Design Secure Architectures

1. An organization uses AWS Organizations. Security requires that no member account can stop or delete AWS CloudTrail trails, even by an account administrator. Which solution meets these requirements?

1. A Create an AWS Config rule that detects when a trail is stopped and re-enables it.
2. B Attach a permissions boundary that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail to the root user of each member account.
3. C Attach a service control policy to the organizational unit that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.
4. D Attach an IAM policy that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail to every administrator role in each member account.

2. A mobile application must let users sign in with an existing corporate SAML identity provider and then call AWS APIs with credentials scoped to a specific role. Which solution meets these requirements?

1. A Create an IAM user for each mobile user and distribute long-term access keys to the devices.
2. B Federate through AWS IAM Identity Center or call AssumeRoleWithSAML to exchange the assertion for temporary credentials.
3. C Use the AWS account root user credentials over an HTTPS connection from the device.
4. D Embed a shared IAM access key and secret key in the application package.

3. A security investigator must read the contents of one Amazon S3 prefix during an investigation but must not be able to modify or delete any object. Which solution meets these requirements?

1. A Add a bucket policy that grants public read access to that prefix.
2. B Attach an IAM policy that allows s3:* on the bucket containing that prefix.
3. C Attach an IAM policy that allows only s3:GetObject on that prefix.
4. D Add the investigator as a bucket owner and rely on procedure to prevent modification.

4. A company must let users authenticate to an application with credentials from an existing on-premises Active Directory. Directory data must not be replicated into AWS. Which solution meets these requirements?

1. A Create an Amazon Cognito user pool and import the users from the on-premises directory.
2. B Deploy AWS Directory Service for Microsoft Active Directory and establish a two-way trust with the on-premises directory.
3. C Deploy AWS Directory Service Simple AD and synchronize users from the on-premises directory.
4. D Deploy AWS Directory Service AD Connector and point it at the on-premises directory.

5. A security team must be notified when any resource policy in the organization grants access to a principal outside the organization. Which solution meets these requirements?

1. A Create an AWS Config rule that evaluates resource policies for external principals.
2. B Enable IAM Access Analyzer with the account as the zone of trust and route findings to Amazon EventBridge.
3. C Enable Amazon GuardDuty and route findings for anomalous cross-account access to Amazon EventBridge.
4. D Enable IAM Access Analyzer with the organization as the zone of trust and route findings to Amazon EventBridge.

6. An application running on servers in an on-premises data center must call AWS APIs. No long-term AWS credentials may be stored on those servers. Which solution meets these requirements?

1. A Create an IAM user for the application and store the access keys in a configuration file on each server.
2. B Configure IAM Roles Anywhere with a trust anchor and exchange X.509 certificates for temporary credentials.
3. C Create an IAM user for the application and distribute the access keys through configuration management.
4. D Configure the servers to retrieve credentials from the Amazon EC2 instance metadata service over AWS Direct Connect.

7. A resource policy must grant access to any principal in the company's AWS Organization, and must remain correct as accounts are added and removed. Which solution meets these requirements?

1. A Add a condition to the resource policy that requires aws:SourceVpc to be in a list of the organization's VPC IDs.
2. B Add a condition to the resource policy that requires aws:PrincipalAccount to be in a list of the current account IDs.
3. C Add a condition to the resource policy that requires aws:PrincipalOrgID to equal the organization ID.
4. D Add a condition to the resource policy that requires aws:PrincipalArn to match a wildcard covering the organization's roles.

8. An application must generate time-limited access to individual objects in Amazon S3 for authenticated users, and that access must expire automatically. Which solution meets these requirements?

1. A Add a bucket policy that grants s3:GetObject to authenticated users and remove it after the access period.
2. B Generate presigned URLs with an expiration, signed by credentials whose own lifetime is at least as long.
3. C Generate presigned URLs with an expiration, signed by the AWS account root user access keys.
4. D Enable S3 Block Public Access and grant users s3:GetObject through an IAM policy for the access period.

