I85PREP
⌘ K
AWS Solutions Architect study materials
AWS Solutions Architect study resources

AWS Solutions Architect practice questions

One question at a time. Build your AWS Solutions Architect understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Design Secure Architectures

An IAM user belongs to a group whose policy allows s3:GetObject on a bucket. A separate inline user policy explicitly denies s3:GetObject on the same bucket. What is the outcome?

  1. Allowed, but only when MFA is present.
  2. Denied, because explicit deny wins. Correct answer.
  3. Allowed, because the group policy grants it.
  4. Denied only if the bucket policy also denies it.

Explanation

IAM evaluates all applicable policies and any explicit deny anywhere in the chain overrides every allow. Group membership does not change that precedence, and a bucket policy deny is not required for the inline deny to take effect.

Question 2Design Secure Architectures

Which measure most directly reduces the risk of compromise of the AWS account root user?

  1. Attach an administrator policy to the root user.
  2. Delete the root access key and use it only for CLI work.
  3. Enable MFA and avoid creating root access keys. Correct answer.
  4. Store root credentials in Secrets Manager for rotation.

Explanation

The root user cannot be restricted by IAM policies, so the practical controls are strong MFA on the account and not creating long-lived root access keys. Routine administrative work should be performed with IAM roles or users instead.

Question 3Design Secure Architectures

A web tier must accept HTTPS from the internet, and a database tier must accept traffic only from the web tier. Which configuration enforces this with security groups?

  1. Place both tiers in one group open to the VPC CIDR.
  2. Allow 0.0.0.0/0 on the database group and filter at the OS.
  3. Allow the web tier's private IP range in the database group.
  4. Use the web tier's security group as the source. Correct answer.

Explanation

A security group rule can name another security group as its source, so instances are permitted based on group membership rather than IP addresses. That keeps the rule valid as the web tier scales or changes addresses.

Question 4Design Secure Architectures

Which Amazon S3 default encryption option produces per-object key usage entries in CloudTrail and lets you govern access with a key policy?

  1. Client-side encryption
  2. SSE-S3
  3. SSE-C
  4. SSE-KMS Correct answer.

Explanation

SSE-KMS uses AWS KMS keys whose usage is logged in CloudTrail and whose access is governed by key policies and IAM. SSE-S3 and SSE-C use keys that are not customer-governed KMS keys with per-key audit trails.

Question 5Design Secure Architectures

An application running on Amazon EC2 must read objects from Amazon S3. What is the secure way to provide credentials?

  1. Create an IAM user and embed keys in the code.
  2. Put the root access keys in user data.
  3. Ship long-lived keys inside a shared encrypted AMI.
  4. Attach an IAM role to the instance profile. Correct answer.

Explanation

An instance profile delivers temporary, automatically rotated credentials to the instance through the instance metadata service. Embedding static keys in code, user data, or AMIs spreads long-lived secrets that are hard to revoke.

Question 6Design Secure Architectures

Which AWS service records API activity in an account for security auditing and incident investigation?

  1. AWS CloudTrail Correct answer.
  2. Amazon CloudWatch
  3. AWS Trusted Advisor
  4. AWS Config

Explanation

CloudTrail logs API calls, including the identity, source IP, and time of each request, which supports auditing and forensics. CloudWatch handles metrics and logs, Config tracks resource configuration, and Trusted Advisor gives best-practice checks.

Question 7Design Secure Architectures

An S3 bucket with versioning enabled must be protected against permanent deletion of object versions. Which feature adds that protection?

  1. Enable default encryption with SSE-S3.
  2. Enable MFA Delete on the bucket. Correct answer.
  3. Enable S3 Transfer Acceleration for uploads.
  4. Require presigned URLs for every delete call.

Explanation

MFA Delete requires an additional authentication factor before object versions or the bucket versioning state can be permanently removed. Versioning alone only keeps prior versions, it does not stop an authorized caller from deleting them.

Question 8Design Secure Architectures

Which service is purpose-built to store and automatically rotate database credentials?

  1. AWS Secrets Manager Correct answer.
  2. S3 Object Lock
  3. AWS Config
  4. IAM Access Analyzer

Explanation

Secrets Manager stores secrets and can rotate them on a schedule using a Lambda rotation function, with native support for Amazon RDS and Amazon Redshift credentials. The other services address compliance, access analysis, and immutability.

Question 9Design Secure Architectures

An IAM user has an identity policy granting s3:* and a permissions boundary that allows only s3:GetObject. What are the user's effective S3 permissions?

  1. No S3 access at all
  2. All s3:* actions except s3:DeleteObject
  3. All s3:* actions from the identity policy
  4. Only s3:GetObject Correct answer.

Explanation

Effective permissions are the intersection of identity-based policies and the permissions boundary, so only the actions allowed by both remain. Here the boundary limits the user to s3:GetObject.

Question 10Design Secure Architectures

An organization has an SCP on an OU that denies ec2:RunInstances for all member accounts, and a user in one member account has an administrator policy. Can that user launch an EC2 instance?

  1. Yes, an administrator policy always wins inside the account.
  2. Yes, if the user has MFA configured.
  3. Yes, if the user signs in as the account root user.
  4. No, because SCPs cap account permissions. Correct answer.

Explanation

Service control policies set the maximum permissions available to principals in member accounts, and identity policies can only grant a subset of that ceiling. An explicit deny in an SCP therefore blocks the action regardless of in-account administrator access.

Question 11Design Secure Architectures

A team in account A must read objects from a bucket in account B. Which combination enables cross-account access?

  1. An IAM user in B whose keys are shared with A.
  2. A VPC peering connection between the two accounts.
  3. A bucket ACL that grants A's canonical user.
  4. A role in B trusting A, plus sts:AssumeRole in A. Correct answer.

Explanation

Cross-account access is normally granted by a role in the trusting account whose trust policy names the other account, plus permission in the trusted account to call sts:AssumeRole. The caller then receives temporary credentials scoped to that role.

Question 12Design Secure Architectures

Instances in a private subnet must reach Amazon S3 without using the public internet, and cost should be minimized. Which solution fits?

  1. An interface endpoint in each subnet.
  2. A gateway VPC endpoint with a route table entry. Correct answer.
  3. A site-to-site VPN to an S3 public endpoint.
  4. A NAT gateway in each Availability Zone.

Explanation

A gateway endpoint for S3 attaches to route tables, keeps traffic on the AWS network, and has no hourly or data processing charge. Interface endpoints work but create billable elastic network interfaces in each subnet.

Question 13Design Secure Architectures

A bucket policy allows public read access, but the account-level S3 Block Public Access setting is enabled. What is the result?

  1. The policy applies but only to IAM users.
  2. Only ACL-based public access is blocked.
  3. The public policy is blocked. Correct answer.
  4. The bucket policy overrides the block.

Explanation

Account-level Block Public Access overrides bucket policies and ACLs that would grant public access, so the public statement does not take effect. The block must be removed at the account or bucket level before public access is possible.

Question 14Design Secure Architectures

A partner needs temporary download access to a single S3 object for one hour, and no IAM users should be created. Which approach meets the requirement?

  1. Create an IAM user per partner and rotate keys.
  2. Make the object public, then revert after one hour.
  3. Generate a presigned URL with a short expiration. Correct answer.
  4. Serve the object from an unauthenticated CloudFront distribution.

Explanation

A presigned URL carries the signer's permissions for a limited time and can be scoped to one object, so no long-lived identity is needed. Making the object public exposes it to anyone who has the URL, with no authentication.

Question 15Design Secure Architectures

An IAM policy in account A grants kms:Decrypt on a customer managed key owned by account B, but the key policy does not mention account A. What happens when account A calls Decrypt?

  1. Decrypt succeeds after an IAM policy refresh delay.
  2. Denied only if the key is asymmetric.
  3. Decrypt succeeds.
  4. Denied, because the key policy must allow the account. Correct answer.

Explanation

AWS KMS requires that the key policy itself delegate access to the external account before IAM policies in that account can allow the action. Without that delegation, the decrypt call fails no matter what the caller's IAM policy says.

Question 16Design Secure Architectures

A Lambda function must write items to one DynamoDB table. Which permission design follows least privilege?

  1. Attach a role with only the needed DynamoDB actions. Correct answer.
  2. Attach AdministratorAccess to the function's role.
  3. Store IAM user keys in environment variables.
  4. Use the account root credentials inside the function.

Explanation

The execution role should grant only the specific DynamoDB actions on the specific table resource, which is the minimum required by the function. Broader permissions or static keys increase the blast radius of a compromise.

Question 17Design Secure Architectures

Which statement about security groups and network ACLs is accurate?

  1. Both are stateless and support allow and deny rules.
  2. Both are stateful and evaluated in numeric order.
  3. NACLs are stateful; security groups are stateless.
  4. Security groups are stateful; NACLs are stateless. Correct answer.

Explanation

Security groups are stateful, so return traffic for an allowed connection is automatically permitted. Network ACLs are stateless, so both inbound and outbound rules must explicitly allow the traffic.

Question 18Design Secure Architectures

Administrators need interactive shell access to EC2 instances in private subnets without a bastion host or an open SSH port. Which approach satisfies this?

  1. Put instances in a public subnet with an EIP.
  2. Use EC2 Instance Connect with a shared key.
  3. Publish a bastion host with a public elastic IP.
  4. Use SSM Session Manager with an instance profile. Correct answer.

Explanation

Session Manager reaches instances through the SSM agent and an instance profile, so no inbound ports, bastion, or public addresses are needed. Access is logged and controlled through IAM policies.

Question 19Design Secure Architectures

A mobile app needs user sign-in through social identity providers and must exchange those identities for scoped AWS credentials used by API Gateway. Which design fits?

  1. SAML federation with an external IdP for each user.
  2. AWS IAM Identity Center permission sets per user.
  3. Create one IAM user per application user.
  4. Cognito user pool with an identity pool. Correct answer.

Explanation

A Cognito user pool handles authentication with social providers and issues tokens, while an identity pool exchanges those tokens for temporary AWS credentials scoped to an IAM role. This avoids creating an IAM identity per application user.

Question 20Design Secure Architectures

A public web application must be protected against SQL injection attempts and large-scale DDoS attacks at the edge. Which combination addresses both?

  1. GuardDuty findings routed to Security Hub.
  2. AWS WAF on CloudFront plus Shield Advanced. Correct answer.
  3. NACLs with deny rules for malicious IP addresses.
  4. An S3 bucket policy that restricts referrers.

Explanation

AWS WAF provides managed and custom rules such as SQL injection match conditions, and Shield Advanced adds DDoS detection and response for edge distributions. Together they cover application-layer filtering and volumetric attack mitigation.

Question 21Design Secure Architectures

A SaaS provider assumes an IAM role in each customer's account. Which control prevents a third party from tricking the provider into using a role session meant for a different customer?

  1. iam:PassedToService in the session policy.
  2. aws:PrincipalOrgID in the bucket ACL.
  3. aws:SourceIp in the permission policy.
  4. sts:ExternalId in the trust policy condition. Correct answer.

Explanation

The external ID is a value shared between the provider and the specific customer, and requiring it in the role trust policy's condition blocks the confused deputy problem. A caller who does not know that customer's external ID cannot assume the role.

Question 22Design Secure Architectures

A federated workforce must be able to access only the resources tagged with the user's department, and departments change frequently. Which design scales best?

  1. SCPs per OU that match department names.
  2. One role plus a session tag with a tag-based condition. Correct answer.
  3. One IAM role per department, each with separate policies.
  4. A bucket policy listing every department ARN.

Explanation

Attribute-based access control maps identity attributes to session tags and uses conditions such as aws:PrincipalTag to compare them with resource tags. Adding a department then requires no new policy or role because the rule is expressed in terms of tags.

Question 23Design Secure Architectures

A company uses an S3 gateway VPC endpoint. Which statement correctly describes its scope?

  1. It applies only to route tables in its own VPC. Correct answer.
  2. It can be used from peered VPCs and on-premises networks.
  3. It requires a NAT gateway to function correctly.
  4. It supports only HTTPS on port 443 from EC2 instances.

Explanation

A gateway endpoint is associated with route tables in the VPC where it is created and cannot be reached from peered VPCs, VPN connections, or Direct Connect. Workloads outside that VPC need an interface endpoint or another path.

Question 24Design Secure Architectures

A service must be given temporary programmatic permission to use a customer managed KMS key without editing the key policy. Which mechanism should be used?

  1. Create a KMS grant on the key. Correct answer.
  2. Publish a new version of the key policy.
  3. Attach a resource-based policy to the calling service.
  4. Attach an IAM permissions boundary to the service role.

Explanation

A KMS grant delegates specific cryptographic operations on a key to a principal, optionally with constraints and an expiration, without modifying the key policy. Grants are the intended mechanism for temporary, programmatic delegation.

Question 25Design Secure Architectures

A security team must continuously identify S3 buckets and IAM roles in an account that are shared with principals outside the account. Which tool provides this?

  1. IAM Access Analyzer findings for the zone of trust. Correct answer.
  2. CloudTrail Insights event analysis.
  3. Trusted Advisor cost optimization checks.
  4. AWS Config rules aggregated with an aggregator account.

Explanation

IAM Access Analyzer evaluates resource-based policies against a zone of trust and reports resources reachable by principals outside that zone. Findings update as policies change, which supports continuous external-access monitoring.

Question 26Design Secure Architectures

A company wants to detect anomalous API calls, cryptocurrency mining activity, and communication with known malicious IP addresses across its AWS accounts with minimal configuration. Which service should it use?

  1. AWS Config
  2. Amazon GuardDuty Correct answer.
  3. AWS Trusted Advisor
  4. Amazon Inspector

Explanation

GuardDuty is a managed threat-detection service that continuously analyzes CloudTrail management and data events, VPC Flow Logs, and DNS logs for malicious or anomalous behavior. It requires no agents or infrastructure to deploy.

Question 27Design Secure Architectures

A request to read an object is allowed by an identity-based policy and by a bucket policy, but an SCP applied in the account contains a Deny statement for that action. What is the outcome?

  1. Allowed, provided the caller is an IAM role rather than an IAM user.
  2. Denied, because SCPs replace all identity-based policies in member accounts.
  3. Denied, because an explicit deny always overrides any allow. Correct answer.
  4. Allowed, because both the bucket policy and the identity policy allow the action.

Explanation

AWS evaluates all applicable policies together and the result is the union of allows, minus anything explicitly denied. An explicit Deny in any policy type, including an SCP, always wins over allow statements elsewhere.

Question 28Design Secure Architectures

Which statement describes AWS Shield Standard?

  1. It must be turned on per Region and is billed for each protected resource.
  2. It provides 24/7 access to the DDoS Response Team and cost protection against DDoS-related scaling charges on protected resources.
  3. It inspects HTTP requests for SQL injection and cross-site scripting patterns.
  4. It is on by default for all accounts at no cost and blocks common volumetric attacks. Correct answer.

Explanation

Shield Standard is automatically applied to all AWS customers at no additional charge and mitigates common network and transport layer DDoS attacks. Advanced capabilities such as the DDoS Response Team and cost protection require the paid Shield Advanced tier.

Question 29Design Secure Architectures

A subnet's network ACL contains rules numbered 100 (allow), 200 (deny), and the default asterisk rule. How is inbound traffic evaluated?

  1. Rules are processed in the order they were created, and the most recent rule wins.
  2. The most specific rule, based on the narrowest CIDR range, is applied first.
  3. All matching rules are combined, and any allow overrides a deny.
  4. Rules are processed in ascending rule-number order and the first match decides. Correct answer.

Explanation

Network ACLs are ordered, stateless filters: each rule is evaluated from the lowest rule number upward and the first rule that matches the traffic determines allow or deny. Rule 100 would therefore match before rule 200.

Question 30Design Secure Architectures

An application running on Amazon EC2 must call AWS APIs. What is the recommended way to supply credentials to the instance?

  1. Bake an IAM user's access keys into the AMI used to launch instances.
  2. Attach an IAM role to the instance through an instance profile. Correct answer.
  3. Store long-term access keys in a file on the instance's EBS volume.
  4. Pass access keys to the instance in the user data script at launch.

Explanation

An instance profile delivers IAM role credentials to the instance, and the AWS SDK retrieves and rotates those temporary credentials automatically. This avoids distributing long-term keys that cannot be scoped or expired easily.

Question 31Design Secure Architectures

An auditor asks for AWS's SOC 2 report and ISO certifications. Which service provides self-service access to these documents?

  1. AWS Security Hub
  2. AWS Artifact Correct answer.
  3. AWS Config
  4. AWS Audit Manager

Explanation

AWS Artifact is the self-service portal for downloading AWS compliance reports and agreements such as SOC, ISO, PCI, and HIPAA artifacts. Audit Manager instead automates evidence collection for your own audits.

Question 32Design Secure Architectures

A company needs to discover and classify personally identifiable information stored in Amazon S3 buckets. Which service is designed for this?

  1. AWS Shield Advanced
  2. Amazon Macie Correct answer.
  3. Amazon GuardDuty
  4. Amazon Inspector

Explanation

Amazon Macie uses managed and custom data identifiers to sample and classify objects in S3, reporting buckets that contain sensitive data such as personal information. It also evaluates bucket-level security and access controls.

Question 33Design Secure Architectures

A compliance team must prove that CloudTrail log files have not been altered after delivery. Which CloudTrail feature should be enabled?

  1. Log file integrity validation Correct answer.
  2. CloudTrail Insights
  3. An organization trail
  4. CloudTrail Lake event data stores

Explanation

Log file integrity validation produces digest files containing hash values for delivered log files, letting you verify that logs were not modified or deleted after delivery. The digests can be validated with the AWS CLI or programmatically.

Question 34Design Secure Architectures

A security policy requires that every request to an S3 bucket use HTTPS. Which bucket policy element enforces this?

  1. An Allow statement scoped to IpAddress aws:SourceIp 0.0.0.0/0.
  2. A Deny statement with the condition StringEquals s3:x-amz-acl private.
  3. An Allow statement for s3:* with the condition Bool aws:SecureTransport true.
  4. A Deny statement for s3:* with the condition Bool aws:SecureTransport false. Correct answer.

Explanation

Because allows are additive and cannot restrict existing permissions, encryption in transit must be enforced with a Deny that triggers when aws:SecureTransport is false. That explicit deny rejects any plain HTTP request, including requests otherwise allowed by other policies.

Question 35Design Secure Architectures

A regulated workload requires that an object version cannot be deleted or overwritten by any user, including the account root user, for a fixed retention period. Which configuration meets this requirement?

  1. S3 Object Lock in compliance mode with a retention period. Correct answer.
  2. A bucket policy that denies s3:DeleteObjectVersion to all principals.
  3. S3 Object Lock in governance mode with a legal hold applied.
  4. S3 versioning with MFA delete enabled on the bucket.

Explanation

Compliance mode retention cannot be shortened or removed by any principal, including the root user, until the retention period expires. Governance mode, by contrast, can be bypassed by users holding s3:BypassGovernanceRetention.

Question 36Design Secure Architectures

An existing unencrypted Amazon RDS database must be encrypted at rest with minimal downtime. What is the valid approach?

  1. Enable encryption in place by modifying the DB instance's storage settings.
  2. Enable encryption on the DB instance's option group and reboot the instance.
  3. Copy the snapshot with encryption and restore from the copy. Correct answer.
  4. Attach an encrypted EBS volume to the DB instance and move the data files onto it.

Explanation

Encryption cannot be turned on for an existing unencrypted RDS instance in place. The supported path is to take a snapshot, copy the snapshot with encryption enabled, and restore a new encrypted instance from that copy.

Question 37Design Secure Architectures

A security team wants to require IMDSv2 (session-token-based) access to instance metadata on existing EC2 instances. Which action achieves this?

  1. Configure the instance metadata options to require HTTP tokens. Correct answer.
  2. Add an inbound rule on port 80 to the instance's security group.
  3. Enable termination protection on the instances.
  4. Disable the instance profile attached to the instance.

Explanation

Setting the instance metadata option HttpTokens to required forces callers to obtain a session token with a PUT request before reading metadata, which mitigates SSRF-based credential theft. The setting can be applied to existing instances without a restart of the workload.

Question 38Design Secure Architectures

A trust policy must ensure that a role can be assumed only when the caller has authenticated with MFA. Which condition key is used?

  1. aws:MultiFactorAuthPresent Correct answer.
  2. aws:PrincipalOrgID
  3. sts:ExternalId
  4. aws:SourceVpce

Explanation

The aws:MultiFactorAuthPresent condition key is true when the calling principal authenticated with an MFA device, so a Bool condition on it in the role trust policy blocks non-MFA callers. The role itself should also require MFA via a policy that denies actions when the key is false.

Question 39Design Secure Architectures

A company must reach a partner's SaaS API over private IP addresses from its VPC without traversing the internet. Which construct should be used?

  1. A virtual private gateway with a static route to the partner's API.
  2. An interface VPC endpoint for the partner service via AWS PrivateLink. Correct answer.
  3. An internet-facing Network Load Balancer in front of the partner endpoint.
  4. A NAT gateway in a public subnet with a route to the partner's CIDR.

Explanation

AWS PrivateLink exposes a service as an elastic network interface endpoint inside your VPC, so traffic to the partner SaaS API stays on the AWS network and never uses the internet. The partner publishes the service and grants your account access.

Question 40Design Secure Architectures

Which information can be obtained from VPC Flow Logs?

  1. Source and destination IP, ports, and whether traffic was accepted or rejected. Correct answer.
  2. The complete application payload of every packet that traverses the elastic network interface.
  3. The operating system process that opened each connection.
  4. The contents of TLS sessions between clients and servers.

Explanation

VPC Flow Logs capture metadata about IP traffic, such as source and destination addresses, ports, protocol, packet and byte counts, and the accept or reject decision. They do not capture payloads or decrypted session contents.

Question 41Design Secure Architectures

A Lambda function in account A must be invoked by an IAM role in account B. Which change makes this possible?

  1. Attach the AWSLambdaFullAccess managed policy to the caller's role.
  2. Add a trust relationship for account B to the function's execution role.
  3. Add a resource-based policy on the function granting invoke to account B. Correct answer.
  4. Enable the function's reserved concurrency for the calling account.

Explanation

Cross-account invocation of a Lambda function is authorized by a resource-based (function) policy that names the trusted account or principal and allows lambda:InvokeFunction. The caller's identity policy alone is insufficient because the resource side must also permit the action.

Question 42Design Secure Architectures

An Application Load Balancer serves an HTTPS listener. Auditors require that clients negotiate at least TLS 1.2. Which setting enforces this?

  1. A network ACL that blocks TCP port 443 for older clients.
  2. An AWS WAF rule group attached to the load balancer.
  3. The listener security policy set to a TLS 1.2 minimum. Correct answer.
  4. The target group's stickiness attributes.

Explanation

The HTTPS listener's security policy defines the minimum protocol version and cipher suites negotiated during the TLS handshake. Selecting a policy whose minimum is TLS 1.2 causes the load balancer to reject older protocol versions.

Question 43Design Secure Architectures

A CloudFront distribution serves private content from an S3 bucket that must not allow public access. Which mechanism restricts the origin to CloudFront?

  1. A bucket website endpoint used as the distribution origin.
  2. Signed cookies issued for each viewer of the distribution.
  3. An S3 bucket ACL that grants READ permission to the AllUsers group.
  4. An origin access control signing requests from CloudFront. Correct answer.

Explanation

Origin access control makes CloudFront sign its requests to the S3 origin, and the bucket policy accepts only that signed distribution, so the bucket can remain fully private. This replaces the older origin access identity mechanism with stronger SigV4 signing.

Question 44Design Secure Architectures

What does enabling EBS encryption by default for a Region accomplish?

  1. It forces all snapshots shared from other accounts to be re-encrypted with the default key.
  2. New volumes and snapshots are encrypted by default; existing volumes are unchanged. Correct answer.
  3. It immediately encrypts every existing unencrypted EBS volume and snapshot in the Region.
  4. It encrypts volumes in every Region for the account from a single setting.

Explanation

The account-level encryption-by-default setting is regional and applies to volumes and snapshots created after it is enabled, using the specified default KMS key. Existing unencrypted volumes are not retroactively encrypted.

Question 45Design Secure Architectures

A bucket policy should allow access only when requests arrive through a specific S3 gateway VPC endpoint. Which condition key accomplishes this?

  1. aws:SourceIp
  2. aws:PrincipalOrgID
  3. aws:SourceVpce Correct answer.
  4. aws:SecureTransport

Explanation

The aws:SourceVpce condition key matches the ID of the VPC endpoint through which the request was made, so a bucket policy can restrict access to that endpoint. Gateway endpoint requests do not originate from a NAT or instance public address, which is why SourceIp is unreliable for this purpose.

Question 46Design Secure Architectures

A bucket policy must allow read access only to principals in accounts that belong to the company's AWS Organization, including accounts added later. Which condition is most appropriate?

  1. StringEquals on aws:PrincipalOrgID with the organization ID. Correct answer.
  2. StringEquals on aws:PrincipalAccount with a list of the current account IDs.
  3. StringEquals on aws:userid with the organization's root user ID.
  4. ArnLike on aws:PrincipalArn with the organization's management account ARN.

Explanation

The aws:PrincipalOrgID global condition key matches the organization of the requesting principal, so the policy automatically covers accounts that join the organization later. An explicit list of account IDs would need to be maintained manually.

Question 47Design Secure Architectures

An application assumes role A and then uses role A's credentials to assume role B. What is the maximum session duration of the credentials for role B?

  1. The duration configured on role A's trust policy.
  2. 36 hours when the caller originates from an IAM user with long-term credentials.
  3. 12 hours, the same as a directly assumed role.
  4. 1 hour, because role chaining limits the session duration. Correct answer.

Explanation

When a role session is used to assume another role, the resulting session is limited to a maximum of one hour regardless of the duration configured on the target role. Directly assumed role sessions can be configured up to twelve hours, but chained sessions cannot.

Question 48Design Secure Architectures

A company must block outbound DNS lookups for known malicious domains from workloads in a VPC while allowing all other queries. Which solution meets this requirement?

  1. A network ACL that denies UDP port 53 to the internet.
  2. Security groups that allow only approved destinations on port 443.
  3. Route 53 Resolver DNS Firewall with a blocking rule group. Correct answer.
  4. An S3 gateway endpoint policy that denies traffic to the listed domains.

Explanation

Route 53 Resolver DNS Firewall inspects queries made through the VPC resolver and can block specific domains or categories while permitting everything else. Domain-level filtering requires a DNS-aware control, which neither security groups nor network ACLs provide.

Question 49Design Secure Architectures

A team needs an audit record of every object-level read in a specific S3 bucket, including reads performed by principals in other accounts. What must be configured?

  1. S3 data events enabled on the trail for the bucket's ARN prefix. Correct answer.
  2. Management events enabled on the CloudTrail trail for that Region.
  3. A VPC Flow Log on the interface used to reach the bucket.
  4. CloudTrail Insights events enabled on the trail.

Explanation

Object-level API activity such as GetObject is recorded only when S3 data events are enabled for the bucket, and the record includes the requesting principal regardless of account. Management events cover control-plane operations like CreateBucket rather than object reads.

Question 50Design Secure Architectures

In the same account, an IAM role has an identity policy allowing kms:Decrypt on a customer managed key. The key policy contains no statement naming that role. What is the outcome?

  1. The call succeeds because an identity policy is sufficient for any principal in the same account.
  2. The call succeeds only if the role is also listed in a grant created by the key administrator.
  3. The call fails because key policies are never combined with identity policies.
  4. It succeeds only if the key policy delegates to the account, enabling IAM policies. Correct answer.

Explanation

Access to a KMS key is always controlled first by the key policy; IAM policies can only contribute when the key policy delegates authority to the account principal, which is present by default. If the key policy has been edited to remove that delegation and does not name the role, the identity policy alone grants nothing.