A finance team wants an email alert when the forecasted monthly cost of resources tagged Project=Atlas is expected to exceed $5,000. The Project tag is activated as a cost allocation tag. The solution must require the LEAST effort to build and maintain. Which solution meets these requirements?
Create an AWS Budgets cost budget filtered by Project=Atlas, sending email when actual monthly cost exceeds the $5,000 threshold.
Create a Cost Anomaly Detection monitor scoped to Project=Atlas, sending email when detected anomalous cost impact exceeds the $5,000 threshold.
Create a scheduled Lambda function querying tag-filtered Cost Explorer forecasts, sending email when the projected monthly cost exceeds $5,000.
Create an AWS Budgets cost budget filtered by Project=Atlas, sending email when forecasted monthly cost exceeds the $5,000 threshold.
D
D directly supports the tag filter and forecast threshold with built-in email alerts. A tests actual spend rather than forecast spend. B detects unusual spending relative to a baseline rather than enforcing a fixed forecasted budget. C can be built but adds scheduling, code, and maintenance. Forecasts need sufficient usage history and are estimates, not real-time spending guarantees.
Design Cost-Optimized Architectures
25
Select One
EC2 instances in private subnets upload several terabytes of data each day to an S3 bucket in the same Region. The traffic goes through a NAT gateway, and NAT gateway data processing charges are high. The instances must not be reachable from the internet. Which solution will reduce costs the MOST?
Create S3 interface endpoints in the application Availability Zones, configuring DNS and access policies so uploads use the endpoints instead of NAT.
Create NAT gateways in the application Availability Zones, updating the private subnet routes so uploads use a gateway in the same zone.
Create an S3 gateway endpoint in the application VPC, associating the private subnet route tables so uploads use the endpoint instead of NAT.
Consolidate outbound traffic through one NAT gateway in the VPC, updating the private subnet routes so all uploads use that shared gateway.
C
C routes same-Region S3 traffic through a gateway endpoint without endpoint hourly or data-processing charges. Instances remain private. A incurs interface endpoint charges. B may reduce cross-zone traffic charges but retains NAT data-processing charges. D retains the same per-GB NAT processing cost and may introduce cross-zone transfer costs.
Design Cost-Optimized Architectures
24
Select One
A healthcare company must retain 500 TB of scanned records for 10 years. Auditors request records about once a year, and the company can wait up to 48 hours for a retrieval. The company wants the lowest possible storage cost. Which S3 storage class should the company use?
S3 Glacier Deep Archive, using bulk restores when auditors request records and retaining the archived objects for the required period.
S3 Glacier Flexible Retrieval, using bulk restores when auditors request records and retaining the archived objects for the required period.
S3 Intelligent-Tiering, enabling the optional Archive Access tier but leaving Deep Archive Access disabled for the entire required retention period.
S3 One Zone-Infrequent Access, keeping records immediately available to auditors and expiring them through lifecycle rules after the required retention period.
A
A provides very low storage cost for long-lived, rarely accessed records, with bulk restores designed to complete within 48 hours. B restores sooner but has higher storage rates. C can move objects to Archive Access, but the lower-cost Deep Archive Access tier is explicitly disabled. D is designed for more immediate access and does not offer Deep Archive storage pricing. Retrieval charges and regional pricing also affect the total bill.
Design Cost-Optimized Architectures
23
Select One
A company has a steady baseline of EC2 usage on m5 and c5 instances in two Regions. Next year it plans to move some workloads to Graviton-based instances and others to AWS Fargate. The company can commit to a consistent hourly spend for 3 years. Which purchasing option provides the MOST savings while supporting these planned changes?
Purchase three-year EC2 Instance Savings Plans for the current instance families in each Region, sizing commitments to the baseline usage at discounted rates.
Purchase three-year Standard Reserved Instances for the current instance families in each Region, matching quantities to the baseline EC2 capacity currently in use.
Purchase three-year Compute Savings Plans for the expected eligible baseline usage, sizing the hourly commitment to that usage at the applicable discounted rates.
