Examkin

Design Secure Architectures

438 soru

Tüm türler438Çoktan seçmeli214Çoklu seçim224
Soru 161Soru →

A multinational financial firm manages its cloud infrastructure using a multi-account AWS Organizations environment. All corporate user identities and security groups are maintained in an on-premises Microsoft Active Directory. The firm's compliance policy strictly prohibits the storage or replication of any user credentials or identity database records in the public cloud. The firm wants to enable federated single sign-on (SSO) for its employees to access the AWS Management Console and AWS CLI across all member accounts. The network architecture includes a dedicated AWS Direct Connect connection between the on-premises data center and a shared services VPC. The solution must minimize ongoing operational overhead and infrastructure costs. Which configuration should a solutions architect recommend to satisfy these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure an AD Connector in the shared services VPC linked to the on-premises Active Directory. Enable AWS IAM Identity Center in the AWS Organizations management account, configure it to use the AD Connector as its directory source, and assign permission sets to on-premises Active Directory groups.

Cevap

Configure an AD Connector in the shared services VPC linked to the on-premises Active Directory. Enable AWS IAM Identity Center in the AWS Organizations management account, configure it to use the AD Connector as its directory source, and assign permission sets to on-premises Active Directory groups.
The correct solution uses an AD Connector, which acts as a directory gateway to redirect directory requests to the on-premises Active Directory without caching or replicating any identity database records or user credentials in the public cloud. This directly satisfies the compliance requirement. By integrating AD Connector with AWS IAM Identity Center, the firm can centrally manage single sign-on access to the AWS Management Console and CLI across all accounts in AWS Organizations. Group-based access mapping ensures that permissions are assigned to existing Active Directory groups, minimizing operational overhead.

Adım Adım Çözüm

1
Analyze compliance and data replication requirements.
Identified that identity data or credentials must not be replicated to the cloud, ruling out solutions that copy AD user accounts or store passwords in AWS.
Compliance policy strictly prohibits public cloud storage of user credentials or database records.
2
Select the appropriate directory integration service.
Choose AD Connector over AWS Managed Microsoft AD because AD Connector functions as a gateway proxy, redirecting authentication requests to the on-premises AD without data replication.
AD Connector avoids cloud identity storage and reduces costs compared to deploying managed domain controllers in AWS.
3
Configure the centralized authentication access mechanism.
Enable AWS IAM Identity Center in the AWS Organizations management account and associate it with the AD Connector.
Provides central management of access to console and CLI across multiple accounts, reducing operational overhead.
4
Map permissions to existing AD structures.
Assign AWS permission sets to existing on-premises Active Directory groups.
Allows group-based access control managed from the on-premises directory without manual mapping per user in AWS.

Anahtar Kavram

AWS IAM Identity Center integration with Active Directory using AD Connector to enable federated access without cloud-side credential replication.
Soru 162Soru →

A retail company is building a multi-account structure on AWS using AWS Organizations. The security team wants to mandate that all administrative and developer access across member accounts must go through AWS IAM Identity Center, which is integrated with their external identity provider. To enforce this, the team wants to prevent the creation of local IAM users and long-term access keys within all member accounts. The management account must remain exempt from this policy to allow break-glass access. Which solution should a solutions architect recommend to meet these requirements with the least administrative effort?

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center to handle federation. Create a Service Control Policy (SCP) that denies iam:CreateUser and iam:CreateAccessKey actions. Attach this SCP to the root of the organization.

Cevap

Configure AWS IAM Identity Center to handle federation. Create a Service Control Policy (SCP) that denies iam:CreateUser and iam:CreateAccessKey actions. Attach this SCP to the root of the organization.
The correct solution uses AWS IAM Identity Center to enable centralized federation. By creating a Service Control Policy (SCP) that denies the creation of IAM users and access keys, and attaching it to the root of the organization, the rule is enforced on all member accounts. Because SCPs do not apply to the management account, the management account remains exempt from the policy, allowing break-glass root access in emergencies.

Adım Adım Çözüm

1
Configure AWS IAM Identity Center
Enables centralized identity federation with the external identity provider for access to all AWS accounts.
Allows users to log in with their corporate credentials without creating individual IAM users in member accounts.
2
Create a Service Control Policy (SCP)
An SCP is defined that denies iam:CreateUser and iam:CreateAccessKey actions.
Ensures that member accounts cannot bypass the federated access mechanism by creating local users or access keys.
3
Attach the SCP to the root of the organization
The restriction applies to all member accounts, while the management account remains unaffected.
SCPs do not apply to the management account, which satisfies the requirement to keep it exempt for emergency break-glass access.

Anahtar Kavram

Centralized Governance using SCPs and IAM Identity Center
Soru 163Soru →

A company is designing a secure environment for its development teams across multiple AWS accounts managed under AWS Organizations. The security team wants to enforce two specific requirements:

1. Developers must be prevented from deleting any Amazon S3 buckets.
2. Developers must be allowed to create and manage IAM roles for their applications, but they must not be able to escalate their own permissions or assign administrator permissions to the new roles.

Which combination of mechanisms should a solutions architect recommend to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level that explicitly denies the s3:DeleteBucket action.; Use IAM permissions boundaries to define the maximum permissions that developers can assign to the roles they create.

