Examkin

Tüm alıştırma soruları

1964 soru

Tüm türler1,964Çoktan seçmeli1,006Çoklu seçim931Sıralama27
Soru 581Soru →

An enterprise manages a multi-account AWS environment under AWS Organizations. The enterprise must configure direct identity federation with an external SAML 2.0 Identity Provider (IdP) to allow corporate directory users to access target IAM roles in member accounts. The security team mandates the following controls:
1. Users must only be allowed to assume the administrative roles if they successfully completed multi-factor authentication (MFA) at the IdP.
2. The administrative roles must only be accessible when the login request originates from the corporate network's public IP range (203.0.113.0/24203.0.113.0/24).

Which TWO configurations must the Solutions Architect implement to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the trust policy of each target IAM role to allow the sts:AssumeRoleWithSAML action, and add a condition block that evaluates saml:MultifactorAuthPresent to true. Ensure the corporate SAML IdP is configured to send the https://aws.amazon.com/SAML/Attributes/MultifactorAuthPresent attribute.; In the trust policy of each target IAM role, add a condition block that uses the IpAddress operator to restrict the sts:AssumeRoleWithSAML action to the corporate public IP range using the aws:SourceIp condition key.

Cevap

The correct configurations are to configure the target IAM role trust policies to allow the sts:AssumeRoleWithSAML action with a condition checking that saml:MultifactorAuthPresent is true while sending the matching attribute from the IdP, and to restrict the trust policy's sts:AssumeRoleWithSAML action using aws:SourceIp in the condition block.
To enforce multi-factor authentication for SAML federated users, the external Identity Provider must assert that MFA occurred by sending the https://aws.amazon.com/SAML/Attributes/MultifactorAuthPresent attribute. AWS STS maps this to the saml:MultifactorAuthPresent context key, which can be evaluated inside the trust policy of the IAM role. Additionally, the trust policy controls who and from where the role can be assumed; evaluating the aws:SourceIp condition key against the corporate IP range directly during the sts:AssumeRoleWithSAML action ensures that unauthorized network locations are blocked before the role is assumed.

Adım Adım Çözüm

1
Configure the external SAML Identity Provider (IdP) to include the attribute https://aws.amazon.com/SAML/Attributes/MultifactorAuthPresent set to true in the SAML assertion when the user performs MFA.
The SAML assertion will convey the user's MFA status to AWS STS during the federation handshake.
AWS STS maps this specific SAML attribute to the saml:MultifactorAuthPresent context key, which is required for policy validation.
2
Modify the target IAM role trust policies to only allow the sts:AssumeRoleWithSAML action when the condition key saml:MultifactorAuthPresent is set to true.
Role assumption is restricted to federated sessions that have successfully completed IdP-managed MFA.
This establishes a secure trust boundary during the initial authentication handshake rather than after session creation.
3
Add a condition block to the target IAM role trust policies that restricts the sts:AssumeRoleWithSAML action using the aws:SourceIp condition key and the corporate public CIDR block.
The STS call will be rejected if the client's request originates from an IP address outside the corporate network.
Evaluating the source IP directly on the role trust policy prevents unauthorized external clients from completing the federation process.

Anahtar Kavram

Multi-Account Identity and Access Management Federation
Soru 582Soru →

An enterprise manages its multi-account environment using AWS Organizations. The organizational structure consists of a parent Organizational Unit (OU) named 'Operations' and a nested child OU named 'Production' under it. A solutions architect attaches a Service Control Policy (SCP) to the 'Operations' OU that allows only EC2 and CloudWatch actions (ec2:* and cloudwatch:*). To ensure that production applications can access storage, the solutions architect attaches another SCP to the 'Production' OU that allows EC2, CloudWatch, and S3 actions (ec2:*, cloudwatch:*, and s3:*). The local IAM policies in the member accounts under the 'Production' OU grant full administrator access (*:*). When a developer in a 'Production' member account attempts to list S3 buckets using the local administrator credentials, the request is denied. Which of the following is the primary reason the developer's request is denied?

Cevabı ve açıklamayı göster

Cevap: The Service Control Policy (SCP) at the parent 'Operations' OU does not allow S3 actions. In an AWS Organizations hierarchy, permissions must be explicitly allowed at every level of the path from the root to the member account, meaning the parent OU's restriction filters out S3 access before it reaches the child OU.

Cevap

The Service Control Policy (SCP) at the parent 'Operations' OU does not allow S3 actions, and because permissions must be allowed at every level of the path from the root to the member account, the restriction filters out S3 access before it reaches the child OU.
The correct answer is correct because AWS Organizations evaluates Service Control Policies (SCPs) hierarchically from the root down to the member account. For any action to be authorized in a member account, it must be allowed by the SCPs at every single level of the hierarchy path. Because the parent 'Operations' OU only allows EC2 and CloudWatch, S3 access is filtered out at that level, preventing the child 'Production' OU from granting or inheriting S3 permissions even if its own SCP and local IAM policies allow it.

Adım Adım Çözüm

1
Analyze the AWS Organizations hierarchy path.
The path is Root -> Operations OU (Parent) -> Production OU (Child) -> Member Account.
This establishes the chain of evaluation for Service Control Policies (SCPs).
2
Evaluate the SCP permissions allowed at each level.
Root allows all permissions. Operations OU allows only ec2:* and cloudwatch:*. Production OU allows ec2:*, cloudwatch:*, and s3:*.
Each level's SCP defines the maximum allowable permissions for all accounts below it.
3
Apply the hierarchical evaluation rule of AWS Organizations.
The intersection of permissions at all levels is allowed. S3 is not allowed at the Operations OU level, so the intersection for S3 is empty.
For a permission to be allowed, it must be explicitly allowed at every level from the root to the target account.

Anahtar Kavram

Service Control Policy (SCP) evaluation in nested Organizational Units (OUs)
Soru 583Soru →

A smart grid utility operator manages a multi-account AWS environment using AWS Organizations. The network topology consists of a Hub VPC in a Shared Services account and multiple Spoke VPCs in Production and Development accounts. The Hub VPC is connected to an on-premises SCADA data center via AWS Transit Gateway and AWS Direct Connect.

The operator hosts a Route 53 Private Hosted Zone (PHZ) named corp.utility.internal in the Shared Services account. The on-premises DNS servers manage the onprem.utility.internal domain. The operator needs a DNS resolution strategy that meets the following requirements:
1. Instances in the Spoke VPCs must resolve hostnames in corp.utility.internal.
2. Instances in the Spoke VPCs must resolve hostnames in onprem.utility.internal.
3. On-premises systems must resolve hostnames in corp.utility.internal.
4. DNS queries between the Spoke VPCs and on-premises must traverse the hybrid connection securely.

Which of the following architectures meets these requirements with the least administrative overhead?

Cevabı ve açıklamayı göster

Cevap: Configure Route 53 Resolver inbound and outbound endpoints in the Hub VPC. In the Shared Services account, create a Resolver outbound rule for onprem.utility.internal pointing to the on-premises DNS servers, share it with the Spoke accounts using AWS Resource Access Manager (RAM), and associate it with the Spoke VPCs. Authorize cross-account VPC associations for the Spoke VPCs to the corp.utility.internal Private Hosted Zone (PHZ) from the Shared Services account, and associate the Spoke VPCs with the PHZ. Configure the on-premises DNS servers to forward queries for corp.utility.internal to the inbound endpoint IP addresses.

