Tüm alıştırma soruları

1964 soru

Tüm türler1,964 Çoktan seçmeli1,006 Çoklu seçim931 Sıralama27

An enterprise manages a multi-account AWS environment using AWS Organizations. The security team has established a centralized identity account containing a SAML 2.0 Identity Provider (IdP) integration. Users first authenticate via the IdP to assume a central broker role (`arn:aws:iam::111111111111:role/FederatedHubRole`) in the identity account. From this central hub, users must transition to target execution roles (e.g., `arn:aws:iam::222222222222:role/TargetExecutionRole`) in various member accounts to perform administrative tasks. During deployment, federated users receive an access denied error when attempting to assume the target execution roles in the member accounts. Which configuration of the target execution role's trust policy will resolve the access issues and permit users to access resources in the member accounts?

Configure the trust policy of the target execution role to trust the SAML identity provider created in the member account, specifying the `sts:AssumeRoleWithSAML` action.

Attach a Service Control Policy (SCP) to the member account's Organizational Unit that permits the central broker role to perform actions, which implicitly grants trust across accounts without updating the target role's trust policy.

Configure the trust policy of the target execution role to trust the ARN of the central broker role in the identity account, specifying the `sts:AssumeRole` action.

Configure the trust policy of the target execution role to trust the identity account's SAML provider ARN, specifying the `sts:AssumeRole` action.

Cevabı ve açıklamayı göster

Cevap: Configure the trust policy of the target execution role to trust the ARN of the central broker role in the identity account, specifying the `sts:AssumeRole` action.

Cevap

Configure the trust policy of the target execution role to trust the ARN of the central broker role in the identity account, specifying the `sts:AssumeRole` action.

The correct option correctly identifies that the scenario involves role chaining. When a user first federated into the central broker role, their identity is established as an assumed role session within AWS. When they attempt to assume a target role in a member account, the request is signed by the broker role's temporary credentials. Therefore, the target execution role's trust policy must trust the broker role's ARN and specify the `sts:AssumeRole` action.

Adım Adım Çözüm

Analyze the access pattern to determine the principal making the request to the target execution role.

The federated user first assumes the broker role in the identity account. At this point, they are using temporary IAM credentials associated with that role session. The request to assume the target role in the member account originates from this role, not directly from the SAML IdP.

Understanding the caller's identity is critical for defining the correct trust relationship principal.

Select the appropriate AWS STS API action for the trust policy.

Because the caller is an IAM role principal using temporary AWS security credentials, the standard cross-account role assumption API (`sts:AssumeRole`) must be used.

Actions like `sts:AssumeRoleWithSAML` require an active SAML assertion, which is not present when performing cross-account role chaining.

Configure the trust policy on the target execution role in the member account.

Update the trust policy's `Principal` block to point to the central broker role (`arn:aws:iam::111111111111:role/FederatedHubRole`) and set the `Action` to `sts:AssumeRole`.

This establishes the necessary trust relationship allowing the identity account's broker role to assume the target role in the member account.

Anahtar Kavram

Role Chaining in Multi-Account AWS Environments

Soru 502Soru →

A global logistics company is migrating its supply chain management systems to AWS. The company is using AWS Organizations to manage a multi-account environment. A central Shared Services account contains a VPC connected to the on-premises corporate network via AWS Transit Gateway and AWS Direct Connect. The Shared Services account hosts a Route 53 Private Hosted Zone (PHZ) for corp.internal containing service endpoints. A Production account and a Development account each have a VPC connected to the Transit Gateway. The on-premises network uses the domain onprem.internal for its internal DNS. The solutions architect must design a hybrid DNS solution that allows EC2 instances in the Production and Development VPCs to resolve hosts in both corp.internal and onprem.internal, and on-premises client machines to resolve hosts in corp.internal. The architecture must minimize cost by avoiding redundant endpoints, and must scale as new VPCs are added to the organization. Which of the following strategies should the solutions architect implement to achieve these requirements?

Configure Route 53 Resolver Inbound Endpoints in the Shared Services VPC. Configure the on-premises DNS servers to forward queries for corp.internal to the Inbound Endpoint IP addresses. Create a Route 53 Resolver Outbound Endpoint in the Shared Services VPC and a Resolver forwarding rule for onprem.internal pointing to the on-premises DNS servers. Share the Resolver rule with the AWS Organization using AWS Resource Access Manager (RAM), and associate the rule with the Shared Services, Production, and Development VPCs. Authorize the association of the corp.internal Private Hosted Zone with the Production and Development VPCs from the Shared Services account, and perform the associations from the Production and Development accounts.

Configure Route 53 Resolver Inbound Endpoints in the Shared Services VPC. Configure the on-premises DNS servers to forward queries for corp.internal to the Inbound Endpoint IP addresses. Create a Route 53 Resolver Outbound Endpoint in the Shared Services VPC and a Resolver forwarding rule for onprem.internal pointing to the on-premises DNS servers. Share the Resolver rule and the corp.internal Private Hosted Zone with the AWS Organization using AWS Resource Access Manager (RAM), and associate both the rule and the hosted zone with all VPCs.

Configure Route 53 Resolver Inbound Endpoints in the Shared Services VPC. Configure the on-premises DNS servers to forward queries for corp.internal to the Inbound Endpoint IP addresses. Create a Route 53 Resolver Outbound Endpoint in the Shared Services VPC and a Resolver forwarding rule for onprem.internal pointing to the on-premises DNS servers. Share the Resolver rule with the AWS Organization using AWS Resource Access Manager (RAM), and associate it with all VPCs. In the Production and Development accounts, use the Route 53 console to associate the Production and Development VPCs directly with the corp.internal Private Hosted Zone hosted in the Shared Services account.

Configure Route 53 Resolver Inbound and Outbound Endpoints in all VPCs (Shared Services, Production, and Development). Create Resolver forwarding rules for onprem.internal in each account pointing to the on-premises DNS servers, routing the DNS queries over the Direct Connect Gateway's public IP address directly to bypass the Transit Gateway.

Cevabı ve açıklamayı göster

Cevap: Configure Route 53 Resolver Inbound Endpoints in the Shared Services VPC. Configure the on-premises DNS servers to forward queries for corp.internal to the Inbound Endpoint IP addresses. Create a Route 53 Resolver Outbound Endpoint in the Shared Services VPC and a Resolver forwarding rule for onprem.internal pointing to the on-premises DNS servers. Share the Resolver rule with the AWS Organization using AWS Resource Access Manager (RAM), and associate the rule with the Shared Services, Production, and Development VPCs. Authorize the association of the corp.internal Private Hosted Zone with the Production and Development VPCs from the Shared Services account, and perform the associations from the Production and Development accounts.

Cevap

Configure Route 53 Resolver Inbound Endpoints in the Shared Services VPC for on-premises resolution, use Route 53 Resolver Outbound Endpoints in the Shared Services VPC with forwarding rules shared via AWS RAM for on-premises domains, and authorize and associate the corp.internal Private Hosted Zone directly with the Production and Development VPCs.

The correct strategy involves setting up Route 53 Resolver Inbound Endpoints in the Shared Services VPC so that on-premises DNS servers can forward queries for corp.internal. For outbound queries to on-premises DNS, a central Outbound Endpoint is created in the Shared Services VPC, and a forwarding rule for onprem.internal is shared across the organization via AWS Resource Access Manager (RAM). To allow the Production and Development VPCs to resolve corp.internal directly without routing through resolver endpoints, the Private Hosted Zone must be associated with those VPCs. This requires authorization from the Shared Services account and association from the target accounts.

Adım Adım Çözüm

Set up Route 53 Resolver Inbound Endpoints in the Shared Services VPC and configure on-premises DNS servers to forward queries for corp.internal to the inbound endpoint IPs.

On-premises clients can now resolve corp.internal DNS records over the AWS Direct Connect connection.

This establishes inbound name resolution from the local data center to AWS.

Set up a Route 53 Resolver Outbound Endpoint in the Shared Services VPC and create a forwarding rule for onprem.internal pointing to on-premises DNS servers. Share the rule with the AWS Organization via AWS Resource Access Manager (RAM).

The forwarding rule becomes available to all member accounts in the organization.

Sharing the rule via RAM allows other VPCs to utilize the Shared Services Outbound Endpoint without needing to provision their own, reducing costs.

Associate the shared forwarding rule with the Shared Services, Production, and Development VPCs.

EC2 instances in all three VPCs can now resolve onprem.internal resources.

VPC association is required for the Route 53 Resolver to evaluate and apply the rule to queries originating in those VPCs.

In the Shared Services account, authorize the association of the corp.internal Private Hosted Zone with the Production and Development VPCs using the AWS CLI or SDK. In the Production and Development accounts, associate the VPCs with the hosted zone.