Cevap

Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level that explicitly denies the s3:DeleteBucket action, and use IAM permissions boundaries to define the maximum permissions that developers can assign to the roles they create.
Applying an SCP at the OU level to explicitly deny the s3:DeleteBucket action provides a strong security guardrail that prevents any user or role in the member accounts from deleting buckets. Using IAM permissions boundaries allows the security team to delegate role creation to developers while ensuring that the permissions of the newly created roles cannot exceed the boundaries defined by the security team.

Adım Adım Çözüm

1
Evaluate how to prevent S3 bucket deletion across multiple accounts under AWS Organizations.
An SCP is the most effective way to enforce coarse-grained policy controls across member accounts, overriding local administrators.
SCPs apply to all users and roles in member accounts, ensuring global compliance.
2
Determine how to delegate role creation without allowing privilege escalation.
Applying an IAM permissions boundary ensures that any role created or managed by the developers cannot exceed the boundary's permissions.
This prevents developers from creating administrative roles to bypass their own constraints.

Anahtar Kavram

Permissions Boundaries and Service Control Policies (SCPs) are used together to delegate administrative permissions safely and enforce guardrails in multi-account environments.
Soru 164Soru →

An Amazon EC2 instance in a private subnet needs to make outbound HTTPS requests to an external API. The security group associated with the instance is configured with an outbound rule that allows traffic to any destination on port 443443. There are no inbound rules configured on the security group. How does the security group handle the response traffic from the external API?

Cevabı ve açıklamayı göster

Cevap: The response traffic is automatically allowed because security groups are stateful.

Cevap

The response traffic is automatically allowed because security groups are stateful.
The correct answer is that the response traffic is automatically allowed. Because security groups in Amazon VPC are stateful, any traffic that is explicitly allowed outbound is automatically allowed back inbound, bypassing the need for a corresponding inbound rule.

Adım Adım Çözüm

1
Analyze the resource and rules configuration.
The EC2 instance uses a security group with an outbound rule allowing port 443443 but no inbound rules.
To determine how return traffic is treated, we must evaluate the statefulness of the security control.
2
Determine the statefulness behavior of security groups.
Security groups are stateful. This means any allowed outbound connection will automatically permit the corresponding inbound response traffic.
Stateful packet filtering tracks the connection state and permits return traffic without requiring a matching rule in the opposite direction.

Anahtar Kavram

Security Group Statefulness
Soru 165Soru →

A logistics enterprise with a multi-account structure in AWS Organizations wants to implement centralized single sign-on (SSO) for its on-premises Active Directory (AD) users. The company's compliance policy strictly prohibits replicating user password hashes to AWS or deploying Microsoft Active Directory domain controllers inside the cloud environment. A dedicated AWS Direct Connect connection provides private network pathing to the on-premises environment. The solutions architect needs to design a secure, highly available identity federation solution that allows users to access the AWS Management Console of member accounts using their corporate AD credentials. Which two actions should the solutions architect take to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an AD Connector in the AWS Organizations management account across two Availability Zones, providing the IP addresses of the on-premises Active Directory domain controllers for name resolution and authentication.; Enable AWS IAM Identity Center and change the identity source from the default identity store to the Active Directory directory associated with the newly deployed AD Connector.

Cevap

To establish federation without replicating passwords or deploying cloud domain controllers, the solutions architect must configure an AD Connector across multiple Availability Zones pointing to the on-premises Active Directory, and configure AWS IAM Identity Center to use this Active Directory directory as its identity source.
Deploying AD Connector allows AWS to proxy authentication requests to the on-premises Active Directory domain controllers without storing password hashes in AWS or requiring domain controller deployments in the cloud. By changing the identity source in AWS IAM Identity Center to use this Active Directory directory, users can authenticate using their existing on-premises credentials to access the AWS Management Console across all accounts within the AWS Organization.

Adım Adım Çözüm

1
Evaluate the architectural constraints concerning password storage and domain controller deployment.
Identify that AWS Managed Microsoft AD is unsuitable because it deploys domain controllers in the AWS Cloud, leaving AD Connector as the correct choice for proxying authentication requests.
Compliance rules prohibit replicating password hashes to the cloud and deploying new domain controllers in AWS.
2
Provision AD Connector in a highly available configuration.
Create the AD Connector across two Availability Zones in the primary VPC, configuring it with the IP addresses of the on-premises domain controllers accessible via the AWS Direct Connect connection.
Multi-AZ deployment ensures service availability, and routing traffic over the Direct Connect ensures secure, private communication.
3
Configure the identity source in AWS IAM Identity Center.
Navigate to the IAM Identity Center console, select the option to change the identity source, and connect it to the Active Directory directory provisioned by the AD Connector.
This establishes the link between IAM Identity Center and the on-premises Active Directory domain, allowing seamless user access without provisioning local IAM users.

Anahtar Kavram

Integrating on-premises Active Directory with AWS IAM Identity Center using AD Connector allows secure, high-availability federation without password replication or cloud-based domain controller deployments.
Soru 166Soru →

A company is designing a multi-account environment on AWS using AWS Organizations. The company has several business units, each requiring its own dedicated account under a specific OU. The security team requires centralized user authentication using the company's external identity provider. Additionally, the security team must prevent any member account from leaving the organization. Which of the following actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center connected to the external identity provider to centrally manage user access across all accounts.; Apply a Service Control Policy (SCP) at the root level of the organization that denies the organizations:LeaveOrganization API action.