Purchase three-year Convertible Reserved Instances for the current EC2 capacity, exchanging reservations for suitable Graviton configurations when the planned instance migrations occur.
C
C preserves discounted usage coverage across Regions and EC2 families, including Graviton, and also covers Fargate. A is tied to an EC2 family and Region. B cannot follow the family changes or apply to Fargate. D permits certain EC2 exchanges but does not cover Fargate. Size the hourly commitment against expected eligible usage at Savings Plans rates rather than blindly copying the On-Demand bill.
Design Cost-Optimized Architectures
22
Select One
A research company runs a nightly batch workload on EC2 On-Demand Instances. An Auto Scaling group launches the fleet at the start of an 8-hour window and terminates it when the jobs finish. Each job takes 10–20 minutes, saves checkpoints to S3, and can be restarted if interrupted. No other workloads can use a Reserved Instance or Savings Plans commitment during the rest of the day. Which solution will reduce compute costs the MOST?
Purchase Standard Reserved Instances matching the fleet’s instance types and sizes, using a one-year term and applying the discount during nightly execution.
Use Spot Instances across suitable instance types and Availability Zones, choosing price-capacity-optimized allocation and resuming interrupted jobs from their saved checkpoints.
Purchase a Compute Savings Plan covering the fleet’s current hourly On-Demand spend, using a one-year term and applying the commitment during nightly execution.
Create On-Demand Capacity Reservations matching the fleet’s instance types and sizes, holding reservations during the nightly window and releasing them after execution.
B
B fits interruptible jobs with checkpoints. Diversification and price-capacity-optimized allocation balance available capacity with price. A and C create continuous commitments even while this nightly fleet is idle, assuming no other workloads consume them. D reserves capacity without a discount. Spot capacity is not guaranteed, so a hard completion deadline may require a fallback strategy.
Design Cost-Optimized Architectures
21
Select One
A company serves images and JavaScript files from an S3 bucket in us-east-1. Users in Europe and Asia report slow page loads, and S3 request charges are rising. The bucket must remain private. The solution must reduce repeated origin requests with minimal operational overhead. Which solution meets these requirements?
Replicate objects to buckets in Europe and Asia, adding regional selection logic that generates signed object URLs for users in each location.
Enable S3 Transfer Acceleration for the bucket and generate presigned object URLs, directing global users to download through its accelerated endpoint.
Create CloudFront with origin access control and a bucket policy allowing that distribution, setting minimum, default, and maximum cache TTLs to zero.
Create CloudFront with origin access control and a bucket policy allowing that distribution, configuring cache policies and object headers for content reuse.
D
D caches reusable content near viewers and protects the S3 origin with OAC and its bucket policy. Cache settings must permit reuse of these objects. A adds replication, routing, and signing work while each download still reaches an S3 origin. B accelerates transfers without caching repeated reads. C provides edge connectivity but disables caching, leaving origin requests in place.
Design High-Performing Architectures
20
Select One
A retailer collects clickstream events from its website at thousands of events per second. Three applications (a real-time dashboard, fraud detection, and an archiver) must each read every event independently, within seconds, in order for each user session. After a bug fix, an application must be able to reprocess the last 7 days of events. Which solution meets these requirements?
Use Kinesis Data Streams with 7-day retention and independent consumers, writing each session’s events in order under the same partition key.
Use three SQS FIFO queues with 7-day retention and separate consumers, sending each session’s events in order under the same message group ID.
Use Data Firehose to deliver events into S3 objects and notify each application, retaining the objects for seven days to support reprocessing.
Use EventBridge rules to deliver events to each application and enable a 7-day archive, replaying archived events after application fixes are deployed.
A
A provides independent consumer positions and replay within the retention window. A session partition key keeps related records on one shard; the producer must preserve write order as stated. PutRecords does not guarantee ordering; sequential PutRecord calls with ordering control can preserve it. B preserves per-session queue order, but consumers normally delete messages after success. Deleted messages cannot be replayed: retention is not an archive of processed events. C requires extra work to manage ordered consumption from delivered objects and does not inherently satisfy the per-session ordered stream requirement. D offers archive replay but does not guarantee ordering.