The corp.internal Private Hosted Zone is associated with the Production and Development VPCs.

This allows instances in the Production and Development VPCs to resolve corp.internal directly using the local Route 53 Resolver, eliminating the need to query across accounts via resolver endpoints.

Anahtar Kavram

Multi-Account and Hybrid DNS Architecture Strategy using Route 53 Resolver and cross-account Private Hosted Zone association.

Tahmini Süre:2m 30s

Soru 503Soru →

A company is setting up a multi-account environment using AWS Organizations. The cloud engineering team wants to allow developers in various member accounts to launch Amazon EC2 instances into a set of pre-defined private subnets located in a central VPC. To simplify administration and maintain control over IP address allocation, the team wants to share these subnets directly without creating separate VPCs or peering connections. Which approach should the solutions architect recommend to share these subnets with the member accounts?

Enable resource sharing within AWS Organizations in the AWS Resource Access Manager (RAM) settings, create a resource share for the subnets, and share them with the target member accounts or Organizational Units.

Create a resource share in AWS Resource Access Manager (RAM) for the subnets and share them with the member accounts directly, without enabling the setting to share with AWS Organizations.

Attach a Service Control Policy (SCP) to the target Organizational Units that grants access to the central subnets, allowing member accounts to launch instances directly.

Share the subnets using AWS Resource Access Manager (RAM), and use the default AWS-managed KMS key in the member accounts to encrypt EBS volumes launched in those subnets.

Cevabı ve açıklamayı göster

Cevap: Enable resource sharing within AWS Organizations in the AWS Resource Access Manager (RAM) settings, create a resource share for the subnets, and share them with the target member accounts or Organizational Units.

Cevap

The correct strategy is to enable resource sharing within AWS Organizations in the AWS Resource Access Manager (RAM) settings, create a resource share for the subnets, and share them with the target member accounts or Organizational Units. This allows participant accounts to deploy resources like EC2 instances directly into the owner's subnets.

Adım Adım Çözüm

Enable sharing within AWS Organizations in the AWS Resource Access Manager (RAM) settings console.

Enables seamless sharing with accounts, Organizational Units (OUs), or the entire organization.

This is required to allow RAM to distribute resource shares across the organization without manual invitation handshakes.

Create a new resource share in AWS RAM, specifying VPC subnets as the resource type.

The target subnets are packaged into a reusable resource share.

AWS RAM requires grouping shareable resources into a resource share package.

Associate the resource share with the target Organizational Units (OUs) or member account IDs.

The subnets become available in the participant accounts' EC2 launch consoles and APIs.

This associates the target consumers with the shared resources.

Anahtar Kavram

AWS Resource Access Manager (RAM) VPC Subnet Sharing

Soru 504Soru →

A financial services organization is consolidating its infrastructure under AWS Organizations with consolidated billing enabled. To streamline operations and minimize costs, the infrastructure team wants to implement a shared VPC model where a centralized network account hosts and shares subnets with individual application accounts. The application accounts run various containerized and serverless workloads on Amazon EC2, AWS Fargate, and AWS Lambda. Additionally, the compliance team requires that AWS CloudTrail logs from all member accounts be written to a single Amazon S3 bucket in a dedicated security audit account, encrypted using keys that support cross-account sharing and customized key rotation schedules.

Which TWO actions should the Solutions Architect take to meet these requirements?

Geçerli olan tümünü seçin

Enable resource sharing within AWS Organizations from the management account. In the Network account, create a resource share using AWS Resource Access Manager (RAM), add the subnets, and share them with the entire organization. Purchase Compute Savings Plans in the Organizations management account to automatically apply discounts to the EC2, Fargate, and Lambda workloads across all member accounts.

In the Network account, create an AWS Resource Access Manager (RAM) resource share for the subnets and share them individually with each member account's

12

-digit AWS account ID. Purchase EC2 Instance Savings Plans in the Organizations management account to optimize compute costs for the EC2, Fargate, and Lambda workloads in all member accounts.

In the security audit account, configure the S3 bucket policy to allow the AWS CloudTrail service principal (cloudtrail.amazonaws.com) to write logs, using a condition key that restricts access to the organization's ID. Use Customer Managed Keys (CMKs) to encrypt the CloudTrail logs and other shared resources, configuring key policies to permit cross-account usage.

Attach a Service Control Policy (SCP) at the root of the organization that explicitly grants s3:PutObject permissions to the CloudTrail service principal for the centralized S3 bucket. Encrypt the central S3 bucket using the AWS-managed key aws/s3 to automatically handle decryption and logging permissions across all member accounts without modifying key policies.

In the security audit account, configure the central S3 bucket policy to grant write access to the root principal of each member account, relying on the member accounts' local IAM policies to delegate write permissions to the CloudTrail service. Encrypt the bucket using the default AWS-managed KMS key aws/s3 to avoid the overhead of managing custom key policies.

Cevabı ve açıklamayı göster

Cevap: Enable resource sharing within AWS Organizations from the management account. In the Network account, create a resource share using AWS Resource Access Manager (RAM), add the subnets, and share them with the entire organization. Purchase Compute Savings Plans in the Organizations management account to automatically apply discounts to the EC2, Fargate, and Lambda workloads across all member accounts.; In the security audit account, configure the S3 bucket policy to allow the AWS CloudTrail service principal (cloudtrail.amazonaws.com) to write logs, using a condition key that restricts access to the organization's ID. Use Customer Managed Keys (CMKs) to encrypt the CloudTrail logs and other shared resources, configuring key policies to permit cross-account usage.

Cevap

Enable resource sharing within AWS Organizations from the management account, share the subnets using AWS RAM with the organization, purchase Compute Savings Plans in the management account, configure the centralized S3 bucket policy to allow the CloudTrail service principal with an organization ID condition, and use Customer Managed Keys (CMKs) for encryption.

To share VPC subnets across an organization using AWS Resource Access Manager (RAM), sharing must first be enabled within the AWS Organizations management account. Once enabled, the network account can share subnets with the entire organization or specific OUs without requiring individual resource invitations. To cover a combination of EC2, Fargate, and Lambda workloads with a single cost-optimization instrument, Compute Savings Plans must be purchased in the management account, where consolidated billing allows the savings to apply across all member accounts. For cross-account resources and centralized CloudTrail logging, Customer Managed Keys (CMKs) must be used because AWS-managed keys (like aws/s3 or aws/ebs) cannot be shared across accounts or have their key policies modified. The central S3 bucket policy must grant write permissions to the CloudTrail service principal (cloudtrail.amazonaws.com) with a condition restricting access to the specific AWS Organization ID to ensure secure, automated log delivery.

Adım Adım Çözüm

Determine the appropriate resource sharing model for the subnets across the organization.

Enable RAM sharing in the AWS Organizations management account and share the subnets from the Network account to the Organization.

This permits subnet sharing across all member accounts without sending or accepting individual resource invitations.

Identify the correct Savings Plan type to optimize the compute workloads.

Select and purchase Compute Savings Plans in the consolidated billing management account.

Compute Savings Plans cover Amazon EC2, AWS Fargate, and AWS Lambda workloads, whereas EC2 Instance Savings Plans only cover EC2.

Design the centralized logging and cross-account encryption strategy.

Configure a centralized S3 bucket policy to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to write logs, restricted by the organization ID, and use Customer Managed Keys (CMKs) for encryption.

AWS-managed KMS keys cannot have their policies modified for cross-account access, making Customer Managed Keys necessary for cross-account resource encryption and logging.

Anahtar Kavram

Multi-account resource sharing, centralized billing cost optimization, and secure cross-account logging integration.

Soru 505Soru →

A multinational enterprise manages a multi-account environment under AWS Organizations with all features enabled. The architecture includes a management account, a centralized shared services account, and multiple member accounts allocated to external clients. The enterprise wants to implement the following requirements:

* Provide a customized chargeback billing view to specific client accounts. The clients must see a consolidated invoice showing a flat $10\%$ markup on all Amazon EC2 and Amazon RDS resources, while ensuring that enterprise-level Savings Plans and Reserved Instance (RI) discounts applied at the management account are not visible or shared with these client accounts.
* Share a centralized AWS Glue Data Catalog located in the shared services account with the client accounts so they can perform cross-account Amazon Athena queries without duplicating catalog metadata. This resource sharing must be restricted strictly to the enterprise's AWS Organization.
* Purchase a Savings Plan that provides the maximum discount coverage for client workloads running on a mix of Amazon EC2 instances, AWS Lambda, and AWS Fargate on Amazon EKS.

