A company uses AWS Shield Advanced to protect its web application from DDoS attacks. The security team wants to receive real-time notifications when a DDoS attack is detected. Which configuration should be used?
A.Use Amazon CloudWatch Events to trigger an AWS Lambda function that sends an Amazon SNS notification when a Shield Advanced event occurs.
B.Enable VPC Flow Logs and create a CloudWatch alarm for high traffic volume.
C.Subscribe an SNS topic to Shield Advanced notifications directly.
D.Enable AWS CloudTrail and create a metric filter for DDoS events.
AnswerA
Shield Advanced publishes events to CloudWatch Events.
Why this answer
AWS Shield Advanced automatically pushes DDoS events to Amazon CloudWatch Events. You can configure a CloudWatch Events rule to match Shield events and trigger an AWS Lambda function that sends notifications via Amazon SNS. Option B is incorrect because VPC Flow Logs record IP traffic metadata, not DDoS events, and a high traffic alarm is not a reliable indicator of a Shield-detected attack.
Option C is incorrect because Shield Advanced does not natively support direct SNS subscriptions for notifications; it integrates via CloudWatch Events. Option D is incorrect because AWS CloudTrail records API calls, not DDoS events, and metric filters on CloudTrail logs would not capture Shield-specific attack detections.
A company hosts a web application on EC2 instances behind an Application Load Balancer. The security team wants to ensure that only traffic from the ALB can reach the EC2 instances. Which configuration should be applied?
A.Configure the instances' security group to allow traffic from the ALB's security group.
B.Configure the instances' security group to allow traffic from the client's source IP addresses.
C.Configure a network ACL on the subnet to allow traffic from the ALB's private IP addresses.
D.Assign an IAM role to the instances that allows traffic only from the ALB.
AnswerA
This ensures only traffic that passes through the ALB can reach the instances.
Why this answer
Security groups support referencing other security groups as a source. By configuring the EC2 instances' security group to allow inbound traffic from the ALB's security group, only traffic originating from the ALB (which uses the ALB's security group) is permitted. This ensures that traffic from any other source, including direct internet traffic, is blocked at the instance level.
Exam trap
The trap here is that candidates often confuse network ACLs (stateless, IP-based) with security groups (stateful, group-based) and mistakenly choose option C, not realizing that security group referencing is the correct and more secure method for this scenario.
How to eliminate wrong answers
Option B is wrong because allowing traffic from client source IP addresses would permit direct access to the EC2 instances, bypassing the ALB and defeating the purpose of restricting traffic to only the ALB. Option C is wrong because network ACLs are stateless and operate at the subnet level; they cannot reference security groups and would require manual management of ALB private IP addresses, which can change over time. Option D is wrong because IAM roles control API-level permissions for AWS services, not network traffic; they cannot filter or allow inbound traffic to EC2 instances.
A company is using AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all Amazon S3 buckets created by CloudFormation are encrypted by default. Which approach should be taken?
A.Configure an IAM policy that requires all S3 operations to use encryption.
B.Set a bucket policy in the CloudFormation template that denies all actions unless encryption is enabled.
C.Enable AWS Config rule s3-bucket-server-side-encryption-enabled to enforce encryption.
D.Use a bucket policy with a condition that denies s3:PutObject if the x-amz-server-side-encryption header is not present.
AnswerD
This policy enforces encryption on object uploads.
Why this answer
A bucket policy with a condition that denies s3:PutObject unless the x-amz-server-side-encryption header is present ensures that any object uploaded to the bucket must include encryption headers. This enforces server-side encryption at the object level, which is the most direct way to guarantee encryption for all objects placed into S3 buckets created by CloudFormation.
Exam trap
The trap here is that candidates often confuse bucket-level default encryption (which can be overridden by individual requests) with object-level enforcement via bucket policy conditions, leading them to choose AWS Config rules or IAM policies that do not guarantee encryption on every object upload.
How to eliminate wrong answers
Option A is wrong because an IAM policy that requires all S3 operations to use encryption applies to the IAM user or role, not to the S3 bucket itself, and does not enforce encryption on objects uploaded by other principals or services. Option B is wrong because a bucket policy that denies all actions unless encryption is enabled would block legitimate operations that do not involve encryption headers, such as listing buckets or reading metadata, and is overly broad. Option C is wrong because an AWS Config rule like s3-bucket-server-side-encryption-enabled only checks whether the bucket has default encryption configured, but does not enforce encryption on individual object uploads, which can bypass default encryption if the request specifies otherwise.
AWS WAF can be associated with an Application Load Balancer to filter traffic based on IP addresses, allowing you to block traffic from a specific IP address range. Option A is incorrect because Network ACLs operate at the subnet level and cannot be directly associated with an ALB. Option B is incorrect because security groups for an ALB cannot block IP addresses; they support allow rules only and do not have a deny capability.
Option C is incorrect because Route53 is a DNS service and does not filter traffic.
A company is designing a VPC for a three-tier web application that must be accessible from the internet only via HTTPS. The web servers must be able to initiate outbound connections to the internet for software updates, but the database servers must have no direct internet access. Which architecture meets these requirements?
A.Web servers in private subnets, database servers in public subnets, both behind an Application Load Balancer
B.Web servers in public subnets, database servers in private subnets with a route to a NATGateway in a public subnet
C.Web servers in private subnets with a route to a NATGateway, database servers in private subnets with no route to the NAT Gateway, both behind an Application Load Balancer in public subnets
D.Web servers in public subnets with Elastic IPs, database servers in private subnets with a route to an internet gateway
AnswerC
Web servers can reach the internet via NAT, database servers have no internet access, and the ALB handles HTTPS traffic.
Why this answer
It places the web servers in private subnets with a route to a NATGateway for outbound internet access (e.g., software updates), while the database servers are in private subnets with no route to the NAT Gateway, ensuring no direct internet access. Both tiers are behind an Application Load Balancer in public subnets for HTTPS ingress. Option A is wrong because database servers in public subnets have direct internet access.
Option B is wrong because web servers in public subnets have direct internet access, reducing security. Option D is wrong because web servers in public subnets with Elastic IPs have direct internet access, and database servers with a route to an internet gateway also have internet access.
A security engineer is reviewing AWS CloudTrail logs and notices repeated `UnauthorizedOperation` errors for `ec2:RunInstances` from a specific IAM user. The user has a policy that allows `ec2:RunInstances` with a condition `aws:RequestedRegion` set to `us-east-1`. The engineer confirms the user is launching instances in `us-east-1`. What is the most likely cause of the error?
A.The user does not have a service-linked role for EC2.
B.The IAM policy lacks a `Resource` element specifying which instances can be launched.
C.The user is trying to launch an instance type that is not supported in us-east-1.
D.The user is using an AWS CLI command that does not include the `--region` parameter, causing the request to go to a global endpoint.
AnswerD
The condition key checks the requested region; without specifying region, it may default to a global endpoint.
Why this answer
The error occurs because the user's IAM policy condition `aws:RequestedRegion` evaluates the region specified in the request, not the physical region where the instance is launched. If the user runs an AWS CLI command without the `--region` parameter, the request goes to the global endpoint (iam.amazonaws.com) or the default region configured in the CLI, which may not be `us-east-1`. This causes the condition to fail, resulting in an `UnauthorizedOperation` error.
Option A is incorrect because service-linked roles are not required for `ec2:RunInstances`. Option B is incorrect because the condition key `aws:RequestedRegion` does not require a `Resource` element; it works with the default resource `*`. Option C is incorrect because the error is `UnauthorizedOperation`, not an instance type error.
A company has a VPC with a single public subnet and a single private subnet. The private subnet contains an RDS MySQL database that should not be accessible from the internet. The public subnet contains a bastion host that is used for SSH access to the database instance. The security team wants to ensure that the database can only be accessed from the bastion host. Which two security group rules should be configured? (Choose TWO.)
Select 2 answers
A.Database security group: Allow inbound MySQL from the public subnet CIDR.
B.Database security group: Allow inbound MySQL from the bastion security group.
C.Bastion security group: Allow inbound SSH from a limited corporate IP range.
D.Database security group: Allow inbound MySQL from 0.0.0.0/0.
E.Bastion security group: Allow inbound SSH from 0.0.0.0/0.
AnswersB, C
This restricts database access to the bastion.
Why this answer
Options B and C are correct. The database security group should allow inbound MySQL from the bastion security group (option B), ensuring only the bastion can access the database. The bastion security group should allow inbound SSH only from a limited corporate IP range (option C) to restrict administrative access.
Option A is incorrect because allowing inbound MySQL from the public subnet CIDR would permit any instance in that subnet, not just the bastion. Option D is incorrect as it allows MySQL from the entire internet. Option E is incorrect because it allows SSH from any IP, which is insecure.
A company runs a critical application on EC2 instances in an Auto Scaling group across multiple Availability Zones. The application uses an Application Load Balancer (ALB) to distribute traffic. The security team has implemented a security group for the ALB that allows inbound HTTPS from 0.0.0.0/0 and a security group for the EC2 instances that allows inbound HTTP from the ALB's security group. Recently, the company experienced a security incident where an attacker exploited a vulnerability in the application to gain access to an EC2 instance and then moved laterally to the database. The database is in a private subnet and uses a security group that allows inbound traffic from the EC2 instance security group on port 3306 (MySQL). The security team wants to prevent lateral movement in the future. Which of the following is the MOST effective course of action?
A.Use VPC peering to isolate the database subnet from the application subnet.
B.Deploy AWS WAF in front of the ALB to block known malicious IPs.
C.Create a network ACL for the private subnet that denies outbound traffic from the EC2 instances to the database subnet.
D.Implement a host-based firewall on each EC2 instance to restrict outbound connections to only the database endpoint.
AnswerD
This provides fine-grained control over outbound traffic from the application.
Why this answer
Implementing a host-based firewall on each EC2 instance provides granular control over outbound connections, allowing only necessary traffic such as to the database endpoint. This prevents an attacker who compromises an EC2 instance from moving laterally to the database by restricting outbound connections at the instance level. In contrast, option A (VPC peering) is for connecting different VPCs and does not prevent lateral movement within the same VPC.
Option B (AWS WAF) protects the ALB from web attacks but does not restrict outbound traffic from instances. Option C (network ACLs) operates at the subnet level and can block traffic between subnets, but it is stateless and less granular than a host-based firewall, and it cannot restrict traffic to a specific database endpoint if the database is in a different subnet. Therefore, a host-based firewall is the most effective solution.
A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can download objects. Which combination of actions should the company take? (Choose TWO.)
Select 2 answers
A.Attach an Internet gateway to the VPC and route traffic through it.
B.Attach a security group to the S3 bucket.
C.Create an S3 bucket policy that allows access only from the VPC using the aws:SourceVpc condition.
D.Create a NATgateway in the VPC for outbound traffic.
E.Create a VPC endpoint for Amazon S3 in the VPC.
AnswersC, E
This restricts access to the specified VPC.
Why this answer
To restrict access to an S3 bucket so that only traffic from a specific VPC can download objects, the correct combination is to create an S3 bucket policy that uses the aws:SourceVpc condition (Option C) and create a VPC endpoint for Amazon S3 in the VPC (Option E). The bucket policy with aws:SourceVpc ensures that only requests originating from the specified VPC are allowed, while the VPC endpoint enables private connectivity between the VPC and S3 without traversing the internet. Option A (Internet gateway) would make the VPC publicly accessible and is not required for private access.
Option B (NATgateway) is used for outbound internet access from private subnets, not for restricting access to S3. Option D (security group) cannot be attached to an S3 bucket; security groups apply to EC2 instances or other resources, not to S3.
A company runs a containerized application on Amazon ECS with Fargate. The security team wants to ensure that the containers can only communicate with specific external APIs and not with other containers in the same task. Which security control should be applied?
A.Configure network ACLs on the subnets where the tasks run.
B.Apply an IAM policy to the task execution role to restrict API calls.
C.Attach a security group to the ECS task with outbound rules allowing only the specific API endpoints.
D.Use VPC endpoints to restrict traffic to specific APIs.
AnswerC
When using awsvpc network mode, tasks get their own security groups that can filter traffic.
Why this answer
Security groups attached to ECS tasks in awsvpc mode can control inbound and outbound traffic at the task level, allowing restriction of communication to specific external API endpoints. Option A is incorrect because network ACLs operate at the subnet level and are stateless, not suitable for per-task granularity. Option B is incorrect because IAM policies control API authorization, not network traffic.
Option D is incorrect because VPC endpoints are used for private connectivity to AWS services, not for restricting container outbound traffic to external APIs.
A security engineer is investigating a potential breach. The engineer notices that an EC2 instance's security group allows inbound SSH (port 22) from 0.0.0.0/0. The instance is in a public subnet and has a public IP address. However, the engineer finds that SSH access is only possible from a specific IP address. What is the most likely explanation?
A.The network ACL allows inbound SSH from 0.0.0.0/0
B.The security group rule is being overridden by a more restrictive security group attached to the same instance
C.The security group rule is being evaluated but the instance's operating system firewall is blocking SSH
D.The network ACL denies inbound SSH from all IPs except the specific IP
AnswerD
Network ACLs are stateless and can explicitly deny traffic. If the NACL denies SSH from all IPs except the specific one, it would override the permissive security group rule, explaining why only that IP can connect.
Why this answer
A network ACL (NACL) can override security group rules if it denies inbound traffic. Option A is wrong because if the NACL allowed SSH from anywhere, then the restriction to a specific IP would not occur. Option B is wrong because if the NACL allowed traffic, it wouldn't explain the restriction.
Option C is wrong because security group rules are evaluated; the rule allowing all traffic would still apply.
A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. The VPC has a VPC endpoint for S3 configured. Which policy should be attached to the bucket?
This condition restricts access to traffic coming through the specified VPC endpoint.
Why this answer
It uses the `aws:SourceVpce` condition key to restrict access to the S3 bucket exclusively to requests originating from the specified VPC endpoint (vpce-11111111). This ensures that only traffic routed through that VPC endpoint, which is attached to the specific VPC, can perform `s3:GetObject` actions, effectively limiting access to the VPC's private network.
Exam trap
The trap here is that candidates often confuse `aws:SourceVpc` with `aws:SourceVpce` or mistakenly use IP-based conditions like `aws:SourceIp` or `aws:VpcSourceIp`, not realizing that for S3 bucket policies, the correct condition key to restrict to a specific VPC endpoint is `aws:SourceVpce`, and that `aws:SourceVpc` is not supported for S3 gateway endpoints.
How to eliminate wrong answers
Option B is wrong because `aws:VpcSourceIp` is not a valid condition key; the correct key for VPC endpoint traffic is `aws:SourceVpce` or `aws:SourceVpc`, not an IP-based condition. Option C is wrong because `aws:SourceVpc` condition key checks the VPC ID of the requester, but this only works for VPC endpoints that support the `aws:SourceVpc` key (e.g., some AWS services), and for S3 gateway endpoints, the `aws:SourceVpc` key is not available; instead, `aws:SourceVpce` must be used to restrict to a specific endpoint. Option D is wrong because `aws:SourceIp` condition key cannot be used to restrict traffic from a VPC endpoint, as the source IP of requests through a VPC endpoint is the private IP of the endpoint's network interface, which is not reliably the same as the VPC's CIDR range, and the condition key `aws:SourceIp` is intended for public IP addresses, not private IPs from VPC endpoints.
A company uses AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets in the organization are encrypted with server-side encryption (SSE-S3) and that no public access is allowed. The team has created an SCP that denies the s3:PutBucketPublicAccessBlock action and also denies s3:PutBucketPolicy if the policy would grant public access. However, the team discovers that some buckets in the production account still have public access enabled. The SCP is applied to the root OU, which includes the production account. What is the most likely reason that the SCP is not being enforced?
A.The SCP does not have an explicit allow for the actions it denies; SCPs require an explicit allow to take effect.
B.The SCP only applies to IAM users and roles, not to the root user.
C.The production account is the management account of the organization, and SCPs do not affect the management account.
D.The SCP is not attached to the production account's OU; it is attached to the root OU.
AnswerC
Management account is not affected by SCPs.
Why this answer
SCPs do not affect the management account; they only apply to member accounts. If the production account is the management account, SCPs will not apply. Option A is incorrect because SCPs don't require explicit allow; they deny by default if not allowed.
Option B is incorrect because SCPs affect all IAM principals in the account. Option D is incorrect because SCPs can be applied to OUs.
A company uses AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all S3 buckets created by CloudFormation have encryption enabled by default. Which TWO approaches can achieve this?
Select 2 answers
A.Create an AWS Config rule that checks for S3 bucket encryption and auto-remediates
B.Enable S3 Block Public Access at the account level
C.Attach a service control policy (SCP) to the root OU that denies S3 bucket creation without encryption
D.Attach an IAM role to the CloudFormation service that grants permissions to encrypt buckets
E.Use a CloudFormation stack policy to deny creation of S3 buckets without encryption
AnswersA, C
AWS Config rule with auto-remediation can detect buckets without encryption and automatically apply encryption, ensuring compliance.
Why this answer
An AWS Config rule can check that S3 buckets have encryption enabled and automatically remediate any non-compliant buckets. Option C is correct because a service control policy (SCP) can be attached to the root OU to deny the creation of S3 buckets without encryption, using a condition on the s3:x-amz-server-side-encryption header. Option B is incorrect because S3 Block Public Access does not enforce encryption.
Option D is incorrect because attaching an IAM role to CloudFormation only grants permissions but does not enforce encryption. Option E is incorrect because CloudFormation stack policies only protect existing resources from updates and cannot enforce conditions on bucket creation.
Refer to the exhibit. A security engineer is investigating a potential unauthorized VPC creation. What does the evidence suggest?
A.The user admin created two VPCs, but one was deleted shortly after creation.
B.The CloudTrail log is incomplete; both VPCs exist.
C.Both VPCs were created successfully and still exist.
D.The user admin only created one VPC; the second event is a duplicate.
AnswerA
Correct. The non-existent VPC suggests deletion.
Why this answer
The CloudTrail log shows two CreateVpc events by user admin. One VPC exists (vpc-12345678), but the other (vpc-87654321) does not exist, indicating that it was deleted after creation. This could indicate malicious activity where a VPC was created and then deleted to cover tracks.
A security engineer runs the above AWS CLI command. The engineer notices that the security group has no outbound rules. What is the implication of this configuration?
A.The EC2 instances in this security group cannot initiate outbound connections
C.The security group allows all outbound traffic by default
D.Outbound traffic is allowed because security groups are stateful
AnswerA
Without outbound rules, all outbound traffic is denied.
Why this answer
A security group without outbound rules will block all outbound traffic by default (since security groups are stateful and default deny egress). Option B is wrong because security groups are stateful; the inbound rule allows return traffic. Option C is wrong because the inbound rule allows HTTP from anywhere, but outbound is missing.
Option D is wrong because the security group does allow inbound HTTP.
Placing the RDS instance in a private subnet ensures it is not directly accessible from the internet, which reduces the attack surface. Restricting inbound traffic to only the application security group (using security group rules) ensures that only the specific application servers can connect to the database, following the principle of least privilege. This is a fundamental network security best practice for database instances.
Exam trap
The trap here is that candidates often confuse high availability (Multi-AZ) or cost-saving measures (disabling backups) with security controls, when in fact they do not address confidentiality, integrity, or access control.
A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and EC2 instances be encrypted. Which configuration ensures this requirement is met?
A.Use an HTTPS listener on the ALB and configure the target group with HTTPS.
B.Use a TCP listener on the ALB and a TCP target group.
C.Configure security group inbound rules to allow only HTTPS traffic.
D.Use an HTTP listener on the ALB and HTTP on the target group.
It ensures end-to-end encryption between the ALB and EC2 instances. By configuring an HTTPS listener on the ALB, traffic from clients to the ALB is encrypted. Then, by setting the target group protocol to HTTPS, the ALB re-encrypts the traffic before forwarding it to the EC2 instances, fulfilling the security team's requirement that all traffic between the ALB and EC2 instances be encrypted.
Exam trap
The trap here is that candidates assume an HTTPS listener alone encrypts all traffic end-to-end, forgetting that the ALB-to-instance leg must also use HTTPS; otherwise, traffic between the ALB and EC2 instances is in plaintext.
How to eliminate wrong answers
Option B is wrong because a TCP listener and TCP target group operate at Layer 4 and do not provide encryption; they forward raw TCP traffic without TLS/SSL termination or re-encryption. Option C is wrong because security group inbound rules only control access at the network level (allowing or denying traffic based on port/protocol) and do not encrypt traffic; encryption is a function of the protocol (HTTPS/TLS), not security group rules. Option D is wrong because using HTTP on both the listener and target group means traffic is transmitted in plaintext at every hop, with no encryption between the ALB and EC2 instances.
Refer to the exhibit. A security engineer is unable to SSH into an EC2 instance in subnet-12345678. The instance's security group allows inbound SSH from 10.0.0.0/8, and the instance has a public IP. What is the most likely reason for the failure?
A.The security group egress rule is blocking return traffic.
B.The security group inbound rule restricts SSH to the 10.0.0.0/8 range, blocking the engineer's IP.
C.The network ACL's default deny rule (32767) is blocking all inbound traffic.
D.The network ACL inbound rule for SSH is misconfigured, denying all traffic.
AnswerB
Correct. The security group only allows SSH from the internal 10.0.0.0/8 range.
Why this answer
The network ACL allows inbound SSH from 0.0.0.0/0, but the security group only allows SSH from 10.0.0.0/8. Since the engineer is connecting from an IP outside that range, the security group blocks the connection.
A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is associated with a security group that allows outbound HTTPS (port 443) to 0.0.0.0/0. The private subnet route table has a default route (0.0.0.0/0) pointing to a NAT Gateway in the public subnet. The NAT Gateway's security group allows inbound HTTPS from the private subnet CIDR. However, the instance cannot download patches. What is the most likely cause?
A.The network ACL for the private subnet is blocking outbound traffic
B.The NATGateway's security group is blocking outbound traffic to the internet
C.The private subnet route table does not have a route to the NATGateway
D.The security group attached to the EC2 instance is blocking inbound traffic
AnswerB
NATGateway's security group must allow outbound HTTPS to 0.0.0.0/0.
Why this answer
The NATGateway's security group must allow outbound traffic to the internet for the patches to be retrieved. Even though the NAT Gateway allows inbound HTTPS from the private subnet, it also needs an outbound rule permitting HTTPS traffic to 0.0.0.0/0 so that response packets from the internet can flow back through the NAT Gateway to the instance. Without this outbound rule, the NAT Gateway drops the return traffic, preventing the download.
Exam trap
The trap here is that candidates assume the NATGateway only needs inbound rules from the private subnet, forgetting that outbound rules are required for return traffic, or they mistakenly think NAT Gateways cannot have security groups at all.
How to eliminate wrong answers
Option A is wrong because the network ACL for the private subnet is not mentioned as blocking traffic; by default, network ACLs allow all inbound and outbound traffic, and the question does not indicate any custom ACL rules that would block outbound HTTPS. Option C is wrong because the private subnet route table already has a default route (0.0.0.0/0) pointing to the NAT Gateway, so routing to the NAT Gateway is correctly configured. Option D is wrong because the security group attached to the EC2 instance allows outbound HTTPS to 0.0.0.0/0, which is sufficient for the instance to initiate the connection; inbound traffic is not relevant for outbound patch downloads.
A security engineer needs to ensure that all Amazon S3 buckets in an AWS account have server-side encryption (SSE) enabled. The engineer wants to automatically remediate any bucket that is created without SSE. Which solution should the engineer implement?
A.Use S3 bucket policies to deny access to objects without encryption.
B.Apply an IAM policy that requires SSE for all S3 actions.
C.Use AWS Config with a managed rule (s3-bucket-server-side-encryption-enabled) and an automatic remediation action.
D.Create a service control policy (SCP) that denies creation of buckets without encryption.
AnswerC
AWS Config can detect and automatically remediate non-compliant resources.
Why this answer
The correct solution is to use AWS Config with the managed rule `s3-bucket-server-side-encryption-enabled` and an automatic remediation action. AWS Config continuously evaluates S3 buckets against this rule and can trigger a remediation action (e.g., enabling default encryption) when a non-compliant bucket is created. Option A is incorrect because a bucket policy can deny access to objects without encryption but does not prevent creation of buckets without SSE.
Option B is incorrect because an IAM policy can require SSE for actions performed by users, but it cannot enforce encryption on the bucket itself at creation time. Option D is incorrect because a service control policy (SCP) applies to all accounts in an organization but requires careful configuration and does not directly enable SSE on the bucket; it can only deny actions that do not include encryption parameters, which is more complex and less straightforward than the AWS Config remediation approach.
A security engineer is designing a network architecture for a multi-tier application. The web servers must be accessible from the internet, while the application servers must only be accessible from the web servers. Which TWO configurations should be used? (Choose TWO.)
Select 2 answers
A.Configure a NATgateway in the private subnet for the application servers.
B.Place the web servers in a public subnet with a route to an internet gateway.
C.Use a network ACL on the application subnet to allow inbound traffic from the web subnet's IP range.
D.Place the application servers in a public subnet with a route to an internet gateway.
E.Configure the application servers' security group to allow traffic only from the web servers' security group.
AnswersB, E
This allows internet traffic to reach the web servers.
Why this answer
Placing web servers in a public subnet with a route to an internet gateway allows them to receive inbound traffic from the internet. This is the standard AWS design for internet-facing resources, where the subnet's route table directs 0.0.0.0/0 traffic to an internet gateway, enabling direct communication from the internet.
Exam trap
The trap here is that candidates often confuse network ACLs with security groups, incorrectly assuming that a stateless network ACL with IP-based rules is the correct way to restrict traffic between tiers, when in fact security group references provide a more secure and manageable solution.
A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Site-to-Site VPN. Security engineers need to ensure that traffic between VPCs is inspected by a third-party firewall appliance deployed in a centralized inspection VPC. Which architecture should be used?
A.Use security groups in each VPC to allow only traffic from the firewall appliance's IP.
B.Establish VPC Peering connections between each VPC and the inspection VPC.
C.Configure Network ACLs in each VPC to deny traffic that does not originate from the inspection VPC.
D.Create a central inspection VPC with the firewall appliance. Configure Transit Gateway route tables to route traffic between VPCs through the inspection VPC.
AnswerD
Transit Gateway supports centralized routing for inspection.
Why this answer
Transit Gateway route tables can force traffic between VPCs through the inspection VPC by attaching the firewall appliance and using specific routing entries. Option A is incorrect because security groups only control traffic at the instance level and cannot redirect traffic to an inspection appliance. Option B is incorrect because VPC Peering does not support transitive routing, so traffic between two VPCs cannot go through a third VPC.
Option C is incorrect because Network ACLs are stateless and can only filter traffic based on IP/port, not route traffic through an inspection appliance.
Refer to the exhibit. A security engineer reviews the AWS WAF web ACL configuration. What is the effect of this configuration?
A.It blocks IPs that send more than 2000 requests and allows requests containing '<script>' in the body.
B.It allows all traffic because the rules are misconfigured.
C.It blocks both SQL injection and XSS attacks.
D.It blocks SQL injection attacks and allows XSS attacks.
AnswerA
Correct. The rate-based rule blocks high request rates, and the XSS rule allows the pattern.
Why this answer
The first rule (SQLiRule) is actually a rate-based rule that blocks IPs exceeding 2000 requests, not SQL injection. The second rule (XSSRule) has an Allow action, which would allow requests containing '<script>' in the body, defeating the purpose of blocking XSS.
A company is deploying a web application on EC2 instances behind an Application Load Balancer. The security team requires that all traffic between the ALB and the EC2 instances be encrypted. Which configuration should the engineer implement?
A.Configure the ALB listener with HTTP protocol and the target group with HTTP protocol, then use a security group to restrict traffic.
B.Configure the ALB listener with HTTPS protocol and the target group with HTTP protocol.
C.Configure the ALB listener with TCP protocol and the target group with TCP protocol, then install SSL certificates on the EC2 instances.
D.Configure the ALB listener with HTTPS protocol and the target group with HTTPS protocol, and install SSL certificates on the EC2 instances.
AnswerD
This encrypts both frontend and backend traffic.
Why this answer
It ensures end-to-end encryption between the ALB and EC2 instances. The ALB listener uses HTTPS to terminate client SSL/TLS, and the target group uses HTTPS to re-encrypt traffic to the instances, requiring SSL certificates on the EC2 instances to decrypt and re-encrypt. This satisfies the security requirement that all traffic between the ALB and EC2 instances be encrypted.
Exam trap
The trap here is that candidates often assume HTTPS on the listener alone is sufficient, overlooking that the target group protocol must also be HTTPS to encrypt traffic between the ALB and instances, not just between clients and the ALB.
How to eliminate wrong answers
Option A is wrong because using HTTP on both the listener and target group means traffic is in plaintext, violating the encryption requirement. Option B is wrong because while the listener uses HTTPS, the target group uses HTTP, so traffic between the ALB and EC2 instances is unencrypted, which does not meet the requirement. Option C is wrong because TCP protocol at the listener and target group does not provide application-layer encryption; SSL certificates on EC2 instances alone do not encrypt traffic without HTTPS configuration on the target group.
A company is using an Application Load Balancer (ALB) to distribute traffic to a set of EC2 instances in private subnets. The security team wants to ensure that only traffic from the ALB can reach the EC2 instances. Which security group configuration should be applied to the EC2 instances?
A.Allow inbound HTTP/HTTPS from the security group attached to the ALB.
B.Configure the network ACL to allow traffic from the ALB's private IP addresses.
D.Allow inbound HTTP/HTTPS from the VPC CIDR block.
AnswerA
This ensures only traffic originating from the ALB is allowed.
Why this answer
Referencing the security group of the Application Load Balancer as the source in the inbound rule ensures that only traffic coming from the ALB can reach the EC2 instances. Option B is incorrect because network ACLs are stateless and cannot reference security groups; they also operate at the subnet level, not at the instance level. Option C is incorrect because allowing traffic from 0.0.0.0/0 would expose the instances to the internet.
Option D is incorrect because allowing traffic from the VPC CIDR would permit any instance in the VPC to access the EC2 instances, not just the ALB.
A security engineer is designing a network architecture in AWS. The engineer needs to ensure that all outbound traffic from a VPC goes through a centrally managed NAT device for logging and filtering. The VPC has multiple private subnets. Which TWO steps are required to accomplish this? (Choose TWO.)
Select 2 answers
A.Deploy an HTTP forward proxy in the public subnet.
B.Create a route table for the private subnets with a default route (0.0.0.0/0) pointing to the NAT device.
C.Set up a transit gateway and attach the VPC to it.
E.Place the NAT device in a public subnet with a route to an internet gateway.
AnswersB, E
This routes outbound traffic from private subnets to the NAT device.
Why this answer
To route all outbound traffic from private subnets through a centrally managed NAT device, you need to configure the route tables for those subnets to send default traffic (0.0.0.0/0) to the NAT device (Option B). Additionally, the NAT device must be placed in a public subnet with a route to an internet gateway so it can translate the private IPs and forward traffic to the internet (Option E). Option A is wrong because an HTTP forward proxy is not necessary for this purpose.
Option C is wrong because a transit gateway does not replace the need for a NAT device and route table configuration. Option D is wrong because a gateway endpoint is for private access to services like S3 or DynamoDB, not for general internet traffic.
A company has a requirement to block traffic from specific IP addresses known to be malicious. The company has an Application Load Balancer (ALB) that fronts a web application. The security engineer needs to implement a solution that can block these IP addresses at the edge before they reach the ALB. Which AWS service should be used?
A.Configure security groups on the ALB to deny traffic from those IP addresses.
B.Enable AWS Shield Advanced and configure rate-based rules.
C.Add a network ACL rule to the ALB's subnet to deny the IP addresses.
D.Use AWS WAF with an IP set rule to block the malicious IP addresses.
AnswerD
WAF can block IPs at the edge before reaching the ALB.
Why this answer
AWS WAF can be associated with an Application Load Balancer and allows you to block traffic based on IP addresses using IP set rules. This enables blocking at the edge before traffic reaches the ALB. Option A is incorrect because security groups are instance-level firewalls and cannot be attached to an ALB.
Option B is incorrect as AWS Shield Advanced provides DDoS protection but does not support IP-based blocking by itself. Option C is incorrect because network ACLs operate at the subnet level, not at the ALB level, and cannot block traffic specifically destined for the ALB.
E.Use an IAM policy that requires MFA for all S3 actions
AnswersA, B
Blocks all public access to S3 buckets.
Why this answer
Options A and B are correct. Enabling S3 Block Public Access at the account level (option A) prevents any public access to all buckets. Using a bucket policy with a condition that denies s3:PutBucketPolicy unless the request comes from a specific VPC (option B) ensures that only authorized VPCs can modify the bucket policy, preventing accidental public exposure.
Option C is wrong because default encryption does not affect public access. Option D is wrong because MFA Delete protects against accidental deletion, not public access. Option E is wrong because requiring MFA for S3 actions does not prevent public access.
Refer to the exhibit. A developer receives an 'UnauthorizedOperation' error when launching an EC2 instance with the specified security group. The developer has permissions to use ec2:RunInstances. What is the most likely cause?
A.The security group contains an inbound rule with a source of 0.0.0.0/0 for port 80, which is too permissive and triggers a service control policy (SCP) that denies launching instances with overly permissive rules.
B.The security group allows inbound HTTPS from the entire RFC 1918 address space, but the instance is in a public subnet.
C.The security group allows outbound all traffic, which violates the principle of least privilege.
D.The instance type t2.micro is not available in the specified subnet's Availability Zone.
AnswerA
Incorrect. SCPs cannot deny actions based on the content of security group rules (e.g., permissiveness). They can only deny based on resource identifiers like security group IDs.
Why this answer
The 'UnauthorizedOperation' error is an authorization error that occurs when a service control policy (SCP) explicitly denies the ec2:RunInstances action. In this scenario, the SCP is configured to deny launching instances associated with security groups that have overly permissive rules, such as an inbound rule from 0.0.0.0/0. Although SCPs cannot dynamically inspect security group rule content, administrators can implement deny policies targeting specific security groups known to be permissive.
The developer's IAM policy allows RunInstances, but the SCP overrides that permission. Option D is incorrect because an instance type not being available in an Availability Zone results in a capacity or compatibility error (e.g., 'InsufficientInstanceCapacity'), not an 'UnauthorizedOperation' error.
Exam trap
Candidates often assume 'UnauthorizedOperation' always indicates missing IAM permissions, but SCPs can cause this error even when the user has explicit Allow, due to an explicit deny on specific resources or conditions.
How to eliminate wrong answers
Option B is wrong because allowing inbound HTTPS from RFC 1918 address space (private IPs) is not inherently problematic and would not trigger an 'UnauthorizedOperation' error; the error is about authorization, not subnet placement. Option C is wrong because outbound all traffic is a default security group setting and does not violate the principle of least privilege in a way that would cause an 'UnauthorizedOperation' error; SCPs typically focus on inbound rules for overly permissive access. Option D is wrong because t2.micro is a standard instance type available in most Availability Zones; if it were unavailable, the error would be 'InsufficientInstanceCapacity' or 'InvalidParameterValue', not 'UnauthorizedOperation'.
A Security Engineer is configuring a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to download patches from the internet. Which TWO actions should the Engineer take to allow the web server internet access without exposing the database to the internet?
Select 2 answers
A.Create a bastion host in the public subnet and configure the web server to use it as a proxy.
D.Attach an Internet Gateway to the VPC and add a route to the Internet Gateway in the private subnet's route table.
E.Add a route in the private subnet's route table that points 0.0.0.0/0 to the NATGateway.
AnswersC, E
NATGateway enables outbound internet access for instances in private subnets.
Why this answer
A NATGateway in the public subnet allows instances in the private subnet to initiate outbound IPv4 traffic to the internet (e.g., to download patches) while preventing unsolicited inbound connections from the internet. By adding a route in the private subnet's route table that points 0.0.0.0/0 to the NAT Gateway, the web server's outbound traffic is forwarded to the NAT Gateway, which then uses the Internet Gateway to reach the internet. The database remains isolated because it has no direct route to the Internet Gateway and no public IP address.
Exam trap
The trap here is that candidates often confuse a NATGateway with a bastion host or assume that a VPC endpoint for S3 can provide general internet access, but the key distinction is that a NAT Gateway enables outbound internet connectivity for private subnets without exposing them to inbound traffic.
A company has a web application running on EC2 instances behind an Application Load Balancer (ALB). The application uses a custom header X-Auth-Token to authenticate requests. The security team wants to use AWS WAF to block requests that do not contain this header or contain an invalid token. The WAF is associated with the ALB. The team creates a rule with a match condition that checks for the presence of the X-Auth-Token header and a regex pattern for the token value. However, the rule is not blocking any requests. What is the most likely cause?
A.AWS WAF is not supported for Application Load Balancers; it only supports CloudFront.
B.AWS WAF cannot inspect custom headers; it can only inspect standard HTTP headers.
C.The regex pattern for the token is too complex for AWS WAF to process.
D.There is an allow rule with a higher priority that allows all requests before the block rule is evaluated.
AnswerD
Rules are evaluated in priority order; a higher priority allow rule would override the block rule.
Why this answer
AWS WAF evaluates rules in order, and if a rule with a higher priority allows the request, it will not be blocked by a lower priority rule. The team may have an allow rule with higher priority that allows all requests. Option A is incorrect because WAF can inspect headers.
Option B is incorrect because WAF can be used with ALB. Option C is incorrect because WAF can handle regex.
A security engineer is designing a VPC with public and private subnets. The private subnets will host databases that should not have direct internet access. Which three components are required to provide outbound internet access for these databases? (Choose THREE.)
The internet gateway provides internet access for the public subnet where the NAT gateway resides.
Why this answer
An internet gateway (IGW) is required to enable outbound internet access for resources in a VPC. The NAT gateway, which resides in a public subnet, uses the IGW to translate private IP addresses to the public IP of the NAT gateway, allowing instances in private subnets to initiate outbound traffic to the internet while preventing inbound connections from the internet.
Exam trap
The trap here is that candidates often think a NAT gateway alone provides internet access, forgetting that the NAT gateway must be placed in a public subnet with a route to an internet gateway, and that the private subnet’s default route must point to the NAT gateway, not the IGW.
A company uses AWS Organizations to manage multiple accounts. The security team must enforce that all Amazon S3 buckets across all accounts are encrypted with AWS KMS. The team has enabled S3 default encryption for new buckets, but existing buckets may not be encrypted. They need to automatically remediate any non-compliant buckets. The team has AWS Config and AWS Lambda available. What is the MOST operationally efficient solution?
A.Manually review all buckets using the S3 console and enable encryption for those that are not encrypted.
B.Write a script that runs daily on an EC2 instance to list all buckets and enable encryption on any that are not encrypted.
C.Use AWS Config with the s3-bucket-server-side-encryption-enabled rule and configure an AWS Systems Manager Automation document to remediate non-compliant buckets.
D.Use AWS Trusted Advisor to check for unencrypted buckets and send an SNS notification to the security team to manually remediate.
AnswerC
Correct: Config detects non-compliance and SSM Automation remediates automatically.
Why this answer
Use AWS Config with the s3-bucket-server-side-encryption-enabled rule to detect non-compliant S3 buckets. Then configure an automatic remediation action using an AWS Systems Manager Automation document to enable encryption on those buckets. This approach is serverless, automated, and operationally efficient as it does not require manual intervention or separate compute resources.
A security engineer is tasked with implementing network segmentation for a multi-tier application. The web tier must be accessible from the internet, but the application tier must only be accessible from the web tier. The database tier must only be accessible from the application tier. All tiers are in the same VPC. Which design meets these requirements?
A.Create a security group for each tier. Configure inbound rules to allow traffic only from the preceding tier's security group.
B.Use a single security group for all instances and use IAM policies to restrict access.
C.Place each tier in separate subnets and use network ACLs with CIDR blocks to allow traffic between tiers.
D.Place all instances in public subnets and restrict access using security groups.
AnswerA
Security group references provide granular control.
Why this answer
Security groups can reference other security groups as sources in inbound rules, allowing granular traffic control between tiers without CIDR blocks. This approach allows the web tier security group to allow inbound from the internet, the app tier security group to allow inbound only from the web tier security group, and the database tier security group to allow inbound only from the app tier security group. Option B is incorrect because IAM policies control user permissions, not network traffic.
Option C is incorrect because network ACLs with CIDR blocks are less specific and do not scale well, and placing tiers in separate subnets is not necessary. Option D is incorrect because placing all instances in public subnets unnecessarily exposes them to the internet, increasing security risk.
Security groups (C) are stateful virtual firewalls that control inbound and outbound traffic at the instance level. They operate at the network interface (ENI) level, allowing only explicitly permitted traffic and automatically allowing return traffic for permitted sessions. This provides a critical layer of host-level defense within the VPC.
Exam trap
The trap here is that candidates often confuse connectivity components (VPN, Internet gateway) with security controls, or they overlook that VPC Flow Logs are a detective control (not preventive) but still a valid part of defense in depth, leading them to select A or B instead of the correct trio of security groups, network ACLs, and VPC Flow Logs.
A company has an AWS Direct Connect connection to its on-premises data center. The security team wants to ensure that traffic between the VPC and the data center is encrypted. Which solution should they use?
A.Set up an IPsecVPN connection over the Direct Connect virtual interface.
B.Enable encryption on the Direct Connect virtual interface.
D.Use VPC Peering to connect the VPC to the data center.
AnswerA
This encrypts traffic between on-premises and AWS.
Why this answer
AWS Direct Connect does not encrypt traffic by default. To encrypt, you can use an IPsecVPN over the Direct Connect virtual interface (option A). Option B is incorrect because Direct Connect does not support native encryption on the virtual interface; encryption must be added via IPsec or application-level encryption.
Option C is not optimal because the requirement specifies using the existing Direct Connect connection, not internet-based VPN. Option D is incorrect because VPC Peering connects VPCs within AWS, not an on-premises data center, and does not provide encryption.
A company wants to allow cross-account access to an S3 bucket. The bucket owner (Account A) wants to grant read-only access to users in Account B. Which combination of policies is required?
A.A bucket ACL in Account A granting READ access to Account B
B.A bucket policy in Account A granting s3:GetObject to Account B and an IAM policy in Account B allowing s3:GetObject
C.An IAM policy in Account A that allows s3:GetObject
D.An IAM role in Account B that grants s3:GetObject to Account A
AnswerB
Both policies are needed: the bucket policy allows cross-account access, and the IAM policy allows the user to perform the action.
Why this answer
Cross-account access to S3 requires a resource-based policy (bucket policy) in the account that owns the bucket (Account A) granting the desired permissions to the principal in Account B, and an identity-based policy (IAM policy) in the accessing account (Account B) that allows the user or role to perform the action (s3:GetObject). Option A is incorrect because bucket ACLs are legacy and do not provide the same level of control; they cannot grant access to accounts in a way that works with IAM policies alone. Option C is incorrect because an IAM policy in Account A would only grant permissions to entities within Account A, not to users in Account B.
Option D is incorrect because an IAM role in Account B would allow Account A to access Account B's resources, not the reverse; the role would need to be in Account A to be assumed by Account B users.
Refer to the exhibit. A user from IP 10.1.2.3 attempts to download an object from my-secret-bucket using HTTP (not HTTPS). What will be the outcome?
A.Success, because the Allow statement is evaluated first.
B.Failure, because the user's IP is not in the allowed range.
C.Success, because the user's IP is within the allowed range.
D.Failure, because the Deny statement blocks HTTP requests.
AnswerD
Correct. The Deny for non-SecureTransport blocks the request.
Why this answer
The Deny statement with condition aws:SecureTransport=false will block HTTP requests. Even though the IP matches the allow rule, the explicit Deny overrides the Allow.
A company is using AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises network to a VPC. The security team wants to encrypt traffic over the Direct Connect connection. Which TWO options can be used? (Choose TWO.)
Select 2 answers
A.Use AWS KMS to encrypt the traffic.
B.Use AWS Certificate Manager to issue certificates for the connection.
C.Enable MACsec on the Direct Connect connection.
D.Use SSL/TLS to encrypt the traffic between on-premises and AWS.
E.Establish an IPsecVPN tunnel over the Direct Connect connection.
AnswersC, E
MACsec provides encryption at the data link layer.
Why this answer
MACsec (IEEE 802.1AE) provides encryption at Layer 2 (data link layer) and can be enabled directly on a Direct Connect connection. This encrypts all traffic between the on-premises router and the AWS Direct Connect endpoint without requiring any changes to higher-layer protocols, making it transparent to applications.
Exam trap
The trap here is that candidates often assume encryption must happen at higher layers (like SSL/TLS) or through a separate service (like KMS), but the exam tests knowledge of Layer 2 encryption (MACsec) and Layer 3 encryption (IPsec over Direct Connect) as the two valid methods to encrypt traffic over a Direct Connect connection.
A security engineer is configuring a VPC with public and private subnets. The engineer needs to allow instances in the private subnet to download software updates from the internet. Which component should be added to the VPC?
NATgateway provides outbound internet connectivity for private subnets.
Why this answer
A NATgateway in a public subnet allows instances in private subnets to initiate outbound connections to the internet for downloading updates. Option A is incorrect because a VPN connection is used for secure connectivity to on-premises networks, not for general internet access. Option B is incorrect because a VPC endpoint provides private connectivity to AWS services like S3, not to the internet.
Option C is incorrect because a bastion host is used for administrative access (SSH/RDP) to instances, not for providing internet access.
A healthcare company runs a HIPAA-compliant application on AWS. The application consists of an Application Load Balancer (ALB) in front of a fleet of EC2 instances behind an Auto Scaling group. The EC2 instances store sensitive patient data in an S3 bucket encrypted with SSE-KMS. The security team recently enabled AWS CloudTrail and Amazon GuardDuty. During a routine audit, they notice that an EC2 instance is making repeated API calls to the S3 bucket from an IP address outside the corporate network. The security team suspects the instance is compromised. What is the MOST effective immediate step to contain the potential breach while maintaining availability of the application?
A.Revoke the IAM role attached to the instance by removing the S3 permissions from the role.
B.Remove the security group that allows outbound traffic from the instance.
C.Stop the EC2 instance and detach it from the Auto Scaling group.
D.Terminate the EC2 instance immediately.
AnswerA
This instantly stops the instance's ability to access S3 while keeping the instance running for forensic analysis.
Why this answer
Revoking the IAM role's S3 permissions (Option A) immediately stops the compromised EC2 instance from accessing the S3 bucket, containing the data breach without terminating the instance or affecting application availability. Terminating or stopping the instance (Options C and D) would disrupt the application, while removing the security group (Option B) does not prevent API calls to S3 because API calls are made over the internet and not controlled by security groups.
A company wants to encrypt data at rest for an Amazon RDS for MySQL DB instance. Which THREE options can be used to achieve this? (Choose THREE.)
Select 3 answers
A.Take a snapshot of the unencrypted instance, copy it with encryption, and restore.
B.Modify the DB instance to enable encryption after creation.
C.Create a read replica with encryption enabled, even if the source is unencrypted.
D.Enable encryption on an existing read replica of an encrypted source.
E.Enable encryption when creating the DB instance.
AnswersA, D, E
This is a valid method to encrypt an existing database.
Why this answer
You can take a snapshot of an unencrypted Amazon RDS for MySQL DB instance, create an encrypted copy of that snapshot, and then restore a new DB instance from the encrypted snapshot. This process effectively encrypts the data at rest, as the restored instance will inherit the encryption setting from the snapshot. AWS RDS does not allow enabling encryption on an existing unencrypted DB instance directly, so this snapshot-based approach is the standard workaround.
Exam trap
The trap here is that candidates assume you can enable encryption on an existing RDS instance via a simple modification (Option B), but AWS explicitly prohibits this, requiring a snapshot-based migration instead.
A security engineer is configuring an AWS WAF web ACL for an Application Load Balancer. The engineer wants to block requests that contain cross-site scripting (XSS) and also limit the rate of requests from a single IP. Which THREE rule groups should be added?
Select 3 answers
A.AWS Managed Rules - IP reputation rule group
B.Rate-based rule
C.AWS Managed Rules - SQL injection rule group
D.AWS Managed Rules - Cross-site scripting (XSS) rule group
E.Geographic match rule
AnswersB, C, D
Rate-based rules limit the number of requests from an IP over a time period.
Why this answer
Options B, C, and D are correct. A Rate-based rule (B) limits the rate of requests from a single IP, meeting the rate-limiting requirement. The AWS Managed Rules for SQL injection (C) and Cross-site scripting (D) directly address the XSS and SQL injection threats.
Option A (IP reputation) blocks based on known malicious IPs, not rate or XSS. Option E (Geographic match) restricts by location, not behavior.
A company is designing a VPC with public and private subnets in two Availability Zones. They need to ensure that instances in the private subnets can access the internet for software updates but cannot be directly accessed from the internet. Which AWS service or feature should be used to meet this requirement?
Correct. NATGateway provides outbound-only internet access for private subnets.
Why this answer
A NATGateway enables instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing inbound traffic from the internet. An Internet Gateway (option D) would allow inbound traffic, which is not allowed. VPC Peering (option B) and AWS VPN (option C) do not provide internet access.
A company is designing a VPC with multiple subnets. The security team wants to ensure that traffic between the application tier and database tier is encrypted in transit. Which TWO actions should be taken?
Select 2 answers
A.Attach an internet gateway to the database subnet
B.Enable encryption on the database connections using TLS/SSL
C.Use security group rules to restrict traffic to the database port
D.Configure the application to use an encrypted protocol when connecting to the database
E.Use VPC Peering to connect the subnets
AnswersB, D
TLS/SSL encrypts data between application and database.
Why this answer
The correct answers are B and D. Option B, enabling TLS/SSL for database connections, encrypts data in transit. Option D, configuring the application to use an encrypted protocol, ensures end-to-end encryption.
Options A, C, and E are incorrect: attaching an internet gateway does not encrypt traffic; security group rules restrict access but do not encrypt; and VPC peering does not provide encryption by default.
An organization has a VPC with public and private subnets. A NATGateway is deployed in a public subnet to allow instances in private subnets to access the internet. The security team notices that instances in a private subnet can reach the internet, but cannot initiate connections to an on-premises network connected via AWS Direct Connect. The on-premises network advertises a specific route. What is the most likely cause?
A.The security group assigned to the instances does not allow outbound traffic to the on-premises network.
B.The network ACL on the private subnet is blocking inbound traffic from the on-premises network.
C.The private subnet route table has a route for the on-premises CIDR pointing to the NAT Gateway.
D.The internet gateway is not attached to the VPC.
AnswerC
The NATGateway route may override the Direct Connect route.
Why this answer
The most likely cause is that the private subnet's route table has a route for the on-premises CIDR pointing to the NATGateway. Since the NAT Gateway is intended for internet-bound traffic, traffic destined to the on-premises network is incorrectly routed to the NAT Gateway, which cannot forward it to the on-premises network via Direct Connect. For Direct Connect, the route should point to the virtual private gateway.
Option A is incorrect because Security Groups are stateful and allow return traffic; outbound rules are not the issue. Option B is incorrect because NACLs are stateless and would affect both directions, but the problem is outbound connectivity. Option D is incorrect because the IGW is not relevant for Direct Connect traffic.
A security team notices that an S3 bucket containing sensitive data is publicly accessible. The bucket policy is as follows:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::example-bucket/*"
}
]
}
Which step should be taken to secure the bucket while maintaining access for authorized users?
A.Use AWS Config to automatically block all public access.
B.Create an IAM role with S3 access and assign it to the bucket.
C.Add a Deny statement for any IP address outside the corporate network.
D.Delete the public bucket policy and attach a new policy that allows access only through a VPC Endpoint.
AnswerD
Restricts access to the VPC endpoint.
Why this answer
Deleting the public bucket policy and attaching a new policy that allows access only through a VPC Endpoint ensures that the bucket is not publicly accessible and only authorized users within the VPC can access it. Option A is incorrect because using AWS Config to block public access does not by itself grant authorized users access; additional configuration is needed. Option B is incorrect because creating an IAM role and assigning it to the bucket does not override the existing public bucket policy; the bucket remains publicly accessible.
Option C is incorrect because adding a Deny statement for IP addresses outside the corporate network does not remove the existing Allow statement for all principals, and the Allow would still grant public access unless an explicit Deny overrides it, which is not guaranteed with this approach.
A company wants to ensure that all Amazon EC2 instances in a VPC can only be accessed via SSH from a specific IP address range (203.0.113.0/24). Which VPC component should be used to enforce this restriction?
Network ACLs are stateless and can deny traffic from IP ranges not in the allowed range.
Why this answer
A network ACL is a stateless firewall that controls inbound and outbound traffic at the subnet level. It can be configured with rules to allow SSH traffic only from the specified IP range (203.0.113.0/24) and deny all other inbound traffic, effectively enforcing the restriction. Security groups (Option A) are stateful and attached to instances, but they cannot explicitly deny traffic; they only allow.
Route tables (Option B) control traffic routing, not filtering. Internet gateways (Option D) allow internet access but do not provide traffic filtering.
A company uses Amazon CloudFront to distribute content from an S3 bucket. The security team wants to ensure that only CloudFront can access the S3 bucket. Which configuration should be used?
A.Set the bucket policy to allow all principals and rely on CloudFront to restrict access.
B.Configure the bucket policy to allow access only from CloudFront's IP addresses.
C.Create an Origin Access Identity (OAI) and grant it read access to the S3 bucket.
D.Use CloudFront trusted signers to restrict access to the S3 bucket.
AnswerC
OAI is the standard way to restrict access to CloudFront only.
Why this answer
An Origin Access Identity (OAI) is a special CloudFront user that you can associate with a distribution, and then the S3 bucket policy can grant read access to that OAI, ensuring that only CloudFront can access the bucket. Option A is incorrect because allowing all principals is too permissive. Option B is incorrect because CloudFront IP addresses can change, so this is not a reliable method.
Option D is incorrect because trusted signers are used for signed URLs/cookies to control who can access content, not to restrict origin access.
A company wants to automate security assessments of its AWS environment. Which TWO AWS services can be used to perform vulnerability scanning and compliance checks?
Select 2 answers
A.AWS Shield
B.Amazon Inspector
C.AWS Security Hub
D.AWS WAF
E.AWS Config
AnswersB, C
Amazon Inspector scans for vulnerabilities and deviations from best practices.
Why this answer
(Amazon Inspector) is correct for vulnerability scanning. Option C (AWS Security Hub) is correct for compliance checks. Option A (AWS Shield) is for DDoS protection.
Option D (AWS WAF) is for web application firewall. Option E (AWS Config) tracks resource changes but does not perform vulnerability scanning or compliance checks.
A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to ensure that only traffic from the ALB reaches the EC2 instances, and that instances cannot initiate outbound connections to the internet. Which combination of security group rules should be implemented? (Select TWO.)
B.Inbound rule: Allow HTTP/HTTPS from the ALB's security group.
C.Outbound rule: Allow all traffic to the ALB's security group only.
D.Outbound rule: Deny all traffic to 0.0.0.0/0.
E.Outbound rule: Allow all traffic to 0.0.0.0/0.
AnswerB, D
This ensures only ALB traffic reaches the instances.
Why this answer
Referencing the ALB's security group as the source for inbound HTTP/HTTPS traffic ensures that only traffic that has passed through the ALB can reach the EC2 instances. This leverages security group chaining, where the ALB's security group acts as a trusted source, preventing direct internet access to the instances. Option D is correct because a deny-all outbound rule to 0.0.0.0/0 blocks all outbound internet connections, satisfying the requirement that instances cannot initiate outbound connections.
Exam trap
The trap here is that candidates often confuse stateful security group behavior with stateless network ACLs, mistakenly thinking that a deny-all outbound rule will block return traffic for inbound connections, or they incorrectly assume that allowing outbound traffic to the ALB's security group is sufficient to prevent internet access.
How to eliminate wrong answers
Option A is wrong because allowing HTTP/HTTPS from 0.0.0.0/0 would permit direct internet traffic to the EC2 instances, bypassing the ALB and violating the security requirement. Option C is wrong because outbound rules in security groups are stateful; allowing traffic to the ALB's security group is unnecessary and does not prevent outbound internet connections—stateful return traffic is automatically allowed, but outbound-initiated traffic to the internet would still be permitted unless explicitly denied. Option E is wrong because allowing all outbound traffic to 0.0.0.0/0 would permit instances to initiate outbound connections to the internet, directly contradicting the requirement.
A Client VPN endpoint is required as the entry point for remote clients to connect to the VPC. It manages authentication, encryption (using TLS 1.2), and routing for client connections. Without this component, there is no VPN server to accept and authenticate client traffic.
Exam trap
The trap here is confusing the components required for a site-to-site VPN (Virtual Private Gateway and Customer Gateway) with those needed for a client-based VPN, leading candidates to incorrectly select B or C instead of the correct client VPN-specific components.
Which THREE are benefits of using AWS Systems Manager Session Manager to connect to EC2 instances? (Choose THREE.)
Select 3 answers
A.It allows closing inbound SSH and RDP ports on the instance.
B.It automatically rotates SSH keys on the instance.
C.It eliminates the need for a bastion host or jump box.
D.It requires an internet gateway or NAT gateway for the instance to communicate with the Session Manager service.
E.It provides session logging to AWS CloudTrail for auditing.
AnswersA, C, E
No open ports are needed for Session Manager.
Why this answer
Session Manager eliminates the need for a bastion host or jump box (C), allows closing inbound SSH and RDP ports (A), and provides session logging to AWS CloudTrail for auditing (E). Option B is incorrect because Session Manager does not automatically rotate SSH keys; it uses IAM for access control. Option D is incorrect because Session Manager does not require an internet gateway or NAT gateway; it uses the SSM agent and AWS Systems Manager endpoints.
A company has a security group rule that allows inbound traffic from 0.0.0.0/0 on port 22. The security engineer wants to restrict SSH access to only the company's public IP range (203.0.113.0/24). What is the correct way to update the security group rule?
A.Remove the existing inbound rule and do not add any new rule; SSH access will be denied by default.
B.Modify the existing inbound rule to change the source from 0.0.0.0/0 to 203.0.113.0/24.
C.Add a new inbound rule with source 203.0.113.0/24 and the security group will automatically deny all other traffic.
Security group rules can be modified in place. Changing the source CIDR from 0.0.0.0/0 to 203.0.113.0/24 restricts inbound SSH traffic to only that range. Option A is incorrect because removing the rule without adding a new one would deny all SSH access, but the goal is to restrict, not deny all.
Option C is incorrect because adding a new rule does not automatically deny other traffic; security groups evaluate all rules and allow matching traffic; you must remove the permissive rule. Option D is incorrect because outbound rules do not affect inbound SSH access.
A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket. Which configuration provides the most secure and efficient access?
A.Create an Interface VPC Endpoint for S3.
B.Create a Gateway VPC Endpoint for S3 and update the route table.
C.Route the traffic through a NATGateway to the internet.
D.Assign a public IP address to the EC2 instance and allow it to access S3 via internet.
AnswerB
Private and secure access to S3.
Why this answer
A Gateway VPC Endpoint for S3 provides private, secure access to S3 without traversing the internet, using AWS's internal network. It is more efficient than an Interface Endpoint for S3 because it does not incur hourly charges or require additional route table entries for each subnet, and it leverages prefix lists to route traffic directly to S3 via the route table. This configuration ensures the EC2 instance in the private subnet can access S3 without a NAT Gateway or public IP, maintaining security and minimizing data transfer costs.
Exam trap
The trap here is that candidates often confuse Interface VPC Endpoints (which are required for most AWS services) with Gateway VPC Endpoints (which are only for S3 and DynamoDB), leading them to choose the more expensive and complex Interface Endpoint for S3.
How to eliminate wrong answers
Option A is wrong because an Interface VPC Endpoint for S3 is not the most secure and efficient choice; it incurs hourly costs and requires additional security group management, while a Gateway Endpoint is free and simpler for S3 access. Option C is wrong because routing traffic through a NAT Gateway to the internet is less secure (traffic leaves AWS network) and less efficient (adds cost and latency) compared to a VPC Endpoint. Option D is wrong because assigning a public IP address to the EC2 instance exposes it to the internet, violating security best practices for private subnets, and requires internet gateway routing, which is neither secure nor efficient for S3 access.
A company wants to ensure that all data transmitted between its EC2 instances and an Application Load Balancer (ALB) is encrypted. Which configuration should be applied?
A.Install SSL certificates on each EC2 instance and configure the ALB to use TCP passthrough.
B.Configure the ALB with an HTTPS listener and a target group that uses HTTPS as the protocol.
C.Use a Network Load Balancer with TLS listeners and target groups.
D.Configure security groups to allow only HTTPS traffic.
AnswerB
This ensures traffic between ALB and instances is encrypted.
Why this answer
It establishes end-to-end encryption between clients and the ALB (via HTTPS listener) and between the ALB and EC2 instances (via HTTPS target group). This ensures that data transmitted over both legs of the connection is encrypted using TLS, meeting the requirement that all data between the EC2 instances and the ALB is encrypted.
Exam trap
The trap here is that candidates often confuse 'encryption in transit' with 'network access control' (security groups) or assume that any load balancer with TLS listeners guarantees encryption between the load balancer and targets, but only an ALB with HTTPS target groups re-encrypts traffic to the instances, while an NLB with TLS passthrough does not re-encrypt.
How to eliminate wrong answers
Option A is wrong because TCP passthrough does not terminate TLS at the ALB; instead, it forwards raw TCP traffic to the instances, which would require the instances to handle SSL termination themselves, and the ALB cannot inspect or re-encrypt the traffic, so the data between the ALB and instances may not be encrypted if the instances are not configured correctly. Option C is wrong because a Network Load Balancer with TLS listeners and target groups encrypts traffic between clients and the NLB, but the NLB does not re-encrypt traffic to targets; it passes the original TLS session through, so the data between the NLB and EC2 instances is still encrypted, but the question specifically asks for an ALB, not an NLB, and using an NLB would not meet the requirement to use an Application Load Balancer. Option D is wrong because security groups only control network access (allow/deny traffic) and do not enforce encryption; they can allow HTTPS traffic, but they do not ensure that the data is actually encrypted in transit.
A company is using AWS CloudTrail to monitor API activity in their account. They have enabled CloudTrail in all regions and are logging to an S3 bucket. The security team wants to ensure that log files are not tampered with after delivery. They enable CloudTrail log file integrity validation. Which additional step must be taken to verify the integrity of the log files?
A.Enable S3 versioning on the log bucket.
B.Configure the S3 bucket to use server-side encryption with AWS KMS.
C.Enable S3 Object Lock on the log bucket.
D.Use the AWS CLI to run the validate-logs command against the log files.
AnswerD
This command checks the digest files to verify integrity.
Why this answer
CloudTrail log file integrity validation uses digital signatures (SHA-256 hashing and signing with a private key). To verify integrity, you must use the AWS CLI command 'aws cloudtrail validate-logs' or download the public key and verify manually. Option A (enable S3 versioning) helps protect against accidental deletion or overwriting but does not verify integrity.
Option B (use KMS to encrypt logs) protects confidentiality only. Option C (use S3 Object Lock) prevents deletion or modification but does not provide tamper detection or integrity verification.
A security engineer is designing a web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be protected from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used to provide this protection?
A.AWS WAF
B.Network ACLs
C.Security Groups
D.AWS Shield Advanced
AnswerA
AWS WAF filters and monitors HTTP requests to protect against web exploits.
Why this answer
AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting. Network ACLs are stateless firewalls at the subnet level and do not inspect application-layer traffic. Security Groups are stateful firewalls at the instance level and do not provide application-layer filtering.
AWS Shield Advanced provides DDoS protection, not application-layer attack prevention.
A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which component should be added to the VPC to enable this?
A NATgateway enables outbound internet access for private subnets.
Why this answer
(NATgateway). A NAT gateway enables instances in a private subnet to initiate outbound traffic to the internet for tasks like software updates, while preventing inbound traffic from the internet. Option A (Internet gateway) is incorrect because it is used for public subnets to allow direct internet access.
Option B (VPN connection) is used for secure connectivity to an on-premises network, not for outbound internet access. Option C (VPC peering connection) is used to connect two VPCs, not to provide internet access.
A security engineer is investigating a potential data exfiltration from an Amazon S3 bucket. The bucket policy allows access to a specific IAM role, but the engineer suspects that the role has been compromised. The engineer wants to quickly block all access to the bucket without deleting the bucket or the policy. What is the BEST course of action?
A.Delete the IAM role that is allowed access to the bucket.
B.Use AWS WAF to block the IP addresses of the compromised role.
C.Modify the bucket policy to deny all principals.
D.Add a bucket policy statement that denies access unless the request comes from a specific IP address that does not exist.
AnswerD
A deny condition with an impossible IP address blocks all access effectively.
Why this answer
Adding a bucket policy statement that denies access unless the request originates from a specific IP address that does not exist effectively blocks all traffic to the bucket. This approach leverages the explicit deny in AWS IAM policy evaluation logic, which overrides any allow, and does not require deleting the bucket or the existing policy. It provides an immediate, reversible block without altering the original policy structure or the IAM role.
Exam trap
The trap here is that candidates may think modifying the bucket policy to deny all principals (Option C) is acceptable, but the question explicitly forbids deleting the policy, and modifying it to deny all principals is a form of policy deletion; the correct approach uses a conditional deny with an impossible condition to avoid altering the original policy structure.
How to eliminate wrong answers
Option A is wrong because deleting the IAM role would permanently remove the role and its permissions, which is not reversible and may break other dependencies; the question requires blocking access without deleting the bucket or policy. Option B is wrong because AWS WAF is a web application firewall that operates at the application layer (HTTP/HTTPS) and cannot directly block S3 API requests, which use AWS Signature Version 4 and are not HTTP requests that WAF can inspect. Option C is wrong because modifying the bucket policy to deny all principals would require editing the existing policy, which the question explicitly prohibits; it also does not meet the requirement to avoid deleting the policy.
A company uses AWS Direct Connect to connect its on-premises data center to AWS. The company has a VPC with public and private subnets. The security team wants to ensure that all traffic between on-premises and the VPC goes through a set of security appliances (firewalls) deployed in the VPC. The appliances are in separate subnets. Currently, traffic is routed directly via the virtual private gateway. What is the MOST secure and scalable way to force traffic through the security appliances?
A.Place the security appliances in a public subnet and route traffic through a NATgateway.
B.Create a transit gateway and attach the Direct Connect virtual interface to it. Then route traffic through the appliance subnets.
C.Deploy a GatewayLoad Balancer and create Gateway Load Balancer endpoints in each subnet. Update the route tables to point to the endpoints.
D.Set up a VPN connection from on-premises to the VPC and route traffic through the appliance subnets.
AnswerC
GatewayLoad Balancer transparently forwards traffic to the firewall appliances and scales automatically.
Why this answer
Using a GatewayLoad Balancer with Gateway Load Balancer endpoints in each subnet allows transparent traffic inspection and scaling. Option A is wrong because a NAT gateway only handles outbound traffic, not bidirectional inspection. Option B is wrong because a transit gateway does not force traffic through appliances; additional routing and appliance VPCs are needed.
Option D is wrong because a VPN connection does not inherently route through VPC appliances; it would require custom routing.
A company runs a multi-tier web application on AWS. The web tier uses an Application Load Balancer (ALB) in a public subnet, and the application tier runs on EC2 instances in private subnets. The security team recently ran a vulnerability scan and found that the application instances are accessible from the internet on port 8080. The EC2 instances have a security group that allows inbound traffic on port 8080 from the ALB's security group only. However, the ALB's security group allows inbound traffic on port 8080 from 0.0.0.0/0. The architecture also includes a NATGateway for outbound internet access from private subnets. The security engineer needs to ensure that only the ALB can communicate with the application instances on port 8080, and that the application instances cannot be directly accessed from the internet. What should the security engineer do?
A.Change the EC2 instance security group to allow inbound traffic on port 8080 from 0.0.0.0/0, and rely on the subnet network ACL to block traffic.
B.Add a rule to the EC2 security group that denies inbound traffic from 0.0.0.0/0 on port 8080.
C.Modify the ALB security group to remove the inbound rule for port 8080 from 0.0.0.0/0, and configure the ALB listener to forward traffic from port 80/443 to port 8080 on the target group.
D.Place the EC2 instances in a public subnet and use a network ACL to block inbound traffic on port 8080 from the internet.
AnswerC
This correctly restricts internet access to the ALB on standard ports and allows the ALB to forward to port 8080.
Why this answer
The ALB's security group should not allow inbound from 0.0.0.0/0 on the application port. Instead, the ALB should listen on port 80/443 from the internet and forward to port 8080 on the instances. The ALB security group rule should be removed, and the listener should be configured on standard ports.
A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security engineer needs to protect the application from common web exploits such as SQL injection and cross-site scripting. Which TWO services can be used together to achieve this? (Choose TWO.)
Select 2 answers
A.Amazon GuardDuty
B.AWS Shield Advanced
C.Network ACLs
D.AWS WAF
E.Amazon CloudFront
AnswersB, D
Shield Advanced provides advanced DDoS protection and integrates with WAF.
Why this answer
AWS WAF (Option D) can be associated with an ALB to filter web requests and protect against common exploits like SQL injection and cross-site scripting. AWS Shield Advanced (Option B) provides enhanced DDoS protection and integrates with WAF for additional layer 7 protections. Option A is wrong because GuardDuty is a threat detection service, not an inline web application firewall.
Option C is wrong because Network ACLs operate at the subnet level and do not provide application-layer filtering. Option E is wrong because CloudFront is a CDN, and while it can be used with WAF, it alone does not provide WAF rules.
AWS Key Management Service (KMS) is the correct service because Amazon RDS for MySQL uses KMS-managed customer master keys (CMKs) to enable encryption at rest for DB instances. When you enable RDS encryption, RDS automatically integrates with KMS to encrypt the underlying storage, automated backups, read replicas, and snapshots using AES-256 encryption. This is the foundational service that provides the key management and encryption operations for RDS at-rest encryption.
Exam trap
The trap here is that candidates confuse the RDS encryption feature (which is a checkbox in the console) with a standalone service, when in fact the underlying service that performs the encryption and key management is AWS KMS.
How to eliminate wrong answers
Option B is wrong because Amazon S3 server-side encryption is a feature specific to objects stored in Amazon S3 buckets, not applicable to RDS DB instance storage. Option C is wrong because 'RDS encryption feature' is not a standalone service; it is a feature that relies on AWS KMS to manage the encryption keys — the question asks which service or feature should be used, and KMS is the underlying service that enables RDS encryption. Option D is wrong because SSL/TLS certificates are used to encrypt data in transit between the client and the database, not data at rest stored on disk.
A company configures a Route 53 alias record to point to a CloudFront distribution. The security team wants to ensure that users can only access the website via CloudFront and not directly via the S3 bucket origin. What additional configuration is needed?
A.Create an Origin Access Control (OAC) for the S3 bucket origin
B.Create a Route 53 health check to verify CloudFront availability
C.Configure CloudFront signed URLs to restrict access
D.Attach a security group to the S3 bucket
AnswerA
OAC ensures only CloudFront can access the S3 bucket.
Why this answer
An Origin Access Control (OAC) is the recommended AWS mechanism to restrict access to an S3 bucket origin so that it only accepts requests from a specific CloudFront distribution. By configuring OAC on the CloudFront distribution and updating the S3 bucket policy to deny any requests that do not include the required OAC headers, the security team ensures that users cannot bypass CloudFront and access the S3 bucket directly via its public URL.
Exam trap
The trap here is that candidates often confuse CloudFront signed URLs (which control user access to content) with origin access controls (which restrict which origin server CloudFront can talk to), leading them to pick option C instead of A.
How to eliminate wrong answers
Option B is wrong because a Route 53 health check verifies the availability of a resource (e.g., CloudFront) for DNS failover, but it does not enforce access restrictions or prevent direct access to the S3 bucket. Option C is wrong because CloudFront signed URLs control access to individual objects by requiring authentication tokens, but they do not prevent users from accessing the S3 bucket directly if the bucket is publicly accessible; signed URLs are for per-request authorization, not origin access control. Option D is wrong because S3 buckets do not support security groups; security groups are a network firewall construct for EC2 instances and other VPC resources, not for S3.
Access to S3 is controlled via bucket policies, IAM policies, or OAC.
A security engineer is designing a VPC with a public subnet and a private subnet. The private subnet will host a database instance that should only be accessible from the application instances in the public subnet. The application instances use an Auto Scaling group. Which configuration ensures that only the application instances can access the database?
A.Allow inbound database port from the security group attached to the application instances in the public subnet.
B.Allow inbound database port from 0.0.0.0/0 in the database security group.
C.Configure a network ACL on the private subnet to allow the database port from the public subnet CIDR.
D.Allow inbound database port from the public subnet CIDR block in the database security group.
AnswerA
This dynamically allows traffic from all application instances.
Why this answer
Security group rules can reference other security groups, allowing dynamic scaling of the application instances without needing to update CIDR blocks. Auto Scaling group instances are automatically assigned the application security group, so only they can access the database. Option B is incorrect because allowing 0.0.0.0/0 would expose the database to the internet.
Option C is incorrect because network ACLs are stateless and cannot reference security groups; they would require explicit rules for return traffic. Option D is incorrect because referencing the public subnet CIDR would allow any instance in that subnet, not just the application instances, and would not handle changes in the application instances' IPs.
A company wants to restrict access to an S3 bucket so that only objects with specific tags can be accessed by a certain IAM role. Which THREE steps are required to implement this?
Select 3 answers
A.Use S3 Inventory to list objects and their tags.
B.Enable S3 object-level logging in CloudTrail.
C.Attach an IAM policy to the role that uses the s3:ExistingObjectTag condition.
D.Create a bucket policy with a condition based on the s3:ExistingObjectTag key.
E.Set a bucket policy that denies access if the object does not have the required tag.
AnswersC, D, E
IAM policies can also use condition keys to restrict access based on tags.
Why this answer
To restrict the IAM role to only access objects with specific tags, three steps are necessary. First, attach an IAM policy to the role using the s3:ExistingObjectTag condition key (option C). This alone, however, can be overridden by a bucket policy that grants broader access.
Second, create a bucket policy that explicitly allows the role to access objects only when they have the required tag (option D). Third, create a bucket policy that denies the role access to objects that do not have the required tag (option E). The combination of IAM and bucket policies ensures tag-based access control is enforced, as IAM provides identity-based restrictions and bucket policies add resource-based checks, including an explicit deny for non-compliant objects.
Exam trap
The trap here is that candidates often confuse S3 Inventory (a reporting tool) or CloudTrail logging (an auditing tool) with access control mechanisms, leading them to select options that do not actually restrict access.
A company uses AWS Systems Manager Session Manager to manage EC2 instances. The security team wants to ensure that all SSH sessions are logged and that commands are recorded. What should be configured?
A.Enable session logging in the Session Manager preferences to send logs to Amazon S3 and CloudWatch Logs
B.Configure the security group to allow inbound SSH from the Session Manager service
C.Enable AWS CloudTrail to log Systems Manager API calls
D.Create an IAM policy that allows ssm:StartSession and attach it to the instance role
AnswerA
Session Manager preferences allow logging of session activities and command recording.
Why this answer
Session Manager preferences allow logging session activity to Amazon S3 and CloudWatch Logs, which records all commands run during SSH sessions. Option B is incorrect because security groups control network access, not logging. Option C is incorrect because CloudTrail logs API calls to Systems Manager, not the commands executed within a session.
Option D is incorrect because an IAM policy only controls permissions to start sessions, not the logging of session activity.
A company uses an AWS Network Firewall to inspect traffic between subnets in a VPC. The security team wants to ensure that all traffic from the web tier to the database tier passes through the firewall. The web servers are in subnet A, and the database servers are in subnet B. What routing configuration is required?
A.Add a route in the route table associated with subnet A that sends all traffic to the firewall endpoint.
B.Add a route in the route table for subnet A with destination subnet B CIDR and target the firewall endpoint. Add a similar route in subnet B's route table with destination subnet A CIDR and target the firewall endpoint.
C.Add a route in the route table associated with subnet B that sends all traffic to the firewall endpoint.
D.Associate both subnets with the same route table and add a route to the firewall endpoint for all traffic.
AnswerB
This ensures both directions go through the firewall.
Why this answer
To force traffic between subnets through the AWS Network Firewall, you need symmetric routes: add a route in subnet A's route table for destination subnet B CIDR with target the firewall endpoint, and similarly add a route in subnet B's route table for destination subnet A CIDR with target the firewall endpoint. This ensures both forward and return traffic pass through the firewall. Option A is wrong because it sends all traffic from subnet A to the firewall, which is overly broad and may break other traffic; more importantly, it does not ensure return traffic from subnet B goes through the firewall.
Option C is wrong because it only handles return traffic from subnet B but not the forward traffic from subnet A. Option D is wrong because both subnets cannot be in the same route table if they need different routes; also, sending all traffic from both subnets to the firewall is not the correct setup for inter-subnet traffic inspection.
A company wants to implement a defense-in-depth strategy for its web application running on EC2 instances. Which TWO AWS services should be used to provide both network and application-layer protection?
Select 2 answers
A.Amazon GuardDuty
B.AWS WAF
C.Security Groups
D.AWS Shield Advanced
E.Network ACLs
AnswersB, C
WAF provides application-layer protection.
Why this answer
AWS WAF is correct because it provides application-layer protection by inspecting HTTP/HTTPS requests to your web application, allowing you to block common attack patterns such as SQL injection and cross-site scripting (XSS) using customizable rules. Security Groups are correct because they act as a virtual firewall at the instance level (network layer), controlling inbound and outbound traffic based on IP addresses, ports, and protocols, thus forming the first line of defense in a defense-in-depth strategy.
Exam trap
The trap here is that candidates often confuse AWS Shield Advanced (which provides DDoS protection) with application-layer filtering, or assume Network ACLs can inspect application data, when in fact they operate only at the network layer and are stateless.
A company wants to restrict access to an RDS database to only EC2 instances that have a specific tag 'Environment: Production'. Which TWO steps should be taken?
Select 2 answers
A.Attach an IAM policy to the EC2 instance role that allows rds:Connect only if the request originates from the VPC Endpoint.
B.Create a resource-based policy on the RDS instance.
C.Use the RDS instance's security group to allow traffic only from the EC2 instance's security group.
D.Create a security group rule that references the EC2 instance's security group.
E.Create a VPC Endpoint for RDS and attach an IAM policy that uses the condition 'ec2:ResourceTag/Environment' : 'Production'.
AnswersA, E
Combines with endpoint policy.
Why this answer
To restrict access to an RDS database to only EC2 instances with a specific tag, options A and E are correct. Option A: Attach an IAM policy to the EC2 instance role that allows rds:Connect only if the request originates from a VPC Endpoint. This ensures that only instances that can reach the VPC Endpoint (which requires proper routing and security) can connect.
Option E: Create a VPC Endpoint for RDS and attach an IAM policy that uses the condition 'ec2:ResourceTag/Environment' : 'Production'. This uses IAM conditions to allow access only from instances with the specified tag. Option B is incorrect because resource-based policies are not supported for RDS instances.
Options C and D are incorrect because security groups do not support tag-based rules; they only filter based on IP addresses, ports, and other security groups.
A company is using AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all S3 buckets created by CloudFormation are encrypted at rest. Which THREE configuration steps should be taken?
Select 3 answers
A.Create an AWS Config rule to check for unencrypted S3 buckets.
B.Use a CloudFormation stack policy to prevent updates that remove encryption.
C.Create a service control policy (SCP) that denies creation of S3 buckets without encryption.
D.In the CloudFormation template, specify the BucketEncryption property for each S3 bucket.
E.Create an IAM role that only allows creation of encrypted buckets.
AnswersA, C, D
Detects non-compliance.
Why this answer
Options A, C, and D are correct. AWS Config rules can detect unencrypted S3 buckets and trigger remediation. Service control policies (SCPs) can deny the creation of S3 buckets without encryption at the organizational level.
In CloudFormation templates, specifying the BucketEncryption property ensures encryption is configured at deployment time. Option B is incorrect because a CloudFormation stack policy only prevents updates to existing stacks but does not enforce encryption during initial creation. Option E is incorrect because an IAM role can restrict permissions but does not enforce encryption directly on S3 buckets created by CloudFormation.
A company uses an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances in private subnets. The security team wants to ensure that only the ALB can communicate with the EC2 instances. Which security group configuration should be applied to the EC2 instances?
A.Allow inbound HTTP traffic from the EC2 instances' own security group
C.Allow inbound HTTP traffic from the VPC CIDR block
D.Allow inbound HTTP traffic from the ALB's security group
AnswerD
This ensures only the ALB can initiate traffic to the EC2 instances.
Why this answer
Security groups can reference other security groups as a source, allowing traffic only from resources associated with that security group. By specifying the ALB's security group as the source for inbound HTTP traffic, the EC2 instances will only accept traffic originating from the ALB, effectively restricting all other inbound traffic. This is a best practice for securing backend instances behind a load balancer.
Exam trap
The trap here is that candidates often confuse security group referencing with CIDR-based rules, mistakenly thinking that allowing the VPC CIDR (Option C) is sufficient, but this would allow any resource in the VPC, not just the ALB, to reach the EC2 instances.
How to eliminate wrong answers
Option A is wrong because allowing inbound HTTP traffic from the EC2 instances' own security group would permit traffic between the EC2 instances themselves, not from the ALB, and does not restrict access to the ALB only. Option B is wrong because allowing inbound HTTP traffic from 0.0.0.0/0 would permit traffic from any IP address on the internet, completely bypassing the ALB and exposing the EC2 instances directly. Option C is wrong because allowing inbound HTTP traffic from the VPC CIDR block would permit traffic from any resource within the VPC (including other EC2 instances, NAT gateways, or VPN connections), not exclusively from the ALB.
A company uses Amazon S3 to store sensitive data. The security team wants to ensure that all objects are encrypted at rest. Which feature should they enable on the S3 bucket?
A.Versioning
B.Server access logging
C.Cross-Region Replication
D.Default encryption
AnswerD
Default encryption ensures all new objects are encrypted at rest.
Why this answer
Amazon S3 default encryption ensures that all new objects are encrypted at rest. Option A (Versioning) is for maintaining multiple versions of objects, not encryption. Option B (Server access logging) logs requests to the bucket.
Option C (Cross-Region Replication) replicates objects to another region but does not enforce encryption. Therefore, the correct answer is D: Default encryption.