Design High-Performing Architectures
19
Select One
A company runs a web application on a single domain, app.example.com, over HTTPS. Requests for /api/* must go to containers in an Amazon ECS service. Requests for /images/* must go to a fleet of EC2 instances. Both paths must remain on app.example.com using standard HTTPS port 443, without client URL changes. Which solution meets these requirements with the LEAST operational overhead?
Run NGINX proxies on an additional EC2 Auto Scaling group, forwarding the two URL paths to separate backend load balancers.
Use one ALB with host-based rules for api.example.com and images.example.com, forwarding requests for each hostname to its corresponding target group.
Use one ALB with an HTTPS listener on port 443, forwarding each specified URL path to its corresponding backend target group.
Use Route 53 weighted records for app.example.com pointing to two ALBs, with each ALB forwarding requests to one backend service.
C
C uses native ALB path-based routing while preserving the hostname and port. A can implement the routing but adds a proxy fleet and more infrastructure to operate. B requires different hostnames, violating the URL constraint. D selects a DNS destination without inspecting the request path, so it cannot consistently select the correct backend.
Design High-Performing Architectures
18
Select One
A mobile game stores player profiles in an Amazon DynamoDB table. During live events, the same profiles are read thousands of times per second. Read latency must drop from single-digit milliseconds to microseconds. Eventually consistent reads are acceptable, and developers want minimal code changes. Which solution meets these requirements?
Deploy ElastiCache and implement cache-aside reads for player profiles, adding cache population and invalidation logic to the existing application.
Deploy a DAX cluster and use its DynamoDB-compatible client for profile reads, retaining DynamoDB as the underlying persistent data store.
Use provisioned DynamoDB capacity with auto scaling and raise the minimum read capacity, reserving headroom for the expected event traffic.
Use DynamoDB global tables and route profile reads to the nearest regional replica, provisioning read capacity for the expected event traffic.
B
B provides microsecond cache-hit latency with a DynamoDB-compatible client and relatively small application changes. A requires separate caching and invalidation logic. C increases throughput capacity rather than providing microsecond reads. D reduces geographic distance but is not an in-memory cache. DAX accelerates eventually consistent reads; strongly consistent reads pass through to DynamoDB. Cache misses still access the table.
Design High-Performing Architectures
17
Select One
A web application runs on EC2 instances in an Auto Scaling group behind an ALB. The application stores user session data in memory on each instance. When the group scales in, users on the terminated instances are logged out. Session reads must have sub-millisecond latency. Which solution meets these requirements with the LEAST operational overhead?
Keep sessions in instance memory and enable ALB stickiness, extending the deregistration delay to allow active connections to drain before termination.
Keep sessions in a DynamoDB table and use strongly consistent reads, provisioning enough read capacity to support the application’s peak session traffic.
Keep sessions in a Multi-AZ RDS for MySQL database and add RDS Proxy, sharing the connection pool across the application’s EC2 instances.
Keep sessions in ElastiCache for Valkey with a cross-zone replica and Multi-AZ enabled, configuring the application to access sessions through the cache.
D
D moves sessions outside the EC2 instances into a managed in-memory store, supporting low-latency access without losing sessions merely because an application instance terminates. Multi-AZ enables automatic cache failover; session expiration should be managed explicitly. A does not preserve terminated-instance memory. B does not provide the requested sub-millisecond in-memory access. C pools relational database connections but does not supply that cache latency. Replica-based failover alone should not be presented as a guarantee of zero session loss.
Design High-Performing Architectures
16
Select One
A content management application runs on Linux EC2 instances in an Auto Scaling group across three Availability Zones. All instances must read and write the same set of uploaded media files concurrently, with POSIX file permissions. Storage needs will grow unpredictably. The existing application must retain its POSIX file operations without modification, and the storage must remain available if one Availability Zone fails. Which solution meets these requirements with the LEAST operational overhead?