Cevap

Configure Route 53 Resolver inbound and outbound endpoints in the Hub VPC. In the Shared Services account, create a Resolver outbound rule for onprem.utility.internal pointing to the on-premises DNS servers, share it with the Spoke accounts using AWS Resource Access Manager (RAM), and associate it with the Spoke VPCs. Authorize cross-account VPC associations for the Spoke VPCs to the corp.utility.internal Private Hosted Zone (PHZ) from the Shared Services account, and associate the Spoke VPCs with the PHZ. Configure the on-premises DNS servers to forward queries for corp.utility.internal to the inbound endpoint IP addresses.
The correct architecture uses Route 53 Resolver inbound endpoints to allow on-premises systems to resolve the AWS Private Hosted Zone (PHZ) and outbound endpoints to forward queries for the on-premises domain. Cross-account PHZ association via the Route 53 API (authorizing the Spoke VPCs first, then associating them) is the standard and supported method to enable Spoke VPCs to resolve the PHZ locally. Sharing a single outbound resolver rule using AWS Resource Access Manager (RAM) minimizes administrative overhead compared to setting up rules in each individual account.

Adım Adım Çözüm

1
Set up centralized DNS query endpoints in the hub VPC.
Inbound and outbound Route 53 Resolver endpoints are created in the Shared Services Hub VPC, allowing hybrid DNS queries to flow between AWS and the on-premises SCADA data center.
Centralizing resolver endpoints prevents the need to deploy and manage endpoints in every spoke VPC, lowering costs and operational complexity.
2
Authorize and associate the Private Hosted Zone with the Spoke VPCs.
Submit a cross-account VPC association authorization from the Shared Services account for each Spoke VPC, and then run the associate command in each Spoke VPC account to bind the VPCs to the corp.utility.internal PHZ.
This allows instances in the Spoke VPCs to resolve resources in the corp.utility.internal zone locally via the default Route 53 Resolver IP, without traversing outbound endpoints.
3
Share the outbound forwarding rule with Spoke accounts using AWS RAM.
A Route 53 Resolver outbound forwarding rule for onprem.utility.internal is created in the Shared Services account and shared with the Spoke accounts via AWS RAM, enabling the Spoke VPCs to associate the rule locally.
Sharing the rule centrally avoids duplicate rule administration across multiple Spoke accounts and directs queries for on-premises domains to the centralized outbound endpoint.
4
Configure on-premises DNS servers to forward queries to the inbound resolver endpoint.
On-premises SCADA DNS servers are configured with conditional forwarders targeting the inbound resolver endpoint IP addresses for the corp.utility.internal domain.
This enables on-premises clients to resolve AWS private resources securely over Direct Connect by forwarding queries to the Route 53 Resolver.

Anahtar Kavram

Multi-Account and Hybrid DNS Architecture Strategy
Soru 584Soru →

A company uses AWS Organizations to manage a multi-account environment with consolidated billing. The environment consists of a Management account, a Shared Services account, and multiple Development accounts. The Development accounts run a mix of Amazon EC2 instances, AWS Fargate tasks, and AWS Lambda functions. The Infrastructure team needs to share several subnets from a central VPC in the Shared Services account with the Development accounts. Additionally, the Finance team wants to purchase a single Savings Plan that provides maximum cost optimization for all of these compute workloads across all accounts in the organization. Which set of actions should a Solutions Architect recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: In the Management account, enable resource sharing within AWS Organizations in the AWS RAM console. In the Shared Services account, create a resource share in AWS RAM for the subnets and associate it with the Development accounts' Organizational Unit. Purchase a Compute Savings Plan in the Management account.

Cevap

The correct recommendation is to enable resource sharing within AWS Organizations in the Management account, share the subnets from the Shared Services account to the Development Organizational Unit via AWS Resource Access Manager (RAM), and purchase a Compute Savings Plan in the Management account.
The correct solution involves enabling organization-level sharing in AWS RAM from the Management account. This permits seamless sharing of resources such as subnets to accounts within the Organization or specific OUs. The subnets can then be shared from the Shared Services account to the Development OU. Purchasing a Compute Savings Plan in the Management account ensures that the cost discount applies to EC2, Fargate, and Lambda across all member accounts via consolidated billing.

Adım Adım Çözüm

1
Enable organization sharing in AWS RAM.
Resource sharing within AWS Organizations is allowed across the entire organization without requiring manual handshakes.
AWS RAM requires explicit authorization from the Management account to share resources with accounts inside the organization without sending invitation emails.
2
Share subnets from the Shared Services account using AWS RAM.
The Development accounts' Organizational Unit is associated with the subnets resource share.
This allows the Development accounts to deploy resources (like Fargate tasks) directly into the shared subnets.
3
Purchase a Compute Savings Plan in the Management account.
The discount benefit is shared across all member accounts under consolidated billing and applies to EC2, Fargate, and Lambda.
Compute Savings Plans offer the greatest flexibility by covering EC2, Fargate, and Lambda, and purchasing them in the Management account ensures the discount applies to all consolidated accounts.

Anahtar Kavram

AWS Resource Access Manager (RAM) organization-level sharing and Compute Savings Plans application in a consolidated billing family.
Soru 585Soru →

An enterprise uses AWS Organizations with fifty member accounts. To meet regulatory requirements, all AWS CloudTrail logs from these accounts must be consolidated into a single Amazon S3 bucket within a centralized Log Archive account. The logs must be encrypted at rest using AWS KMS. The security team requires that the KMS key supports cross-account decryption by security analysts.

Which of the following actions must the solutions architect take to satisfy these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure the organization trail to write to the S3 bucket in the Log Archive account. Use a customer managed KMS key in the Log Archive account with a key policy that grants kms:GenerateDataKey* and kms:Decrypt permissions to the CloudTrail service principal, and update the S3 bucket policy to allow the CloudTrail service principal to perform s3:PutObject operations.

Cevap

Configure the organization trail to write to the S3 bucket in the Log Archive account. Use a customer managed KMS key in the Log Archive account with a key policy that grants permissions to the CloudTrail service principal, and update the S3 bucket policy to allow the CloudTrail service principal to perform write operations.
The correct configuration utilizes an organization trail that delivers logs to a centralized S3 bucket. Because AWS-managed KMS keys cannot be shared across accounts, a customer managed key must be used. The key policy must allow the CloudTrail service principal to generate data keys and decrypt them, and the S3 bucket policy must allow the CloudTrail service principal to write objects.

Adım Adım Çözüm

1
Configure the destination S3 bucket in the Log Archive account.
The bucket is ready to receive logs but requires a bucket policy to allow writes from external accounts.
Since CloudTrail will write logs from multiple member accounts, a resource-based policy must trust the CloudTrail service principal.
2
Create and configure a Customer Managed Key (CMK) in AWS KMS in the Log Archive account.
A key is generated that can have its key policy modified.
AWS-managed keys (like aws/cloudtrail) cannot be shared across accounts. A customer managed key allows customizing the key policy to trust the CloudTrail service principal for encryption (GenerateDataKey) and security analysts for decryption.
3
Deploy the organization trail to aggregate logs from all member accounts.
CloudTrail automatically creates trails in all member accounts and begins sending encrypted logs to the centralized bucket.
An organization trail ensures uniform audit logging across all current and future accounts in the organization.