9. A company runs an application on Amazon EC2 instances in private subnets. The application must read objects from an Amazon S3 bucket. Company policy prohibits any route from the private subnets to the internet, including through NAT devices. Which solution meets these requirements?

1. A Create a NAT gateway in a public subnet and add a default route to it in the private subnet route tables.
2. B Create an interface VPC endpoint for Amazon S3 and add a route to it in the private subnet route tables.
3. C Create a gateway VPC endpoint for Amazon S3 and add a route to it in the private subnet route tables.
4. D Attach an internet gateway to the VPC and add a route to it in the private subnet route tables.

10. A web tier in public subnets must accept HTTPS from the internet. An application tier in private subnets must accept traffic only from the web tier, and the fleet size changes throughout the day. Which solution meets these requirements?

1. A Configure the application tier security group to allow inbound traffic from the web tier security group.
2. B Configure the application tier network ACL to allow inbound traffic from the web tier security group.
3. C Configure the application tier security group to allow inbound traffic from the public subnet CIDR ranges.
4. D Configure the application tier security group to allow inbound traffic from 0.0.0.0/0 and restrict traffic with a network ACL.

11. An Amazon RDS database in private subnets must be reachable by an application in a VPC owned by another AWS account. The database must not be reachable from the internet. Which combination of steps meets these requirements? (Select TWO.)

1. A Attach an internet gateway to the database VPC and add a route for the peer VPC CIDR.
2. B Create a VPC peering connection between the two VPCs and add routes to the peer CIDR in both route tables.
3. C Create a NAT gateway in the database VPC and route peer traffic through it.
4. D Move the database to a public subnet and restrict access with a security group.
5. E Modify the database security group to allow inbound traffic from the peer VPC CIDR range.

12. Instances in private subnets must call a partner API over the internet. The partner allows traffic only from a small, fixed set of public IP addresses. Which solution meets these requirements?

1. A Assign an Elastic IP address to each instance and give the partner those addresses.
2. B Create an AWS PrivateLink endpoint to the partner API and give the partner the endpoint identifier.
3. C Route outbound traffic through NAT gateways with Elastic IP addresses and give the partner those addresses.
4. D Route outbound traffic through an internet gateway and give the partner the VPC CIDR range.

13. An application on Amazon EC2 in private subnets must read from one Amazon DynamoDB table. Traffic must not traverse the internet, and the instances must not be able to reach any other table. Which combination of steps meets these requirements? (Select TWO.)

1. A Attach an IAM role to the instances with a policy that allows dynamodb:* on all resources.
2. B Create a NAT gateway with an Elastic IP address and route DynamoDB traffic through it.
3. C Create a gateway VPC endpoint for DynamoDB and add a route to it in the private subnet route tables.
4. D Add a bucket policy to the DynamoDB table that allows access only from the VPC.
5. E Attach an IAM role to the instances with a policy that allows the required actions on that table ARN only.

14. An Amazon API Gateway REST API must remain publicly routable but must accept requests only from the company's office network. Which solution meets these requirements?

1. A Convert the API to a private API and associate it with an interface VPC endpoint.
2. B Require an API key on every method and distribute the key to office users.
3. C Attach a resource policy to the API that denies requests when aws:SourceIp is outside the office CIDR ranges.
4. D Attach a security group to the API that allows inbound traffic only from the office CIDR ranges.

15. A company must expose one internal service to dozens of consumer VPCs in other accounts. Consumers must reach that service only, and no routed path may exist between the networks. Which solution meets these requirements?

1. A Attach the provider VPC and all consumer VPCs to a transit gateway and add routes for the service subnet.
2. B Create a VPC peering connection from the provider VPC to each consumer VPC and add routes for the service subnet.
3. C Expose the service through an internet-facing Application Load Balancer and restrict access with IP allow-lists.
4. D Publish the service as an AWS PrivateLink endpoint service behind a Network Load Balancer and have consumers create interface endpoints.