Which combination of actions will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

In AWS Billing Conductor in the management account, create a billing group containing the client accounts. Configure the billing group settings to exclude Savings Plans and Reserved Instance discount sharing. Create a pricing rule with a

10\%

markup for the Amazon EC2 and Amazon RDS services, and associate the rule with the billing group.

In the AWS Billing Conductor console in the management account, create a billing group for the client accounts. Purchase EC2 Instance Savings Plans in the client accounts directly. Define an AWS Cost Category with a rule that applies a

10\%

chargeback tax to all services, and write a Service Control Policy (SCP) to block access to the Billing Dashboard for the client accounts.

Enable resource sharing in the AWS Organizations management account. In AWS Resource Access Manager (RAM) in the shared services account, create a resource share for the AWS Glue Catalog databases and tables, and associate it with the client accounts or their Organizational Unit (OU). In the management account, purchase Compute Savings Plans to cover the compute consumption across all accounts.

In AWS Resource Access Manager (RAM) in the shared services account, create a resource share for the AWS Glue Data Catalog, enabling sharing with external entities. In the management account, purchase EC2 Instance Savings Plans to cover the EC2, Fargate, and Lambda workloads across the organization.

Cevabı ve açıklamayı göster

Cevap: In AWS Billing Conductor in the management account, create a billing group containing the client accounts. Configure the billing group settings to exclude Savings Plans and Reserved Instance discount sharing. Create a pricing rule with a $10\%$ markup for the Amazon EC2 and Amazon RDS services, and associate the rule with the billing group.; Enable resource sharing in the AWS Organizations management account. In AWS Resource Access Manager (RAM) in the shared services account, create a resource share for the AWS Glue Catalog databases and tables, and associate it with the client accounts or their Organizational Unit (OU). In the management account, purchase Compute Savings Plans to cover the compute consumption across all accounts.

Cevap

To meet the requirements, the enterprise must create a billing group in AWS Billing Conductor containing the client accounts, disable discount sharing, and apply a custom pricing rule with a

10\%

markup on EC2 and RDS. Additionally, the enterprise must enable resource sharing in AWS Organizations, share the AWS Glue databases and tables using AWS Resource Access Manager, and purchase Compute Savings Plans to cover EC2, Lambda, and Fargate workloads.

AWS Billing Conductor allows solutions architects to group member accounts, disable discount sharing, and apply custom pricing rules (such as a

10\%

markup) to present a customized pro forma invoice. Enabling resource sharing within AWS Organizations allows AWS RAM to share Glue databases and tables with member accounts or OUs seamlessly. Compute Savings Plans provide the necessary flexibility to apply discount coverage across EC2, Lambda, and Fargate compute resources.

Adım Adım Çözüm

Configure billing group and pricing rules in AWS Billing Conductor

Disables Savings Plans and Reserved Instance discount sharing for client accounts and applies a

10\%

markup on EC2 and RDS.

Ensures that the client accounts receive a customized consolidated bill showing marked-up pricing without seeing management account discounts.

Enable sharing in AWS Organizations and create resource share in AWS RAM

Allows cross-account sharing of the AWS Glue Data Catalog databases and tables restricted to the AWS Organization.

Enables client accounts to query metadata using Amazon Athena without duplicating databases or accepting external invitations.

Evaluate and purchase the correct Savings Plan type

Purchase Compute Savings Plans in the management account.

Compute Savings Plans provide discount coverage for all targeted compute types, including Amazon EC2, AWS Lambda, and EKS Fargate, whereas EC2 Instance Savings Plans do not cover Lambda or Fargate.

Anahtar Kavram

AWS Billing Conductor custom pricing and discount isolation, AWS Organizations integrated Resource Access Manager (RAM) sharing, and Compute Savings Plan scope.

Soru 506Soru →

A retail company is migrating its regional store inventory management system to AWS. The architecture requires connecting $12$ spoke VPCs, each owned by a different AWS account within the same AWS Organization, to a shared on-premises system. A Solutions Architect plans to deploy AWS Transit Gateway in a dedicated network hub account.

Which TWO configurations must the architect perform to establish basic multi-account network connectivity between the spoke VPCs and the shared Transit Gateway? (Select TWO.)

Geçerli olan tümünü seçin

Create the Transit Gateway in the dedicated network hub account, and use AWS Resource Access Manager (RAM) to share the gateway with the AWS Organization.

In each spoke account, create a Transit Gateway VPC attachment for the local VPC targeting the shared Transit Gateway.

Establish VPC Peering connections between all spoke VPCs to allow transitive traffic to traverse a central Virtual Private Gateway.

Deploy a single NAT Gateway in a shared services VPC and route all inter-VPC traffic through it to perform network address translation.

Associate a centralized Route 53 Private Hosted Zone directly with the Transit Gateway to manage cross-VPC IP address routing.

Cevabı ve açıklamayı göster

Cevap: Create the Transit Gateway in the dedicated network hub account, and use AWS Resource Access Manager (RAM) to share the gateway with the AWS Organization.; In each spoke account, create a Transit Gateway VPC attachment for the local VPC targeting the shared Transit Gateway.

Cevap

The correct configurations are sharing the Transit Gateway using AWS Resource Access Manager (RAM) from the hub account, and creating Transit Gateway VPC attachments in each spoke account.

To connect VPCs across multiple AWS accounts to a centralized Transit Gateway, the gateway must be created in a central account and shared with the member accounts using AWS Resource Access Manager (RAM). Once shared, each spoke account must create a Transit Gateway VPC attachment to link its VPC to the Transit Gateway, enabling hub-and-spoke traffic flow.

Adım Adım Çözüm

Identify the mechanism to share network resources across multiple AWS accounts within an AWS Organization.

AWS Resource Access Manager (RAM) is selected to share the Transit Gateway from the hub account.

Resources like Transit Gateways cannot be accessed across account boundaries unless shared via AWS RAM.

Identify how to link individual spoke VPCs to the shared Transit Gateway.

Create Transit Gateway VPC attachments in each spoke account pointing to the shared gateway.

An attachment creates the network interface required for the Transit Gateway to route packets into and out of the VPC.

Anahtar Kavram

Multi-account network connectivity using AWS Transit Gateway shared via AWS Resource Access Manager (RAM).

Soru 507Soru →

A company has four VPCs across multiple AWS accounts in the same AWS Region. They need to design a network architecture that allows all VPCs to communicate with each other and also connect to their on-premises data center using a single existing AWS Direct Connect connection. Which of the following architectures meets these requirements with the least operational complexity?

Deploy an AWS Transit Gateway, attach all four VPCs to it, and associate the Transit Gateway with a Direct Connect Gateway connected to the Direct Connect connection.

Attach a Virtual Private Gateway to each VPC, associate them all directly with a single Direct Connect Gateway, and configure routing policies on the Direct Connect Gateway to enable VPC-to-VPC communication.

Establish VPC peering connections between all VPCs to handle inter-VPC traffic, and deploy a single NAT Gateway in one VPC to route all traffic to the on-premises data center.

Create a Route 53 Private Hosted Zone for each VPC, associate them across accounts, and configure a public virtual interface on the Direct Connect connection to route all internal VPC-to-VPC traffic.

Cevabı ve açıklamayı göster

Cevap: Deploy an AWS Transit Gateway, attach all four VPCs to it, and associate the Transit Gateway with a Direct Connect Gateway connected to the Direct Connect connection.

Cevap

Deploy an AWS Transit Gateway, attach all four VPCs to it, and associate the Transit Gateway with a Direct Connect Gateway connected to the Direct Connect connection.

Deploying an AWS Transit Gateway as a central hub allows for transitive routing between all attached VPCs and the on-premises network via a Direct Connect Gateway association. This hub-and-spoke model simplifies routing management, reduces operational overhead, and scales easily as the network grows.

Adım Adım Çözüm

Analyze the connectivity requirements: VPC-to-VPC communication and VPC-to-on-premises communication using a single Direct Connect connection.

The design must support transitive routing between multiple VPCs and connect to the hybrid network.

Ensures all communication paths are addressed.

Evaluate AWS Transit Gateway as a centralized hub.

Transit Gateway natively supports transitive routing, allowing attached VPCs to communicate with one another.

Simplifies multi-VPC routing configurations.

Determine how to connect Transit Gateway to the on-premises environment using Direct Connect.

Associate the Transit Gateway with a Direct Connect Gateway, which connects to the on-premises network via a transit virtual interface (transit VIF).

Allows all VPCs attached to the Transit Gateway to share the same Direct Connect connection.

Anahtar Kavram

AWS Transit Gateway simplifies hybrid and multi-account network topology by acting as a cloud router that supports transitive routing between VPCs and integrates with Direct Connect Gateway.