Anahtar Kavram

Centralized cross-account logging requires S3 bucket policies and Customer Managed KMS keys configured for cross-account access, as AWS-managed keys cannot be shared across account boundaries.
Soru 586Soru →

A company is designing the deployment strategy for a new web service that will run on Amazon Elastic Container Service (Amazon ECS). The deployment will be managed by updating the ECS service's task definition via AWS CloudFormation. The application must maintain 100%100\% of its desired task capacity at all times during the rolling update to prevent performance degradation, and it can temporarily run up to 200%200\% of the desired task count to facilitate the deployment.

Which configuration of the deployment parameters in the ECS service resource will meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Set the minimum healthy percent to 100%100\% and the maximum percent to 200%200\%.

Cevap

Setting the minimum healthy percent to 100%100\% and the maximum percent to 200%200\% in the Amazon ECS service configuration.
The correct configuration is setting the minimum healthy percent to 100%100\% and the maximum percent to 200%200\%. This ensures that during a rolling update, the ECS service maintains all of its existing running tasks while launching new tasks up to double the desired capacity. Once the new tasks pass health checks, the ECS scheduler will terminate the old tasks, ensuring zero downtime and no performance degradation.

Adım Adım Çözüm

1
Determine the minimum healthy task count requirement during the rolling update.
The requirement states that the service must maintain 100%100\% of its desired task capacity at all times, which means the minimum healthy percent must be set to at least 100%100\%.
This prevents the ECS scheduler from terminating any running tasks before new tasks are successfully deployed and pass health checks.
2
Determine the maximum allowed task count during the deployment.
The requirement states that the service can temporarily run up to 200%200\% of the desired task count to facilitate the update.
Setting the maximum percent to 200%200\% allows the ECS scheduler to spin up a complete set of new tasks alongside the existing tasks before starting the cutover.
3
Select the option that combines both configurations.
Configuring the ECS service resource with a minimum healthy percent of 100%100\% and a maximum percent of 200%200\%.
This is the only configuration that satisfies both the capacity maintenance and the temporary resource scaling requirements during a rolling update.

Anahtar Kavram

Amazon ECS service rolling update parameters (minimum healthy percent and maximum percent) control deployment capacity and speed.
Soru 587Soru →

A financial services firm operates a multi-account AWS environment with 4040 spoke VPCs distributed across 22 AWS accounts in the `us-east-1` and `us-west-2` Regions. The firm connects its on-premises data center to AWS using an AWS Direct Connect (DX) gateway associated with an AWS Transit Gateway (TGW) in each Region via transit virtual interfaces (VIFs) over redundant 10 Gbps10\text{ Gbps} connections. As a backup, a Site-to-Site VPN connection is established from on-premises to each TGW. The firm requires:

1. Symmetrical routing over the DX connections under normal operations, with automatic failover to the VPN connections if the DX connections fail.
2. Outbound internet traffic from all spoke VPCs must be routed through a centralized egress VPC in each Region while ensuring high availability.
3. Services in all VPCs must resolve DNS queries for a private hosted zone (PHZ) hosted in `us-east-1` under one of the AWS accounts.

Which configuration should the Solutions Architect implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure the on-premises router to advertise the on-premises prefixes with AS-path prepending over the VPN connections, and set a higher BGP local preference on-premises for routes received via DX. Deploy NAT Gateways in multiple Availability Zones in the egress VPC of each Region, configuring separate subnet route tables to route egress traffic. Authorize and associate the Route 53 PHZ with all spoke VPCs across both accounts.

Cevap

Configure the on-premises router to advertise the on-premises prefixes with AS-path prepending over the VPN connections, and set a higher BGP local preference on-premises for routes received via DX. Deploy NAT Gateways in multiple Availability Zones in the egress VPC of each Region, configuring separate subnet route tables to route egress traffic. Authorize and associate the Route 53 PHZ with all spoke VPCs across both accounts.
The correct configuration implements BGP routing policies to ensure symmetric routing, where Direct Connect is the preferred primary path and VPN is the backup. By prepending AS-paths on the VPN, AWS Transit Gateway chooses the shorter path (Direct Connect) for inbound traffic to on-premises. Setting a higher Local Preference on the on-premises router ensures outbound traffic to AWS uses the Direct Connect path. Deploying NAT Gateways across multiple Availability Zones in the egress VPC prevents single points of failure. Authorizing and associating the Route 53 Private Hosted Zone across accounts using Route 53 APIs allows services in all VPCs to resolve internal DNS names properly.

Adım Adım Çözüm

1
Configure BGP attributes on the on-premises router and AWS Transit Gateway to ensure symmetric routing.
Traffic from AWS to on-premises prefers the Direct Connect path because the backup VPN advertises paths with AS-path prepending. Traffic from on-premises to AWS prefers Direct Connect because of a higher BGP Local Preference configuration.
Prevents asymmetric routing, which can cause stateful firewalls on-premises to drop return packets and lead to unpredictable performance.
2
Deploy NAT Gateways in each Availability Zone (AZ) in the egress VPCs.
The spoke VPCs forward outbound traffic to the local TGW, which routes the traffic to the NAT Gateway in the corresponding Availability Zone of the egress VPC.
Eliminates cross-AZ data transfer charges and ensures high availability, guaranteeing that an outage in one AZ does not affect internet egress for the remaining AZs.
3
Set up cross-account Route 53 Private Hosted Zone (PHZ) associations using the AWS CLI or Route 53 API.
Spoke VPCs in both AWS accounts can privately resolve domain names hosted in the primary account's PHZ.
Allows secure private DNS resolution across accounts. Since AWS Resource Access Manager (RAM) does not support Route 53 PHZs, the cross-account association workflow must be executed.

Anahtar Kavram

Symmetric hybrid routing, high availability egress design, and cross-account Route 53 Private Hosted Zone association.
Soru 588Soru →

An enterprise wants to establish hybrid connectivity between three spoke VPCs in different AWS accounts and their on-premises data center. The design must satisfy the following requirements:
1. The VPCs must be able to communicate with each other (VPC-to-VPC routing).
2. The VPCs must connect to the on-premises data center using a single AWS Direct Connect connection.
3. Private DNS resolution for a shared internal domain must be accessible across all VPCs.

Which architecture meets these requirements with the least operational complexity?

Cevabı ve açıklamayı göster

Cevap: Attach the three spoke VPCs to an AWS Transit Gateway, connect the Transit Gateway to the on-premises data center using an AWS Direct Connect Gateway with a transit virtual interface, and associate the Route 53 Private Hosted Zone with all three spoke VPCs.

Cevap

Attach the three spoke VPCs to an AWS Transit Gateway, connect the Transit Gateway to the on-premises data center using an AWS Direct Connect Gateway with a transit virtual interface, and associate the Route 53 Private Hosted Zone with all three spoke VPCs.
The correct answer combines AWS Transit Gateway for transitive VPC-to-VPC routing, an AWS Direct Connect Gateway with a transit virtual interface for hybrid connectivity, and associates the Route 53 Private Hosted Zone with all three spoke VPCs to allow DNS resolution.

Adım Adım Çözüm

1
Address the multi-VPC transitive routing requirement.
Attach the three spoke VPCs to a central AWS Transit Gateway.
AWS Transit Gateway acts as a cloud router, enabling transitive routing between attached VPCs, which is not supported by Direct Connect Gateway alone.
2
Configure hybrid connectivity to the on-premises data center.
Connect the AWS Transit Gateway to an AWS Direct Connect Gateway using a transit virtual interface (Transit VIF).
Transit VIF is the required interface type to connect a Direct Connect Gateway to an AWS Transit Gateway for hybrid routing.
3
Address the private DNS resolution requirement.
Associate the Route 53 Private Hosted Zone with all three spoke VPCs.
Route 53 Private Hosted Zones must be associated with each VPC requiring DNS resolution for those private records, regardless of network transit paths.