16. A public web application is subject to credential stuffing attacks against its sign-in endpoint. Which solution provides the MOST effective mitigation?

1. A Configure a security group that allows inbound traffic only on port 443.
2. B Associate an AWS WAF web ACL that includes only a rate-based rule set to a high threshold.
3. C Enable AWS Shield Standard on the application endpoint.
4. D Associate an AWS WAF web ACL that includes the account takeover prevention managed rule group and a rate-based rule.

17. Engineers require interactive shell access to Amazon EC2 instances in private subnets. No inbound ports may be opened, no bastion host may be deployed, and every session must be recorded. Which solution meets these requirements?

1. A Deploy an EC2 Instance Connect Endpoint and restrict access with a security group.
2. B Use AWS Systems Manager Session Manager and configure session logging to Amazon CloudWatch Logs or Amazon S3.
3. C Use AWS Systems Manager Session Manager without configuring session logging.
4. D Deploy a bastion host in a public subnet and restrict SSH access to the office CIDR range.

18. Traffic between clients and an Application Load Balancer is encrypted. Compliance requires that traffic between the load balancer and its Amazon EC2 targets is also encrypted. Which combination of steps meets these requirements? (Select TWO.)

1. A Enable access logging on the load balancer and store the logs in an encrypted S3 bucket.
2. B Configure the target group protocol as HTTPS.
3. C Configure a security group that allows only port 443 inbound to the target instances.
4. D Install a TLS certificate on each target instance and configure the application to terminate TLS.
5. E Enable encryption at rest on the EBS volumes attached to the target instances.

19. An application on Amazon EC2 must read a database password at run time. The password must rotate every 30 days without any change to application code or configuration. Which solution meets these requirements with the LEAST operational overhead?

1. A Store the password in AWS Systems Manager Parameter Store as a String parameter and grant the instance profile permission to retrieve it.
2. B Store the password in an encrypted Amazon S3 object and download it when the application starts.
3. C Store the password in AWS Secrets Manager, enable automatic rotation, and grant the instance profile permission to retrieve the secret.
4. D Store the password as an environment variable in the launch template and replace the template every 30 days.

20. A company must ensure that every object written to an Amazon S3 bucket is encrypted with one specific AWS KMS key. Uploads that request a different key or no encryption must be rejected. Which solution meets these requirements?

1. A Enable default encryption on the bucket and specify the required KMS key.
2. B Add a bucket policy that denies s3:PutObject when s3:x-amz-server-side-encryption-aws-kms-key-id does not match the required key ARN.
3. C Create an S3 Lifecycle rule that re-encrypts objects with the required KMS key after upload.
4. D Enable S3 Block Public Access on the bucket and specify the required KMS key.

21. A company must encrypt an Amazon EFS file system at rest and encrypt traffic between Amazon EC2 instances and the file system. Which combination of steps meets these requirements? (Select TWO.)

1. A Enable encryption at rest when the file system is created.
2. B Mount the file system with the TLS option by using the EFS mount helper.
3. C Place the file system and the instances in the same private subnet.
4. D Enable encryption at rest on the existing file system after creation.
5. E Attach an IAM policy that restricts which principals may mount the file system.

22. An application must verify that an object retrieved from Amazon S3 is byte-for-byte identical to the object that was uploaded. Which solution meets these requirements?

1. A Configure the bucket policy to deny requests that do not originate from the uploading account.
2. B Enable an additional checksum algorithm on upload and compare the stored checksum with one computed on retrieval.
3. C Enable S3 server access logging and compare the object size recorded in the log with the retrieved object.
4. D Enable S3 Versioning on the bucket and compare the current version ID with the version ID recorded at upload.

23. A company stores customer documents in Amazon S3. A document deleted by a user must remain recoverable for 30 days and must then be removed permanently. Which solution meets these requirements?