Soru 508Soru →

An enterprise is implementing a federated identity solution using an external SAML 2.0 compliant identity provider (IdP) to grant database administrators single sign-on access to Amazon RDS databases across multiple member accounts in AWS Organizations. The solutions architect has configured the SAML identity provider entity in each AWS account. However, during initial testing, users attempting to federate from the IdP dashboard receive an access denied error before they can choose a role. Which configuration step must the solutions architect perform to resolve this authentication error?

Configure the trust policy of the IAM role in each target account to trust the SAML identity provider principal and allow the sts:AssumeRoleWithSAML action, and ensure the IdP is configured to send the required SAML attributes.

Modify the trust policy of the IAM role in each target account to trust the external IdP domain and allow the sts:AssumeRole action, and map the user groups to target role ARNs directly inside the IAM console.

Deploy a Service Control Policy (SCP) at the root of the AWS Organization that permits the sts:AssumeRoleWithSAML action for all member accounts, and remove trust policies from the local IAM roles to simplify configuration.

Configure the external IdP to call the sts:AssumeRoleWithWebIdentity API, and register the IdP as an OpenID Connect (OIDC) provider in each of the member accounts.

Cevabı ve açıklamayı göster

Cevap: Configure the trust policy of the IAM role in each target account to trust the SAML identity provider principal and allow the sts:AssumeRoleWithSAML action, and ensure the IdP is configured to send the required SAML attributes.

Cevap

The correct answer correctly specifies the configuration requirements for SAML 2.0 federation in AWS. A successful SAML assertion authentication relies on a trust relationship defined in the IAM role that trusts the SAML provider principal and allows the 'sts:AssumeRoleWithSAML' action. Additionally, the IdP must be configured to pass the mandatory SAML attributes ('Role' and 'RoleSessionName') so AWS can map the user session to the appropriate IAM role.

Adım Adım Çözüm

Analyze the authentication protocol and federation requirements.

The identity provider uses SAML 2.0, requiring the SAML assertion to match AWS IAM SAML requirements.

Identifying the federation protocol ensures selection of the correct AWS Security Token Service (STS) action and trust principal.

Configure the trust policy of the target IAM role.

The trust policy is updated to set the SAML provider ARN as the Principal and permit the 'sts:AssumeRoleWithSAML' action.

This establishes the cryptographic trust relationship between the AWS account and the external SAML IdP.

Verify and configure SAML attributes in the IdP.

The IdP is configured to send 'https://aws.amazon.com/SAML/Attributes/Role' and 'https://aws.amazon.com/SAML/Attributes/RoleSessionName' in the assertion.

AWS STS requires these specific claims to determine which IAM role the user is authorized to assume and to identify the session.

Anahtar Kavram

SAML 2.0 Federation Trust Configuration

Soru 509Soru →

An enterprise manages its multi-account environment using AWS Organizations. The structure consists of a Management account, a Security organizational unit (OU) containing a Security Audit account, and several workload OUs containing production and development accounts. The security team designates the Security Audit account as the delegated administrator for Amazon GuardDuty and AWS Security Hub. The team requires that member accounts in the workload OUs must be prevented from disabling GuardDuty or Security Hub, and any new accounts created in or moved to these OUs must have these services enabled automatically. However, the Security Audit account must maintain the ability to configure, update, and disable these services across all member accounts for troubleshooting purposes. Which strategy meets these requirements with the least operational overhead?

Enable GuardDuty and Security Hub in each member account locally. Configure an IAM permission boundary in the Management account that denies modification of GuardDuty and Security Hub, and require all member accounts to apply this boundary to all local IAM users and roles. Manage these services by having the Security Audit account assume a cross-account IAM role in each member account.

Register the Security Audit account as the delegated administrator for GuardDuty and Security Hub from the Management account. Attach a Service Control Policy (SCP) to the Root OU that denies all guardduty:* and securityhub:* actions. In the workload accounts, configure local IAM policies to explicitly allow these actions only for roles assumed by the Security Audit account.

Register the Security Audit account as the delegated administrator for GuardDuty and Security Hub from the Management account. Enable auto-enable for new accounts within GuardDuty and Security Hub from the Security Audit account. Attach a Service Control Policy (SCP) to the workload OUs that denies guardduty:DeleteDetector, guardduty:UpdateDetector, securityhub:DisableSecurityHub, and securityhub:UpdateStandardsControl, with a condition block that excludes the Security Audit account and the Management account using the aws:PrincipalAccount key.

Register the Security Audit account as the delegated administrator for GuardDuty and Security Hub from the Management account. Attach a Service Control Policy (SCP) to the workload OUs that denies guardduty:DeleteDetector, guardduty:UpdateDetector, securityhub:DisableSecurityHub, and securityhub:UpdateStandardsControl. Deploy a custom AWS Config rule and AWS Lambda function in the Security Audit account to automatically detect and remediate any unauthorized changes.

Cevabı ve açıklamayı göster

Cevap: Register the Security Audit account as the delegated administrator for GuardDuty and Security Hub from the Management account. Enable auto-enable for new accounts within GuardDuty and Security Hub from the Security Audit account. Attach a Service Control Policy (SCP) to the workload OUs that denies guardduty:DeleteDetector, guardduty:UpdateDetector, securityhub:DisableSecurityHub, and securityhub:UpdateStandardsControl, with a condition block that excludes the Security Audit account and the Management account using the aws:PrincipalAccount key.

Cevap

Register the Security Audit account as the delegated administrator for GuardDuty and Security Hub from the Management account, enable auto-enable for new accounts from the Security Audit account, and attach an SCP to the workload OUs denying modifications to these services with a condition excluding the Security Audit and Management accounts using the aws:PrincipalAccount key.

Delegating administration to the Security Audit account enables central control, while enabling auto-enable ensures new accounts are immediately protected. The SCP attached to the workload OUs prevents local administrators from altering GuardDuty or Security Hub configurations. Crucially, the condition block using the aws:PrincipalAccount key ensures that the SCP restrictions do not apply to calls made by the Security Audit account or the Management account, allowing them to manage the services successfully.

Adım Adım Çözüm

The Security Audit account is designated as the delegated administrator for Amazon GuardDuty and AWS Security Hub, allowing central management of these services across the organization.

This establishes centralized operations and satisfies the requirement that the Security Audit account maintains administrative control.

Configure auto-enable settings.

From the Security Audit account, enable the auto-enable configuration for GuardDuty and Security Hub for all current and future member accounts.

This automates security enablement for new accounts without manual intervention.

Create and attach the SCP with conditions.

Attach an SCP to the workload OUs that denies disable and update actions for GuardDuty and Security Hub, but includes a condition block checking that the calling principal's account ID does not match the Security Audit account or the Management account.

This acts as a preventive guardrail that stops local member account administrators from disabling the services while preserving the delegated administrator's ability to manage them.

Anahtar Kavram

Delegated administration and Service Control Policies (SCPs) with condition keys are used to enforce security compliance centrally while preserving administrative permissions for security teams.

Soru 510Soru →

A global logistics provider is establishing a hybrid DNS architecture. On-premises servers must resolve DNS names in an AWS Private Hosted Zone (PHZ) named corp.logistics.aws associated with AWS VPCs. Conversely, EC2 instances inside AWS VPCs must resolve DNS names for on-premises servers under the domain onprem.logistics.local. A centralized network VPC contains the hybrid connectivity interfaces. Which configuration steps must the solutions architect perform to establish two-way DNS resolution? (Select TWO.)

Geçerli olan tümünü seçin

Configure the on-premises DNS servers to forward queries for corp.logistics.aws to the IP addresses of a Route 53 Resolver inbound endpoint created in the centralized VPC.

Create a Route 53 Resolver outbound endpoint in the centralized VPC, and create a forwarding rule for onprem.logistics.local targeting the on-premises DNS servers.

Share the Private Hosted Zone corp.logistics.aws with the on-premises DNS servers using AWS Resource Access Manager (RAM).

Configure a Route Table in the centralized VPC to route DNS queries for corp.logistics.aws directly to the Direct Connect Gateway (DXGW).

Cevabı ve açıklamayı göster

Cevap: Configure the on-premises DNS servers to forward queries for corp.logistics.aws to the IP addresses of a Route 53 Resolver inbound endpoint created in the centralized VPC.; Create a Route 53 Resolver outbound endpoint in the centralized VPC, and create a forwarding rule for onprem.logistics.local targeting the on-premises DNS servers.

Cevap

Configure the on-premises DNS servers to forward queries for corp.logistics.aws to the Route 53 Resolver inbound endpoint IPs, and create a Route 53 Resolver outbound endpoint with a forwarding rule for the on-premises domain.

Establishing two-way hybrid DNS resolution requires both an inbound endpoint and an outbound endpoint. The inbound resolver endpoint accepts queries forwarded from on-premises DNS servers for AWS-hosted domains. The outbound resolver endpoint, combined with a forwarding rule, directs AWS queries for on-premises domains to the on-premises DNS infrastructure.

