CCNA Design Secure Questions

Referencing the ALB's security group as the source in the instances' inbound rule ensures only traffic that passed through the load balancer is accepted. Placing instances in private subnets removes direct internet routing, and a NAT gateway provides outbound-only internet access for updates, satisfying both requirements without exposing the instances.

Federated access with permission sets and audited temporary assignments reduces standing privilege.

The trust policy should name only the specific vendor role that is allowed to assume the role in your account. Restricting the principal minimizes the trust boundary and prevents unrelated identities from attempting the assumption path.

Amazon EFS is a managed shared file system that can be mounted by multiple EC2 instances across multiple Availability Zones. It is a strong fit when applications need the same files at the same time and must remain available even if one AZ experiences issues. The service is highly available by design and reduces operational work compared with self-managed file servers.

Using sts:ExternalId in the trust policy ensures only assume-role requests presenting the correct external identifier are allowed. This directly mitigates confused-deputy attacks by binding authorization to a value the vendor must know. It also keeps the permissions model clean, because the check is enforced during the STS AssumeRole request.

An AWS Site-to-Site VPN provides an encrypted tunnel over the internet between the on-premises network and the VPC. Security groups on the EC2 instances can be configured to allow inbound HTTP (port 80) and HTTPS (port 443) only from the on-premises CIDR. This meets the requirements for encryption in transit and restricted traffic.

An SCP denying `ec2:CreateVolume` when the `ec2:Encrypted` condition key is false blocks unencrypted volume creation across every account in the organisation, regardless of IAM permissions. This preventive guardrail satisfies the requirement that only encrypted EBS volumes can be created, unlike detective controls or default encryption settings.

AWS WAF inspects HTTP and HTTPS requests and can block common exploits such as SQL injection and cross-site scripting using managed rule groups. It also supports rate-based rules that count requests from a source IP over a time window, which meets the rate-limiting requirement. Associating a web ACL with the Application Load Balancer provides the needed protection.

An S3 access point gives each team a distinct hostname and policy scoped to its own prefix, so a single shared bucket can be partitioned without duplicating data. This enforces per-team prefix isolation while access point policies replace per-object ACL grants.

CloudFront-scoped WAF web ACLs use a global scope that is provisioned/managed in us-east-1. Creating the web ACL in the wrong region (or with the wrong scope) prevents CloudFront from evaluating the expected web ACL rules, which would lead to no rule matches in logs.

Permission boundaries constrain the maximum permissions that an identity can receive. Even if developers attach an identity policy that allows broader actions, the effective permissions are limited to the intersection of the identity policy and the boundary.

Referencing the web tier's security group as the source in the database security group's inbound rule allows any instance that carries that security group to connect on 3306, regardless of its private IP address. Placing Aurora in private subnets removes any route to the internet, so only resources inside the VPC can attempt a connection, satisfying the least-privilege requirement.

DynamoDB Accelerator, or DAX, is the best fit for repeated reads of the same items when eventual consistency is acceptable. It provides an in-memory cache in front of DynamoDB and can dramatically reduce read latency for hot catalog items during traffic spikes. Because the table schema is already sound, DAX adds performance without forcing a redesign of keys or access patterns.

S3 Object Lock in compliance mode enforces a write-once-read-many (WORM) model where every object version is locked for a specified retention period. During that period, neither the object owner, the bucket owner, nor even the AWS root user can overwrite or delete the object; any such attempt fails. This makes it the only option that provides true immutability and regulatory-grade protection, such as meeting SEC Rule 17a-4 requirements, for audit log storage.

ALBs are regional resources. When you protect an ALB without CloudFront, you should use the regional WAF scope and associate the web ACL directly with the ALB, so WAF can inspect incoming requests destined for that ALB.

IAM database authentication for RDS with an EC2 instance role is the correct approach because it lets the application generate a short-lived (15-minute) authentication token using SigV4, eliminating any stored database password. The EC2 instance assumes an instance role with rds-db:connect permissions, and the application presents the token to PostgreSQL over SSL; RDS validates the token against IAM rather than a static password. This provides centralized credential management via IAM roles, automatic rotation of credentials, and ensures no secret is baked into configurations, user data, or code.

Secrets Manager is designed for secure secret storage with built-in rotation support and fine-grained access through IAM. In this case, the application can retrieve the current database credentials at runtime with its EC2 role, while the secret is rotated on a schedule without embedding passwords in code. This reduces operational risk, improves auditability, and avoids manual password changes that often cause outages.