1. A Enable S3 Object Lock in governance mode with a 30-day retention period.
2. B Enable S3 Versioning and add a Lifecycle rule that expires current versions after 30 days.
3. C Configure S3 Cross-Region Replication to a backup bucket and delete objects from the backup after 30 days.
4. D Enable S3 Versioning and add a Lifecycle rule that expires noncurrent versions after 30 days.

24. Thousands of teams share one Amazon S3 bucket, each with its own prefix and distinct permissions. The bucket policy has reached its size limit. Which solution meets these requirements?

1. A Create a separate S3 bucket for each team with a bucket policy scoped to that team.
2. B Create an S3 Access Point for each team with an access point policy scoped to that team's prefix.
3. C Consolidate the statements in the existing bucket policy and reference IAM groups instead of users.
4. D Create an IAM role for each team and attach an inline policy scoped to that team's prefix.

25. A company must ensure that every new Amazon EBS volume and snapshot in an account is encrypted, without depending on users selecting the option. Which solution meets these requirements?

1. A Create an AWS Config rule that reports unencrypted volumes and remediates them.
2. B Enable EBS encryption by default in each Region of the account.
3. C Apply a tag policy that requires an encryption tag on every volume.
4. D Attach an IAM policy that denies ec2:CreateVolume when the encrypted parameter is false.

26. A task running on Amazon ECS with the Fargate launch type must retrieve one secret from AWS Secrets Manager. The secret is encrypted with a customer managed AWS KMS key. Which combination of steps meets these requirements? (Select TWO.)

1. A Grant the task role kms:Decrypt on the customer managed key in the key policy.
2. B Attach a policy to the task execution role that allows secretsmanager:* on all secrets.
3. C Attach a task role with a policy that allows secretsmanager:GetSecretValue on that secret ARN.
4. D Attach an instance profile with the required permissions to the underlying container host.
5. E Set the secret value as a plaintext environment variable in the task definition.

27. Objects in an Amazon S3 bucket must remain readable only to principals that also hold permission on a specific encryption key, so that object-level permissions alone are insufficient. Which solution meets these requirements?

1. A Enable S3 Block Public Access on the bucket and restrict the bucket policy to the intended principals.
2. B Configure the bucket to use server-side encryption with Amazon S3 managed keys and restrict the bucket policy to the intended principals.
3. C Enable S3 Versioning on the bucket and restrict the bucket policy to the intended principals.
4. D Configure the bucket to use server-side encryption with a customer managed AWS KMS key and restrict the key policy to the intended principals.

28. A compliance archive in Amazon S3 must be provably unaltered for seven years, and no principal including the account root user may delete or overwrite an object version during that period. Which combination of steps meets these requirements? (Select TWO.)

1. A Enable S3 Object Lock in compliance mode with a seven-year retention period on a versioned bucket.
2. B Add a bucket policy that denies s3:DeleteObject and s3:DeleteObjectVersion to all principals.
3. C Enable MFA Delete on the bucket and require multi-factor authentication for version deletion.
4. D Enable S3 Object Lock in governance mode with a seven-year retention period on a versioned bucket.
5. E Record an additional checksum on upload so integrity can be verified independently on retrieval.

29. A company must guarantee that no Amazon S3 bucket in an account can be made publicly accessible, including buckets created in the future. Which solution meets these requirements?

1. A Enable S3 Block Public Access at the account level.
2. B Add a bucket policy to each bucket that denies s3:PutBucketPolicy and s3:PutBucketAcl.
3. C Create an AWS Config rule that detects public buckets and removes the public grants.
4. D Enable S3 Block Public Access on each existing bucket.

30. An application on Amazon EC2 must access an S3 bucket in a different account. Which solution meets these requirements?

1. A Make the bucket public and restrict it by source IP address.
2. B Store access keys from the other account on the instance.
3. C Copy the bucket's contents into the application's own account.
4. D Attach an instance profile whose role is permitted in the bucket's policy in the other account.

31. A company must allow employees to sign in to the AWS Management Console using their existing corporate credentials. Which solution meets these requirements?

1. A Create an Amazon Cognito user pool for the employees.
2. B Share a single IAM user among the employees.
3. C Configure AWS IAM Identity Center with the corporate identity provider as the identity source.
4. D Create an IAM user for each employee with a password.

32. An IAM policy must permit an action only when the request comes from a specific VPC endpoint. Which element is required?

1. A A principal naming the endpoint.
2. B A resource ARN naming the endpoint.
3. C A condition on aws:sourceVpce matching the endpoint identifier.
4. D An action permitting the endpoint service.

33. A solution must grant a mobile application's users temporary AWS credentials scoped to their own data. Which solution meets these requirements?

1. A Embed IAM access keys in the mobile application.
2. B Use Amazon Cognito identity pools to exchange a user's authentication for temporary credentials with a policy variable scoping access to their identity.
3. C Create an IAM user for each mobile user.
4. D Use a shared IAM role with full access to the data store.

34. An application's database credentials must be rotated automatically and retrieved by the application at run time. Which solution meets these requirements?

1. A Store the credentials in AWS Secrets Manager with rotation enabled and retrieve them from the application.
2. B Store the credentials in the application's environment variables.
3. C Store the credentials in an encrypted file in the deployment package.
4. D Store the credentials in a Systems Manager Parameter Store String parameter.

35. An Amazon EC2 instance in a private subnet must download operating system updates from the internet without being reachable from it. Which solution meets these requirements?

1. A Place the instance in a public subnet with a restrictive security group.
2. B Route the subnet's outbound traffic through a NAT gateway in a public subnet.
3. C Attach an internet gateway route to the private subnet.
4. D Assign an Elastic IP address to the instance.

36. A web application must be protected from SQL injection attempts. Which solution meets these requirements?

1. A Associate an AWS WAF web ACL with the appropriate managed rule group to the application's load balancer or distribution.
2. B Enable AWS Shield Standard on the load balancer.
3. C Restrict the load balancer's security group to port 443.
4. D Enable VPC Flow Logs on the application's subnets.

37. Instances in an Auto Scaling group must be permitted to reach a database, and the group's instances change frequently. Which security group configuration is appropriate?

1. A Permit the entire VPC CIDR range in the database's inbound rule.
2. B List each instance's private IP address in the database's inbound rule.
3. C Permit all traffic and rely on the database's own authentication.
4. D Reference the instances' security group as the source in the database's inbound rule.

38. Objects in an Amazon S3 bucket must be encrypted, and the encryption key's use must be auditable. Which solution meets these requirements?

1. A Enable S3 Versioning on the bucket.
2. B Configure server-side encryption with a customer managed AWS KMS key and review its use in AWS CloudTrail.
3. C Configure server-side encryption with Amazon S3 managed keys.
4. D Enable S3 Block Public Access on the bucket.

39. Data on an Amazon EBS volume attached to an existing unencrypted instance must be encrypted. Which solution meets these requirements?

1. A Enable EBS encryption by default in the Region.
2. B Take a snapshot and restore it to the same volume.
3. C Create a snapshot, copy it with encryption enabled, create a volume from the encrypted copy, and attach it.
4. D Enable encryption on the existing volume in place.

40. A company must retain S3 objects so that no user can delete them before a retention period expires. Which solution meets these requirements?

1. A Enable MFA Delete on the bucket.
2. B Enable S3 Versioning and apply a bucket policy denying deletes.
3. C Enable S3 Object Lock in compliance mode with the required retention period on a versioned bucket.
4. D Move the objects to S3 Glacier Deep Archive.

41. Traffic between an Application Load Balancer and its EC2 targets must be encrypted. Which solution meets these requirements?

1. A Configure the listener protocol as HTTPS and leave the target group on HTTP.
2. B Enable encryption at rest on the targets' EBS volumes.
3. C Configure the target group protocol as HTTPS and install certificates on the targets.
4. D Place the load balancer and targets in the same Availability Zone.

42. An application must assume different roles depending on which customer's data it is processing. Which solution meets these requirements?

1. A Use one role with access to every customer's resources.
2. B Grant the application administrator access.
3. C Create an IAM user for each customer.
4. D Assume a customer-specific role per request with a session policy scoping access to that customer's resources.

43. An IAM policy must permit an action only when the caller has authenticated with multi-factor authentication. Which element is required?

1. A A condition on aws:MultiFactorAuthPresent.
2. B A condition on aws:PrincipalOrgID.
3. C A condition on aws:SourceIp.
4. D A condition on aws:SecureTransport.

44. A solution must grant an on-premises application access to AWS without long-term credentials. Which solution meets these requirements?

1. A Use IAM Roles Anywhere so a certificate is exchanged for temporary credentials.
2. B Use the account root user credentials.
3. C Create an IAM user and store its access keys on the server.
4. D Share credentials from an EC2 instance profile.

45. An organization must prevent any principal outside the organization from assuming its roles. Which solution meets these requirements?

1. A Require multi-factor authentication for role assumption.
2. B Remove all cross-account trust relationships.
3. C Add a condition on aws:SourceIp to the trust policies.
4. D Add a condition on aws:PrincipalOrgID to the roles' trust policies.

46. A federated user must receive permissions determined by a group in the corporate directory. Which solution meets these requirements?

1. A Assign permissions manually after each sign-in.
2. B Create an IAM user for each directory member.
3. C Map the directory group to a permission set in AWS IAM Identity Center so membership determines access.
4. D Grant every federated user the same role.

47. An application must be prevented from using credentials outside a specific VPC. Which solution meets these requirements?

1. A Shorten the role's session duration.
2. B Add a condition on aws:sourceVpce or aws:SourceVpc to the role's policy.
3. C Place the application in a private subnet.
4. D Restrict the application's security group.

48. Objects uploaded to Amazon S3 must be encrypted with a key that AWS cannot access. Which solution meets these requirements?

1. A Use server-side encryption with a customer managed AWS KMS key.
2. B Enable default encryption on the bucket.
3. C Use server-side encryption with Amazon S3 managed keys.
4. D Encrypt the objects client-side with a key the organization holds outside AWS.

49. An RDS database's automated backups must be encrypted. Which consideration applies?

1. A Backups can be encrypted independently of the instance.
2. B Backups inherit the instance's encryption, so the instance must be encrypted at creation.
3. C Encryption can be enabled on existing backups.
4. D Backups are always encrypted regardless of the instance.

50. Data on an Amazon EFS file system must be encrypted in transit between instances and the file system. Which configuration is required?

1. A Enable encryption at rest on the file system.
2. B Place the instances and file system in the same subnet.
3. C Restrict the file system's security group.
4. D Mount the file system with the TLS option so traffic is encrypted.

51. An organization must discover which S3 buckets contain personally identifiable information. Which solution meets these requirements?

1. A Enable AWS Config rules for the buckets.
2. B Run an AWS Glue crawler over the buckets.
3. C Enable S3 server access logging.
4. D Run Amazon Macie sensitive data discovery jobs against the buckets.

52. A DynamoDB table's data must be encrypted with a key the organization controls and audits. Which configuration is appropriate?

1. A Rely on the default encryption at rest.
2. B Configure the table to use a customer managed AWS KMS key.
3. C Enable point-in-time recovery on the table.
4. D Encrypt the values in the application before writing.

53. An organization must ensure that snapshots shared with another account remain encrypted. Which configuration is required?

1. A Share the snapshot without encryption.
2. B Copy the snapshot to the other account's Region.
3. C Make the snapshot public.
4. D Encrypt the snapshot with a customer managed key and grant the other account permission to use that key.