Anahtar Kavram

AWS Transit Gateway is required for multi-VPC transitive routing and hybrid connectivity via Direct Connect Gateway, while Route 53 Private Hosted Zones must be explicitly associated with all consuming VPCs.
Tahmini Süre:2m 0s
Soru 589Soru →

A company manages a multi-account environment under AWS Organizations. The architecture includes a Management account, a Shared Network account, a dedicated Security account, and several Application accounts grouped into distinct Organizational Units (OUs).

The company must meet the following design requirements:
- Share private subnets from a VPC in the Shared Network account with the Application accounts so they can deploy resources directly. The application teams must retain administrative control to manage their own security groups.
- Enable the Application accounts to encrypt their data at rest in Amazon S3 using a Customer Managed Key (CMK) managed within the Security account.
- Generate customized billing reports for a subsidiary's accounts under a specific OU that display public retail On-Demand pricing, while excluding the parent organization's consolidated Savings Plans and Volume Discounts.

Which TWO of the following actions should the Solutions Architect take to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In the Shared Network account, create a resource share using AWS Resource Access Manager (RAM) for the specific private subnets and associate it with the AWS Organization. In the Security account, create a customer managed KMS key, and configure its key policy to allow the Application accounts' root principals to perform cryptographic operations.; In the Management account, use AWS Billing Conductor to create a billing group containing the subsidiary's accounts. Define a pricing rule that applies public On-Demand rates and assign it to the billing group to generate pro forma billing data.

Cevap

The correct actions are to share the VPC subnets via AWS Resource Access Manager (RAM) within the AWS Organization, delegate cross-account KMS cryptographic operations using a customer managed key in the Security account, and utilize AWS Billing Conductor to apply public On-Demand pricing rules to a billing group containing the subsidiary accounts.
The correct strategy combines AWS Resource Access Manager (RAM) for subnet sharing and AWS Billing Conductor for localized pricing customization. Using RAM to share subnets within the AWS Organization allows the application accounts to deploy EC2 and ECS resources while managing their own security groups locally. For cross-account encryption, a customer managed KMS key is required because its key policy can delegate cryptographic operations to target accounts, unlike AWS-managed keys. Finally, AWS Billing Conductor is the designated service to generate pro forma bills with public retail pricing for specific billing groups without affecting actual consolidated billing invoices or disabling global savings plans sharing.

Adım Adım Çözüm

1
Configure subnet sharing by creating a resource share in AWS RAM within the Shared Network account, targeting the AWS Organization or the target OUs.
Application accounts gain access to deploy resources into the shared subnets while retaining control over their local security groups.
VPC sharing isolates network management while allowing application teams to maintain their own workloads and security groups.
2
Create a customer managed KMS key in the Security account and update its key policy to delegate trust to the Application accounts' root principals.
Application accounts can now grant KMS permissions locally to their IAM roles for cross-account S3 bucket encryption.
AWS-managed KMS keys cannot be shared across accounts; only customer managed keys allow key policy modifications to delegate trust.
3
In the Management account, navigate to AWS Billing Conductor to set up a billing group containing the acquired subsidiary's accounts, create a custom pricing rule that applies public On-Demand rates, and link the pricing rule to the billing group.
Pro forma bills are generated for the subsidiary's accounts showing retail pricing, while the rest of the organization continues to benefit from consolidated discounts.
AWS Billing Conductor provides pro forma billing data modeling without affecting the actual consolidated billing invoice or global discount sharing configurations.

Anahtar Kavram

Multi-account resource sharing with AWS RAM, cross-account KMS key delegation, and billing isolation using AWS Billing Conductor.
Soru 590Soru →

A company is designing a hybrid network architecture to connect its on-premises data center with multiple spoke VPCs across different AWS accounts in the same Region. They plan to use AWS Direct Connect as the primary connection and require transitive routing between all spoke VPCs and the on-premises network. Additionally, the company has created a Route 53 Private Hosted Zone (PHZ) in a central shared services account and wants to ensure that all spoke VPCs can resolve the internal domain names hosted in this PHZ. Which TWO actions must a solutions architect perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an AWS Transit Gateway, attach all spoke VPCs to the Transit Gateway, and connect the Transit Gateway to the on-premises data center via an AWS Direct Connect gateway using a Transit Virtual Interface (Transit VIF).; Authorize and associate the central Route 53 Private Hosted Zone with the spoke VPCs in the other AWS accounts by using the AWS CLI or SDK to perform cross-account hosted zone associations.

Cevap

The correct actions are to create an AWS Transit Gateway attached to all spoke VPCs and connect it to the on-premises environment using an AWS Direct Connect gateway with a Transit Virtual Interface (Transit VIF), and to authorize and associate the central Route 53 Private Hosted Zone with the spoke VPCs in the other AWS accounts using Route 53 cross-account associations.
Establishing hybrid connectivity with transitive routing requires AWS Transit Gateway connected to a Direct Connect gateway using a Transit VIF. For cross-account DNS resolution, the central Private Hosted Zone must be authorized and associated with each spoke VPC in other accounts using the Route 53 CLI or API.

Adım Adım Çözüm

1
Identify the proper AWS service for hybrid transitive routing.
Determine that AWS Transit Gateway is required to act as the hub for VPC-to-VPC and VPC-to-on-premises connectivity over Direct Connect, which must use a Transit Virtual Interface (Transit VIF).
AWS Direct Connect Gateway does not support transitive VPC-to-VPC routing directly without a transit hub.
2
Determine the proper method for cross-account private DNS resolution.
Determine that cross-account VPC association with the central Route 53 Private Hosted Zone must be authorized and associated.
Route 53 Private Hosted Zones cannot be shared via AWS Resource Access Manager (RAM), requiring programmatic cross-account VPC associations instead.

Anahtar Kavram

AWS Transit Gateway for hybrid hub-and-spoke routing, combined with cross-account Route 53 Private Hosted Zone associations.
Soru 591Soru →

A company is designing a cost-effective, multi-region disaster recovery (DR) architecture for a web application across two AWS regions (us-east-1 as primary and us-west-2 as secondary). The business requires a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes. The database layer uses Amazon Aurora PostgreSQL. Which two of the following database replication and routing configurations should be implemented to meet these HA/DR requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Amazon Aurora Global Database by adding a secondary DB cluster in the secondary region, which replicates data asynchronously with a typical latency of less than 1 second.; Configure Amazon Route 53 active-passive failover routing with health checks to route public traffic to the Application Load Balancer in the primary region, failing over to the secondary region if the primary becomes unhealthy.

Cevap

Create an Amazon Aurora Global Database with a secondary DB cluster in the secondary region, and configure Amazon Route 53 active-passive failover routing with health checks.
To meet the low RTO and RPO requirements, the database must replicate data continuously with sub-second latency. Amazon Aurora Global Database uses dedicated replication infrastructure to copy data across regions in less than a second, satisfying the 5-minute RPO. To meet the 15-minute RTO, Amazon Route 53 active-passive failover routing should be configured with health checks to automatically or quickly redirect traffic to the secondary region if the primary region's infrastructure becomes degraded.

Adım Adım Çözüm

1
Determine the replication mechanism required to meet the 5-minute RPO constraint.
Amazon Aurora Global Database provides sub-second cross-region replication, which easily satisfies the 5-minute RPO.
Standard replication or backups would introduce higher lag or manual restoration time that could exceed the RPO.
2
Select the appropriate global traffic routing mechanism to achieve the 15-minute RTO during a disaster.
Configure Amazon Route 53 failover routing policy with health checks pointing to the primary Application Load Balancer, with the secondary region as the passive target.
This allows Route 53 to redirect user traffic automatically or with minimal manual intervention to the secondary region when the primary becomes unavailable.
3
Validate the high availability design of the supporting infrastructure components.
Ensure redundant NAT Gateways are deployed per Availability Zone, and avoid relying on passive RDS Multi-AZ standbys for read traffic scaling.
A resilient architecture must not contain single points of failure like a single NAT Gateway, and must correctly utilize read replicas rather than standbys for read scaling.

Anahtar Kavram

Multi-region disaster recovery using Aurora Global Database replication and Route 53 Active-Passive failover routing.
Soru 592Soru →

A global e-commerce and logistics company manages its multi-account environment using AWS Organizations. The core network consists of a central Hub VPC in a Shared Services account and several spoke VPCs in Line of Business (LoB) accounts, all interconnected via an AWS Transit Gateway. The Shared Services VPC has an active AWS Direct Connect connection to the on-premises datacenter. The company needs to design a hybrid DNS resolution strategy. On-premises systems must resolve resources in a Private Hosted Zone (PHZ) for `aws.ecommerce.internal` hosted in the Shared Services account. Additionally, all spoke VPCs must resolve both the `aws.ecommerce.internal` domain and the on-premises domain `corp.internal`. Which TWO configurations should the solutions architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In the Shared Services account, create Route 53 Resolver outbound endpoints in the Shared Services VPC. Create an outbound Resolver rule for the `corp.internal` domain pointing to the on-premises DNS servers, share this rule with the organization using AWS Resource Access Manager (RAM), and associate the shared rule with the spoke VPCs.; In the Shared Services account, authorize the association of the `aws.ecommerce.internal` Private Hosted Zone with the spoke VPCs in the LoB accounts using the Route 53 API. In each LoB account, associate the Private Hosted Zone with the respective spoke VPCs. Create Route 53 Resolver inbound endpoints in the Shared Services VPC, and configure the on-premises DNS servers to forward queries for `aws.ecommerce.internal` to the inbound endpoint IP addresses.

Cevap

The configurations to implement are: creating Route 53 Resolver outbound endpoints in the Shared Services VPC, sharing an outbound Resolver rule for `corp.internal` via AWS RAM, and associating it with the spoke VPCs; and authorizing the cross-account association of the `aws.ecommerce.internal` Private Hosted Zone with the spoke VPCs using the Route 53 API, completing the association in each LoB account, and deploying Route 53 Resolver inbound endpoints in the Shared Services VPC for on-premises DNS forwarding.
The correct configurations involve setting up a centralized hybrid DNS hub-and-spoke pattern. To resolve the on-premises domain, outbound Route 53 Resolver endpoints are placed in the central VPC, and an outbound rule for `corp.internal` is shared with LoB accounts via AWS RAM. To resolve the private domain from spoke VPCs, the PHZ in the Shared Services account is authorized and associated with the spoke VPCs using the Route 53 API. To resolve the private domain from on-premises, Route 53 Resolver inbound endpoints are placed in the central VPC, and on-premises DNS servers are configured to forward queries to these endpoints.

Adım Adım Çözüm

1
Set up outbound DNS resolution for the on-premises domain.
Create Route 53 Resolver outbound endpoints in the central Shared Services VPC. Define a Resolver rule for `corp.internal` pointing to on-premises DNS servers, share it with the LoB accounts using AWS RAM, and associate the rule with the spoke VPCs.
This allows all spoke VPCs to forward DNS queries for the on-premises domain to the central outbound endpoints, which send the traffic across the Direct Connect connection to the on-premises DNS servers.
2
Set up cross-account resolution for the AWS private domain.
Authorize the association of the `aws.ecommerce.internal` Private Hosted Zone (PHZ) in the Shared Services account with the spoke VPCs in the LoB accounts, then perform the association in each LoB account.
VPCs can only resolve domains in a PHZ if they are explicitly associated with it. For cross-account VPCs, this requires a two-step authorization and association process.
3
Set up inbound DNS resolution from on-premises.
Create Route 53 Resolver inbound endpoints in the Shared Services VPC. Configure on-premises DNS forwarders to route queries for `aws.ecommerce.internal` to the inbound endpoint IP addresses.
This allows on-premises clients to query the inbound endpoint, which can resolve the PHZ associated with the Shared Services VPC.

Anahtar Kavram

Hybrid DNS routing requires a combination of Route 53 Resolver inbound endpoints (for on-premises to AWS query flow), outbound endpoints and rules shared via AWS RAM (for AWS to on-premises query flow), and cross-account Private Hosted Zone association to enable DNS resolution across different AWS accounts.
Soru 593Soru →

A healthcare software provider uses AWS Organizations to manage 150 member accounts. The security team mandates that a specific IAM role named SecurityAuditRole must exist in all accounts and must be protected from deletion or modification by any local administrator. However, developers in the Research and Development (R&D) Organizational Unit (OU) require full administrative access to create, update, and delete IAM roles for local microservices testing. Which strategy should the solutions architect implement to enforce this governance control with the least administrative overhead?

Cevabı ve açıklamayı göster

Cevap: Attach a Service Control Policy (SCP) to the R&D OU that denies IAM modification and deletion actions where the resource matches the ARN of the SecurityAuditRole, while continuing to grant developers administrative access via local IAM policies.

Cevap

Attach a Service Control Policy (SCP) to the R&D OU that denies IAM modification and deletion actions where the resource matches the ARN of the SecurityAuditRole, while continuing to grant developers administrative access via local IAM policies.
The correct strategy combines a Service Control Policy (SCP) with local IAM policies. The SCP acts as a guardrail by denying IAM delete and modification API actions specifically targeting the ARN of the SecurityAuditRole. Because explicit denies override any allows, this prevents local administrators from modifying the role. Since SCPs do not grant permissions directly, developers still need local IAM policies granting administrative permissions (such as iam:*) to manage other resources in their account.

Adım Adım Çözüm

1
Analyze the requirement to restrict access to a specific resource (SecurityAuditRole) across multiple accounts while allowing administrative actions on other resources of the same type.
Identify that Service Control Policies (SCPs) are the primary mechanism in AWS Organizations to restrict permissions across member accounts.
SCPs allow defining organization-wide guardrails that apply to all users and roles in member accounts, including the root user.
2
Evaluate the interaction between SCPs and local IAM policies.
Determine that an explicit deny in an SCP overrides any local allow permissions. Developers can keep their administrative local IAM policies (allowing iam:*), but the SCP will intercept and block any actions targeting the SecurityAuditRole.
The intersection of the SCP (guardrail) and the local IAM policy (grant) determines the effective permissions.
3
Formulate the SCP rule targeting the ARN of the role: arn:aws:iam::*:role/SecurityAuditRole.
The SCP should deny actions such as iam:DeleteRole, iam:PutRolePolicy, iam:DeleteRolePolicy, iam:AttachRolePolicy, iam:DetachRolePolicy, and iam:UpdateAssumeRolePolicy on this specific resource.
This target matches the role across all accounts in the OU and prevents unauthorized modification.

