CCNA Design Secure Questions

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because a lifecycle policy to transition objects to Glacier does not prevent direct S3 URL access; it only changes storage class, and objects in Glacier are still accessible via S3 APIs if permissions allow. Option C is wrong because relying solely on CloudFront signed URLs without updating the S3 bucket policy leaves the bucket publicly accessible, allowing direct S3 URL access to bypass CloudFront entirely. Option D is wrong because a WAF rule on CloudFront that blocks requests containing 'amazonaws.com' in the URL path would block legitimate CloudFront requests to the S3 origin, and it does not prevent direct S3 URL access which bypasses CloudFront altogether.

Why this answer

How to eliminate wrong answers

Option A is wrong because permission boundaries are not a fallback that only apply when permissions are missing; they are an upper limit that always applies, and adding the action again to the identity policy does not override the boundary. Option C is wrong because permission boundaries are enforced at runtime; removing the boundary would bypass security controls and is not a best practice. Option D is wrong because encrypting deployment artifacts with KMS does not affect IAM authorization for iam:CreateRole; KMS handles encryption/decryption, not IAM policy evaluation.

Why this answer

How to eliminate wrong answers

Option B is wrong because removing the Deny statement would allow access to all secrets, including prod, which violates the requirement to block prod secrets. Option C is wrong because SCPs are evaluated before identity-based policies and cannot be overridden by any IAM policy in the member account; an `aws:PrincipalOrgID` condition does not bypass SCP Deny statements. Option D is wrong because STS session duration has no effect on SCP evaluation; SCPs are evaluated on every API call regardless of session length.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because an allow statement with `aws:SecureTransport: true` does not block HTTP requests; it only permits HTTPS, but any other policy that allows access (e.g., a public bucket policy) could still allow HTTP requests. Option C is wrong because matching the bucket name has no relation to TLS enforcement; it addresses routing or bucket identification, not transport security. Option D is wrong because requiring SSE-KMS enforces encryption at rest, not encryption in transit (TLS); requests without SSE-KMS could still be sent over HTTP, violating the requirement.

Why this answer

How to eliminate wrong answers

Option A is wrong because S3 server access logging only records requests made to the bucket; it does not prevent deletion or overwriting of existing logs. Option B is wrong because S3 lifecycle expiration deletes objects after a set period, which would violate the requirement to prevent deletion for seven years. Option C is wrong because S3 versioning alone preserves previous versions but does not prevent deletion of the current version or overwrites; it requires additional controls like MFA delete or Object Lock to enforce immutability.

Why this answer

How to eliminate wrong answers

Option A is wrong because a spread placement group places instances on separate hardware to reduce correlated failures, not to minimize latency; it actually increases inter-node latency due to physical separation. Option C is wrong because moving instances into different Availability Zones increases network distance and latency, which is the opposite of what is needed. Option D is wrong because a partition placement group is designed to isolate instances across logical partitions for fault tolerance, not to reduce latency, and it does not guarantee close physical proximity.

Why this answer

How to eliminate wrong answers

Option A is wrong because storing an encrypted object in Amazon S3 does not provide automatic rotation of the password; you would need to manually manage rotation and versioning, and the Lambda function would require additional logic to decrypt and rotate the secret. Option C is wrong because AWS Systems Manager Parameter Store SecureString without automation lacks built-in automatic rotation; you would need to implement custom rotation logic, and Parameter Store does not natively support scheduled rotation like Secrets Manager. Option D is wrong because a KMS-encrypted Lambda environment variable is static and cannot be rotated automatically; the password would remain the same until the Lambda function is redeployed, and environment variables are visible in the function configuration, violating the requirement to not store the password in environment variables.

Why this answer

How to eliminate wrong answers

Option B is wrong because aws:PrincipalArn can be spoofed or misused; the trust policy already restricts to account 2222, but any role in that account (including unintended ones) could match the prefix, so it does not uniquely identify the specific workload. Option C is wrong because sts:RoleSessionName is a user-supplied string that can be arbitrarily set by any caller; it is not a secure mechanism to enforce workload identity and can be easily bypassed. Option D is wrong because SCPs in account 1111 cannot restrict actions within account 2222; SCPs are applied to the account that owns the role (1111) and cannot control which principals in account 2222 can assume the role—they only affect permissions for principals in the same organization.

Why these pairings

Why this answer

How to eliminate wrong answers

Option A is wrong because permission boundaries apply to IAM roles and users, not just users; the developer's user policy does not restrict roles they create unless the boundary is applied to the role. Option C is wrong because SCPs (Service Control Policies) operate at the AWS Organizations account level and cannot be attached to individual roles; they provide a maximum permission guardrail but do not replace the need for a permission boundary on the role. Option D is wrong because a developer cannot modify a permission boundary policy after it is created; the boundary is a separate policy document that the developer cannot edit, and adding a 'deny' statement would require permissions the developer does not have.

Why this answer

How to eliminate wrong answers

Option B is wrong because AWS Config periodic compliance evaluations only check resource compliance at scheduled intervals, not in real-time, and they do not directly capture or alert on every API call attempt (including failed ones) to change policies. Option C is wrong because IAM Access Analyzer is designed to analyze resource-based policies for unintended public or cross-account access, not to block or alert on all policy change attempts; it does not continuously block changes or capture failed attempts. Option D is wrong because S3 server access logging logs object-level access requests, not management API calls like PutBucketPolicy, and KMS key rotation does not capture policy modifications; neither service logs policy change attempts.

Why this answer

How to eliminate wrong answers

Option B is wrong because enabling public read access on the S3 bucket bypasses the need for signed cookies/URLs, and WAF cannot validate signatures—WAF inspects HTTP headers, URI paths, and IP addresses, but does not have the capability to verify CloudFront signed URL or signed cookie cryptographic signatures. Option C is wrong because leaving the S3 bucket publicly accessible defeats the purpose of using signed URLs; CloudFront does not filter traffic based on signed URLs at the origin level, so a public bucket would allow direct access to objects without authentication. Option D is wrong because omitting signed cookies/URLs means there is no mechanism to restrict access to authorized viewers only; WAF rate limiting and exploit blocking do not provide authentication or authorization for private content.

Why this answer

How to eliminate wrong answers

Option B is wrong because network ACLs are stateless and require manual intervention to add or remove rules; they cannot automatically block an IP after a threshold of requests is observed. Option C is wrong because AWS Shield Advanced provides DDoS protection and custom protection groups for resource-level mitigation, not automatic per-IP rate limiting based on request count. Option D is wrong because security group rules are stateful and cannot dynamically update to block a specific client IP based on request rate; they only allow or deny traffic based on static rules.

Why this answer

How to eliminate wrong answers

Option A is wrong because adding a NAT gateway would route traffic to the public Secrets Manager endpoint over the internet, violating the requirement that traffic must not traverse the public internet. Option C is wrong because gateway VPC endpoints are only supported for AWS services like S3 and DynamoDB, not for Secrets Manager, which requires an interface endpoint. Option D is wrong because VPC peering with another VPC that has internet access still requires the application to go through a NAT or internet gateway to reach Secrets Manager, breaking the 'no public internet' rule and adding unnecessary complexity.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS WAF operates at the application layer (Layer 7) and cannot block direct S3 URL access; it only filters HTTP/HTTPS requests to CloudFront, and allowing public reads on the S3 bucket would still permit direct S3 access. Option C is wrong because sharing IAM credentials with customers violates security best practices, and it does not prevent direct S3 URL access if the credentials are used outside CloudFront. Option D is wrong because enabling S3 static website hosting does not restrict access to CloudFront; the S3 website endpoint is publicly accessible and does not enforce CloudFront-only access controls.

Why this answer

How to eliminate wrong answers

Option A is wrong because security group rules control network traffic at the instance level, not at the S3 bucket policy level, and they cannot enforce that traffic must come through a specific VPC endpoint. Option B is wrong because `aws:RequestedRegion` checks the AWS Region in the request, not the VPC endpoint used; it does not restrict traffic to a specific endpoint. Option C is wrong because denying all IAM users except the EC2 role would block legitimate access from other authorized principals (e.g., cross-account roles or services) and does not enforce the endpoint requirement.

Why this answer

How to eliminate wrong answers

Option B is wrong because CloudWatch Logs metric filters on application logs cannot capture the full API request parameters or the exact principal identity for IAM changes; they only analyze log text patterns and lack the granularity of CloudTrail management events. Option C is wrong because GuardDuty alerts are designed for threat detection (e.g., anomalous API behavior) and do not provide the complete request parameters or a centralized, immutable audit trail of every IAM policy change. Option D is wrong because AWS Config alone records resource configuration snapshots and changes but does not capture who made the change or the API request parameters; it requires CloudTrail to provide the identity and source of changes.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because an internet gateway attached to a private subnet does not provide administrative access; it only enables outbound internet traffic for instances in that subnet, and inbound connections still require a public IP or NAT device. Option C is wrong because assigning a public Elastic IP address to each instance would expose SSH or RDP ports to the internet, violating the requirement to avoid opening those ports. Option D is wrong because a bastion host with SSH open to 0.0.0.0/0 explicitly opens port 22 to the entire internet, which is insecure and contradicts the requirement to avoid opening SSH or RDP ports to the internet.

Why this answer

How to eliminate wrong answers

Option A is wrong because attaching an Internet Gateway route to the NLB would expose it to the public internet, violating the requirement to keep traffic private, and NLBs do not support security groups—security groups are only supported for ALBs and ENIs, not NLB itself. Option C is wrong because an S3 Gateway endpoint is designed exclusively for Amazon S3 access, not for connecting to an NLB-hosted service; it cannot resolve or route traffic to a service hostname behind an NLB. Option D is wrong because using a bastion host introduces a single point of failure, requires SSH key management, and adds unnecessary complexity and latency; it also violates least-privilege by granting broad network access rather than a direct private connection.

Why this answer

How to eliminate wrong answers

Option B is wrong because security group rules operate at the network layer (layer 3/4) and cannot inspect application-layer payloads like SQL statements; they only allow or deny traffic based on IP addresses, ports, and protocols, so they cannot block SQL injection attempts. Option C is wrong because network ACLs are stateless packet filters that operate at the subnet level and cannot inspect or block SQL statements in the request body; they only filter based on IP, port, and protocol headers. Option D is wrong because Amazon KMS encryption on ALB listener certificates is used for encrypting data in transit (TLS termination) and has no capability to inspect or block malicious HTTP requests or SQL injection attempts.

Why this answer

How to eliminate wrong answers

Option A is wrong because it removes all IAM permissions from AppProvisioner and requires manual role creation by a central security team, which eliminates the delegation and automation that the platform team wants, and does not scale or meet the requirement for developers to create roles. Option C is wrong because adding a CloudTrail rule to alert after a privileged policy is attached is a detective control, not a preventive one; it does not prevent a developer-created role from exceeding the approved permission set, only notifies after the fact. Option D is wrong because moving the delegated IAM workflow into a separate VPC and restricting it with security groups and network ACLs addresses network-level access control, not IAM permissions or role creation boundaries, and has no effect on the permission set of roles created by developers.

Why this answer

How to eliminate wrong answers

Option B is wrong because NACLs are stateless, not stateful; they require explicit rules for both inbound and outbound traffic, and the fix involves the NACL, not the security group. Option C is wrong because the issue is not related to ALB health checks; health checks would cause target registration failures, not client connection timeouts, and the described symptom matches a missing NACL outbound rule. Option D is wrong because the instances are in private subnets behind an ALB, and return traffic to the ALB does not require a NAT gateway; the ALB handles routing within the VPC, and the problem is purely a NACL misconfiguration.

Why this answer

How to eliminate wrong answers

Option A is wrong because it allows s3:PutObject on the entire bucket (arn:aws:s3:::build-artifacts-prod/*) without restricting the prefix, so the pipeline could upload to any prefix, violating the requirement to only upload under teamA/. Option C is wrong because it allows s3:GetBucketLocation on the prefix path, which is not a valid ARN for that action (GetBucketLocation operates on the bucket, not a prefix) and does not grant the necessary s3:ListBucket permission to list objects, so the pipeline cannot verify uploads or list objects under teamA/. Option D is wrong because it allows s3:* on the prefix, granting excessive permissions like s3:DeleteObject or s3:GetObject, and s3:ListAllMyBuckets is irrelevant for restricting access to a specific bucket and prefix, violating least privilege.

Why this answer

How to eliminate wrong answers

Option A is wrong because Systems Manager Parameter Store SecureString encrypts the password at rest, but it does not natively support automatic rotation; rotation would require a custom solution, and the requirement to rotate without redeploying the task definition is not fully met. Option C is wrong because storing the password in a local file within the container image at build time violates the requirement to rotate without redeploying the task definition, and it does not use AWS-managed encryption controls for the secret at rest in transit. Option D is wrong because S3 with server-side encryption encrypts at rest, but allowing all ECS tasks to read the password using a broad IAM policy on the bucket prefix violates the least-privilege requirement, and rotating the password would require updating the S3 object and potentially redeploying the task definition.

Why this answer

How to eliminate wrong answers

Option B is wrong because security groups operate at the network layer (L3/L4) and can only filter based on IP addresses, ports, and protocols; they cannot inspect application-layer payloads to detect SQL injection or XSS. Option C is wrong because AWS Shield Advanced provides DDoS protection and enhanced detection, but it does not include rule-based inspection for application-layer attacks like SQL injection or XSS; that requires AWS WAF. Option D is wrong because IAM permissions control what actions an AWS resource (like an EC2 instance) can perform, not the content of incoming HTTP requests; restricting IAM permissions does not prevent SQL injection payloads from being processed by the application.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because it ignores the hierarchical nature of AWS authorization: an explicit deny in an SCP at the OU level overrides any allow in an IAM policy, so the request cannot succeed. Option C is wrong because even if the KMS key policy grants kms:Decrypt to the user, the SCP explicit deny still applies and blocks the action; SCPs are evaluated before resource-based policies. Option D is wrong because kms:Decrypt is a single action, not a read or write category, and SCPs apply uniformly to all actions they specify; there is no distinction between read-only and write actions in this context.

Why this answer

How to eliminate wrong answers

Option B is wrong because allowing s3:GetObject to 'Principal': '*' makes the bucket publicly readable, bypassing CloudFront entirely; anyone with the S3 URL can access the PDFs directly, violating the requirement. Option C is wrong because restricting by aws:SourceIp without specifying a Principal still leaves the bucket open to any principal, and CloudFront's IP addresses are not a reliable way to enforce exclusive access (they can change and be spoofed). Option D is wrong because enabling SSE-KMS encryption does not restrict access; it only encrypts data at rest, leaving the bucket policy unchanged and allowing direct S3 access if the URL is known.

Why this answer

How to eliminate wrong answers

Option A is wrong because using Resource '*' grants access to all secrets in the account, violating the least-privilege principle and potentially exposing other secrets. Option C is wrong because secretsmanager:DescribeSecret only retrieves metadata (e.g., secret version IDs, rotation status) but does not allow retrieving the actual secret value, which is the required action. Option D is wrong because using a wildcard prefix (arn:aws:secretsmanager:us-east-1:111122223333:secret:prod/*) would match any secret under the 'prod/' path, granting access to more secrets than needed, which is not least-privilege.

Why this answer

How to eliminate wrong answers

Option A is wrong because enabling automatic key rotation does not grant any cross-account permissions; it only rotates the key material periodically and does not affect authorization. Option C is wrong because in cross-account scenarios, the key policy in the key-owning account (account B) is the primary authorization mechanism; IAM policies in the consuming account (account A) are not sufficient on their own, and the key policy must explicitly allow the external principal. Option D is wrong because you cannot disable encryption on an EBS volume that was created from an encrypted snapshot; encryption is a permanent attribute of the volume, and attempting to disable it would fail or require creating an unencrypted copy, which defeats the purpose.

Why this answer

How to eliminate wrong answers

Option A is wrong because tagging encrypted volumes after creation is a detective or corrective control, not preventive; it does not block the creation of unencrypted volumes. Option B is wrong because VPC Flow Logs capture network traffic metadata and have no effect on EBS volume creation or encryption enforcement. Option D is wrong because running a daily Lambda function to encrypt unencrypted volumes is a reactive/corrective control; it does not prevent the initial creation of unencrypted volumes, leaving a window of exposure.

Why this answer

How to eliminate wrong answers

Option A is wrong because re-enabling object ACLs violates the requirement that ACLs must remain disabled, and managing access at the object level is not scalable for many teams. Option B is wrong because splitting into one bucket per team increases management overhead and does not solve the bucket policy size issue; a single shared bucket policy for all buckets would still be complex and error-prone. Option D is wrong because making the bucket public exposes data to the internet, violating security best practices, and presigned URLs are temporary and not suitable for ongoing team access management.

Why this answer

How to eliminate wrong answers

Option B is wrong because increasing the writer instance size only scales the single node vertically, which does not offload read queries and still leaves the writer as a bottleneck; it also costs more than adding replicas. Option C is wrong because replacing Aurora with DynamoDB would require significant application redesign and DynamoDB does not natively support SQL joins or complex queries; replication lag is not eliminated, as DynamoDB global tables have eventual consistency. Option D is wrong because Multi-AZ failover provides high availability, not increased read throughput; the standby instance does not serve read traffic unless it is an Aurora replica.

Why this answer

How to eliminate wrong answers

Option A is wrong because a bastion host with SSH open to 0.0.0.0/0 exposes a management port to the entire internet, violating the requirement to avoid opening SSH or RDP ports to the internet. Option C is wrong because assigning a public Elastic IP address to each instance directly exposes them to the internet, requiring open SSH or RDP ports for administrative access. Option D is wrong because an internet gateway attached to a private subnet does not provide administrative access; it only enables outbound internet connectivity for instances in that subnet, and administrators still need a way to connect without open ports.

Why this answer

How to eliminate wrong answers

Option A is wrong because a bastion host with SSH open to 0.0.0.0/0 exposes the instance to the entire internet, violating the requirement to avoid opening SSH or RDP ports. Option C is wrong because assigning a public Elastic IP address to each instance would require opening SSH or RDP ports to the internet for direct access, which is explicitly prohibited. Option D is wrong because an internet gateway attached to a private subnet does not provide administrative connectivity; it only enables outbound internet access for instances, and inbound administrative access would still require open ports or a bastion host.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because S3 server access logging only records requests made to the bucket, it does not prevent deletion or overwriting of existing logs. Option B is wrong because S3 lifecycle expiration automatically deletes objects after a period, which directly violates the requirement that logs cannot be deleted for seven years. Option C is wrong because S3 versioning alone preserves previous versions of objects but does not prevent deletion of the current version or overwriting; it requires additional controls like MFA Delete or Object Lock to enforce immutability.

Why this answer

How to eliminate wrong answers

Option B is wrong because tagging encrypted volumes after creation is a detective or reactive control, not preventive; it does not stop unencrypted volumes from being created. Option C is wrong because VPC Flow Logs capture network traffic metadata and have no ability to enforce or audit EBS volume encryption policies. Option D is wrong because running a daily Lambda function to encrypt unencrypted volumes is a corrective/reactive control that relies on custom operational scripts, which the design explicitly avoids, and it does not prevent the initial creation of unencrypted volumes.

Why this answer

How to eliminate wrong answers

Option A is wrong because it omits the MFA requirement entirely, incorrectly assuming that MFA can be enforced by the IAM role session policy—session policies cannot enforce MFA; the trust policy must explicitly require `aws:MultiFactorAuthPresent = true`. Option C is wrong because it uses `aws:PrincipalTag:Department = Engineering` to identify engineers, which is unreliable across accounts (tags are not automatically shared) and omits the MFA condition, leaving the session unauthenticated by MFA. Option D is wrong because it relies on `aws:SecureTransport` (which only enforces HTTPS) and assumes MFA can be enforced by IAM permissions in account C—account C's permissions cannot enforce MFA on the assumed role session in account A; the trust policy must include the MFA condition.

Why this answer

How to eliminate wrong answers

Option A is wrong because SSE-S3 uses an Amazon-managed key, which the customer does not control, failing the requirement for customer-controlled keys. Option C is wrong because client-side encryption requires developers to manage encryption in application code, which contradicts the requirement that developers do not want to manage encryption in code, and storing the encryption key in the same S3 bucket is a severe security risk. Option D is wrong because S3 replication only copies objects to another bucket and does not provide encryption key control or the ability to quickly disable access; it is a data durability and availability feature, not a security control for encryption or access revocation.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records API calls (e.g., who made a change) but does not evaluate the current configuration state of resources against compliance rules; it lacks the ability to detect an unencrypted EBS volume or an overly permissive security group rule without additional analysis. Option C is wrong because Amazon GuardDuty is a threat detection service that analyzes network traffic and DNS logs for malicious activity, not a configuration compliance tool; it does not automatically encrypt resources or evaluate security group rules. Option D is wrong because Amazon Macie is a data security service that uses machine learning to discover and protect sensitive data in S3, not a service for managing encryption settings or evaluating resource configurations like EBS volumes or security groups.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because disabling S3 Block Public Access and using an ACL that grants READ and WRITE to the bucket owner only does not prevent public access—ACLs are legacy and do not override bucket policies that might allow public access; also, ACLs cannot enforce user-specific prefixes or HTTPS. Option C is wrong because enabling bucket website hosting and allowing public GET requests violates the requirement to prevent any public access and makes presigned URLs unnecessary, but it exposes objects to the public. Option D is wrong because using ACLs to grant ObjectOwner full control does not enforce user-specific prefixes or HTTPS, and relying on longer presigned URL expirations does not fix the 403 error—the 403 is likely due to a missing or incorrect bucket policy that denies access based on the requester's identity or prefix.

Why this answer

How to eliminate wrong answers

Option A is wrong because embedding the database password in the AMI stores credentials persistently on the EC2 instance, violating the requirement that credentials must not be stored on the instance, and the password is long-lived, not short-lived. Option B is wrong because storing the database password in user data also places credentials on the EC2 instance (accessible via the instance metadata), again violating the no-storage requirement and providing a long-lived credential. Option C is wrong because a security group rule only controls network access at the transport layer; it does not address authentication or credential management, and it does not provide short-lived credentials.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records API activity and governance events for auditing, but it does not inspect the content of S3 objects to discover sensitive data. Option C is wrong because AWS Config evaluates resource configurations against compliance rules and tracks configuration changes, but it cannot scan or analyze the data within S3 objects for sensitive content. Option D is wrong because Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior using VPC Flow Logs, DNS logs, and CloudTrail events, but it does not perform content inspection of S3 objects to find sensitive data.

Why this answer

How to eliminate wrong answers

Option B is wrong because AWS Direct Connect establishes a dedicated private network connection from on-premises to AWS, which does not cache content or reduce latency for global users accessing public S3 objects. Option C is wrong because Amazon Route 53 health checks monitor endpoint availability and route traffic away from unhealthy endpoints, but they do not cache content or reduce repeated requests to the origin. Option D is wrong because Amazon EFS is a scalable file system for EC2 instances, not a caching or content delivery service, and it would not improve latency for users accessing static files via the internet.

Why this answer

How to eliminate wrong answers

Option B is wrong because enabling TLS only on the target group does not enforce HTTPS for client-to-ALB traffic; clients can still connect over HTTP, and the ALB will forward requests to targets over TLS, but the initial connection remains unencrypted. Option C is wrong because S3 server-side encryption is for data at rest in Amazon S3, not for encrypting data in transit between clients and the ALB. Option D is wrong because simply removing the port 80 listener and leaving only a default target group would drop all HTTP traffic, but it does not provide a redirect to HTTPS, which is a better user experience and the recommended approach; clients would receive a connection error instead of being seamlessly redirected.

Why this answer

How to eliminate wrong answers

Option A is wrong because making objects public with 'security through obscurity' (difficult-to-guess names) is not secure; anyone who discovers the URL can access the objects, and S3 does not enforce access control based on object name guessability. Option B is wrong because creating an IAM user in the company account and sharing access keys introduces a long-term credential that must be rotated, managed, and could be leaked; it violates the principle of least privilege and does not scale across multiple partner accounts. Option C is wrong because copying objects to a public website bucket (e.g., S3 static website hosting) makes them publicly accessible over HTTP/HTTPS with no authentication, which is insecure and does not provide read-only access control for a specific partner.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because S3 server access logging only records requests made to the bucket, it does not prevent deletion or overwriting of existing objects. Option B is wrong because S3 lifecycle expiration after seven years would automatically delete objects after that period, but it does not prevent premature deletion or overwriting before the seven-year mark. Option C is wrong because S3 versioning alone preserves previous versions of objects but does not prevent deletion of the current version or overwriting with a new version; it only retains old versions, not block writes or deletes.

Why this answer

How to eliminate wrong answers

Option A is wrong because disabling CloudTrail during troubleshooting removes all audit logging, directly violating the security team's requirement for audit logging. Option B is wrong because permanently attaching AdministratorAccess to every developer role grants excessive, permanent privileges, violating the principle of least privilege and the requirement for temporary, time-bound access. Option D is wrong because creating shared administrator access keys eliminates individual accountability, breaks audit trails, and violates the security team's need for approvals and expiry.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because requiring the vendor to use the same MFA device serial number as your internal administrators is impractical and insecure—it would require sharing a physical or virtual MFA device, which violates the principle of least privilege and does not prevent confused-deputy attacks. Option C is wrong because removing the role’s permissions policy and relying solely on the S3 bucket policy does not mitigate the confused-deputy risk; the trust policy still governs who can assume the role, and without an external ID condition, any principal in the vendor account could assume it. Option D is wrong because allowing `sts:AssumeRole` from the vendor account root principal without restricting to the vendor’s specific IAM role actually increases the attack surface—it permits any user or service in the vendor account to assume the role, making confused-deputy attacks easier, not harder.

Why this answer

How to eliminate wrong answers

Option B is wrong because Interface VPC endpoints (PrivateLink) are used for services that require private IP addresses and are typically for services like API Gateway, Kinesis, or custom services, not for S3; S3 supports Gateway endpoints natively, which are more cost-effective and simpler. Option C is wrong because a Transit Gateway is a network transit hub to connect VPCs, VPNs, and on-premises networks, but it does not provide direct private access to S3 without an internet gateway or NAT; routing to S3 over the internet would still require public connectivity. Option D is wrong because placing a NAT Gateway would allow outbound internet traffic, but the requirement explicitly states 'without sending traffic to the public internet,' and a NAT Gateway incurs additional cost and complexity; a Gateway VPC endpoint achieves the goal without any internet exposure.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because S3 default encryption applies to data at rest in S3 buckets, not to data in transit over HTTP; it cannot encrypt client-to-ALB traffic. Option C is wrong because encrypting data after it is received by the ALB means the initial client-to-ALB leg remains in plaintext HTTP, failing the requirement for encrypted client connections. Option D is wrong because AWS WAF is a web application firewall that inspects HTTP/HTTPS traffic but does not perform encryption; it cannot encrypt plain HTTP traffic.

Why this answer

How to eliminate wrong answers

Option B is wrong because S3 Gateway VPC endpoints are specific to Amazon S3 and cannot be used for Secrets Manager requests; Secrets Manager requires an Interface endpoint (powered by PrivateLink), not a Gateway endpoint. Option C is wrong because assigning a public IP address would route traffic over the public internet, violating the requirement that traffic stays within AWS’s private network. Option D is wrong because sending all 0.0.0.0/0 traffic to an Internet Gateway would force traffic out to the public internet, which is not allowed, and the subnet has no NAT Gateway to enable return traffic.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because adding a permissive security group rule for outbound 0.0.0.0/0 does not eliminate the need for a NAT gateway or internet gateway; it only permits traffic but still requires a route to the internet, which violates the requirement to avoid internet or NAT gateway traffic. Option C is wrong because replacing the NAT gateway with a network ACL that allows ephemeral ports to the internet does not provide private connectivity; network ACLs are stateless and cannot route traffic to AWS services privately, and they still require an internet gateway for outbound internet access. Option D is wrong because moving instances to public subnets would require public IP addresses and an internet gateway, exposing them to the internet and defeating the requirement to avoid internet traffic.

Why this answer

How to eliminate wrong answers

Option B is wrong because disabling CloudTrail would eliminate audit logging, directly violating the security team's requirement for audit logging. Option C is wrong because creating shared administrator access keys violates the principle of least privilege, provides no individual accountability, and cannot enforce time-bound access or approvals. Option D is wrong because permanently attaching AdministratorAccess to every developer role grants persistent elevated privileges with no expiry, which contradicts the requirement for temporary, time-bound access and increases the attack surface.

Why this answer

How to eliminate wrong answers

Option A is wrong because NAT gateways are explicitly prohibited by the requirement, and relying on security groups to block internet destinations does not prevent traffic from traversing the public internet; security groups control inbound/outbound traffic but do not alter the routing path. Option B is wrong because while interface VPC endpoints work for Secrets Manager, S3 does not support interface VPC endpoints in all regions and using one for S3 would incur higher costs and complexity; the recommended approach for S3 is a gateway endpoint, which is free and uses prefix lists. Option D is wrong because VPC peering to a public subnet with a proxy still requires traffic to traverse the internet or a NAT device, and it introduces a single point of failure and additional latency, violating the 'no public internet' requirement.

Why this answer

How to eliminate wrong answers

Option B is wrong because attaching the allow policy to the vendor account's IAM user does not grant the user permission to assume the role; the trust policy on the role must explicitly allow the external account (or its users/roles) to call sts:AssumeRole. Option C is wrong because GetCallerIdentity returns information about the caller's identity and does not grant or infer permissions to access resources in another account; it cannot replace the need for role assumption. Option D is wrong because enabling MFA on the vendor's IAM user and requiring MFA in the role's permissions policy does not address the missing trust policy authorization; the trust policy must first allow the sts:AssumeRole call, and MFA conditions are optional enhancements, not a fix for a missing trust relationship.

Why this answer

How to eliminate wrong answers

Option B is wrong because removing the ABAC condition would bypass the intended fine-grained access control, but it does not address the root cause—the session tags are missing due to lack of `sts:TagSession` permission. Option C is wrong because the `aws:PrincipalTag/Project` condition belongs in the resource-based policy or identity-based policy to enforce ABAC on downstream actions; moving it to the trust policy would only affect who can assume the role, not the presence of session tags in the assumed session. Option D is wrong because KMS authorization failures are unrelated to missing session tags; the issue is purely about STS tag propagation, not encryption key permissions.

Why this answer

How to eliminate wrong answers

Option B is wrong because denying all IAM users except the EC2 role does not restrict traffic to the VPC endpoint; it only controls which IAM identities can access the bucket, not the network path. Option C is wrong because `aws:RequestedRegion` checks the AWS Region of the request, not the VPC endpoint, and does not enforce that traffic comes through a specific endpoint. Option D is wrong because security group rules apply to EC2 instances, not to S3 bucket policies, and S3 does not support security group rules in bucket policies; S3 uses bucket policies and VPC endpoint policies for access control.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because moving the bastion host to a private subnet and requiring a corporate VPN still maintains an unnecessary bastion host, which adds complexity, cost, and a potential attack surface; it does not remove the bastion host as required. Option C is wrong because attaching a public IP to each private instance defeats the purpose of a private subnet, exposing instances directly to the internet and violating the principle of least privilege, even with security group restrictions. Option D is wrong because allowing RDP (port 3389) from engineers' source IPs still requires opening inbound ports and managing IP whitelists, which is less secure and more operationally burdensome than using Session Manager's agent-based, port-free access.

Why this answer

How to eliminate wrong answers

Option A is wrong because it creates an IAM user with AdministratorAccess and only requires MFA at login, which still allows the user to generate long-lived access keys and perform actions without MFA after the initial session. Option C is wrong because it attaches policies to an IAM user and enables MFA in the account but does not use condition keys, meaning the user can still use access keys without MFA for API calls. Option D is wrong because it enforces MFA only at the application layer via OTP prompts, which does not prevent API calls made directly to AWS using temporary credentials that bypass the application-level check.

Why this answer

How to eliminate wrong answers

Option B is wrong because security group rules operate at the network layer (Layer 3/4) and cannot inspect application-layer traffic or implement rate-based logic; they only filter by IP/port/protocol, which would block all traffic from the attacker IPs rather than rate-limit abusive requests. Option C is wrong because target group stickiness (sticky sessions) is a load-balancing feature that routes requests from the same client to the same target, but it does not integrate with AWS WAF or enable request counting for rate-based rules. Option D is wrong because AWS Shield Advanced provides DDoS protection at the network/transport layer and does not automatically apply application-layer rate limiting; the Web ACL must still be associated with the ALB for WAF rules to take effect.

Why this answer

How to eliminate wrong answers

Option A is wrong because disabling CloudTrail during troubleshooting would remove all audit logging for that period, violating the security team's requirement for audit logging and making it impossible to track actions taken. Option C is wrong because permanently attaching AdministratorAccess to every developer role violates the principle of least privilege, grants excessive permissions at all times, and does not provide time-bound access or expiry. Option D is wrong because creating shared administrator access keys eliminates individual accountability, bypasses approval workflows, and prevents proper audit logging since actions cannot be attributed to a specific developer.