Adım Adım Çözüm

Configure the on-premises DNS servers to conditionally forward DNS queries for the corp.logistics.aws domain to the inbound resolver endpoint IPs.

On-premises clients can now resolve AWS-hosted resources using private IP addresses via Route 53 Resolver.

This establishes inbound DNS resolution from on-premises to AWS.

Create a Route 53 Resolver outbound endpoint in the centralized VPC.

An interface is established for AWS-originated DNS queries to egress the VPC toward on-premises networks.

This provides the outbound path required for AWS resources to query on-premises DNS servers.

Create a Route 53 Resolver forwarding rule for the domain onprem.logistics.local pointing to the on-premises DNS servers, and associate it with the VPCs.

AWS EC2 instances can resolve the on-premises domain names.

This redirects queries for the on-premises domain to the outbound endpoint and onto the on-premises servers.

Anahtar Kavram

Hybrid DNS resolution requires Route 53 Resolver inbound endpoints for queries entering AWS, and outbound endpoints with forwarding rules for queries exiting AWS.

Soru 511Soru →

A logistics company is designing a multi-account AWS environment in the `us-east-1` Region. The architecture consists of $10$ spoke VPCs for different business units, a central inspection VPC for outbound internet traffic, and a shared services VPC that hosts common tools and a Route 53 Private Hosted Zone (PHZ) named `logistics.local`.

The company's network requirements are:
1. All spoke VPCs must route outbound internet traffic through the central inspection VPC.
2. The egress architecture must be highly available and resilient to Availability Zone (AZ) failures.
3. Resources in all spoke VPCs must resolve DNS queries for `logistics.local`.
4. Operational complexity and cost must be minimized.

Which architecture meets these requirements?

Provision an AWS Transit Gateway to connect all spoke VPCs and the central inspection VPC. Deploy NAT Gateways in multiple Availability Zones within the central inspection VPC, routing internet-bound traffic through them. Associate the `logistics.local` Private Hosted Zone with each of the spoke VPCs.

Provision an AWS Transit Gateway to connect all spoke VPCs and the central inspection VPC. Deploy a single NAT Gateway in a single Availability Zone within the central inspection VPC to minimize cost, and route all egress traffic through it. Associate the `logistics.local` Private Hosted Zone with each of the spoke VPCs.

Provision an AWS Transit Gateway to connect all spoke VPCs and the central inspection VPC. Deploy NAT Gateways in multiple Availability Zones within the central inspection VPC. Enable DNS support on the Transit Gateway attachments, relying on them to automatically forward DNS queries for the `logistics.local` Private Hosted Zone without associating it with the spoke VPCs.

Establish a full mesh of VPC peering connections between all spoke VPCs and the central inspection VPC. Deploy NAT Gateways in multiple Availability Zones within the central inspection VPC. Use a Direct Connect Gateway associated with all VPCs to route inter-VPC traffic and resolve private DNS queries.

Cevabı ve açıklamayı göster

Cevap: Provision an AWS Transit Gateway to connect all spoke VPCs and the central inspection VPC. Deploy NAT Gateways in multiple Availability Zones within the central inspection VPC, routing internet-bound traffic through them. Associate the `logistics.local` Private Hosted Zone with each of the spoke VPCs.

Cevap

The correct architecture uses AWS Transit Gateway to simplify routing by acting as a hub for spoke VPCs. Centralizing outbound traffic through NAT Gateways deployed across multiple Availability Zones in the central inspection VPC provides both highly available egress and resilience against AZ failures. Associating the Route 53 Private Hosted Zone with all spoke VPCs enables DNS resolution for the private domain directly and cost-effectively.

Adım Adım Çözüm

Analyze the egress requirements and select a centralized VPC architecture with AWS Transit Gateway.

All spoke VPCs are connected to the central inspection VPC via Transit Gateway attachments.

Using Transit Gateway avoids the administrative complexity of maintaining a full mesh of VPC peering connections.

Design the high availability configuration for the NAT Gateways in the central inspection VPC.

NAT Gateways are deployed in multiple Availability Zones within the central inspection VPC.

Deploying NAT Gateways across multiple AZs ensures egress traffic remains operational if a single Availability Zone experiences an outage.

Establish private DNS resolution for the shared Private Hosted Zone.

The Route 53 Private Hosted Zone is associated with each of the spoke VPCs.

Associating the Private Hosted Zone directly with the spoke VPCs allows resource instances within them to resolve the domain names without incurring the costs or complexity of Route 53 Resolver endpoints.

Anahtar Kavram

Centralized egress and shared DNS resolution in a multi-account AWS environment using Transit Gateway and Private Hosted Zones.

Soru 512Soru →

A financial services firm is designing a hybrid network architecture to connect $30$ spoke VPCs in the `eu-west-1` Region to its on-premises data centers in London ( $172.16.10.0/24$ ) and Dublin ( $172.16.20.0/24$ ). Each spoke VPC is attached to a centralized AWS Transit Gateway (TGW) in the `eu-west-1` Region.

The architecture must meet the following requirements:
- The London data center must connect to AWS using a $10\text{ Gbps}$ AWS Direct Connect (DX) connection as the primary path, and a redundant IPsec VPN connection over the internet as a backup.
- The Dublin data center must connect to AWS using a separate $10\text{ Gbps}$ DX connection as the primary path, and a redundant IPsec VPN connection over the internet as a backup.
- If the local DX connection fails, traffic to and from that data center must fail over to its local VPN connection.
- A data center must only route traffic through the other data center's connections if both its local DX and VPN connections are unavailable.
- Asymmetric routing must be avoided, and BGP routing must be configured dynamically.

Which two configuration options should the solutions architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure the customer gateway routers in both London and Dublin to advertise their respective local subnets to AWS with no AS-Path prepending over their local Direct Connect connection, prepended with two AS hops over their local VPN connection, and prepended with four AS hops over the remote location's connections.

Configure the customer gateway routers in both London and Dublin to assign the highest BGP local preference to the AWS routes received via their local Direct Connect connection, a lower local preference to routes received via their local VPN connection, and the lowest local preference to routes received via the cross-facility connection.

Create a full mesh of VPC Peering connections between all 30 spoke VPCs to allow inter-VPC traffic, and connect each VPC to the Direct Connect Gateway using private virtual interfaces to route traffic directly to the on-premises locations.

Create a centralized Amazon Route 53 Private Hosted Zone in a shared services account for local DNS resolution, and deploy Route 53 Resolver inbound endpoints to handle hybrid queries without associating the zone with the spoke VPCs in the individual AWS accounts.

Route all outbound internet-bound traffic from the spoke VPCs to a single NAT Gateway located in a single Availability Zone in a centralized egress VPC to reduce NAT gateway hourly charges.

Cevabı ve açıklamayı göster

Cevap: Configure the customer gateway routers in both London and Dublin to advertise their respective local subnets to AWS with no AS-Path prepending over their local Direct Connect connection, prepended with two AS hops over their local VPN connection, and prepended with four AS hops over the remote location's connections.; Configure the customer gateway routers in both London and Dublin to assign the highest BGP local preference to the AWS routes received via their local Direct Connect connection, a lower local preference to routes received via their local VPN connection, and the lowest local preference to routes received via the cross-facility connection.

Cevap

The solutions architect should configure the customer gateway routers to advertise local subnets with no prepending over Direct Connect, prepended with two AS hops over VPN, and prepended with four AS hops over the remote connections. In addition, the routers should assign the highest BGP local preference to AWS routes received over the local Direct Connect, followed by the local VPN, and then the cross-facility connection.

To satisfy both failover and symmetry requirements, routing controls must be applied on both sides of the hybrid network. Configuring the customer gateways to advertise local subnets with no prepending over the local Direct Connect, prepended with two AS hops over the local VPN, and prepended with four AS hops over the remote connections ensures the AWS Transit Gateway selects paths in the correct order. On the on-premises side, assigning local preference values to favor the local Direct Connect over the local VPN and the cross-facility path ensures symmetric routing and prevents traffic from unnecessarily crossing the inter-data-center link.

Adım Adım Çözüm

Determine the path selection requirements for inbound traffic (AWS to on-premises). AWS Transit Gateway path selection evaluates AS-Path length when prefix lengths are equal. To establish the preference order of Local DX > Local VPN > Remote Connections, apply graduated AS-Path prepending at the customer gateways.

London customer gateway advertises 172.16.10.0/24 with 0, 2, and 4 AS prepends over London DX, London VPN, and Dublin connections respectively. Dublin does the same for 172.16.20.0/24.