Anahtar Kavram

Service Control Policies (SCPs) act as permission filters (guardrails) and must be combined with local IAM policies to grant permissions.
Tahmini Süre:2m 30s
Soru 594Soru →

An enterprise is implementing a multi-account strategy using AWS Organizations. Users must authenticate using an external SAML 2.0 Identity Provider (IdP) to access resources in several member accounts. A solutions architect creates the IAM SAML identity provider resource in each target member account and configures the corresponding federated IAM roles. During testing, users are successfully authenticated by the corporate IdP and redirected to AWS, but they receive an Access Denied error when attempting to assume the target IAM role in the member account. Which configuration error is the most likely cause of this issue?

Cevabı ve açıklamayı göster

Cevap: The trust policy of the IAM role in the member account specifies the SAML provider as the federated principal but designates the sts:AssumeRole action instead of sts:AssumeRoleWithSAML.

Cevap

The trust policy of the IAM role in the member account specifies the SAML provider as the federated principal but designates the sts:AssumeRole action instead of sts:AssumeRoleWithSAML.
The trust policy of the IAM role must permit the sts:AssumeRoleWithSAML action and specify the SAML provider as the federated principal. If the action is configured as sts:AssumeRole, STS will reject the SAML assertion because sts:AssumeRole is designed for standard IAM security credentials, not SAML assertions.

Adım Adım Çözüm

1
Examine the authentication flow stage where the error occurs.
The user is successfully authenticated by the IdP and redirected, meaning the SAML assertion is generated correctly, but AWS rejects the role assumption request.
This isolates the failure to the trust verification process on the AWS side when processing the incoming SAML assertion.
2
Analyze the IAM role configuration required for SAML federation.
SAML federation requires a specific API call, sts:AssumeRoleWithSAML, to exchange the assertion for temporary credentials.
The trust policy must permit this specific STS action rather than the standard sts:AssumeRole action used for IAM-based cross-account access.
3
Identify the incorrect trust policy configuration causing the Access Denied error.
A trust policy that specifies the federated SAML principal but maps it to sts:AssumeRole is invalid for SAML exchange, leading to failure.
STS requires the sts:AssumeRoleWithSAML action in the trust policy to match the assertion consumption endpoint protocol.

Anahtar Kavram

SAML 2.0 Federation Trust Relationships and STS Actions
Tahmini Süre:2m 30s
Soru 595Soru →

A software-as-a-service (SaaS) company is designing a multi-region disaster recovery (DR) architecture for a telemetry ingestion application. The workload runs in the primary Region (us-west-2) and uses a secondary Region (us-east-1) for disaster recovery. The business requires a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 15 minutes. The architecture uses Amazon Aurora PostgreSQL for data storage, and external client agents send data to Application Load Balancers (ALBs) in both Regions. The configuration must automate failover while maintaining high availability. Which TWO options should the Solutions Architect implement to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon Aurora Global Database with the primary DB cluster in us-west-2 and a secondary DB cluster in us-east-1.; Configure Route 53 with Failover routing records, using an active health check on the primary Application Load Balancer in us-west-2 and a standby record pointing to the Application Load Balancer in us-east-1.

Cevap

Deploy an Amazon Aurora Global Database across the primary and secondary regions, and configure Route 53 Failover routing records with active health checks to redirect telemetry traffic.
To satisfy the RPO of 5 minutes and RTO of 15 minutes, the solution must utilize continuous data replication and automated DNS failover. Amazon Aurora Global Database provides sub-second replication lag, meeting the RPO, and can be promoted rapidly. Route 53 Failover routing records detect primary endpoint issues via health checks and redirect telemetry traffic to the secondary Region dynamically to satisfy the RTO.

Adım Adım Çözüm

1
Address the database RPO by deploying Amazon Aurora Global Database.
Establishes sub-second cross-region replication from the primary cluster in us-west-2 to the secondary cluster in us-east-1, satisfying the 5-minute RPO requirement.
Traditional backup and restore methods fail to meet the RPO, requiring continuous asynchronous database replication.
2
Address the routing RTO by implementing Route 53 Failover routing.
Directs client traffic to the primary ALB in us-west-2 during normal operations, and automatically shifts traffic to the secondary ALB in us-east-1 if health checks fail.
This automates traffic redirection without manual DNS intervention, completing the failover within the 15-minute RTO.

Anahtar Kavram

Disaster recovery planning using Aurora Global Database for sub-minute RPO and Route 53 Failover routing for automated traffic redirection.
Soru 596Soru →

An enterprise implements a multi-account AWS environment under AWS Organizations. Corporate data analysts authenticate through an external SAML 2.0 Identity Provider (IdP) to access AWS. Upon authentication, users assume a federated role named `SAML-Analyst-Role` in a centralized Identity AWS account (Account ID: `111122223333`). From this role, analysts need to assume a cross-account role named `Athena-Query-Role` in a target Analytics member account (Account ID: `123456789012`) to run database queries. The trust policy for `Athena-Query-Role` in the Analytics account is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:role/SAML-Analyst-Role"
},
"Action": "sts:AssumeRole"
}
]
}

The default `FullAWSAccess` Service Control Policy (SCP) has been detached from the Analytics Organizational Unit (OU) containing the Analytics account, and only the following custom SCP is attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AnalyticsAccessOnly",
"Effect": "Allow",
"Action": [
"athena:*",
"glue:*",
"s3:*",
"kms:*"
],
"Resource": "*"
}
]
}

When data analysts attempt to switch roles to `Athena-Query-Role` from their federated session, they receive an Access Denied error. Which combination of configuration changes will resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Update the SCP on the Analytics OU to include `sts:AssumeRole` in the list of allowed actions, and attach an IAM policy to the `SAML-Analyst-Role` in the Identity account that grants `sts:AssumeRole` permissions on the `Athena-Query-Role` ARN.

Cevap

Update the SCP on the Analytics OU to include `sts:AssumeRole` in the list of allowed actions, and attach an IAM policy to the `SAML-Analyst-Role` in the Identity account that grants `sts:AssumeRole` permissions on the `Athena-Query-Role` ARN.
To resolve the issue, the calling role in the Identity account must be granted permissions to assume the target role, and the Service Control Policy (SCP) of the target account's OU must allow the `sts:AssumeRole` action. Both are required because AWS evaluates both the identity-based policy of the caller and the SCP of the target account for cross-account resource access.

Adım Adım Çözüm

1
Analyze the role transition sequence.
Identify that the user first federates into the Identity account using SAML, and then attempts a cross-account role assumption (sts:AssumeRole) into the Analytics account. Determine that standard cross-account role assumption requires the calling principal to have an identity-based IAM policy allowing `sts:AssumeRole`.
To ensure the calling role has the necessary outbound permissions.
2
Evaluate the impact of the Service Control Policy (SCP) on the target account.
Note that the default `FullAWSAccess` SCP has been detached, and the custom SCP acts as an allow-list which does not include `sts:AssumeRole`. Since SCPs act as guardrails that filter all requests (including cross-account requests) targeting resources in the account, `sts:AssumeRole` must be explicitly added to the SCP.
To prevent the target account boundary from blocking the incoming STS call.
3
Verify the correct STS action to use.
Confirm that `sts:AssumeRole` is the correct action for an IAM role assuming another IAM role, whereas `sts:AssumeRoleWithSAML` is only for the initial federated login.
To prevent misconfiguring the trust policy with an incorrect STS action.

