in Account B must also explicitly trust the Task Role ARN from Account A, as S3 bucket policies cannot delegate KMS permissions.

Adım Adım Çözüm

1
Configure the ECS Task Role in Account A.
The tasks assume a temporary security credential with identity-based permissions to call `s3:GetObject` and `kms:Decrypt`.
The application must be authorized to perform these actions by its own account before cross-account policies can evaluate the request.
2
Update the S3 bucket policy in Account B to trust the ECS Task Role ARN.
Cross-account read access to the S3 objects is authorized at the storage layer.
By default, cross-account access to S3 resources requires the resource owner to explicitly trust the external IAM entity.
3
Update the KMS key policy in Account B to trust the ECS Task Role ARN.
Cross-account decryption access is authorized at the cryptographic layer.
S3 bucket policies cannot delegate permissions for KMS CMKs; the key policy itself must explicitly trust the external IAM principal for decryption.

Anahtar Kavram

Cross-account IAM authorization for KMS-encrypted S3 resources
Soru 105Soru →

An organization needs to implement centralized user access management for its engineering department across a newly created multi-account AWS environment. The security policy mandates that engineers use their existing corporate directory credentials to log in, and no long-term credentials should be distributed.

Which solution should a Solutions Architect implement to meet these governance requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy AWS IAM Identity Center in the organization, integrate it with the corporate directory, and assign the engineers to appropriate permission sets.

Cevap

Deploy AWS IAM Identity Center in the organization, integrate it with the corporate directory, and assign the engineers to appropriate permission sets.
Deploying AWS IAM Identity Center allows organizations to centrally manage single sign-on access to all AWS accounts. Integrating it with an external identity provider ensures that engineers can use their existing corporate directory credentials, and temporary security credentials are automatically requested when they access their designated accounts, fulfilling the security policy.

Adım Adım Çözüm

1
Enable and configure AWS IAM Identity Center from the organization's management account.
Centralized single sign-on service is activated across the entire organization.
This establishes a centralized directory and access portal for all member accounts.
2
Integrate AWS IAM Identity Center with the existing corporate directory (e.g., Active Directory or external identity provider).
Users can authenticate using their existing corporate credentials.
This eliminates the need to create new sets of credentials for the engineers.
3
Create permission sets defining the required access levels and assign them to the engineering directory groups in the target accounts.
Engineers gain federated access to target accounts with temporary credentials.
This ensures compliance with the security policy against distributing long-term credentials.

Anahtar Kavram

Centralized Identity Management and Federation in Multi-Account Environments
Soru 106Soru →

A retail company has migrated its business units into separate AWS accounts controlled by AWS Organizations. The compliance department demands that all developer access be federated from the company's external Active Directory, granting role-based access without long-term credentials. Furthermore, the company must guarantee that no administrator in any member account can delete or stop AWS CloudTrail logging. Which combination of AWS configurations will satisfy these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center to federate with the external Active Directory, define permission sets for developer roles, and apply Service Control Policies (SCPs) at the organizational unit (OU) level to deny the CloudTrail:StopLogging and CloudTrail:DeleteTrail actions.

Cevap

Configure AWS IAM Identity Center to federate with the external Active Directory, define permission sets for developer roles, and apply Service Control Policies (SCPs) at the organizational unit (OU) level to deny the CloudTrail:StopLogging and CloudTrail:DeleteTrail actions.
The correct option correctly suggests integrating the external Active Directory with AWS IAM Identity Center to provide federated role-based access using temporary credentials. To enforce governance and prevent administrators in member accounts from stopping CloudTrail logging, Service Control Policies (SCPs) applied at the OU level must be used, as they act as a maximum permission boundary that cannot be bypassed by administrators in member accounts.