Use a Regional EFS file system and create mount targets in the application zones, mounting the file system on each instance.
Use an EFS One Zone file system with a mount target in its zone, mounting that file system from all application instances.
Use EBS-backed NFS servers in each application zone and implement file replication between them, mounting the local server on each instance.
Use an S3 bucket and install Mountpoint for Amazon S3 on every instance, exposing the same bucket through each local mount.
A
A supplies shared POSIX-compatible storage with Regional resilience and managed scaling. B is accessible across zones but stores data in one zone, so it does not meet the zone-failure requirement. C requires operating and coordinating replicated NFS servers. D does not implement all POSIX filesystem behavior required by the unchanged application.
Design High-Performing Architectures
15
Select One
A company runs a web application in us-east-1 behind an ALB. A fully scaled copy runs in us-west-2 behind another ALB. The application accepts POST requests for customer orders. Traffic must go to us-west-2 only when the us-east-1 application is unhealthy, and failover must be automatic. Which solution meets these requirements?
Use Route 53 latency-based alias records for both ALBs, enabling target health evaluation to exclude unhealthy regional endpoints.
Use Route 53 failover alias records for the ALBs, selecting east as primary and west as secondary with target health evaluation.
Use Global Accelerator endpoint groups for both Regions, setting both traffic dials to 50% and registering each regional ALB.
Use a CloudFront origin group containing both ALBs, selecting east as primary and west as secondary for origin failover.
B
B provides primary/secondary DNS routing using ALB target health. A chooses a healthy Region based on latency rather than a fixed primary. C does not configure primary/secondary routing: a 50% traffic dial modifies traffic otherwise directed to each group, not a guaranteed global 50/50 split. D cannot fail over POST requests because CloudFront origin failover supports GET, HEAD, and OPTIONS. DNS caching can delay client switchover.
Design Resilient Architectures
14
Select One
A stateless web application runs on EC2 instances in an Auto Scaling group behind an ALB. All instances are in one Availability Zone. Peak traffic requires 4 instances. The application must keep at least 4 instances in service at all times, including immediately after any single Availability Zone fails. The Region has three Availability Zones. Which solution meets these requirements MOST cost-effectively?
Use three Availability Zones with a minimum of 4 instances and maximum of 6, launching replacements when capacity is lost.
Use two Availability Zones with a minimum of 8 running instances, maintaining an even distribution of capacity across the zones.
Use three Availability Zones with a minimum of 6 running instances, maintaining an even distribution of capacity across the zones.
Use three Availability Zones with a minimum of 4 running instances and a warm pool containing 2 additional stopped instances.
C
C leaves 4 running instances when any one zone’s 2 instances are lost. B also satisfies the requirement but runs 8 instances rather than 6. A and D can start with only 4 running instances, so a zone failure reduces ready capacity below the requirement. Replacement launches or warm-pool starts do not provide immediate capacity. This comparison assumes equal instance capability and the even distribution specified in the options.
Design Resilient Architectures
13
Select One
An ordering service publishes an event for every new order. A billing service and an inventory service must each receive every event. Either service might be offline for several hours during maintenance. Its events must be kept until it recovers, without affecting the other service. Which TWO steps meet these requirements with the LEAST operational overhead? (Select TWO.)
Create one SQS queue and let both services consume it independently, using separate IAM roles and separate long-polling requests.
Create an SNS topic with HTTPS subscriptions for both services, and configure each service to persist events after receiving them.
Configure the ordering service to publish each new order event to an SNS standard topic through the supported publishing API.
Create an SQS queue per service, subscribe both to the topic, and set each queue retention longer than expected outages.
C
C and D provide a durable, independent backlog for each service with little application code. The queues need appropriate access policies and sufficient retention. A makes the consumers compete for messages. B does not supply a service-owned queue that can retain events during subscriber downtime.