This guarantees that AWS Transit Gateway selects the local DX as primary, local VPN as secondary, and remote paths only as a tertiary backup.

Determine the path selection requirements for outbound traffic (on-premises to AWS). The on-premises routers select paths based on local preference for BGP routes received from AWS.

On-premises routers assign Local Preference values: Local DX (e.g., 200) > Local VPN (e.g., 150) > Cross-facility (e.g., 100).

This prevents asymmetric routing by ensuring outbound traffic uses the same hierarchy of paths as inbound traffic.

Evaluate and eliminate distractors based on routing and architectural anti-patterns.

Eliminated options suggesting full-mesh peering (non-transitive over DXGW), unassociated Route 53 Private Hosted Zones, and non-redundant NAT Gateways.

These alternatives violate scaling, high availability, and functional routing requirements.

Anahtar Kavram

BGP routing policy control using AS-Path prepending and Local Preference within a multi-account, hybrid architecture utilizing AWS Transit Gateway and Direct Connect Gateway.

Soru 513Soru →

A global financial enterprise is migrating its workload to a multi-account, multi-region AWS environment. They have $50$ spoke VPCs distributed across the `us-east-1` and `eu-west-1` Regions. The enterprise must establish a hybrid network architecture connecting these VPCs to their on-premises data centers in New York and London. The design must meet the following requirements:
- Primary high-bandwidth connectivity must use AWS Direct Connect.
- Private IP communication is required between all spoke VPCs across both Regions and the on-premises data centers.
- An IPsec VPN over the public internet must serve as an active-passive backup to the Direct Connect connections.
- The design must minimize administrative overhead and avoid manual routing table updates when VPCs are added or removed.

Which TWO actions should the solutions architect take to meet these connectivity requirements?

Geçerli olan tümünü seçin

Deploy AWS Transit Gateway in both the `us-east-1` and `eu-west-1` Regions, peer the two Transit Gateways, attach the local spoke VPCs to their regional Transit Gateway, and associate both Transit Gateways with a single AWS Direct Connect Gateway connected to the on-premises locations.

Establish AWS Site-to-Site VPN connections from the on-premises data centers to the Transit Gateway in each Region, configure BGP dynamic routing, and set a higher BGP local preference on the customer gateway routers for prefixes received via Direct Connect.

Create a single AWS Direct Connect Gateway and associate it directly with all

50

spoke VPCs across both Regions to enable transit routing between the VPCs and the on-premises networks without deploying Transit Gateways.

Create a centralized Route 53 Private Hosted Zone (PHZ) in a shared services VPC and associate the PHZ directly with the peered Transit Gateways to automatically enable cross-account hybrid DNS resolution for all connected spoke VPCs.

Deploy a single NAT Gateway in a centralized egress VPC in `us-east-1`, and route all internet-bound traffic from the spoke VPCs in both Regions through this NAT Gateway to minimize hourly NAT Gateway costs.

Cevabı ve açıklamayı göster

Cevap: Deploy AWS Transit Gateway in both the `us-east-1` and `eu-west-1` Regions, peer the two Transit Gateways, attach the local spoke VPCs to their regional Transit Gateway, and associate both Transit Gateways with a single AWS Direct Connect Gateway connected to the on-premises locations.; Establish AWS Site-to-Site VPN connections from the on-premises data centers to the Transit Gateway in each Region, configure BGP dynamic routing, and set a higher BGP local preference on the customer gateway routers for prefixes received via Direct Connect.

Cevap

Deploy AWS Transit Gateway in both Regions, peer the Transit Gateways, attach local VPCs, and associate them with a single Direct Connect Gateway. Additionally, establish AWS Site-to-Site VPN connections to the Transit Gateways and configure the customer gateway to prefer Direct Connect paths using BGP local preference.

Deploying AWS Transit Gateway in each Region and peering them allows for scalable, transitive inter-VPC communication. Connecting them to a single Direct Connect Gateway allows both Regions to access the on-premises network over Direct Connect. Establishing Site-to-Site VPN connections directly to the Transit Gateways provides a backup path. Adjusting BGP local preference on the customer gateways ensures that inbound traffic to AWS prefers the high-bandwidth Direct Connect path over the VPN connection.

Adım Adım Çözüm

Configure the core Transit Gateway architecture.

AWS Transit Gateways are deployed in both `us-east-1` and `eu-west-1`. Local VPCs in each region are attached to their respective regional Transit Gateway. The two Transit Gateways are peered to allow inter-region VPC-to-VPC routing.

This establishes a scalable hub-and-spoke topology across regions, minimizing routing table management overhead.

Configure hybrid connectivity via Direct Connect.

A single Direct Connect Gateway is created and associated with both Transit Gateways. On-premises routers establish BGP sessions over Direct Connect transit virtual interfaces.

Direct Connect Gateway serves as the centralized hybrid router, routing traffic between the on-premises data centers and both regional Transit Gateways.

Establish the backup VPN path and configure routing preference.

AWS Site-to-Site VPN connections are created to the Transit Gateways. The customer gateway routers are configured to prefer routes received via Direct Connect by setting a higher BGP local preference.

This ensures that traffic from on-premises to AWS defaults to Direct Connect and fails over to VPN only when Direct Connect is unavailable. Outbound traffic from AWS to on-premises automatically prefers Direct Connect over VPN in Transit Gateway path selection.

Anahtar Kavram

Transit Gateway hybrid routing with Direct Connect Gateway and BGP failover preferences.

Soru 514Soru →

A company is deploying a new version of a microservice hosted on AWS Lambda. The deployment process must ensure zero downtime. The system must route $10\%$ of the incoming traffic to the new version of the function for a duration of $10$ minutes. If there are no errors, all remaining traffic must be routed to the new version immediately. If errors are detected, the deployment must automatically roll back.

Which two options should the solutions architect combine to achieve this deployment strategy? (Select two.)

Geçerli olan tümünü seçin

Configure AWS CodeDeploy to manage the traffic shifting for the AWS Lambda function.

Select the Canary10Percent10Minutes deployment configuration in the deployment group.

Select the Linear10PercentEvery10Minutes deployment configuration in the deployment group.

Select the AllAtOnce deployment configuration in the deployment group.

Use AWS Elastic Beanstalk rolling deployments to shift traffic to the new version.

Cevabı ve açıklamayı göster

Cevap: Configure AWS CodeDeploy to manage the traffic shifting for the AWS Lambda function.; Select the Canary10Percent10Minutes deployment configuration in the deployment group.

Cevap

Configure AWS CodeDeploy to manage traffic shifting, and select the Canary10Percent10Minutes deployment configuration.

AWS CodeDeploy manages serverless deployments by updating Lambda function aliases to shift traffic. The Canary10Percent10Minutes deployment configuration specifically exposes

10\%

of traffic to the new version for a

10

-minute window, then routes

100\%

of the traffic to the new version if no CloudWatch alarms are triggered.

Adım Adım Çözüm

Identify the target service and hosting model.

The application is hosted on AWS Lambda.

Traffic shifting for serverless functions requires mechanisms that support Lambda alias routing.

Determine the required traffic shifting pattern.

The strategy requires a two-phase shift:

10\%

traffic for

10

minutes, followed by an immediate shift of the remaining

90\%

This behavior corresponds to a canary deployment pattern, specifically Canary10Percent10Minutes in CodeDeploy.

Evaluate the correct combination of deployment service and configuration.

AWS CodeDeploy provides native Canary10Percent10Minutes configurations for AWS Lambda.

Combining CodeDeploy with the correct canary configuration satisfies all technical requirements.

Anahtar Kavram

AWS Lambda deployment traffic shifting configurations using AWS CodeDeploy.

Tahmini Süre:1m 0s

Soru 515Soru →

A solutions architect is designing a centralized logging solution for an AWS Organization with multiple member accounts. The security team requires all AWS CloudTrail logs to be consolidated into a single Amazon S3 bucket located in a dedicated Security account. The architecture must support encryption at rest for the log files. Which configuration meets these requirements?

Create a trail in each member account and configure them to send logs to the centralized S3 bucket. Apply a Service Control Policy (SCP) at the Organization root level that grants the member accounts write access to the S3 bucket in the Security account.

Create an Organization trail in the management account that delivers logs to the S3 bucket in the Security account. Configure the S3 bucket policy to allow the CloudTrail service principal to write logs. Encrypt the log files using the AWS-managed KMS key for CloudTrail (aws/cloudtrail).

Create an Organization trail in the management account that delivers logs to the S3 bucket in the Security account. Configure the S3 bucket policy to allow the CloudTrail service principal to write logs. Encrypt the log files using a customer managed AWS KMS key with a key policy that allows cross-account access.