Adım Adım Çözüm

1
Configure AWS IAM Identity Center integration with the external Active Directory to allow users to authenticate and receive temporary security credentials.
Developers can sign in to their respective AWS accounts using their existing Active Directory credentials without needing long-term IAM access keys.
This establishes federated access and complies with identity governance requirements.
2
Define permission sets in AWS IAM Identity Center to manage role-based access controls across accounts.
Developers are mapped to the correct IAM roles within member accounts based on Active Directory group membership.
This enforces least privilege access control across multiple AWS accounts.
3
Create and attach a Service Control Policy (SCP) to the relevant Organizational Units (OUs) that denies permissions for disabling or deleting CloudTrail logs.
Even users with administrator permissions in member accounts are blocked from stopping or deleting CloudTrail trails.
SCPs define the maximum permission boundaries for member accounts, overriding local administrator actions.

Anahtar Kavram

Multi-account identity federation and centralized governance using Service Control Policies (SCPs)
Soru 107Soru →

An enterprise is planning to grant its network engineering team access to manage resources in the AWS Cloud. The network engineers are currently managed in the company's on-premises Active Directory. The company's security policy requires that engineers authenticate using their existing corporate credentials and that no long-term AWS credentials, such as access keys, are created or stored. Which solution meets these requirements while following AWS security best practices?

Cevabı ve açıklamayı göster

Cevap: Configure identity federation using AWS IAM Identity Center integrated with the company's Active Directory, and assign permission sets to the engineering group.

Cevap

Configure identity federation using AWS IAM Identity Center integrated with the company's Active Directory, and assign permission sets to the engineering group.
The correct solution uses AWS IAM Identity Center to federate the on-premises Active Directory. This allows network engineers to sign in with their corporate credentials and access AWS resources using short-term, temporary credentials. This directly fulfills both requirements of using existing corporate credentials and avoiding long-term access keys.

Adım Adım Çözüm

1
Identify the authentication and credential requirements.
The requirements specify using existing corporate credentials (on-premises Active Directory) and avoiding the creation or storage of long-term AWS credentials.
This sets the boundary that IAM users with access keys should be avoided, and federation is required.
2
Select the appropriate AWS service for identity federation.
AWS IAM Identity Center provides native integration with active directories to enable federated single sign-on using temporary security tokens.
IAM Identity Center centralizes access management and eliminates the need for long-term IAM credentials for enterprise directory users.
3
Map permissions to the federated identities.
Assign AWS permission sets to the Active Directory engineering group to grant administrative access.
Permission sets define the level of access users have to AWS accounts and resources based on their directory group membership.

Anahtar Kavram

Identity Federation and Single Sign-On (SSO) with IAM Identity Center
Soru 108Soru →

An organization needs to grant console access to its team of internal software developers. The developers already authenticate daily using the company's central Active Directory. Which approach represents the most secure method for granting AWS Management Console access to these developers?

Cevabı ve açıklamayı göster

Cevap: Configure identity federation using AWS IAM Identity Center to map Active Directory groups to AWS permissions.

Cevap

Configure identity federation using AWS IAM Identity Center to map Active Directory groups to AWS permissions.
The correct approach is to configure identity federation using AWS IAM Identity Center. This maps the company's existing Active Directory groups directly to AWS permissions, allowing developers to authenticate using their existing corporate credentials. This adheres to the principle of least privilege, minimizes administrative overhead, and avoids the creation of long-term IAM user credentials.

Adım Adım Çözüm

1
Identify the existing identity store used by the developers.
The developers are already authenticated using the company's central Active Directory.
This indicates that identity federation is the preferred approach to avoid credential duplication.
2
Select the appropriate AWS service for centralized identity management and federation.
AWS IAM Identity Center is the recommended service for directory federation.
It integrates directly with Active Directory to manage single sign-on access to AWS accounts and applications.
3
Evaluate the security implications of alternative options.
Creating individual IAM users, sharing root credentials, or storing keys in plaintext parameters violate AWS security best practices.
These alternatives introduce credential management overhead, violate the principle of least privilege, and expose sensitive credentials.