Design Resilient Architectures
12
Select Two
D
An SQS consumer deletes messages only after successful processing. Malformed messages are repeatedly delivered and waste capacity. The team wants to isolate these messages automatically for later analysis once a configured threshold of five deliveries is exceeded. Which solution requires the LEAST development effort?
Track deliveries in DynamoDB and add consumer logic that copies messages to another queue when the threshold is exceeded.
Set a redrive allow policy on another queue and configure source message retention to cover five expected processing durations.
Monitor the oldest message age with CloudWatch and invoke custom code to move messages when the age threshold is exceeded.
Set the source queue redrive policy to use a separate dead-letter queue and configure maxReceiveCount to a value of 5.
D
D provides native isolation based on receive count. SQS moves an undeleted message to the dead-letter queue when its receive count exceeds maxReceiveCount. This is a delivery counter, not a count of application exceptions. A requires custom tracking and movement logic. B controls which queues may use a DLQ but does not establish source-queue redrive behavior. C measures age rather than each message’s deliveries and adds custom code.
Design Resilient Architectures
11
Select One
An application processes orders from an SQS standard queue. Charging a card can take 45 seconds, but the visibility timeout is 30 seconds. Workers sometimes receive the same order concurrently. A worker can also crash before calling the payment provider or lose the response after a successful charge. The provider offers a retry-safe payment API, and each order requires one payment. All retries occur within the provider’s supported retry window. Which solution prevents duplicate charges while allowing interrupted payments to be retried without permanently skipping an unpaid order?
Use the order ID as the payment API idempotency key, retaining that key across retries throughout the supported retry period.
Increase the visibility timeout to 60 seconds, and delete each message only after the payment API returns a successful response.
Use a FIFO queue with content-based deduplication and a 60-second visibility timeout, and delete each message after payment succeeds.
Conditionally write the order ID to DynamoDB before charging, and skip payment whenever a record for that order already exists.
A
A makes repeated payment calls refer to the same operation, so retries do not create another charge and can complete an interrupted attempt. The provider must honor the key for the full retry period. B reduces overlapping processing but does not resolve an uncertain payment outcome or all duplicate deliveries. C deduplicates queue sends but does not make the payment operation safe to retry. D can permanently skip an unpaid order if the worker crashes after the conditional write but before charging. Adjusting or extending visibility timeout is still useful in addition to payment idempotency.
Design Resilient Architectures
10
Select One
An order database uses an RDS for PostgreSQL Multi-AZ DB instance deployment. Long reporting queries slow order processing. Reports can tolerate asynchronous replication lag, but daily snapshots are too stale. The company must preserve automatic database failover and move reporting query execution off the primary. Which solution meets these requirements?
Keep the current deployment and configure reporting clients to connect directly to its standby DB instance, leaving order processing on the primary.
Keep the current deployment and add RDS Proxy for reporting connections, configuring connection pooling to reduce the load on the primary database.
Keep the current deployment and create an asynchronous read replica, configuring reporting clients to use its endpoint while orders use the primary.
Keep the current deployment and restore a daily snapshot into another DB instance, configuring reporting clients to query the most recently restored copy.
C
C moves reporting reads to a separate instance while the original Multi-AZ deployment retains its failover capability. Replication is asynchronous and lag should be monitored. A is not supported: the standby in a Multi-AZ DB instance deployment does not serve client queries. B pools connections but still executes reports on the primary. D is explicitly too stale. Multi-AZ DB clusters are a different deployment type and can have readable instances.
Design Resilient Architectures
9
Select One
An AWS Lambda function must download objects from an S3 bucket in the same account. The objects are encrypted with SSE-KMS by using a customer managed key. The key policy allows the account to grant access to the key through IAM policies, and there are no explicit deny statements. The function already knows each object key and downloads the current version without requesting checksum metadata. Following the principle of least privilege, which TWO permissions must the function's execution role include? (Select TWO.)
s3:ListBucket on the bucket
s3:GetObject on the object ARNs
kms:GenerateDataKey on the customer managed key
kms:Decrypt on the customer managed key
B
B and D authorize reading the object and decrypting its data key. The stated KMS key policy permits IAM-based authorization. A is unnecessary when the object key is known. C is used for generating data keys, not for decrypting an existing object.