Session Manager connects to instances through the Systems Manager agent without inbound ports or a bastion host, so the SSH rule can be deleted entirely. Access is governed by IAM, so each engineer's session is attributable, and session logging to Amazon S3 and CloudWatch Logs produces the audit trail the auditors requested without distributing or rotating SSH key pairs.

AWS Secrets Manager with rotation enabled stores the database credentials as a secret encrypted with a KMS key and automatically invokes a rotation Lambda function on a schedule to change the password. The Lambda can call GetSecretValue to fetch the current credentials, and the managed rotation eliminates manual credential updates, making it the right choice.

The correct fix is to make the decryption call supply the exact encryption context used at encryption time, i.e., `"purpose" = "myapp-secrets"`. AWS KMS treats the encryption context as authenticated additional data (AAD): it is not stored encrypted, but it must be provided during decryption or the operation fails. If the KMS key policy condition requires `kms:EncryptionContext:purpose` to equal that value, then every decrypt request must include that context key and value to satisfy the policy. Updating the application code to consistently pass this context—both when encrypting new secrets and when decrypting existing ones—resolves the failure without weakening the key policy or forcing key rotation, and it preserves the integrity check that the context provides.

An organization trail applies to all accounts in the organization, and an SCP can deny the specific actions that would disable logging. SCPs are inherited by all accounts, including future ones, and affect all principals, including root users. This combination ensures CloudTrail cannot be disabled, meeting the requirement with minimal ongoing effort.

Compute optimized instances, such as the C5 or C6g families, provide the highest vCPU-to-memory ratio and are purpose-built for CPU-intensive workloads like image processing, scientific modeling, and video encoding. Their enhanced clock speeds and sustained compute performance directly target the processing bottleneck, making them the most efficient and cost-effective choice for this workload.

With SSE-KMS, KMS decryption is authorized by KMS for the specific CMK. The CMK key policy is a primary authorization layer; if the key policy does not allow kms:Decrypt for the role (or a matching principal), S3 requests that require KMS decryption will fail even if the S3 or IAM identity policies allow s3:GetObject.

AWS App Mesh provides service-to-service communication control and supports mutual TLS, where both sides present certificates to authenticate and encrypt traffic. Integrating with ACM Private CA allows the mesh to issue and rotate certificates automatically. This satisfies the requirement to encrypt data in transit between microservices and adds identity verification, which is a strong security control for internal microservices.

Because the SCP contains an explicit Deny based on region and OU, the correct remedy is to change the SCP conditions (or operate within allowed regions). SCP evaluation is performed before/independent of IAM identity policies for the permission decision.

AWS WAF is a managed web application firewall that inspects HTTP and HTTPS requests at layer 7 and can be associated with an Application Load Balancer to filter traffic before it reaches backend instances. It supports AWS-managed rule groups, including the SQL database and cross-site scripting rule sets, that examine request components such as headers, query strings, and body payloads. When deployed on an ALB, WAF can block or allow requests in real time based on those rules, directly mitigating the specific attacks described.

S3 Block Public Access at the account or bucket level provides four protective settings that prohibit public ACLs, ignore existing public ACLs, block public bucket policies, and restrict any bucket policy that would grant public access. For a healthcare document service, this acts as a strict guardrail that nullifies any accidental public exposure, regardless of how a bucket policy or ACL is configured. Since the settings are enforced centrally, they provide comprehensive coverage against bucket misconfiguration.

A bucket policy is a resource-based policy that can explicitly grant the partner's IAM role cross-account access to a specific prefix, such as s3:GetObject on arn:aws:s3:::reports/partner/*. This approach adheres to least privilege by restricting actions to only what is required (e.g., GetObject, ListBucket on that prefix) and by naming a specific external principal. It also avoids sharing long-term keys because the partner role will assume the role using its own credentials, and the policy can be updated or removed centrally by the bucket owner.

A resource policy can grant cross-account access to a specific external role and prefix.

A cross-account role requires both an IAM permissions policy and a trust policy. The trust policy must allow the specific principal in account A to call sts:AssumeRole into account B’s role. With that trust in place, the app can obtain temporary credentials and then use the UploadRole permissions for s3:PutObject.

A JWT authorizer configured for the OpenID Connect issuer is the correct choice because API Gateway can automatically fetch the OIDC provider's JSON Web Key Set (JWKS) to validate the JWT signature, expiry, issuer, and audience. This allows the API to authenticate users who received tokens from a trusted OIDC-compatible identity provider (such as Amazon Cognito or Auth0) without managing a custom Lambda authorizer or session state. It also supports scopes and claims for fine-grained authorization, making it a low-operational-overhead and secure solution for public internet users.

EBS snapshots are the native backup mechanism for EBS volumes. They capture point-in-time copies that can later be used to create a new volume, making them a simple and reliable way to restore data after a server or volume loss. Snapshots are incremental, so repeated backups are efficient and suitable for ongoing protection.

CloudTrail management events cover control-plane activity, not per-object access details in S3. Enabling S3 data events (object-level logging) causes CloudTrail to record events like GetObject and PutObject for the targeted bucket and prefixes. This directly addresses the missing visibility symptom described. It also limits logging scope when you specify the bucket/prefix.

A cluster placement group places instances physically close together within one Availability Zone, which improves network throughput and reduces latency between nodes. That is the right fit for tightly coupled workloads that exchange frequent small messages and need the lowest possible east-west latency. It also keeps the design simple because the application already runs in a single AZ.

SCPs provide guardrails that apply to all principals in member accounts. By explicitly denying the IAM action at the organization level, you can prevent access key creation even if local IAM policies would otherwise allow it.

Restricting the Resource to the exact Secrets Manager secret ARN limits retrieval to only that secret. This minimizes exposure and follows least-privilege practices. (If the secret is encrypted with a customer-managed KMS key, additional KMS permissions may be required for decrypting the ciphertext, but the Secrets Manager permission itself should still be scoped tightly.)

AWS WAF can be associated with an ALB to inspect incoming traffic. It provides managed rule groups for SQL injection and cross-site scripting, and you can create IP match conditions to allow only specific IP ranges. Rate-based rules automatically block IPs that exceed a request threshold, meeting the rate-limiting requirement. This is the most direct and effective solution.

Increasing the Lambda memory setting directly allocates more proportional vCPU power to the function. This is crucial for CPU-heavy JSON transformations because it provides the necessary computational resources to execute the intensive processing faster. By boosting the available vCPU, the function can complete its work more efficiently, directly addressing the performance constraint of slow execution without requiring any code modifications.

A Network Load Balancer is the best fit for a custom TCP service that needs extremely low latency and static IP addresses. NLB operates at Layer 4, preserves high throughput, and is commonly used when protocol simplicity and performance matter more than application-layer routing features. It matches the workload's network requirements without adding unnecessary HTTP-specific behavior.

RDS automated backups are enabled by default and provide a daily snapshot of the database plus transaction logs captured every five minutes. This combination enables point-in-time recovery to any second within the configured retention window, which can be set from 1 to 35 days. Manual snapshots, on the other hand, are user-initiated, persist indefinitely, and provide a baseline that can be used to restore a database after the automated retention period has lapsed. Together, these backup mechanisms are purpose-built for database recovery and are the correct way to ensure backup and restore capability for Amazon RDS.

NACLs are stateless, so return traffic from instances to clients on ephemeral ports needs an explicit outbound allow; the missing rule drops responses, causing timeouts. Security groups are stateful and cannot bypass a NACL denial.

AWS Secrets Manager natively supports automatic rotation of database credentials for Amazon Aurora MySQL by using a provided Lambda rotation function. The application retrieves the secret at runtime via the AWS SDK, and the EC2 instance role grants access through secretsmanager:GetSecretValue. This eliminates hardcoded credentials and rotates the password every 30 days without requiring application code changes to handle rotation events.

For S3, a gateway VPC endpoint is the correct private-connectivity option for EC2 instances in private subnets. The route table sends S3 prefix-list traffic to the gateway endpoint, so requests stay on the AWS network instead of traversing a NAT gateway or the public internet. The bucket policy condition on aws:SourceVpce then ensures that even valid AWS-authenticated requests are accepted only when they arrive through the approved endpoint ID.

Amazon SQS acts as a durable buffer between the frontend and the worker instances, so incoming orders are immediately acknowledged and stored in the queue while workers consume messages at a pace they can handle. During a traffic spike, the queue absorbs the burst, preventing the frontend from being overwhelmed and allowing workers to scale out independently. It also provides at-least-once delivery and retries, which improves resilience when processing is temporarily slow or fails.

A JWT authorizer is the correct choice because it natively validates RS256-signed OAuth2/OIDC tokens against the issuer's JSON Web Key Set (JWKS) without requiring custom Lambda code. For a financial reporting platform, it lets you use an existing enterprise identity provider (e.g., Auth0, Okta, Azure AD) so users authenticate with standard SSO, and you can enforce per-user scopes and claims. API Gateway automatically checks token expiry, issuer, and audience, giving low operational overhead while keeping authentication separate from application logic.

For SSE-KMS uploads, S3 uses KMS to generate a data key for encrypting the object. kms:GenerateDataKey is the direct permission required for that flow. kms:DescribeKey can be useful for validation or troubleshooting, but it is not the core cryptographic permission.

This scopes object writes to only the uploads/ prefix (resource-level restriction for s3:PutObject) and scopes object listing to only that same prefix by restricting the ListBucket request via the s3:prefix condition key (bucket-level authorization for s3:ListBucket).

S3 Block Public Access provides a centralized, account- or bucket-level safety net that overrides both bucket policies and object ACLs. When enabled, the IgnorePublicAcls and BlockPublicPolicy settings cause S3 to reject any attempt to make objects publicly accessible via a public ACL or a policy that grants public access. This is the definitive control for a claims portal because it closes the two most common misconfiguration paths, ensuring claim documents remain private even if an administrator accidentally attaches a permissive policy.

Interface VPC endpoints for Systems Manager are powered by AWS PrivateLink and create a private elastic network interface with a private IP address in each subnet. This allows instances in private subnets to communicate with the Systems Manager service (including the SSM agent and Parameter Store) without any internet-facing resources like NAT gateways or internet gateways. This is the correct and secure method for private instances to access Systems Manager.

Cross-account use of a CMK requires the KMS key policy (in the CMK’s account) to allow the external principal to perform kms:Decrypt. Since CloudTrail shows the denial is by key policy, updating the key policy to grant the account B role kms:Decrypt on the specific key is the correct and least-privilege solution.

For SSE-KMS objects, the caller needs permission to use the KMS key as well as S3 permissions. The role already has S3 access, but KMS is denying Decrypt because the key policy does not allow the role. Adding the role through the key policy or a grant, together with the needed KMS actions, resolves the failure while preserving customer-managed encryption.

S3 Transfer Acceleration improves upload performance over long distances by routing traffic through AWS edge locations and optimized network paths to the target bucket. This is a strong fit for globally distributed users uploading large files directly to S3. It preserves the same storage destination while making the transfer path faster and more consistent for remote clients.

AWS WAF is a Layer 7 (application-layer) firewall that you can associate with an Application Load Balancer to inspect every HTTP/HTTPS request before it is forwarded to backend instances. It can examine the entire request—including URI, query strings, headers, body, and cookies—and enforce custom rules or AWS managed rule groups specifically designed to block SQL injection and cross-site scripting. This makes it the correct service to protect the mobile banking backend from the described web attacks.

Restricting the load balancer security group to the corporate CIDR range limits access to the approved network. Referencing the load balancer security group as the source in the instance security group allows only traffic forwarded by the load balancer, so the instances are not directly reachable from the internet. This matches both requirements.

This is the standard confused deputy protection pattern for third-party cross-account access. The trust policy limits who can call AssumeRole, and the sts:ExternalId condition lets the customer require a customer-specific value that the vendor must supply. That prevents another customer or a malicious party from reusing the same role ARN successfully.

To grant an external vendor access to your AWS resources, you must edit the role's trust policy to include a principal from the vendor account and an action of sts:AssumeRole. This trust relationship is the only mechanism that authorizes a foreign principal to assume your role; the permissions policy alone cannot authorize cross-account assumption. Adding an ExternalId condition prevents the confused deputy problem by ensuring the role is assumed only for your intended vendor, not a third party using the same role.

The JWT authorizer configured for the OpenID Connect issuer is the correct choice because it validates the JWT's signature, expiry, issuer, and audience against the OIDC provider's public keys (JWKS), requiring no custom Lambda or additional infrastructure. It integrates directly with any standards-compliant IdP—such as Auth0, Okta, or the platform's existing identity service—so users' existing login tokens are recognized. This approach authenticates every request with low latency and minimal operational overhead while supporting fine-grained scopes and claims for authorization.

AWS Secrets Manager is purpose-built for storing secrets and, when rotation is enabled, it automatically rotates the secret value on a schedule using an associated Lambda function. It also keeps previous versions during rotation so applications can continue to work while the new secret is being tested, and it integrates natively with services like RDS, Redshift, and DocumentDB. This directly satisfies the need for automated secret rotation and eliminates the operational overhead of manually updating credentials.

AWS WAF inspects HTTP(S) requests and applies allow/block decisions based on rule matches. AWS Managed Rules provide prebuilt protections for common threat patterns, and attaching the WAF web ACL to CloudFront applies filtering at the edge.

Attaching an IAM role to the instance profile allows the AWS SDK to obtain temporary credentials from the instance metadata service automatically. No long-term keys are stored on disk, and the attached policy can be scoped to grant only s3:PutObject on the specific bucket. This satisfies both the no-stored-credentials and least-privilege requirements with minimal operational overhead.

Configure the S3 bucket to block all public access, then attach a bucket policy that grants s3:GetObject only to the CloudFront origin access control (OAC) identity, using the aws:SourceArn condition to restrict the principal to the exact CloudFront distribution ARN. This creates a hardened origin where the S3 bucket rejects any direct anonymous requests from the internet, while CloudFront's authenticated requests are permitted. Using OAC or OAI ensures the bucket owner has to intentionally authorize only that distribution, eliminating the common mistake of leaving objects publicly readable.

A JWT authorizer validates the token signature against the OpenID Connect issuer's published JWKS and checks claims such as audience and expiry. This satisfies the requirement that clients authenticate with standards-based tokens from an external OpenID Connect provider, which IAM authorization or API keys cannot validate.

Referencing the EC2 instances' security group as the source in the DB cluster security group allows only those instances to reach port 3306, and IAM database authentication lets the application generate a short-lived authentication token from its IAM role instead of storing a database password on the instance.

A bucket policy can use the request context key aws:sourceVpce to distinguish requests that came through a particular VPC endpoint. Using a Deny with a condition such as StringNotEquals on aws:sourceVpce blocks PutObject unless the request reached S3 via that specific Gateway Endpoint. Requests that arrive by other network paths will not match the required endpoint ID and will be denied.

Referencing the ALB's security group as the source means only traffic that the ALB forwards can reach the instances, regardless of the instances' public IPs. Restricting the ALB security group to the corporate CIDR range enforces the second requirement. This is the standard two-tier security group pattern and satisfies both conditions without extra infrastructure.

SSE-KMS requires the caller to have kms:Decrypt permission on the customer managed key in addition to s3:GetObject. Adding an explicit deny for the former employee in the key policy guarantees they cannot decrypt objects even if IAM or bucket policies later grant S3 access, because an explicit deny in the key policy overrides any allow. This achieves targeted revocation without impacting other principals.

Fast Snapshot Restore removes the initial performance penalty that occurs when a restored EBS volume reads blocks that have not yet been hydrated. By pre-warming the snapshot data in the target AZ, it helps ensure consistent read performance immediately after restore. This is especially valuable for databases and other workloads that must recover quickly without waiting for the background hydration process.

SSE-KMS with a customer managed key lets the company control the key policy, define who can use the key, and configure automatic key rotation on a schedule the company chooses. This meets the requirement for company-managed keys with controllable rotation, and it also provides an audit trail of key usage through AWS CloudTrail, which is valuable for compliance.

Assuming a role in the target account is a clean cross-account pattern that uses temporary credentials instead of static keys. The trust policy in Account B controls who may assume the role, and the role in B can then be given the exact S3 permissions needed. This is easy to revoke centrally by changing the trust relationship or role policy.

AWS Systems Manager Session Manager gives you encrypted, browser-based shell access to EC2 instances without opening any inbound ports. The instance must have the SSM agent installed and be assigned an IAM instance role with AmazonSSMManagedInstanceCore, allowing it to poll the SSM API over TLS. User access is governed by IAM policies and all shell activity is logged to CloudTrail and optionally S3/CloudWatch Logs, giving audited secure administration.

Cross-account S3 access requires a resource-based permission on the bucket. The bucket policy must explicitly allow the external role to read the needed prefix, otherwise the bucket owner blocks the request even if the role's identity policy allows it.

ALB supports authenticate-cognito and authenticate-oidc actions on listener rules. A Cognito user pool can federate a SAML 2.0 IdP, so the ALB can offload the SAML exchange and issue its own session cookie. This meets the requirement without custom sign-in code on the EC2 instances.

STS AssumeRole issues short-lived credentials, eliminating long-lived access keys. Attaching least-privilege IAM policies scoped to the specific Parameter Store parameters and CloudWatch Logs write actions confines the pipeline to exactly the permissions required, satisfying both security constraints.

Customer managed KMS keys give the company full control over rotation, and every use is recorded in AWS CloudTrail for auditing. The KMS key policy can grant or deny permissions per principal, so revoking the compromised IAM role is immediate and does not affect other roles that retain access.