Anahtar Kavram

AWS identity federation using IAM Identity Center allows organizations to grant AWS access based on existing corporate directory identities without managing separate IAM user credentials.
Tahmini Süre:1m 0s
Soru 109Soru →

A financial services firm is establishing a landing zone to host transaction-processing workloads that must comply with PCI-DSS. The company has structured its AWS Organizations hierarchy with distinct Organizational Units (OUs) for Core, Workloads, and Sandbox. The architecture team needs to restrict root user activity in the member accounts, enforce multi-factor authentication (MFA) for administrative tasks, and implement a single sign-on experience linked to their corporate identity provider (IdP). Which combination of actions should the Solutions Architect take to establish this governance framework? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center and federate it with the corporate identity provider to manage user access across all member accounts.; Apply an SCP to the Workloads and Sandbox OUs that denies API requests if the caller is the member account root user.

Cevap

Configure AWS IAM Identity Center federated with the corporate identity provider, and apply an SCP to the Workloads and Sandbox OUs that denies API requests if the caller is the member account root user.
Centralizing access through AWS IAM Identity Center federated with the corporate IdP allows seamless, secure single sign-on access across all member accounts without maintaining static credentials. In addition, applying an SCP to the Workloads and Sandbox OUs that denies all actions when the principal is the root user restricts member account root activities, which helps satisfy security standards like PCI-DSS.

Adım Adım Çözüm

1
Centralize administrative access management.
Enable and configure AWS IAM Identity Center, linking it with the corporate Identity Provider (IdP) via SAML 2.0 or OIDC.
This establishes a single sign-on (SSO) experience for administrators, eliminating the need to manage individual IAM users in each AWS account.
2
Restrict member account root user access.
Create a Service Control Policy (SCP) that explicitly denies all actions if the AWS Principal is the root user. Apply this SCP to the Workloads and Sandbox Organizational Units.
Applying this SCP ensures that nobody can perform administrative tasks using member account root credentials, enforcing the use of federated administrative identities instead.

Anahtar Kavram

Centralized multi-account governance involves federating administrative identities using AWS IAM Identity Center and enforcing policy guardrails with Service Control Policies (SCPs) in AWS Organizations.
Soru 110Soru →

An enterprise is consolidating its billing and resource management under AWS Organizations. The security team wants to establish centralized access control so that employees can sign in using their existing corporate credentials and access their assigned AWS accounts without managing separate passwords. Which of the following is the most secure and operationally efficient method to achieve this goal?

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center integrated with the enterprise's corporate identity provider.

Cevap

Configure AWS IAM Identity Center integrated with the enterprise's corporate identity provider.
The correct option is configuring AWS IAM Identity Center integrated with the enterprise's corporate identity provider. This approach centralizes permissions management and integrates directly with the existing corporate identity store, eliminating the need to manage individual IAM credentials in multiple member accounts.

Adım Adım Çözüm

1
Identify the primary requirement.
The requirement is to implement centralized identity federation and cross-account access management without using separate credentials for each AWS account.
This establishes the scope of the solution as multi-account identity and governance.
2
Evaluate the solutions against AWS best practices.
AWS IAM Identity Center is the native AWS service designed to handle centralized user federation and permission management across accounts within AWS Organizations.
This identifies the correct service matching the goals.
3
Eliminate options that rely on long-term or shared credentials.
Creating local IAM users or distributing root user credentials increases operational overhead and security risk, which fails the requirement.
Ensures the selected option is the most secure and operationally efficient.

Anahtar Kavram

Centralized multi-account access control via AWS IAM Identity Center
Tahmini Süre:45s
Soru 111Soru →

A logistics company is designing a multi-account strategy using AWS Organizations. The IT department wants to implement centralized user access for administrative staff by integrating their existing external identity provider. Furthermore, the security team requires that no member account is allowed to disable AWS CloudTrail logging. Which solution should a solutions architect recommend to satisfy these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center federated with the external identity provider, and attach a Service Control Policy (SCP) that denies the cloudtrail:StopLogging action to the organizational unit containing the member accounts.

Cevap

Configure AWS IAM Identity Center federated with the external identity provider, and attach a Service Control Policy (SCP) that denies the cloudtrail:StopLogging action to the organizational unit containing the member accounts.
Integrating AWS IAM Identity Center with an external identity provider simplifies identity management by using federation rather than local credentials. Additionally, attaching an SCP to the member accounts' organizational unit successfully prevents any user or role inside those member accounts from stopping CloudTrail logging, guaranteeing compliance.