Anahtar Kavram

Cross-account IAM role assumption under restrictive Service Control Policies (SCPs) in a multi-account environment.
Tahmini Süre:2m 30s
Soru 597Soru →

An enterprise manages a multi-account AWS environment under AWS Organizations. The security team wants to establish federated access for its operations team using an external SAML 2.0 Identity Provider (IdP). The operations team must be able to log in and assume the OperationsAdmin role in several member accounts under a specific Organizational Unit (OU). The architecture must prevent any other roles in these member accounts from being assumed via SAML federation, and it must ensure that only authorized SAML assertions can assume the role. Which TWO configurations must the solutions architect implement to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In each member account, create the OperationsAdmin IAM role with a trust policy that allows the sts:AssumeRoleWithSAML action for the SAML Identity Provider principal, and includes a condition verifying that the SAML:aud attribute is set to https://signin.aws.amazon.com/saml.; Attach a Service Control Policy (SCP) to the OU containing the member accounts that denies sts:AssumeRoleWithSAML for all resources except for the Amazon Resource Name (ARN) of the OperationsAdmin role.

Cevap

To configure secure multi-account federation, the OperationsAdmin role must be created in each member account with a trust policy allowing sts:AssumeRoleWithSAML and validating the SAML:aud condition. Additionally, a Service Control Policy (SCP) must be attached to the OU containing the member accounts to deny sts:AssumeRoleWithSAML for all resources except the OperationsAdmin role.
Establishing federated access requires configuring a local trust policy on the target IAM role in each member account that trusts the SAML Identity Provider and allows the sts:AssumeRoleWithSAML action, verifying the SAML:aud condition to prevent unauthorized logins. To enforce a multi-account guardrail that restricts SAML federation exclusively to this role, a Service Control Policy (SCP) must be attached to the OU that denies the sts:AssumeRoleWithSAML action for all resources except the specific role ARN. This combination ensures secure identity federation and organizational compliance.

Adım Adım Çözüm

1
Determine the correct AWS Security Token Service (STS) action required for SAML 2.0 federation trust policies.
Identify that the trust policy of the IAM role must permit the sts:AssumeRoleWithSAML action and contain a condition checking that the SAML:aud attribute matches the AWS SAML endpoint (https://signin.aws.amazon.com/saml).
SAML federation authentication requests are processed via the AssumeRoleWithSAML API operation rather than standard cross-account AssumeRole API calls.
2
Formulate a policy to restrict SAML role assumption to only the OperationsAdmin role across the Organizational Unit (OU).
Create a Service Control Policy (SCP) that uses a Deny effect with a NotResource block pointing to the OperationsAdmin role's ARN, targeting the sts:AssumeRoleWithSAML action.
SCPs act as organizational guardrails. By applying a Deny statement on sts:AssumeRoleWithSAML for all resources except the specified role, the organization prevents the federation of any other role in those accounts.

Anahtar Kavram

Configuring SAML 2.0 federation using trust policies and enforcing multi-account access boundaries with Service Control Policies (SCPs).
Soru 598Soru →

A financial services company manages its multi-account environment using AWS Organizations. The security team has grouped all active workload accounts under a single Workloads Organizational Unit (OU). To comply with strict regulatory frameworks, the security team must enforce the following security policies:

1. All Amazon EBS volumes created in the member accounts must be encrypted at rest.
2. Volume encryption must only use Customer Managed Keys (CMKs) created within the local member accounts. The use of AWS-managed keys (such as aws/ebs) is strictly prohibited.
3. A centralized IAM role named SecurityAuditRole, which is deployed via AWS CloudFormation StackSets to all member accounts, must be protected from deletion or modification by any local administrator.
4. The CloudFormation StackSets service must still be allowed to update the SecurityAuditRole from the Management account during security maintenance windows.

Which solutions architect design represents the most secure and operationally efficient configuration to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Create and attach a Service Control Policy (SCP) to the Workloads OU that denies ec2:CreateVolume and ec2:RunInstances if ec2:Encrypted is false. In the same SCP, deny kms:CreateGrant if kms:KeyManager equals AWS when the request is made via the EC2 service principal. Additionally, deny iam:DeleteRole, iam:UpdateRole, and all policy modification actions targeting the SecurityAuditRole resource, except when the caller is the StackSet execution role AWSCloudFormationStackSetExecutionRole.

Cevap

Create and attach a Service Control Policy (SCP) to the Workloads OU that denies ec2:CreateVolume and ec2:RunInstances if ec2:Encrypted is false. In the same SCP, deny kms:CreateGrant if kms:KeyManager equals AWS when the request is made via the EC2 service principal. Additionally, deny iam:DeleteRole, iam:UpdateRole, and all policy modification actions targeting the SecurityAuditRole resource, except when the caller is the StackSet execution role AWSCloudFormationStackSetExecutionRole.
The correct solution uses a single Service Control Policy (SCP) to implement all guardrails. The first statement ensures EBS encryption by denying volume creation if the encryption flag is false. The second statement blocks the use of AWS-managed keys by checking the kms:KeyManager condition key (which is set to AWS for AWS-managed keys and CUSTOMER for customer-managed keys) and denying the kms:CreateGrant action when called by the EC2 service. The third statement prevents modification of the SecurityAuditRole by local administrators while explicitly exempting the StackSet execution role, which is the standard mechanism for StackSets to manage resources across accounts.

Adım Adım Çözüm

1
Enforce EBS Encryption at rest using an SCP.
Use an SCP with a deny statement that blocks ec2:CreateVolume and ec2:RunInstances if the ec2:Encrypted condition key is false.
This guarantees that no volume can be created unless encryption is requested and enabled.
2
Enforce Customer Managed Keys (CMKs) and block AWS-managed keys.
Restrict kms:CreateGrant actions by denying requests where the resource uses a key managed by AWS (kms:KeyManager equals AWS) and the request is initiated via EC2.
AWS-managed keys (like aws/ebs) have kms:KeyManager set to AWS, whereas Customer Managed Keys have it set to CUSTOMER. Denying grants on AWS-managed keys forces the use of CMKs.
3
Protect the SecurityAuditRole from local modification while allowing CloudFormation StackSets.
Add an SCP deny statement targeting iam:DeleteRole, iam:UpdateRole, and policy changes for the specific role resource, adding a Condition of StringNotLike or ArnNotEquals for the AWSCloudFormationStackSetExecutionRole.
This allows the StackSet execution role to modify the role during automated deployments while blocking local administrators in the member accounts.

Anahtar Kavram

Organizational governance using Service Control Policies (SCPs) to establish security guardrails without granting permissions, utilizing KMS condition keys (kms:KeyManager) to enforce key ownership requirements, and managing cross-account deployment roles (AWSCloudFormationStackSetExecutionRole) safely.
Tahmini Süre:3m 0s
Soru 599Soru →

A global financial technology enterprise is migrating its core banking ledger to AWS. The hybrid network architecture consists of an on-premises mainframe data center and a multi-account AWS environment managed by AWS Organizations. The on-premises DNS servers host the `onprem.bank.internal` zone. A central transit VPC is deployed in a dedicated `Network` AWS account, which is connected to the on-premises network via AWS Direct Connect and an AWS Transit Gateway. Separate business units run workloads in their own AWS accounts (such as `Account-A` and `Account-B`), with each VPC attached to the central Transit Gateway. A Private Hosted Zone (PHZ) for `cloud.bank.internal` is created in a centralized `SharedServices` AWS account. The enterprise requires that:

1. On-premises systems must resolve resource records in `cloud.bank.internal`.
2. Workloads in `Account-A` and `Account-B` must resolve resource records in both `onprem.bank.internal` and `cloud.bank.internal`.
3. DNS queries and network traffic must not traverse the public internet, and administrative overhead must be minimized.