Create an Organization trail in the management account that delivers logs to the S3 bucket in the Security account. Configure local IAM policies in each member account to grant permission to write to the centralized S3 bucket, without modifying the S3 bucket policy in the Security account.

Cevabı ve açıklamayı göster

Cevap: Create an Organization trail in the management account that delivers logs to the S3 bucket in the Security account. Configure the S3 bucket policy to allow the CloudTrail service principal to write logs. Encrypt the log files using a customer managed AWS KMS key with a key policy that allows cross-account access.

Cevap

Create an Organization trail in the management account that delivers logs to the S3 bucket in the Security account. Configure the S3 bucket policy to allow the CloudTrail service principal to write logs. Encrypt the log files using a customer managed AWS KMS key with a key policy that allows cross-account access.

Creating an AWS Organizations trail simplifies log collection by automatically applying the trail to all member accounts. Because the logs are stored in a centralized S3 bucket within a different AWS account (the Security account), the S3 bucket policy must explicitly allow the CloudTrail service principal to write objects. Additionally, since the logs are delivered from multiple AWS accounts, the KMS key used for encryption must be a customer managed key with a policy that allows cross-account KMS actions, as AWS-managed KMS keys cannot be shared or modified for cross-account access.

Adım Adım Çözüm

Establish the multi-account logging trail.

Use AWS Organizations to create an Organization trail in the management account, which automatically applies the trail to all member accounts.

This reduces operational overhead and ensures compliance across all accounts.

Configure the destination S3 bucket permissions.

Add a bucket policy to the centralized S3 bucket in the Security account allowing the CloudTrail service principal (cloudtrail.amazonaws.com) to perform s3:PutObject actions.

Cross-account access to S3 requires the resource-based policy of the target bucket to explicitly trust the calling service/accounts.

Configure KMS key encryption for log files.

Create a customer managed key (CMK) in the Security account, and update its key policy to allow CloudTrail and the member accounts to use the key for encryption. Avoid using AWS-managed keys.

AWS-managed KMS keys (like aws/cloudtrail) do not support cross-account key sharing or key policy modifications, which causes log delivery from member accounts to fail.

Anahtar Kavram

Centralized multi-account logging using AWS Organizations CloudTrail, S3 bucket policies for cross-account access, and customer managed KMS keys for cross-account encryption.

Tahmini Süre:2m 0s

Soru 516Soru →

A company manages a multi-account AWS environment under AWS Organizations. The network engineering team has created a central VPC in a Shared Services account and wants to share specific subnets with development accounts in the Organization to streamline IP address management. Additionally, the finance team has purchased a Compute Savings Plan in the management account to cover compute usage across the Organization, but wants to exclude a subset of testing accounts from benefiting from these discounts to accurately track their un-discounted research and development (R&D) costs.

Which of the following actions should the Solutions Architect recommend to achieve these goals? (Select TWO.)

Geçerli olan tümünü seçin

Enable resource sharing within the organization in the AWS Resource Access Manager (RAM) console, and create a resource share in the Shared Services account containing the subnets, sharing it with the development Organizational Unit (OU).

In the AWS Billing console of the management account, modify the Preferences settings to disable Savings Plans discount sharing for the specific testing accounts.

Create an AWS RAM resource share for the subnets in the Shared Services account and invite each development account individually using their AWS account IDs without enabling organization-wide sharing.

Attach a Service Control Policy (SCP) to the testing accounts' OU that denies the savingsplans:PurchaseSavingsPlans and savingsplans:DescribeSavingsPlans actions to block the application of the discounts.

Purchase EC2 Instance Savings Plans in the management account and rely on consolidated billing to automatically apply the discounts to the AWS Fargate tasks run in the development accounts.

Cevabı ve açıklamayı göster

Cevap: Enable resource sharing within the organization in the AWS Resource Access Manager (RAM) console, and create a resource share in the Shared Services account containing the subnets, sharing it with the development Organizational Unit (OU).; In the AWS Billing console of the management account, modify the Preferences settings to disable Savings Plans discount sharing for the specific testing accounts.

Cevap

Enable resource sharing within the organization in the AWS Resource Access Manager console to share subnets with the development Organizational Unit, and modify the Preferences settings in the AWS Billing console of the management account to disable Savings Plans discount sharing for the specific testing accounts.

The correct strategy combines using AWS Resource Access Manager (RAM) with organization sharing enabled to distribute subnets to the development Organizational Unit (OU), and using Billing Preferences in the management account to selectively disable Savings Plans sharing for the testing accounts. This allows the Shared Services account to seamlessly share network resources without administrative overhead and allows the finance team to isolate un-discounted costs in the testing accounts.

Adım Adım Çözüm

Enable organization sharing within AWS Resource Access Manager (RAM).

This allows resource sharing across the entire organization or specific OUs without requiring account-level invitations.

To securely and efficiently share subnets from the central Shared Services account to the development OU.

Create a Resource Share in the Shared Services account for the subnets.

The subnets become visible and usable by resources in the member accounts within the development OU.

This establishes the VPC resource sharing mechanism.

Navigate to the AWS Billing console in the management account and locate the Billing Preferences.

Access is granted to settings for Credit and Savings Plans sharing preferences.

This is where consolidated billing sharing behaviors are configured.

Disable discount sharing for the testing accounts.

The Compute Savings Plan discounts will no longer apply to compute usage in these specific accounts, keeping their R&D costs at standard rates.

To satisfy the finance team's requirement to track un-discounted costs for the testing accounts.

Anahtar Kavram

AWS RAM Organization Sharing and AWS Billing Discount Preferences

Tahmini Süre:2m 0s

Soru 517Soru →

An organization wants to configure federated single sign-on (SSO) to allow corporate users to access the AWS Management Console using their existing on-premises SAML 2.0 compliant Identity Provider (IdP). To establish this trust relationship, which of the following configuration steps must be performed within AWS Identity and Access Management (IAM)? (Select TWO.)

Geçerli olan tümünü seçin

Create an IAM SAML identity provider entity by uploading the SAML metadata document obtained from the on-premises IdP.

Create an IAM role for SAML 2.0 federation with a trust policy that allows the sts:AssumeRoleWithSAML action and designates the SAML provider as the principal.

Create an IAM role with a trust policy that permits the sts:AssumeRole action and designates the external SAML provider as the principal.

Create a Service Control Policy (SCP) at the root level of the AWS Organization to grant console access to the external SAML provider.

Cevabı ve açıklamayı göster

Cevap: Create an IAM SAML identity provider entity by uploading the SAML metadata document obtained from the on-premises IdP.; Create an IAM role for SAML 2.0 federation with a trust policy that allows the sts:AssumeRoleWithSAML action and designates the SAML provider as the principal.

Cevap

To configure SAML 2.0 single sign-on (SSO) in AWS, you must create a SAML identity provider in IAM using the IdP's metadata document, and create an IAM role for SAML 2.0 federation with a trust policy that permits the sts:AssumeRoleWithSAML action.

The correct options are creating an IAM SAML identity provider using the IdP metadata document and configuring an IAM role with a trust policy that permits the sts:AssumeRoleWithSAML action. Together, these configurations establish trust and allow federated users to gain temporary access to AWS resources using SAML assertions.

Adım Adım Çözüm

Upload the IdP metadata document to AWS IAM.

A SAML identity provider entity is created inside the AWS account, establishing trust.

AWS needs to know the signing certificates and endpoints of the external identity provider to validate incoming SAML assertions.

Create an IAM role for SAML 2.0 federation with the appropriate trust policy.

An IAM role is created with the trust policy action set to sts:AssumeRoleWithSAML and the Principal set to the ARN of the SAML provider.

This configuration allows users authenticated by the SAML IdP to assume the role and obtain temporary credentials to access AWS resources.

Anahtar Kavram

SAML 2.0 identity federation configuration in AWS IAM

Soru 518Soru →

An organization needs to implement basic governance controls across its multi-account environment using AWS Organizations. The administrator wants to ensure that member accounts cannot disable AWS CloudTrail and cannot delete a centralized IAM role used for security auditing.

Which of the following actions should the administrator take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach it to the target organizational units (OUs).

Create a Service Control Policy (SCP) that denies the iam:DeleteRole action for the auditing role, and attach it to the target organizational units (OUs).

Attach an IAM policy with a Deny effect on the target actions to the management account, relying on cross-account policy inheritance to protect member accounts.

Use AWS Resource Access Manager (RAM) to share the security auditing IAM role from the management account to all member accounts to restrict local deletion.

Create local Service Control Policies (SCPs) inside the IAM console of each individual member account to block the target actions.

Cevabı ve açıklamayı göster

Cevap: Create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach it to the target organizational units (OUs).; Create a Service Control Policy (SCP) that denies the iam:DeleteRole action for the auditing role, and attach it to the target organizational units (OUs).