Adım Adım Çözüm

1
Select the centralized authentication mechanism.
AWS IAM Identity Center is configured and integrated with the external identity provider to enable federated access without creating local IAM users.
Centralized identity management reduces credentials overhead and simplifies access lifecycle management.
2
Define the policy structure to prevent disabling CloudTrail.
Create a Service Control Policy (SCP) with a Deny effect on the cloudtrail:StopLogging action.
SCPs are the primary mechanism in AWS Organizations to set maximum permissions boundaries across accounts.
3
Apply the policy to the multi-account hierarchy.
Attach the SCP to the organizational unit containing the member accounts.
Applying the SCP at the organizational unit level ensures enforcement across all member accounts in that unit while avoiding restrictions on the management account's root operational functions if they are kept separate.

Anahtar Kavram

Centralized multi-account governance using AWS Organizations SCPs and AWS IAM Identity Center.
Soru 112Soru →

A software-as-a-service (SaaS) provider has multiple development and production environments, each hosted in a separate AWS account within an organization in AWS Organizations. The IT security team must establish a single location to manage user access and ensure that developers cannot configure long-term IAM user credentials. Which of the following actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable AWS IAM Identity Center and integrate it with the organization's existing external identity provider.; Apply a Service Control Policy (SCP) to the root of the organization that denies the creation of new IAM users and access keys.

Cevap

Enable AWS IAM Identity Center integrated with an external identity provider, and apply a Service Control Policy (SCP) to the root of the organization that denies the creation of new IAM users and access keys.
The correct approach involves centralizing user access management using AWS IAM Identity Center integrated with an external identity provider. To enforce compliance and prevent the creation of unauthorized long-term credentials, a Service Control Policy (SCP) must be applied to the organization's root to explicitly deny the creation of new IAM users and access keys across member accounts.

Adım Adım Çözüm

1
Centralize user identity and credentials.
By enabling AWS IAM Identity Center and connecting it to an external identity provider, the organization eliminates the need to create local IAM users and long-term credentials.
This simplifies credential rotation and centralizes access control across all AWS accounts.
2
Enforce governance guardrails across the organization.
By attaching a Service Control Policy (SCP) to the root of the organization, the creation of IAM users and long-term access keys is blocked in all member accounts.
SCPs define the maximum permission boundary for member accounts, preventing administrators or developers from bypassing the centralized identity configuration.

Anahtar Kavram

Centralized identity management and organizational guardrails using AWS IAM Identity Center and Service Control Policies (SCPs).
Tahmini Süre:1m 0s
Soru 113Soru →

A solutions architect is configuring a new AWS Lambda function that must read data from an Amazon DynamoDB table. According to AWS security best practices, how should the solutions architect grant the Lambda function the necessary permissions to access the table?

Cevabı ve açıklamayı göster

Cevap: Create an IAM execution role with a permissions policy that allows read access to the DynamoDB table, and associate this role with the Lambda function.

Cevap

Create an IAM execution role with a permissions policy that allows read access to the DynamoDB table, and associate this role with the Lambda function.
The correct answer is correct because configuring an IAM execution role and attaching it to the Lambda function allows the function to securely assume the role at runtime. This provides the function with temporary credentials via AWS STS and follows the principle of least privilege without managing static credentials.

Adım Adım Çözüm

1
Create an IAM execution role with a trust policy that allows the AWS Lambda service to assume the role.
The Lambda service gains the capability to dynamically assume the role and request temporary security credentials.
AWS services must establish a trust relationship before they can assume an identity and access other resources.
2
Attach a permissions policy to the IAM role that grants read-only access (such as GetItem or Query actions) to the target DynamoDB table.
The role is granted the minimum necessary permissions required to read data from the database.
Restricting access to only the required resource and actions adheres to the security principle of least privilege.
3
Associate the execution role with the configuration of the Lambda function.
When the Lambda function is invoked, AWS securely injects temporary credentials representing the role into the execution environment.
This eliminates the need to hardcode or manually retrieve long-term access keys, significantly reducing the credential exposure risk.