Which TWO actions must a solutions architect perform to implement this hybrid and multi-account DNS architecture? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In the `Network` account, create a Route 53 Resolver outbound endpoint in the transit VPC. Create a resolver rule for `onprem.bank.internal` pointing to the on-premises DNS servers, associate the rule with the outbound endpoint, share the rule with the AWS Organization using AWS Resource Access Manager (RAM), and associate the shared rule with the VPCs in `Account-A` and `Account-B`.; In the `Network` account, create Route 53 Resolver inbound endpoints in the transit VPC, and configure the on-premises DNS servers to forward queries for `cloud.bank.internal` to the inbound endpoint IP addresses. Authorize cross-account VPC associations for the `cloud.bank.internal` hosted zone from the `SharedServices` account to the transit VPC and the VPCs in `Account-A` and `Account-B`, and associate the VPCs in their respective accounts.

Cevap

To resolve the on-premises domain, create a Route 53 Resolver outbound endpoint in the transit VPC, associate it with a forwarding rule for the on-premises domain, share the rule via AWS RAM, and associate it with the application VPCs. To resolve the AWS private hosted zone from on-premises, create Route 53 Resolver inbound endpoints in the transit VPC and forward queries from on-premises. To resolve it from the application VPCs, authorize and associate the private hosted zone in the shared services account with the transit and application VPCs.
To establish hybrid DNS resolution, a centralized outbound endpoint in the transit VPC (which has Direct Connect/VPN connectivity) handles queries from AWS to on-premises. The forwarding rule is shared via AWS RAM so that spoke VPCs in other accounts can reuse the central endpoint, avoiding redundant deployments. For on-premises systems to resolve AWS records, inbound endpoints are deployed in the transit VPC. To allow the spoke and transit VPCs to resolve the private hosted zone hosted in the central shared services account, cross-account VPC association authorizations must be created by the zone owner and accepted by the VPC owners, as Private Hosted Zones cannot be shared via AWS RAM.

Adım Adım Çözüm

1
Deploy Route 53 Resolver outbound endpoints in the centralized transit VPC which has direct hybrid connectivity to the on-premises network.
The transit VPC can forward DNS queries to the on-premises DNS servers IP addresses.
Outbound DNS resolution from AWS to on-premises requires network paths and outbound endpoints situated in a VPC connected to the on-premises environment.
2
Create a Route 53 Resolver forwarding rule for the on-premises domain in the central network account, associate it with the outbound endpoint, and share the rule via AWS RAM with the organization.
The forwarding rule becomes available for association in the application accounts.
Sharing the rule via AWS RAM prevents the need to deploy costly outbound endpoints in every individual spoke VPC.
3
In the application accounts, associate the shared resolver rule with the application VPCs.
Workloads in the application VPCs can resolve the on-premises domain.
Associating the shared rule directs the local VPC resolvers to route queries for the on-premises domain through the central outbound endpoint.
4
In the central network account, create Route 53 Resolver inbound endpoints in the transit VPC, and configure the on-premises DNS servers to forward queries for the AWS private domain to the inbound endpoint IP addresses.
On-premises systems can reach the inbound endpoints and resolve AWS internal records.
Inbound endpoints act as forwarding targets for external DNS servers to resolve private hosted zones within AWS.
5
From the shared services account, authorize cross-account VPC associations for the private hosted zone to the transit VPC and the application VPCs. From the respective owner accounts, accept and complete the associations.
The private hosted zone is associated with all VPCs across the accounts.
Since Private Hosted Zones cannot be shared via AWS RAM, cross-account VPC association authorization and association API calls are required to allow the VPCs to resolve records in the hosted zone.

Anahtar Kavram

Route 53 Resolver Endpoints and Cross-Account Private Hosted Zone Association
Soru 600Soru →

An enterprise manages its multi-account environment using AWS Organizations. The organization consists of Production, Development, and Sandbox OUs, along with dedicated Shared Services and Security accounts. The billing department has specified that the Sandbox accounts, which are leased to a third-party contractor, must receive customized pro-forma billing reports showing a 10%10\% markup on AWS list prices instead of the enterprise's negotiated rates. Additionally, the contractor's Sandbox accounts must be excluded from benefiting from the enterprise's Compute Savings Plans. For network optimization, VPC subnets from the Shared Services account must be shared with the Production and Development accounts, but not the Sandbox accounts. Developers in the Production and Development accounts must be able to launch Amazon EC2 instances with encrypted EBS volumes using a Customer Managed Key (CMK) managed in the central Security account.

Which TWO of the following solutions should the Solutions Architect implement to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a billing group in AWS Billing Conductor with the Sandbox accounts as members. Define a custom pricing plan with a markup rate of 10%10\% and associate it with this billing group. In the Billing Preferences of the Management account, disable Savings Plans discount sharing for the Sandbox accounts.; Share the subnets from the Shared Services account to the Production and Development OUs using AWS Resource Access Manager (RAM). In the Security account, create a KMS Customer Managed Key (CMK) and configure its key policy to allow the IAM roles and EC2 service-linked roles in the application accounts to perform kms:CreateGrant and kms:Decrypt operations.

Cevap

The correct strategy requires configuring AWS Billing Conductor for pro-forma billing with markup, disabling Savings Plans discount sharing for Sandbox accounts in Billing Preferences, sharing the subnets with the Production and Development OUs via AWS RAM, and sharing a Customer Managed Key from the Security account with the application accounts with permissions to create grants and decrypt.
The correct solution correctly combines AWS Billing Conductor (to model custom pricing and generate pro-forma invoices with markups) and the Billing Preferences console (to turn off Savings Plans discount sharing for designated accounts). It also utilizes AWS Resource Access Manager (RAM) to target the specific OUs (Production and Development) for subnet sharing. For cross-account KMS encryption of EBS volumes, a Customer Managed Key is used, which allows cross-account delegation via key policy, granting the necessary decrypt and grant creation permissions to the app accounts' roles.

Adım Adım Çözüm

1
Identify the billing and cost management mechanism to generate custom pricing plans (pro-forma bills) for Sandbox accounts.
Use AWS Billing Conductor to define a billing group containing the Sandbox accounts and apply a pricing plan with a 10%10\% markup.
This generates customized reports showing a markup on AWS list prices without altering actual billing.
2
Configure Savings Plans sharing exclusion.
Navigate to Billing Preferences in the Management account and disable discount sharing for the Sandbox accounts.
This prevents the contractor's accounts from consuming the organization's Compute Savings Plans.
3
Set up secure resource sharing.
Share the subnets from the Shared Services account to the Production and Development OUs using AWS Resource Access Manager (RAM). Do not share these resources with the Sandbox accounts or OUs.
This allows the application accounts to run instances in shared subnets while isolating the Sandbox environment.
4
Configure cross-account KMS key sharing for EC2 EBS encryption.
Create a Customer Managed Key (CMK) in the Security account and update the key policy to grant the application accounts' IAM roles and the EC2 service-linked roles the rights to perform kms:Decrypt and kms:CreateGrant.
This allows EC2 to create a grant on the key to attach and decrypt the volume under the service-linked role.

Anahtar Kavram

Consolidated billing customization, Savings Plans discount sharing configuration, AWS Resource Access Manager (RAM) subnet sharing, and cross-account Customer Managed Key policy permissions.
Tahmini Süre:3m 0s
ÖncekiSayfa 30 / 99Sonraki
Tüm alıştırma soruları — AWS Certified Solutions Architect - Professional | Examkin