Design Secure Architectures
8
Select Two
D
A financial services company must store trade records in Amazon S3 for 7 years. A regulator requires that no user, including the AWS account root user, can delete or overwrite a record version during the retention period. The retention period must not be shortened after it is set. Which solution meets these requirements?
Enable S3 Versioning and MFA Delete. Restrict access to the root user MFA device for the duration of the retention period.
Enable S3 Object Lock and apply a 7-year compliance-mode retention period to every record version.
Enable S3 Object Lock with 7-year governance-mode retention and deny bypass permission to all IAM users and roles.
Apply an S3 Object Lock legal hold to every record version and grant only a compliance administrator permission to remove legal holds.
B
B protects each retained version against deletion or overwrite, including by the root user, and prevents shortening the retention period. A permits version deletion with the required MFA authorization. C retains a governance bypass mechanism and does not bind root through IAM policies. D permits an authorized user to remove the legal hold. New versions can still be created; the retained version remains protected.
Design Secure Architectures
7
Select One
An external customer without an AWS account needs a browser link to download a private invoice from S3. The bucket has S3 Block Public Access enabled. The link must remain usable for 24 hours and reject new download requests afterward. Assume permissions and credentials are not revoked during that period. Which solution meets these requirements?
Generate an S3 presigned URL with a 24-hour expiry using credentials from a newly assumed role whose session lasts 12 hours.
Create a CloudFront distribution with origin access control and a 24-hour cache TTL, then provide its unsigned URL for the invoice.
Generate an S3 presigned URL with a 7-day expiry using IAM user credentials, and set the invoice Cache-Control max-age to 86400.
Generate an S3 presigned URL with a 24-hour expiry using an AWS SDK and IAM user credentials authorized to read the invoice.
D
D creates an authenticated, time-limited object request without making the bucket public. IAM user credentials can sign a 24-hour S3 URL using an SDK. A expires when its 12-hour role session expires. B uses cache lifetime rather than viewer-access expiration. C likewise confuses caching with authorization. Revoking the signing credentials or access can invalidate a URL earlier.
Design Secure Architectures
6
Select One
An application on EC2 connects to an Amazon RDS for MySQL DB instance. The database user name and password are hardcoded in the application's configuration file. A new policy requires database credentials to be stored encrypted in a central location and rotated automatically every 30 days. The application must always use the current password. Which solution meets these requirements with the LEAST operational overhead?
Store credentials in Secrets Manager and enable database-integrated rotation every 30 days. Have the application refresh its cached secret after credential changes.
Store credentials in Parameter Store and build a scheduled Lambda workflow to update the database and parameter. Have the application refresh cached values.
Store credentials in Secrets Manager and schedule a function to generate a new secret value monthly. Have the application refresh from the updated secret.
Store encrypted credentials in Parameter Store and re-encrypt them under a new KMS key monthly. Have the application decrypt the parameter for new connections.
A
A updates both the database password and its stored secret through a supported rotation workflow. Cache refresh lets the application use the new credential. B can work but requires building and maintaining a custom workflow. C changes only the secret value, leaving the database password unchanged. D changes encryption protection rather than the password itself. Secrets Manager rotation may use a supported Lambda rotation function; it is not simply a KMS key-rotation setting.
Design Secure Architectures
5
Select One
A company hosts a public web application on EC2 instances behind an ALB. Application logs show repeated SQL injection attempts in query strings and request bodies. The company wants to block these requests before they reach the instances, and it cannot modify the application code. The relevant request bodies are smaller than 8 KB. Which solution will meet these requirements with the LEAST operational overhead?
Associate a WAF web ACL with the ALB and use a rate-based rule to block requests from clients exceeding the configured threshold.
Associate a WAF web ACL with the ALB and use the Amazon IP reputation managed rule group to block requests from listed sources.