Anahtar Kavram

AWS Lambda execution roles permit service-to-service authorization using temporary credentials rather than long-term access keys.
Soru 114Soru →

A company has multiple AWS accounts managed under AWS Organizations. The security audit team in the central audit account needs read-only access to Amazon S3 buckets containing CloudTrail logs in all member accounts. A solutions architect must configure this access securely following the principle of least privilege. Which TWO actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IAM role in each member account with a trust policy that trusts the central audit account, and attach a policy allowing read-only access to the S3 buckets.; Grant permissions to the security audit team members in the central audit account to assume the IAM roles in the member accounts.

Cevap

The solutions architect should create an IAM role in each member account that trusts the central audit account and allows read-only access to the S3 buckets. Additionally, the security audit team members in the central audit account must be granted permissions to assume those roles.
Establishing cross-account access securely involves creating an IAM role in the target (member) accounts with a trust policy that trusts the trusted (audit) account, along with a permissions policy granting read-only S3 access. Additionally, users in the trusted account must be granted permissions to assume that cross-account role.

Adım Adım Çözüm

1
Configure the receiving accounts (member accounts) to trust the sending account.
An IAM role is created in each member account with a trust policy that points to the central audit account ID, allowing users from that account to assume the role.
This establishes cross-account trust securely without creating IAM users or long-term credentials in the target accounts.
2
Configure the permissions within the receiving accounts' roles.
An IAM permission policy is attached to the role, granting read-only access specifically to the S3 buckets containing CloudTrail logs.
This limits the scope of the assumed role to only the required resources, enforcing the principle of least privilege.
3
Grant assume role permissions to the audit team in the central account.
The IAM users, groups, or roles representing the audit team in the central audit account are given a policy allowing the sts:AssumeRole action on the ARN of the roles in the member accounts.
This enables the audit team to dynamically assume the target roles in the member accounts to perform their audit tasks.

Anahtar Kavram

Cross-account access using IAM roles allows users from one AWS account to access resources in another AWS account securely without creating duplicate IAM users or using long-term credentials.
Soru 115Soru →

A financial services company is deploying an application on-premises that needs to periodically read and write files to an Amazon S3 bucket. The application must also retrieve credentials to connect to an Amazon RDS database and decrypt sensitive configuration files using an AWS KMS customer managed key. The company's security policy strictly prohibits the use of long-term AWS credentials and requires that all access be based on temporary security credentials. The company already has an established internal public key infrastructure (PKI). Which combination of actions should a solutions architect recommend?

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Roles Anywhere to allow the on-premises application to assume an IAM role with the minimum required S3 and KMS permissions. Store the database credentials in AWS Secrets Manager with automatic rotation enabled, and enable automatic annual rotation for the KMS customer managed key.

Cevap

Configure AWS IAM Roles Anywhere to allow the on-premises application to assume an IAM role with the minimum required S3 and KMS permissions. Store the database credentials in AWS Secrets Manager with automatic rotation enabled, and enable automatic annual rotation for the KMS customer managed key.
The correct solution uses AWS IAM Roles Anywhere to establish trust between the on-premises PKI and AWS IAM. This allows the on-premises application to assume an IAM role and obtain temporary credentials, avoiding long-term access keys. AWS Secrets Manager is the best practice for storing database credentials because it supports automatic rotation. Enabling automatic annual key rotation for the KMS key is the recommended key management practice.

Adım Adım Çözüm

1
Establish a trust anchor in AWS IAM Roles Anywhere using the company's internal PKI Certificate Authority (CA) certificate.
AWS IAM Roles Anywhere can now authenticate the on-premises application based on its X.509 certificate.
To eliminate the need for long-term AWS credentials on the on-premises server.
2
Create an IAM role with a trust policy that allows the AWS IAM Roles Anywhere service principal to assume the role, and attach policies granting the required permissions for S3 and KMS.
The application can exchange its certificate for temporary security credentials corresponding to the role.
To enforce the principle of least privilege using short-lived credentials.
3
Store the database credentials in AWS Secrets Manager with automatic rotation enabled, and enable automatic key rotation for the customer managed key in AWS KMS.
Database credentials are rotated automatically without application downtime, and the KMS key is rotated annually without disabling the ability to decrypt historical data.
To satisfy the security requirements for secrets management and secure key lifecycle management.

Anahtar Kavram

AWS IAM Roles Anywhere and Secure Credentials Management
Soru 116Soru →

A Solutions Architect is designing a secure multi-account environment using AWS Organizations. The environment consists of a management account and multiple member accounts grouped into operational Organizational Units (OUs). The security team has established two key governance mandates: first, users from the corporate external Active Directory must have single sign-on access to member accounts based on their job roles without using persistent IAM credentials; second, all member accounts must be prevented from stopping AWS CloudTrail logging or deleting trails. Which combination of actions should the Solutions Architect take to satisfy these mandates? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center, integrate it with the external Active Directory, and assign permission sets to corporate groups mapped to the target accounts.; Create an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach it to the root of the Organization or to the parent OUs of the member accounts.

Cevap

The correct combination of actions is to configure AWS IAM Identity Center integrated with the external Active Directory to assign permission sets to corporate groups, and to create an SCP denying the stopping or deleting of CloudTrail logs attached to the root of the Organization or parent OUs.
Configuring AWS IAM Identity Center integrated with the external Active Directory provides a centralized federation mechanism that avoids persistent IAM credentials. Attaching an SCP with explicit deny statements for cloudtrail:StopLogging and cloudtrail:DeleteTrail to the root or parent OUs ensures that all member accounts conform to the security guardrail, while the management account remains unaffected as SCPs do not restrict it.

Adım Adım Çözüm

1
Address the centralized identity and access mandate by establishing federation.
AWS IAM Identity Center is configured and connected to the corporate Active Directory.
This allows group-based mapping and grants temporary security credentials for single sign-on access without managing persistent credentials.
2
Address the governance requirement to prevent disabling or deleting CloudTrail logs across member accounts.
An SCP with explicit deny rules for cloudtrail:StopLogging and cloudtrail:DeleteTrail is drafted.
SCPs are the standard mechanism to enforce guardrails across member accounts in AWS Organizations.
3
Attach the SCP to the appropriate boundary within the Organization hierarchy.
The SCP is attached to the Organization root or parent OUs, exempting the management account.
SCPs do not restrict the management account, which satisfies the operational separation of the management account while enforcing strict policies on all member accounts.

Anahtar Kavram

Centralized multi-account governance and secure identity federation using AWS Organizations SCPs and AWS IAM Identity Center.
Tahmini Süre:2m 30s
Soru 117Soru →

A company needs to grant a third-party auditing firm temporary access to run configuration compliance checks on resources across all accounts in its AWS Organization. The auditing firm will access the organization's accounts from their own AWS account (123456789012123456789012) using a commercial automated tool. The company's security policy requires that:

- The auditing tool must only be allowed to read resource configuration metadata, with no access to read actual data stored in Amazon S3 buckets or databases.
- The configuration must mitigate the risk of the 'confused deputy' security vulnerability.
- The access granted to the auditing firm must automatically expire in 3030 days without requiring manual intervention.

Which solution meets these requirements securely and with the least administrative overhead?

Cevabı ve açıklamayı göster

Cevap: Create an IAM role in the company's AWS Organizations management account that trusts the auditing firm's AWS account (123456789012123456789012). In the trust policy, specify a condition for the unique external ID provided by the auditing firm and a DateLessThan condition restricting the current time to 3030 days. Attach the AWS-managed SecurityAudit policy to this role.

Cevap

Create an IAM role in the company's AWS Organizations management account that trusts the auditing firm's AWS account. Use a trust policy containing conditions for the unique external ID and a DateLessThan current time condition set to 3030 days, while attaching the SecurityAudit managed policy.
The correct solution involves creating a cross-account IAM role that trusts the auditing firm's AWS account. To address the confused deputy problem, a condition for the external ID is added to the trust policy. The requirement for automatic expiration after 3030 days is met by using the DateLessThan condition block with the aws:CurrentTime key in the trust policy. The SecurityAudit AWS-managed policy provides read-only access to resource metadata and configurations (such as AWS Config or CloudTrail) without granting access to actual customer data inside Amazon S3 or databases.

Adım Adım Çözüm

1
Determine the correct access mechanism
Utilize role-based cross-account access rather than creating IAM users or sharing root credentials to adhere to AWS security best practices.
This establishes temporary security credentials and avoids managing long-term access keys.
2
Address the confused deputy risk
Include the unique external ID provided by the third-party auditor in the trust policy condition block (sts:ExternalId).
This ensures the auditing firm's tool only assumes the role when acting specifically on behalf of the company.
3
Enforce automatic expiration
Implement a temporal constraint in the trust policy using the DateLessThan condition block compared against aws:CurrentTime set to 3030 days in the future.
This prevents STS from issuing credentials once the date threshold is exceeded, meeting the automatic expiration requirement.
4
Apply least privilege permissions
Attach the AWS-managed SecurityAudit policy to the role.
This policy allows read-only access to configurations and metadata without exposing raw customer data in databases or Amazon S3.

Anahtar Kavram

Implementing secure cross-account access using IAM roles, mitigating the confused deputy vulnerability using external IDs, enforcing temporary access duration with temporal policy conditions, and applying least privilege with predefined security audit policies.
Tahmini Süre:3m 0s
Soru 118Soru →

A financial services company is using AWS Organizations to manage its multi-account environment. The security team wants to ensure that no member accounts in the 'Core-Workloads' Organizational Unit (OU) can disable Amazon GuardDuty or delete its detectors. Additionally, the company needs to establish centralized access control so that employees can sign in using their existing corporate identity provider credentials and be mapped to specific roles across various AWS accounts. Which combination of actions will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable AWS IAM Identity Center in the organization's management account and configure federation with the corporate identity provider.; Create a Service Control Policy (SCP) that denies guardduty:DeleteDetector and guardduty:UpdateDetector, and attach the SCP to the Core-Workloads OU.

Cevap

Enable AWS IAM Identity Center in the organization's management account and configure federation with the corporate identity provider, and create a Service Control Policy (SCP) that denies guardduty:DeleteDetector and guardduty:UpdateDetector, and attach the SCP to the Core-Workloads OU.
Centralizing access control through AWS IAM Identity Center and federating it with the corporate identity provider simplifies administration and eliminates the need to manage individual IAM users in member accounts. Additionally, applying a Service Control Policy (SCP) to the OU containing member accounts enforces security policies globally, preventing local administrators from disabling Amazon GuardDuty.

Adım Adım Çözüm

1
Evaluate the requirement to prevent member accounts from disabling Amazon GuardDuty.
Local IAM policies are insufficient because local administrators can modify or bypass them. A Service Control Policy (SCP) must be used at the Organizational Unit (OU) level to establish a permission guardrail.
SCPs apply to all users and roles in member accounts, including the root user, ensuring compliance with security baselines.
2
Evaluate the requirement for centralized federated access using the corporate identity provider.
AWS IAM Identity Center should be enabled in the management account and integrated with the identity provider via SAML 2.0 or OIDC.
This centralizes user management, eliminates local IAM users, and enforces single sign-on across the organization.
3
Combine the security baseline and federation solutions to form the complete architectural recommendation.
The final architecture uses IAM Identity Center for access governance and SCPs for resource governance.
This meets both the security and operations requirements according to AWS Well-Architected best practices.

Anahtar Kavram

Multi-Account Security Governance and Centralized Identity Management
Soru 119Soru →

A Solutions Architect is designing a multi-account strategy using AWS Organizations. The organization consists of a management account, a Security organizational unit (OU), a Production OU, and a Development OU. The security team requires that no users or roles in the Production and Development OUs are allowed to disable AWS CloudTrail or delete trails. However, the Security OU must retain the ability to modify CloudTrail settings for automated maintenance. Additionally, the company wants to implement centralized single sign-on access using their existing external identity provider (IdP) without managing individual credentials in each member account.

Which combination of actions will meet these security and access requirements?

Cevabı ve açıklamayı göster

Cevap: Enable AWS IAM Identity Center in the management account and configure federation with the external IdP. Create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach this SCP to the Production and Development OUs.

Cevap

Enable AWS IAM Identity Center in the management account, configure federation with the external IdP, create an SCP that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach this SCP to the Production and Development OUs.
The correct option addresses all requirements by using AWS IAM Identity Center to federate identity access from the external identity provider, which avoids managing local IAM users. It correctly limits the scope of the SCP by attaching it only to the Production and Development OUs, thereby exempting the Security OU and allowing it to perform authorized maintenance tasks.

Adım Adım Çözüm

1
Address the centralized authentication requirement.
Enable AWS IAM Identity Center in the organization's management account and configure integration with the external identity provider.
This establishes centralized single sign-on and federated access, eliminating the need to create and manage individual IAM users with long-term credentials in each member account.
2
Define the policy to prevent unauthorized CloudTrail modifications.
Create a Service Control Policy (SCP) containing a Deny rule for the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.
SCPs act as permission guardrails that define the maximum permissions for member accounts under an organization.
3
Target the policy attachment to respect organizational unit boundaries.
Attach the created SCP to the Production and Development OUs, leaving the Security OU and the management account root exempt from the policy.
Attaching the SCP to specific OUs allows granular enforcement, ensuring the Security OU retains its administrative capability over CloudTrail while protecting the target environments.

Anahtar Kavram

Fine-grained governance using Service Control Policies and centralized authentication with AWS IAM Identity Center.
Tahmini Süre:2m 30s
Soru 120Soru →

A Solutions Architect is designing a security governance framework for a healthcare technology provider. The provider has a multi-account environment managed through AWS Organizations, structured with separate OUs for Production, Testing, and Shared Services. The compliance team mandates that no IAM user or role within any member account—including administrative users—can create unencrypted Amazon EBS volumes or delete AWS KMS customer managed keys. Furthermore, the organization wants to manage human access centrally via an existing Microsoft Entra ID tenant without maintaining long-term security credentials in individual member accounts.

Which combination of actions should the Solutions Architect take to satisfy these governance and security requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center to federate with Microsoft Entra ID as the external identity provider, and assign permission sets to manage user access across the member accounts.; Create a Service Control Policy (SCP) that denies kms:DeleteKey and ec2:CreateVolume actions if encryption is not enabled, and attach the policy to the organization's root or specific organizational units.

Cevap

Configure AWS IAM Identity Center to federate with Microsoft Entra ID and assign permission sets, and create a Service Control Policy (SCP) denying the unauthorized actions attached to the organization's root or organizational units.
Integrating AWS IAM Identity Center with Microsoft Entra ID allows central management of user access across multiple AWS accounts using temporary credentials, which avoids creating long-term IAM user credentials. At the same time, applying an SCP to the root or OUs prevents actions such as deleting KMS customer managed keys or creating unencrypted volumes across all member accounts, including administrative identities.

Adım Adım Çözüm

1
Analyze the compliance requirement to restrict all administrative and standard users in member accounts from creating unencrypted volumes or deleting KMS keys.
Determine that Service Control Policies (SCPs) attached to the organization's root or organizational units (OUs) are the correct mechanism to enforce these mandatory guardrails across all member account roles.
SCPs define permission guardrails that even account administrators in member accounts cannot bypass.
2
Analyze the identity requirement to centralize access from Microsoft Entra ID without creating individual member account IAM users.
Determine that AWS IAM Identity Center integrated with Microsoft Entra ID as the external identity provider is the standard and secure solution.
AWS IAM Identity Center provides federated access using short-term credentials, avoiding the creation and maintenance of long-term IAM users.

Anahtar Kavram

Centralized governance and federated access in a multi-account structure using AWS Organizations SCPs and AWS IAM Identity Center.
Tahmini Süre:2m 30s
ÖncekiSayfa 6 / 22Sonraki
Design Secure Architectures Alıştırma Soruları — AWS Certified Solutions Architect - Associate — Sayfa 6 | Examkin