Cevap

Configure AWS IAM Identity Center connected to the external identity provider, and apply a Service Control Policy (SCP) at the root level that denies the organizations:LeaveOrganization action.
Integrating AWS IAM Identity Center with the external identity provider is the native, scalable method to grant federated access to AWS accounts without manual credential configuration. Applying a Service Control Policy that denies the organizations:LeaveOrganization action at the root level ensures that no member account can detach itself from the organization's governance boundary.

Adım Adım Çözüm

1
Address the centralized identity requirement.
By using AWS IAM Identity Center, the solutions architect integrates the corporate external identity provider once to provide single sign-on access to all AWS accounts.
This centralizes user access and avoids the management overhead of creating local IAM users.
2
Address the multi-account governance and organization control requirement.
By applying an SCP denying organizations:LeaveOrganization at the root of the organization, the constraint is inherited by all member accounts.
SCPs are the standard mechanism to enforce organizational boundaries and security controls across accounts.

Anahtar Kavram

Centralized multi-account governance using AWS Organizations SCPs and AWS IAM Identity Center.
Soru 167Soru →

An enterprise is building an application that stores sensitive customer metadata in a shared Amazon DynamoDB table. The design requires strict tenant isolation, ensuring that users from one tenant cannot view or modify the metadata of another tenant. All client authentication is managed by an external identity provider (IdP) federated with AWS, which supplies a custom tenant identifier during the login process. The application must leverage AWS Identity and Access Management (IAM) to enforce this tenant separation dynamically at the database level.

Which design strategy should the solutions architect implement to meet these requirements securely with the least administrative overhead?

Cevabı ve açıklamayı göster

Cevap: Implement an IAM policy for the application execution role that uses a condition block matching the dynamodb:LeadingKeys condition key with the federated user's tenant tag variable.

Cevap

Implement an IAM policy for the application execution role that uses a condition block matching the dynamodb:LeadingKeys condition key with the federated user's tenant tag variable.
The correct strategy uses IAM policy variables to achieve fine-grained access control. By matching the dynamodb:LeadingKeys condition key with the federated session's principal tag (${aws:PrincipalTag/TenantID}), IAM dynamically verifies that the user can only read or write items whose partition key matches their tenant ID. This enforces strict logical tenant isolation within a single DynamoDB table without managing individual credentials or multiple database tables.

Adım Adım Çözüm

1
Map the federated identity attributes to user tags in AWS STS when clients assume the role.
The tenant identifier is securely passed to the AWS session as a principal tag, accessible via the variable ${aws:PrincipalTag/TenantID}.
This establishes a dynamic session variable that uniquely and securely identifies the tenant context for each request.
2
Configure the DynamoDB table to use the tenant identifier as the partition key for all items.
Items belonging to a specific tenant are logically grouped under that tenant's partition key.
This structural requirement enables fine-grained access control using DynamoDB policy conditions.
3
Attach a policy to the application role with a condition statement that checks 'dynamodb:LeadingKeys' against '${aws:PrincipalTag/TenantID}'.
IAM dynamically enforces that any query, put, or delete operation on the DynamoDB table only targets partition keys matching the authenticated tenant tag.
This enforces the required isolation at the database level with minimal latency and no administrative overhead of managing separate users or credentials.

Anahtar Kavram

Fine-Grained Access Control in Amazon DynamoDB using IAM Policy Variables and Principal Tags
Tahmini Süre:2m 0s
Soru 168Soru →

A system administrator is reviewing the network access controls for a new application environment within an Amazon VPC. The administrator wants to ensure that the security groups and network access control lists (network ACLs) are configured correctly. Which TWO statements accurately describe the traffic-filtering behavior of these security components? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: A security group automatically permits outbound return traffic for any allowed inbound connection.; A network ACL requires a separate outbound rule to allow the return traffic of a permitted inbound connection.

Cevap

Security groups automatically permit outbound return traffic for any allowed inbound connection, and network ACLs require a separate outbound rule to allow the return traffic of a permitted inbound connection.
The correct options accurately describe that security groups automatically permit outbound return traffic for any allowed inbound connection due to their stateful nature, and network ACLs require a separate outbound rule to allow the return traffic of a permitted inbound connection because they are stateless.

Adım Adım Çözüm

1
Analyze security group connection tracking behavior.
Security groups are stateful. When traffic is permitted in one direction, the return traffic is automatically allowed.
This is a fundamental design feature of AWS security groups to simplify rule management for established connections.
2
Analyze network ACL connection tracking behavior.
Network ACLs are stateless. Each rule evaluates packets independently without keeping track of the connection state.
Because they are stateless, returning response packets require an explicit rule matching their port and destination to pass through.
3
Evaluate the remaining options regarding default configurations and association scopes.
Custom network ACLs deny all traffic by default, newly created security groups deny all inbound traffic by default, and network ACLs apply at the subnet level rather than the network interface level.
Correctly identifying these configurations avoids common misconceptions about AWS VPC network security default behaviors.

Anahtar Kavram

Stateful vs. stateless traffic filtering in Amazon VPC using Security Groups and Network ACLs
Tahmini Süre:1m 0s
Soru 169Soru →

An enterprise is deploying a payment processing engine on Amazon EC2 instances in Subnet A (CIDR 10.0.1.0/2410.0.1.0/24) of a VPC. The instances must query a database service exposed via an Interface VPC Endpoint located in Subnet B (CIDR 10.0.2.0/2410.0.2.0/24) within the same VPC. The database listens on TCP port 33063306. The network architecture mandates that Subnet A and Subnet B use custom, non-default Network Access Control Lists (NACLs). Which combination of Security Group (SG) and NACL configurations will allow successful communication while adhering to the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: For the EC2 instances SG: Outbound rule allowing TCP port 33063306 to the Interface Endpoint SG. For the Interface Endpoint SG: Inbound rule allowing TCP port 33063306 from the EC2 instances SG. For Subnet A NACL: Outbound rule allowing TCP port 33063306 to 10.0.2.0/2410.0.2.0/24, and Inbound rule allowing TCP ports 1024−655351024-65535 from 10.0.2.0/2410.0.2.0/24. For Subnet B NACL: Inbound rule allowing TCP port 33063306 from 10.0.1.0/2410.0.1.0/24, and Outbound rule allowing TCP ports 1024−655351024-65535 to 10.0.1.0/2410.0.1.0/24.

Cevap

The correct configuration uses stateful Security Groups targeting port 33063306 without reverse rules, and stateless Network ACLs that explicitly permit the request on port 33063306 and the response traffic on ephemeral ports 1024−655351024-65535 between the two subnet CIDRs.
Security Groups are stateful. When the EC2 instance initiates a connection to the database endpoint on port 33063306, the Security Group automatically allows the return traffic. Therefore, the EC2 Security Group only requires an outbound rule to the Endpoint Security Group, and the Endpoint Security Group only requires an inbound rule from the EC2 Security Group. Conversely, Network ACLs are stateless. Subnet A's NACL must explicitly allow the outbound request to Subnet B on port 33063306, and it must also allow the inbound return traffic from Subnet B on the ephemeral port range (1024−655351024-65535). Similarly, Subnet B's NACL must allow the inbound request on port 33063306 and the outbound return traffic to Subnet A on the ephemeral port range (1024−655351024-65535).

Adım Adım Çözüm

1
Configure the Security Groups for the initiating client and the receiving endpoint.
EC2 Security Group allows outbound TCP 33063306 to the Endpoint Security Group; Endpoint Security Group allows inbound TCP 33063306 from the EC2 Security Group.
Since Security Groups are stateful, return traffic is automatically allowed, meaning no inbound ephemeral rules are required on the client side, and no outbound rules are required on the endpoint side.
2
Configure the Network ACL rules for Subnet A (the EC2 client subnet).
Subnet A NACL allows outbound TCP 33063306 to the destination subnet CIDR (10.0.2.0/2410.0.2.0/24) and inbound TCP 1024−655351024-65535 (ephemeral ports) from the destination subnet CIDR.
Network ACLs are stateless, so the return packets sent from the database to the client's ephemeral ports must be explicitly permitted inbound.
3
Configure the Network ACL rules for Subnet B (the VPC Endpoint subnet).
Subnet B NACL allows inbound TCP 33063306 from the client subnet CIDR (10.0.1.0/2410.0.1.0/24) and outbound TCP 1024−655351024-65535 to the client subnet CIDR.
Because Network ACLs are stateless, the outbound response traffic returning to the client's ephemeral ports must be explicitly allowed outbound.

Anahtar Kavram

VPC Network Security: Stateful Security Groups vs. Stateless Network ACLs
Soru 170Soru →

A biopharmaceutical corporation is designing a hybrid cloud architecture to connect its on-premises Microsoft Active Directory domain with a newly deployed multi-account AWS environment managed via AWS Organizations. The corporation requires corporate employees to authenticate using their existing Active Directory credentials to access resources across all AWS accounts. The solution must minimize administrative overhead, avoid synchronizing or replicating user passwords to the cloud, and support centralized permission management.

Which combination of actions will meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy an AWS Directory Service AD Connector to connect to the on-premises Active Directory domain controllers.; Enable AWS IAM Identity Center in the Organizations management account and configure it to use the AD Connector directory as the identity source.

Cevap

Deploy an AWS Directory Service AD Connector to connect to the on-premises Active Directory, and enable AWS IAM Identity Center in the Organizations management account, configuring it to use the AD Connector directory as the identity source.
Deploying an AWS Directory Service AD Connector allows AWS to proxy authentication requests directly to the on-premises Active Directory domain controllers without replicating credentials to the cloud. Combining this with AWS IAM Identity Center provides centralized federation and access management across all AWS accounts in the organization, meeting all requirements with minimal administrative overhead.

Adım Adım Çözüm

1
Analyze the requirements for identity source and replication constraints.
The solution must authenticate against on-premises Active Directory without replicating password hashes or user credentials to AWS.
This rules out directory synchronization mechanisms and points to directory gateway or proxy solutions.
2
Select the appropriate directory integration service.
Choose AWS Directory Service AD Connector.
AD Connector acts as a proxy that redirects authentication requests to the on-premises domain controllers without storing or caching credentials.
3
Configure single sign-on access across the multi-account environment.
Enable AWS IAM Identity Center and bind it to the AD Connector.
IAM Identity Center integrates natively with AWS Organizations and AWS Directory Service, allowing centralized user access management with single sign-on capabilities.

Anahtar Kavram

Centralized hybrid identity federation using AWS Directory Service AD Connector and AWS IAM Identity Center
Soru 171Soru →

A company stores sensitive files in an Amazon S3 bucket encrypted with an AWS KMS Customer Managed Key. The security team wants to ensure that the key material is rotated automatically every year to comply with internal guidelines. Which of the following statements correctly describe the behavior and configuration of AWS KMS automatic key rotation? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS KMS automatically rotates the key material annually without requiring any changes to the application's key ARN or code.; Enabling automatic key rotation does not automatically re-encrypt historical data, and AWS KMS retains the older key material to decrypt existing data.

Cevap

AWS KMS automatically rotates the key material annually without requiring any changes to the application's key ARN or code, and enabling automatic key rotation does not automatically re-encrypt historical data, with AWS KMS retaining the older key material to decrypt existing data.
AWS KMS automatic key rotation manages key material lifecycle seamlessly. It automatically generates a new version of the key material annually without modifying the key ID or ARN, ensuring applications require no changes. Additionally, it preserves historical key material versions so that existing data encrypted under those versions can be decrypted without needing immediate re-encryption.

Adım Adım Çözüm

1
Identify the mechanics of AWS KMS customer managed key automatic rotation.
Understand that AWS KMS rotates key material once per year and maintains the key's metadata, including the ARN, unchanged.
This confirms that application configuration and code do not need to be updated.
2
Analyze how rotation affects existing historical data.
Recognize that rotation only applies to new data encryption; historical data remains encrypted with the old key material, which AWS KMS retains for decryption.
This establishes that existing data is not re-encrypted and old key versions are kept.

Anahtar Kavram

AWS KMS Automatic Key Rotation Mechanics
Soru 172Soru →

A company is migrating its internal resource scheduling application to AWS. The company's employees currently authenticate using an on-premises Active Directory. A solutions architect must design an access control solution that allows employees to sign in to the AWS Management Console using their existing corporate credentials, without introducing long-term AWS credentials or administrative overhead.

Which solution meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center and establish a SAML 2.0 identity federation between the on-premises Active Directory and AWS.

Cevap

Configure AWS IAM Identity Center and establish a SAML 2.0 identity federation between the on-premises Active Directory and AWS.
Establishing SAML 2.0 identity federation via AWS IAM Identity Center is the standard, secure, and recommended pattern for integrating an on-premises Active Directory with AWS. It allows employees to use their existing credentials to log in, and relies on AWS Security Token Service (STS) to generate temporary credentials, eliminating the need to manage static AWS IAM users and credentials.

Adım Adım Çözüm

1
Evaluate the requirement for corporate directory integration without long-term AWS credentials.
Identify SAML 2.0 identity federation as the standard mechanism to map external corporate directory identities to AWS temporary credentials.
Federation enables single sign-on (SSO) and relies on short-term STS credentials rather than permanent IAM user credentials.
2
Select the appropriate AWS service for centralized single sign-on and directory integration.
Identify AWS IAM Identity Center (formerly AWS Single Sign-On) as the modern and recommended service for this scenario.
IAM Identity Center integrates out-of-the-box with SAML 2.0 providers and manages access permissions across multiple accounts from a single location.
3
Eliminate options that use long-term IAM users or root account credentials.
Discard solutions proposing individual IAM users or root access keys as they increase security risk and management overhead.
These violate the principle of least privilege and fail to meet the constraint of avoiding long-term credentials.

Anahtar Kavram

AWS Directory Federation and IAM Identity Center
Soru 173Soru →

A financial services company hosts a payment processing application on Amazon EC2 instances in a private VPC subnet with the CIDR block 172.16.5.0/24172.16.5.0/24. The application must securely communicate with an on-premises hardware security module (HSM) on port 443443 via an AWS Site-to-Site VPN connection (on-premises network CIDR 192.168.10.0/24192.168.10.0/24). Additionally, the application must access the AWS Key Management Service (AWS KMS) via an Interface VPC Endpoint located at 172.16.5.50172.16.5.50 in the same subnet. The company enforces strict regulatory requirements: all external internet access is blocked, and Network ACLs (NACLs) must operate under a default-deny posture. Which of the following configurations are required to establish these network connections while adhering to the principle of least privilege and stateless inspection? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an outbound Network ACL rule for the EC2 subnet allowing TCP port 443443 to the destination CIDRs (192.168.10.0/24192.168.10.0/24 and 172.16.5.50/32172.16.5.50/32), and a corresponding inbound Network ACL rule allowing TCP ports 1024−655351024-65535 from these destinations.; Configure a Security Group associated with the EC2 instances with outbound rules allowing TCP port 443443 to the on-premises network CIDR (192.168.10.0/24192.168.10.0/24) and the Security Group of the KMS interface endpoint, with no inbound rules configured for return traffic.

Cevap

To establish secure connections under strict stateless controls, configure a Network ACL allowing outbound port 443 traffic to the destinations and inbound ephemeral port traffic (1024-65535) from them, and configure a stateful Security Group with outbound port 443 permissions without any inbound return rules.
Network ACLs are stateless, meaning both request and response paths must be explicitly defined; hence, an outbound rule for port 443 and an inbound rule for ephemeral return ports (1024-65535) are required. Security Groups are stateful, so allowing outbound port 443 to the destinations automatically permits the return response traffic without needing inbound rules.

Adım Adım Çözüm

1
Analyze Network ACL stateless behavior.
Determined that outbound traffic to the destinations requires an explicit rule on port 443, and the return traffic requires an inbound rule on ephemeral ports (1024-65535).
Network ACLs are stateless and do not automatically allow return traffic.
2
Analyze Security Group stateful behavior.
Determined that allowing outbound port 443 traffic to the destinations automatically permits response traffic, without needing inbound rules.
Security Groups are stateful and automatically track connections to allow return traffic.
3
Verify VPC routing rules for Interface Endpoints.
Confirmed that local routes in the route table handle Interface Endpoint traffic natively within the VPC.
VPC Interface Endpoints are hosted inside the VPC and do not rely on Virtual Private Gateways for routing.

Anahtar Kavram

VPC Network Security and Statefulness Comparison (Security Groups vs Network ACLs)
Tahmini Süre:2m 30s
Soru 174Soru →

A company is designing a secure multi-account architecture using AWS Organizations. The security team requires that all employee authentication be integrated with their existing enterprise Identity Provider (IdP) for centralized access control. Additionally, member account administrators must be prevented from disabling or deleting AWS CloudTrail resources.

Which solution should a Solutions Architect recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Enable AWS IAM Identity Center and configure it to federate with the external IdP. Apply a Service Control Policy (SCP) to the organization's root or organizational units (OUs) that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.

Cevap

Enable AWS IAM Identity Center and configure it to federate with the external IdP. Apply a Service Control Policy (SCP) to the organization's root or organizational units (OUs) that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.
The correct solution involves configuring AWS IAM Identity Center to federate authentication with the company's external Identity Provider (IdP). This provides a centralized single sign-on experience without manual creation of IAM users. To prevent member account administrators from disabling or deleting AWS CloudTrail, a Service Control Policy (SCP) must be applied at the organization's root or OU level. SCPs apply to all IAM users and roles in member accounts, including the root user of those accounts, ensuring compliance cannot be bypassed locally.

Adım Adım Çözüm

1
Establish centralized authentication with the external IdP using AWS IAM Identity Center.
Employees can authenticate using their existing enterprise directory credentials to access authorized AWS accounts.
Centralizing authentication reduces administrative overhead and eliminates the need to manage individual IAM users.
2
Write a Service Control Policy (SCP) that explicitly denies actions like cloudtrail:StopLogging and cloudtrail:DeleteTrail.
A policy document is created containing the explicit deny rule.
SCPs serve as permission guards that define the maximum permissions for member accounts.
3
Attach the Service Control Policy (SCP) to the organization's root or specific OUs containing the member accounts.
The restriction is enforced across all users and roles within the targeted member accounts, including account administrators.
This ensures that member account administrators cannot modify or disable AWS CloudTrail.

Anahtar Kavram

Multi-account governance using AWS Organizations and AWS IAM Identity Center federation.
Tahmini Süre:1m 30s
Soru 175Soru →

A financial auditing firm is deploying a reporting engine on Amazon EC2 instances in a private subnet (172.16.8.0/22172.16.8.0/22) within a VPC. The reporting engine must access compliance data stored in Amazon S3 and write audit results to Amazon DynamoDB. Additionally, the reporting engine must perform outbound HTTPS requests (port 443443) to an external regulatory API at `api.compliance-registry.org` to validate audit certificates. Company security policy mandates that all AWS service traffic must not traverse the public internet or NAT gateways, and data transfer costs must be minimized. Outbound internet egress must be strictly restricted to the regulatory API domain, and all other outbound traffic must be denied.

Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create Gateway VPC endpoints for Amazon S3 and Amazon DynamoDB, and associate them with the route table of the private subnet.; Route outbound internet traffic from the private subnet through an AWS Network Firewall deployed in a public subnet, and configure a stateful rule group with a domain list containing `api.compliance-registry.org`.

Cevap

Create Gateway VPC endpoints for Amazon S3 and Amazon DynamoDB, and route outbound internet traffic through an AWS Network Firewall with a stateful rule group allowing the regulatory API domain.
Gateway VPC endpoints are the most cost-effective and direct routing mechanism for S3 and DynamoDB because they do not incur hourly charges or data processing costs, unlike Interface endpoints. To restrict internet egress traffic to a specific domain name (FQDN), an AWS Network Firewall deployed in a public subnet with a stateful rule group using domain list filtering is required, as standard Security Groups and Network ACLs do not support filtering by hostnames.

Adım Adım Çözüm

1
Select the most cost-effective connection type to access AWS services privately.
Identify Gateway VPC endpoints as the optimal solution for Amazon S3 and Amazon DynamoDB traffic.
Gateway endpoints keep traffic within the AWS private network and are free, unlike Interface endpoints which charge hourly and data processing fees.
2
Evaluate subnet-level and instance-level security options for domain-specific filtering.
Recognize that Security Groups and Network ACLs cannot filter outbound traffic based on Fully Qualified Domain Names (FQDN).
Security groups and Network ACLs only support IP addresses and CIDR blocks, meaning they cannot resolve or restrict egress based on hostnames like `api.compliance-registry.org`.
3
Identify the service capable of domain list filtering.
Select AWS Network Firewall to filter outbound HTTP/HTTPS requests.
AWS Network Firewall provides stateful rule groups that allow domain name filtering to restrict outbound internet egress to specific allowed destinations.
4
Configure the private subnet routing table to direct traffic to the correct targets.
Associate S3 and DynamoDB routes with Gateway endpoints, and route default outbound traffic (0.0.0.0/00.0.0.0/0) to the AWS Network Firewall endpoint.
This setup separates internal AWS traffic from external compliance API traffic and enforces least-privilege egress controls.

Anahtar Kavram

VPC routing and endpoint configuration for private AWS service communication, combined with stateful domain-level egress filtering using AWS Network Firewall.
Soru 176Soru →

An application running on an Amazon EC2 instance in a development AWS account needs to securely access and read objects from an Amazon S3 bucket located in a separate production AWS account. The company's security policy strictly prohibits the use of long-term credentials and requires that all access logs identify the specific EC2 instance making the requests. Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In the production account, create an IAM role with a trust policy that allows the development account's EC2 instance IAM role to assume it.; In the development account, attach an IAM policy to the EC2 instance's IAM role that grants the sts:AssumeRole permission for the production account's role.

Cevap

To securely access the S3 bucket in a separate account without long-term credentials, create an IAM role in the production account that trusts the development EC2 instance role, and grant the EC2 instance role permission to assume that production role.
The correct solution involves setting up cross-account access using an IAM role. In the production account, an IAM role is created with a trust policy that allows the IAM role attached to the EC2 instance in the development account to assume it. In the development account, the EC2 instance role is granted permission to perform the sts:AssumeRole action on the production role. This approach ensures access is secure, temporary, and easily auditable.

Adım Adım Çözüm

1
Configure the IAM role in the target production account.
An IAM role is created in the production account with a trust policy allowing the development EC2 instance's IAM role to assume it, along with a permissions policy granting read access to the specific S3 bucket.
This defines who is trusted to access the production resources and what actions they can perform once authorized.
2
Configure the IAM role in the source development account.
An IAM role is attached to the EC2 instance as an instance profile, and its policy is updated to allow the sts:AssumeRole action targeting the ARN of the IAM role in the production account.
This authorizes the EC2 instance to request temporary credentials by assuming the trusted role in the production account.
3
Assume the role from the EC2 instance.
The application running on the EC2 instance calls the AWS Security Token Service (STS) to assume the production IAM role, receiving short-lived temporary security credentials to access the S3 bucket.
This satisfies the security requirement to use temporary credentials instead of long-term keys.

Anahtar Kavram

Cross-account access using IAM roles and STS AssumeRole.
Soru 177Soru →

A solutions architect is configuring network security controls for a new application within a VPC. The architect needs to understand the default behavior of the default security group and the default network access control list (NACL). Which of the following statements accurately describe the default configurations of these resources? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The default security group allows all inbound traffic originating from resources associated with that same security group.; The default network ACL allows all inbound and outbound traffic.

Cevap

The correct answers are the options stating that the default security group allows all inbound traffic from resources associated with the same security group, and that the default network ACL allows all inbound and outbound traffic.
The default security group is configured to allow inbound traffic only if it originates from resources that are associated with the same security group. All other inbound traffic is blocked. Meanwhile, the default network ACL is preconfigured to allow all inbound and outbound traffic, acting as a pass-through until custom rules are written.

Adım Adım Çözüm

1
Analyze security group default configuration rules.
The default security group allows all outbound traffic and allows inbound traffic only from resources associated with the same security group.
This establishes the baseline behavior for instances launched into the default security group.
2
Analyze network ACL default configuration rules.
The default network ACL allows all traffic to pass both inbound and outbound.
This ensures that subnets associated with the default NACL do not have traffic blocked until custom rules are defined.
3
Differentiate security group and network ACL characteristics.
Identify that security groups are stateful and operate at the interface level, while network ACLs are stateless and operate at the subnet level.
This filters out incorrect options that confuse statefulness and placement levels.

Anahtar Kavram

Default VPC Network Security Configurations
Soru 178Soru →

As a solutions architect, you are tasked with securing a gaming studio's environment within AWS Organizations. The security team wants to enforce a policy where no member accounts can disable GuardDuty, while ensuring the management account retains administrative control and is not restricted by this policy. Additionally, the studio wants to manage employee permissions centrally from an external identity provider without creating static credentials. Which combination of actions will meet these governance requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: Set up IAM Identity Center integrated with the external identity provider. Create an SCP that denies GuardDuty disabling actions and attach it to the organization's root.

Cevap

Set up IAM Identity Center integrated with the external identity provider, and create an SCP that denies GuardDuty disabling actions and attach it to the organization's root.
Integrating IAM Identity Center with an external identity provider enables native identity federation, satisfying the requirement to avoid static credentials. Creating an SCP that denies GuardDuty disabling actions and attaching it to the root of the organization enforces the security requirement on all member accounts. Because SCPs do not restrict permissions in the management account, administrative control is preserved without impacting the management account itself.

Adım Adım Çözüm

1
Integrate the external identity provider with IAM Identity Center to enable centralized federation without static access credentials.
Centralized, federated identity management is established across all AWS accounts.
This satisfies the requirement to manage employee permissions centrally from an external provider without using static access keys or credentials.
2
Create an SCP denying GuardDuty disablement actions (such as guardduty:DeleteDetector) and apply it at the organization's root.
All member accounts are restricted from disabling GuardDuty, while the management account remains unrestricted.
SCPs apply to all member accounts within an organization but do not apply to the management account itself, meeting both security and administrative requirements.

Anahtar Kavram

Centralized identity federation and multi-account policy governance using SCPs
Soru 179Soru →

A smart grid utility company operates a real-time energy telemetry API on AWS. The API is deployed on Amazon EC2 instances behind an Application Load Balancer (ALB). During grid fluctuations, the API suffers from coordinated Layer 7 HTTP flood attacks disguised as legitimate smart meter reporting traffic. The legitimate meter reports always target a specific URI path and include a custom header X-Meter-Token. The security team wants to mitigate these attacks at the edge before they reach the ALB, without blocking legitimate traffic or modifying the backend application code. Which solution meets these requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon CloudFront distribution in front of the ALB. Associate an AWS WAF web ACL with the CloudFront distribution. Configure an AWS WAF rate-based rule that limits requests targeting the API's URI path that do not contain the expected X-Meter-Token header. Restrict the ALB to accept traffic only from the CloudFront distribution.

Cevap

Deploy Amazon CloudFront in front of the ALB, associate an AWS WAF web ACL with the CloudFront distribution, use a rate-based rule to restrict requests missing the X-Meter-Token header, and restrict the ALB to accept traffic only from CloudFront.
Deploying Amazon CloudFront in front of the Application Load Balancer (ALB) and associating it with AWS WAF protects the application at the edge of the AWS network. Configuring an AWS WAF rate-based rule matching requests that target the API path and do not contain the custom X-Meter-Token header ensures that flood traffic is blocked before hitting the origin, while legitimate meter traffic remains unaffected. Restricting the ALB to accept traffic only from CloudFront ensures that attackers cannot bypass the edge protections.

Adım Adım Çözüm

1
Deploy Amazon CloudFront in front of the Application Load Balancer.
Establishes a global cache and edge networking front-end that can absorb large-scale infrastructure and application-layer traffic before it hits origin servers.
This is necessary to satisfy the security requirement of mitigating the DDoS attack at the edge of the network.
2
Create and associate an AWS WAF web ACL with the CloudFront distribution with a targeted rate-based rule.
Evaluates incoming requests at the CloudFront edge locations, applying rate-limiting specifically to traffic matching the API path that is missing the X-Meter-Token header.
This distinguishes legitimate meter traffic from the malicious HTTP flood and mitigates it automatically at the layer 7 level.
3
Restrict the ALB to only accept requests forwarded from the CloudFront distribution.
Ensures that clients cannot bypass CloudFront and AWS WAF protections by targeting the ALB public IP address directly.
To secure the origin and maintain edge-protection enforcement.

Anahtar Kavram

Deploying CloudFront with AWS WAF at the edge for Layer 7 DDoS mitigation and protecting the origin from direct access.
Tahmini Süre:2m 0s
Soru 180Soru →

An enterprise hosts a batch processing application on Amazon EC2 instances in a private VPC subnet. The application must securely upload large datasets to a specific Amazon S3 bucket within the same AWS Region. Security policy requires that all traffic to Amazon S3 must remain within the AWS network, and no other outbound internet access should be permitted from the EC2 instances. The architecture must minimize data transfer costs and administrative overhead. Which combination of actions should a solutions architect perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a Gateway VPC Endpoint for Amazon S3, associate it with the private subnet's route table, and apply an endpoint policy that restricts access to the organization's specific S3 bucket.; Configure the security group attached to the EC2 instances to allow outbound HTTPS traffic to the AWS-managed prefix list for Amazon S3, and remove the default rule allowing all outbound traffic (0.0.0.0/0).

Cevap

Create a Gateway VPC Endpoint for Amazon S3, associate it with the private subnet's route table, and apply an endpoint policy that restricts access to the organization's specific S3 bucket. Additionally, configure the security group attached to the EC2 instances to allow outbound HTTPS traffic to the AWS-managed prefix list for Amazon S3, and remove the default rule allowing all outbound traffic.
The correct strategy combines the creation of a Gateway VPC Endpoint for Amazon S3 with security group outbound rules. The Gateway Endpoint provides secure, private access to Amazon S3 at no additional cost and automatically handles routing updates. The endpoint policy secures S3 access by ensuring instances can only interact with the specified bucket. By configuring the EC2 security group to permit outbound HTTPS traffic only to the AWS-managed prefix list for S3 and removing the default open outbound rule, the instances are prevented from reaching any other public internet destinations.

Adım Adım Çözüm

1
Analyze the connectivity requirements.
The application needs access to Amazon S3 but must not have general outbound internet access.
This establishes the scope of VPC network security controls needed.
2
Select the most cost-effective and secure private connectivity option for Amazon S3.
A Gateway VPC Endpoint for Amazon S3 is chosen over an Interface VPC Endpoint because it is free of charge and automatically routes traffic using prefix lists in the subnet's route table.
Gateway endpoints are the standard, zero-cost method for connecting to S3 from within a VPC.
3
Enforce the security restriction for the specific S3 bucket.
Apply a VPC Endpoint policy to the Gateway VPC Endpoint that permits access only to the target S3 bucket.
VPC Endpoint policies allow fine-grained access control to AWS resources from within the VPC.
4
Restrict outbound traffic on the EC2 instances using security groups.
Modify the instance security group to allow outbound traffic on port 443 only to the AWS-managed prefix list for Amazon S3 (pl-xxxxxx) and delete the default 0.0.0.0/0 outbound rule.
This ensures the instances cannot connect to any other destinations on the public internet, satisfying the zero-internet egress security policy.

Anahtar Kavram

Combining S3 Gateway Endpoints with Security Group prefix list filtering allows secure, cost-effective, private resource access while preventing all other egress to the internet.
ÖncekiSayfa 9 / 22Sonraki
Design Secure Architectures Alıştırma Soruları — AWS Certified Solutions Architect - Associate — Sayfa 9 | Examkin