Examkin

Soru

Zorluk: ZorStrengthening Identity, Access, and Network Security

An enterprise is improving the security posture of an existing internal administration portal hosted in a Shared Services VPC. The application runs on Amazon EC2 instances behind an internal Application Load Balancer (ALB). Users access the portal from the on-premises network via an AWS Transit Gateway connected to an AWS Direct Connect gateway. Remote administrators must also access the portal, authenticating via an external OpenID Connect (OIDC) identity provider. The security team wants to prevent DNS exfiltration from the EC2 instances and ensure that remote administrator access is restricted to corporate-approved devices. Which of the following actions should the Solutions Architect recommend? (Select TWO.)

  1. Associate a Route 53 Resolver DNS Firewall rule group with the Shared Services VPC to block DNS queries for known exfiltration domains and non-approved external domains.Cevap
  2. Configure the internal ALB listener rule to authenticate remote administrators directly using OIDC with the external IdP, and configure the backend application to validate the authentication tokens and device claims.Cevap
  3. C
    Attach a Service Control Policy (SCP) to the Shared Services organizational unit (OU) that grants the sts:AssumeRoleWithWebIdentity API action to remote administrators, allowing them to bypass local IAM trust policy requirements.
  4. D
    Deploy AWS WAF on the internal ALB, placing a general allow rule for partner networks at priority 10, followed by specific block rules for unauthorized client IP ranges and SQL injection patterns at priority 20 and 30.
  5. E
    Configure the application to encrypt administrator session state files in an Amazon S3 bucket using the AWS-managed KMS key (aws/s3), and modify the bucket policy to delegate cross-account KMS decrypt permissions to the remote administrators' account.

Cevap

Associate a Route 53 Resolver DNS Firewall rule group with the Shared Services VPC to block DNS queries for known exfiltration domains, and configure the internal ALB listener rule to authenticate remote administrators directly using OIDC with the external IdP while verifying device claims in the application.
The correct actions are to associate a Route 53 Resolver DNS Firewall rule group with the Shared Services VPC to block DNS exfiltration and configure the Application Load Balancer (ALB) to perform OIDC authentication for remote administrators, passing the verified claims to the backend application. Route 53 Resolver DNS Firewall filters outbound DNS queries to block unauthorized domains, satisfying the network security requirement. ALB OIDC integration offloads federated authentication securely, allowing the application to enforce device compliance by checking the ID token claims.

Adım Adım Çözüm

1
Analyze the network layer requirement to prevent DNS-based data exfiltration from the private EC2 instances in the Shared Services VPC.
Route 53 Resolver DNS Firewall provides a native way to monitor and filter outbound DNS queries for VPC resources.
By blocking queries for non-approved or malicious domains, you prevent exfiltration channels that rely on DNS tunneling.
2
Evaluate the identity and access management requirements for remote administrators using OIDC.
ALB natively supports OIDC user authentication.
Offloading OIDC authentication to the ALB simplifies implementation, while verifying device claims in the application ensures only approved devices access the admin tool.
3
Identify and eliminate invalid configuration patterns from the other options.
Eliminate the option referencing SCP granting access, the option referencing invalid AWS WAF rule ordering, and the option referencing cross-account AWS-managed KMS key delegation.
SCPs cannot grant permissions, WAF rules evaluate sequentially (matching early allows bypasses blocks), and AWS-managed KMS key policies cannot be modified for cross-account delegation.

Anahtar Kavram

Strengthening network and identity security using Route 53 Resolver DNS Firewall, Application Load Balancer OIDC integration, and avoiding common misconfigurations in AWS SCPs, AWS WAF rule priorities, and KMS key types.
Bu soruyu puanla

Konular

Strengthening Identity, Access, and Network Security