Cevap

Create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach it to the target organizational units (OUs); and Create a Service Control Policy (SCP) that denies the iam:DeleteRole action for the auditing role, and attach it to the target organizational units (OUs).

To prevent member accounts from disabling AWS CloudTrail or deleting specific IAM roles, the organization must use Service Control Policies (SCPs) managed centrally. The option recommending an SCP denying the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and the option recommending an SCP denying the iam:DeleteRole action for the auditing role are correct because SCPs define permission guardrails that restrict actions for all IAM users and roles in the member accounts, including the root user.

Adım Adım Çözüm

Identify the mechanisms available in AWS Organizations to enforce maximum permissions boundaries across multiple accounts.

Service Control Policies (SCPs) are identified as the primary tool to set guardrails and restrict actions for member accounts centrally.

SCPs allow centralized restriction of actions like disabling CloudTrail or deleting IAM roles across member accounts.

Determine the correct SCP configurations required for the requested restrictions.

An SCP denying cloudtrail:StopLogging/DeleteTrail and another denying iam:DeleteRole for the specific auditing role name are designed.

Explicit Deny statements in SCPs override any local administrator permissions in member accounts.

Evaluate the placement of these SCPs.

Attach the SCPs to the target organizational units (OUs) that contain the member accounts.

Attaching SCPs at the OU level ensures governance applies to all member accounts within those OUs.

Anahtar Kavram

Service Control Policies (SCPs) in AWS Organizations are used to establish permission guardrails across member accounts, overriding local administrators.

Soru 519Soru →

An enterprise is designing a multi-account strategy using AWS Organizations. The architecture consists of a management account, a shared network account, a centralized security logging account, and multiple application accounts organized into a Developer Organizational Unit (OU). The Solutions Architect must implement the following requirements:

1. Share VPC subnets created in the shared network account with the Developer OU to enable application deployment.
2. Capture VPC Flow Logs from the shared subnets and centralize them into an Amazon S3 bucket in the security logging account. The log files must be encrypted at rest using an AWS KMS key.
3. Maximize cost savings across the organization's compute portfolio, which includes Amazon EC2 instances, AWS Fargate tasks, and AWS Lambda functions.

Which combination of actions should the Solutions Architect take to meet these requirements securely and efficiently? (Select TWO.)

Geçerli olan tümünü seçin

Enable resource sharing with AWS Organizations in AWS RAM from the management account. In the shared network account, create a resource share for the subnets and associate it with the Developer OU. In the management account, purchase Compute Savings Plans with sharing enabled to cover compute usage across all member accounts.

Purchase EC2 Instance Savings Plans in the management account to cover the EC2 instances, Fargate tasks, and Lambda functions. In the shared network account, configure AWS RAM to share the subnets directly with application accounts. Attach a Service Control Policy (SCP) to the Developer OU to grant application instances the permission to launch in the shared subnets.

In the security logging account, create an Amazon S3 bucket with a bucket policy that grants s3:PutObject permissions to the delivery.logs.amazonaws.com service principal. Create a symmetric customer managed key (CMK) in AWS KMS with a key policy allowing the delivery.logs.amazonaws.com service principal to use the kms:GenerateDataKey* and kms:Decrypt actions, and configure VPC Flow Logs to use this CMK and target the bucket.

Configure the S3 bucket in the security logging account to use the default AWS-managed KMS key (aws/s3) for encryption. Modify the key policy of aws/s3 to allow the VPC Flow Logs service principal (delivery.logs.amazonaws.com) from the shared network account to access the key, and configure cross-account access policies.

In the shared network account, create a resource share in AWS RAM for the subnets, enable external sharing, and invite each application account's root email address. Create an S3 bucket in the security logging account with a bucket policy that permits general read and write access, restricting access only by a source IP address range condition matching the VPC CIDRs.

Cevabı ve açıklamayı göster

Cevap: Enable resource sharing with AWS Organizations in AWS RAM from the management account. In the shared network account, create a resource share for the subnets and associate it with the Developer OU. In the management account, purchase Compute Savings Plans with sharing enabled to cover compute usage across all member accounts.; In the security logging account, create an Amazon S3 bucket with a bucket policy that grants s3:PutObject permissions to the delivery.logs.amazonaws.com service principal. Create a symmetric customer managed key (CMK) in AWS KMS with a key policy allowing the delivery.logs.amazonaws.com service principal to use the kms:GenerateDataKey* and kms:Decrypt actions, and configure VPC Flow Logs to use this CMK and target the bucket.

Cevap

The correct strategy requires enabling AWS RAM sharing with AWS Organizations to share subnets with the Developer OU, purchasing Compute Savings Plans in the management account to cover EC2, Fargate, and Lambda, and creating an S3 bucket in the security logging account alongside a symmetric customer managed key (CMK) with key and bucket policies that grant access to the delivery.logs.amazonaws.com service principal.

The correct strategy combines two actions. First, enabling AWS Organizations support in AWS RAM allows the subnets to be shared with the Developer OU. Purchasing Compute Savings Plans covers the EC2, Fargate, and Lambda instances across the entire organization. Second, to encrypt and store cross-account VPC Flow Logs in the security logging account, a Customer Managed Key (CMK) is required because AWS-managed KMS keys cannot be shared cross-account or have their policies modified. Both the S3 bucket policy and the KMS key policy must authorize the delivery.logs.amazonaws.com service principal.

Adım Adım Çözüm

Enable sharing with AWS Organizations in AWS RAM.

Allows resource sharing to OUs and member accounts without requiring individual handshake invitations.

Required to cleanly and securely share the VPC subnets from the network account to the Developer OU.

Select and purchase Compute Savings Plans.

Applies discount rates automatically to EC2, Fargate, and Lambda across all linked accounts.

Only Compute Savings Plans cover serverless compute resources (Fargate and Lambda) in addition to EC2 instances.

Configure the S3 bucket and AWS KMS Customer Managed Key (CMK) in the security logging account.

Ensures the S3 bucket and the CMK key policy explicitly allow delivery.logs.amazonaws.com to write logs and generate data keys.

AWS-managed KMS keys cannot be modified to grant cross-account permissions to the log delivery service, requiring a customer managed key.

Anahtar Kavram

Multi-account resource sharing via AWS RAM, centralized logging with cross-account KMS requirements, and organization-wide compute cost optimization.

Soru 520Soru →

A company's security team is setting up identity federation to allow corporate users to access the AWS Management Console of a member account. The users will authenticate using an external SAML 2.0 Identity Provider (IdP). An IAM SAML identity provider entity has been created in the target AWS account. The solutions architect now needs to configure the trust policy of the IAM role that the federated users will assume. Which configuration must be specified in the trust policy to allow users authenticated by the SAML IdP to assume this role?

Set the Principal to the Amazon Resource Name (ARN) of the SAML provider entity, and set the Action to sts:AssumeRoleWithSAML.

Set the Principal to the Amazon Resource Name (ARN) of the SAML provider entity, and set the Action to sts:AssumeRole.

Configure a Service Control Policy (SCP) at the Organizational Unit level that allows sts:AssumeRoleWithSAML, assuming it will automatically delegate the permission to the role's trust policy.

Set the Principal to the AWS account ID of the AWS Organizations management account, and set the Action to sts:AssumeRoleWithWebIdentity.

Cevabı ve açıklamayı göster

Cevap: Set the Principal to the Amazon Resource Name (ARN) of the SAML provider entity, and set the Action to sts:AssumeRoleWithSAML.

Cevap

Set the Principal to the Amazon Resource Name (ARN) of the SAML provider entity, and set the Action to sts:AssumeRoleWithSAML.

To establish federated access using SAML 2.0, the target IAM role's trust policy must trust the IAM SAML identity provider entity. This is configured by specifying the SAML provider's ARN in the Principal block and authorizing the sts:AssumeRoleWithSAML action.

Adım Adım Çözüm

Identify the authentication standard being used.

SAML 2.0 federation is specified.

Choosing the correct AWS Security Token Service (STS) API action requires matching the federation protocol, which is SAML 2.0 in this scenario.

Determine the required Security Token Service (STS) action for SAML 2.0.

The correct action is sts:AssumeRoleWithSAML.

Unlike standard IAM cross-account access which uses sts:AssumeRole, federated access via SAML 2.0 requires the specific sts:AssumeRoleWithSAML action.

Identify the proper principal to trust in the policy.

The principal must be the IAM SAML identity provider entity ARN.

To establish trust with the external IdP, the trust policy must reference the IAM SAML provider resource rather than a standard AWS account ID.

Anahtar Kavram

SAML 2.0 identity federation trust policy configuration

ÖncekiSayfa 26 / 99Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram