Design Secure Architectures
Core concepts
Security questions on this exam are usually about who can do what, from where, and with what encryption. Know the IAM evaluation chain: an explicit deny always wins, then an explicit allow, otherwise the request is implicitly denied. Enumerate the policy types and what each can and cannot do: identity-based policies, resource-based policies, permissions boundaries (they cap, never grant), SCPs (they cap an entire account or OU, never grant), and session policies.
On the network side, be precise about statefulness. Security groups are stateful, allow-only, and reference other security groups rather than CIDRs where possible. NACLs are stateless and ordered, so return traffic needs ephemeral ports (1024-65535) opened. Know which service is the right detector: GuardDuty for threat detection, Inspector for vulnerability/CVE scanning, Macie for PII discovery in S3, Config for compliance drift, CloudTrail for API audit, Security Hub for aggregation.
Encryption: SSE-S3 versus SSE-KMS versus client-side, TLS in transit, and the fact that a KMS key policy is the root of authority for a CMK. For edge protection, know Shield (DDoS) versus WAF (Layer 7 rules) versus ACM.
Traps
- Cross-account access almost always needs both sides: a role/policy in the trusted account and a resource or key policy in the owning account.
- Questions offering "create an IAM user with access keys on the instance" are distractors; the answer is an instance profile role.
- S3 Block Public Access and Object Ownership can override a bucket policy that looks correct.
Worked example
An EC2 app must read objects from a bucket in another account, encrypted with a customer managed key. The complete answer is: an instance profile role on EC2, a bucket policy granting that role ARN s3:GetObject, a KMS key policy granting the role kms:Decrypt, and no long-term credentials anywhere.