Associate a WAF web ACL with the ALB and maintain custom regular-expression rules to block SQL keyword patterns in query strings and bodies.
Associate a WAF web ACL with the ALB and use the AWS managed SQL database rule group with its blocking actions enabled.
D
D uses maintained SQL injection signatures at the HTTP layer before requests reach the application. A addresses request rates, so low-rate attacks can pass. B addresses known bad source IPs, not SQL injection from other sources. C requires maintaining custom signatures and can both miss attacks and block legitimate content. Managed rules should still be tested and tuned for the application.
Design Secure Architectures
4
Select One
An internet-facing Application Load Balancer (ALB) receives HTTPS traffic. It forwards requests to EC2 instances on TCP port 8080 in the same VPC, and health checks use the traffic port. The ALB's security group currently has no outbound rules. The instances must accept traffic only from the ALB. The ALB security group is dedicated to this ALB and is not attached to other resources. Which TWO security group changes meet these requirements? (Select TWO.)
Add an inbound rule to the instances' security group that allows TCP 8080 from the CIDR ranges of the ALB subnets.
Add an inbound rule to the instances' security group that allows TCP 8080 from the ALB's security group.
Add an outbound rule to the ALB's security group that allows TCP 8080 to the instances' security group.
Add an outbound rule to the instances' security group that allows TCP 8080 to the ALB's security group.
C
B and C authorize the ALB-to-target connection on port 8080, including health checks. The dedicated ALB security group identifies the intended source. A also admits other resources with addresses in those subnets. D and E do not authorize the initiating connection; stateful security groups already permit response traffic for allowed connections.
Design Secure Architectures
3
Select Two
B
A company uses AWS Organizations with all features enabled. Its member accounts are in an OU named Workloads. Developers have AdministratorAccess and can create new roles. The security team must prevent the IAM users and roles that developers use or create in these accounts from stopping or deleting the accounts' CloudTrail trails. The control must cover existing and future roles without relying on remediation. Which solution meets these requirements?
Apply a boundary denying the two CloudTrail actions to existing developer roles, and require developers to reuse those roles for future workloads.
Apply an explicit-deny policy for the two CloudTrail actions to developer IAM groups, and allow their members to create new workload roles.
Apply an SCP denying the two CloudTrail actions to the Workloads OU, covering its member accounts and their existing and future developer roles.
Apply an organization-wide AWS Config rule to detect disabled logging, and configure a remediation function to restart affected trails in member accounts.
C
C establishes an explicit deny at the OU level for affected member-account users and ordinary roles, including future roles. SCPs do not grant permissions and do not restrict service-linked roles or the management account. A covers only current roles and needs additional protection against removal. B does not govern all role sessions or newly created roles. D reacts after logging has already stopped.
Design Secure Architectures
2
Select One
An application on EC2 instances in an Auto Scaling group reads a private S3 bucket. The application currently uses IAM user access keys stored in its configuration. A new policy prohibits long-term credentials on instances. Both current and replacement instances must comply. Which solution meets the requirement with the LEAST operational overhead?
Store bucket-read IAM user keys in Secrets Manager. Update the application to retrieve them at startup and deploy the change through an instance refresh.
Add a bucket-read role through an instance profile in the launch template. Refresh instances with application settings that use the role instead of stored keys.
Distribute temporary STS credentials from a management host. Update the application to read the credential file and schedule credential replacement before each session expires.
Use IAM user keys to assume a bucket-read role during startup. Delete the source keys after authentication and repeat this setup whenever instances are replaced.
B
B uses the native EC2 role-credential mechanism and rolls the change out to existing instances. AWS SDKs can retrieve and refresh these temporary credentials automatically. A still places long-term keys in the application runtime. C requires operating a separate credential-distribution and renewal system. D still introduces long-term keys during startup and does not provide a sustainable credential-renewal mechanism. Remove stored keys from the application configuration and revoke them once migration is complete.
Design Secure Architectures
1
Select One
.png)
.svg)
