AWS Certified Solutions Architect – Associate — All Questions
← Back to practice7 questions
An application running on EC2 instances needs to read objects from an S3 bucket. What is the most secure way to grant this access?
- a.Embed an IAM user's access keys in the application code
- b.Store long-lived credentials in a file on the instance
- c.Attach an IAM role to the EC2 instances with a policy granting least-privilege S3 read access✓
- d.Make the S3 bucket public and filter by source IP
IAM roles provide temporary, automatically rotated credentials to EC2 instances via the instance metadata service, eliminating the need to store long-lived keys. Scoping the role's policy to only the required bucket and actions follows the principle of least privilege. Hard-coded access keys and public buckets create serious security risks and violate the Security pillar of the Well-Architected Framework.
A company must encrypt data at rest in S3 while retaining full control over the key material, key rotation policy, and the ability to audit every key usage via CloudTrail. Which option best meets this requirement?
- a.Server-side encryption with AWS KMS customer managed keys (SSE-KMS)✓
- b.Server-side encryption with Amazon S3 managed keys (SSE-S3)
- c.Client-side encryption with a hard-coded static key
- d.No encryption, relying on bucket policies only
SSE-KMS with a customer managed key lets you define rotation, key policies, and grants while logging each decrypt/encrypt call in CloudTrail for auditing. SSE-S3 encrypts data but gives you no control over or visibility into the key. Bucket policies control access but do not encrypt data at rest.
A web application behind an Application Load Balancer is being targeted by SQL injection and cross-site scripting attempts at the HTTP layer. Which service should be added to filter this malicious traffic?
- a.AWS Shield Standard
- b.AWS WAF with managed rule groups✓
- c.Amazon GuardDuty
- d.A network ACL on the public subnet
AWS WAF inspects HTTP/HTTPS requests and can block SQL injection and XSS using AWS managed rule groups attached to the ALB. Shield Standard protects against network/transport-layer DDoS, not application-layer exploits. NACLs operate on IP/port and cannot parse request content.
An RDS database must be reachable only from application servers in a private subnet and never from the internet. Which configuration achieves this?
- a.Place the database in a public subnet with an Elastic IP
- b.Attach an internet gateway route to the database subnet
- c.Open the database security group to 0.0.0.0/0 on port 3306
- d.Place the database in a private subnet and set its security group to allow inbound traffic only from the application tier's security group✓
Deploying RDS in a private subnet with no route to an internet gateway keeps it unreachable from the internet. Referencing the application tier's security group as the source in the database security group restricts access to just those instances, following least privilege. Opening 0.0.0.0/0 or using public subnets would expose the database.
An application needs to retrieve database credentials at runtime, and the credentials must be automatically rotated on a schedule. Which service is purpose-built for this?
- a.AWS Secrets Manager✓
- b.AWS Systems Manager Parameter Store standard parameters
- c.Amazon S3 with encryption
- d.IAM instance profile tags
Secrets Manager stores credentials encrypted with KMS and provides native automatic rotation, including built-in integration with RDS to rotate database passwords. Standard Parameter Store parameters can hold secrets but do not offer managed rotation. Storing credentials in S3 or tags is insecure and lacks rotation.
A mobile and web application needs user sign-up, sign-in, and federated identity with Google and Apple, returning tokens the app can use to call an API. Which service should be used?
- a.AWS IAM users, one per end user
- b.AWS Directory Service
- c.Amazon Cognito user pools with identity federation✓
- d.AWS KMS
Amazon Cognito user pools provide managed user directories, sign-up/sign-in flows, and federation with social and enterprise identity providers, issuing JWT tokens for authorizing API calls. Creating an IAM user per application end user does not scale and is not intended for app-user authentication. KMS handles encryption keys, not identity.
A security team wants to allow developers to launch EC2 instances but must ensure they cannot detach or modify IAM policies. Which approach follows AWS best practice?
- a.Grant developers the AdministratorAccess managed policy
- b.Attach a least-privilege IAM policy granting only the specific EC2 actions needed, with no IAM write permissions✓
- c.Share the root account credentials for convenience
- d.Give every developer full IAM permissions and monitor with CloudTrail
Least privilege means granting only the specific permissions required for the task, so a scoped policy allowing EC2 launch actions without IAM write access is correct. AdministratorAccess and root credentials violate least privilege and separation of duties. Monitoring after over-permissioning does not prevent misuse.