4 of the 11 questions we have for this objective, shown with the answer and the reasoning.
Determine a strategy to improve security
Tamsin Outdoor Gear runs its storefront in one VPC. An Application Load Balancer, the EC2 web instances and an Amazon RDS for PostgreSQL instance all sit in the same public subnets. The web instances' security group allows TCP 80 from 0.0.0.0/0, and the database security group allows TCP 5432 from the VPC CIDR. A penetration test also showed that the storefront's search page is vulnerable to SQL injection attempts that reach the application.
Which two changes should the solutions architect recommend to add defense in depth? Each correct answer presents part of the solution.
- AMove the web instances and the database to private subnets, allow web traffic only from the ALB's security group, and allow database traffic only from the web instances' security group.This removes direct internet reachability and uses security group references so each tier accepts traffic only from the tier in front of it.
- BAssociate an AWS WAF web ACL with the ALB that includes the AWS managed SQL database rule group and the core rule set.AWS WAF inspects HTTP requests at the edge of the application and blocks common injection patterns before they reach the instances.
- CAdd a network ACL rule to the public subnets that denies all inbound traffic from 0.0.0.0/0.The ALB lives in those subnets and must accept internet traffic, so this would take the storefront offline rather than layer the defenses.
- DSubscribe to AWS Shield Advanced and add the RDS instance as a protected resource.RDS instances are not a Shield Advanced protected resource type, and Shield addresses DDoS rather than SQL injection or network segmentation.
- EEnable Amazon GuardDuty so that it blocks SQL injection requests to the ALB.GuardDuty is a threat detection service that produces findings; it does not block HTTP requests.
Why: Security at every layer means each tier has its own control and none depends on another tier alone. Placing application and data tiers in private subnets with security groups that reference the upstream tier's security group gives tight network segmentation without managing IP ranges. AWS WAF on the ALB adds application-layer filtering for injection and other common attacks. The distractors misplace a control (a subnet-wide NACL deny), choose an unsupported target (Shield Advanced on RDS), or assume a detective service can block traffic.
Determine a strategy to improve security
Hollis and Grant Legal runs 900 long-lived EC2 instances, both Windows Server and Amazon Linux 2023, across 30 accounts in two Regions. Each account team patches with its own maintenance windows, and compliance reporting is assembled by hand every quarter. Policy now requires critical and security updates to be installed within 7 days of release on all instances, with a central compliance view, and the platform team wants to minimize administrative effort.
Which solution meets these requirements?
- ACreate a Systems Manager Quick Setup patch policy for the organization that targets all accounts and both Regions, uses patch baselines that auto-approve critical and security updates, scans daily and installs weekly, and reports compliance centrally.Patch policies deploy consistent baselines, scan and install schedules across accounts and Regions from one place and provide organization-wide compliance reporting.
- BUse Systems Manager Run Command to run yum update and Windows Update commands on all instances every Sunday.Ad hoc commands do not apply approval rules per classification, and they produce no patch compliance data for the auditors.
- CEnable Amazon Inspector in all accounts and treat closed findings as the patch compliance report.Inspector identifies vulnerabilities but does not install patches, so it cannot meet the installation requirement on its own.
- DAsk each account team to keep its maintenance windows and export patch compliance from each account to a shared spreadsheet monthly.This keeps the inconsistent per-account process and manual reporting that the company is trying to eliminate.
Why: A sound patch process defines what is approved, when it is installed and how compliance is proven, and applies all three consistently. Systems Manager Patch Manager patch baselines express approval rules by product, classification and severity, and a Quick Setup patch policy distributes those baselines and schedules across an organization's accounts and Regions. Daily scans provide current compliance data, and weekly installs keep the delay within the 7-day requirement. Detection tools and ad hoc commands each cover only part of the process.
Determine a strategy to improve security
Ashgrove Energy has 25 accounts in AWS Organizations. Each account owner created a separate AWS CloudTrail trail, and during an investigation the security team discovered that two account administrators had deleted their trails. The company needs a record of management events from every account and every Region that member account administrators cannot stop or delete, stored in the existing log-archive account.
What should the solutions architect recommend?
- ACreate an AWS Config aggregator in the log-archive account that collects configuration items from all accounts.AWS Config records resource configuration changes, not a full record of API calls and the identities that made them.
- BCreate a multi-Region organization trail from the management account that delivers to an S3 bucket in the log-archive account, with log file validation enabled.An organization trail applies to every member account and Region, member accounts can see it but cannot modify or delete it, and log file validation detects tampering with delivered files.
- CEnable VPC Flow Logs in every VPC and deliver them to the log-archive account.Flow logs capture network traffic metadata, not which user or role called which AWS API.
- DAsk each account administrator to re-create their trail and add an IAM policy that denies cloudtrail:DeleteTrail to their own role.Administrators who control their own IAM policies can remove the deny, so this does not prevent the trail from being deleted again.
Why: Traceability across an organization starts with an organization trail, created by the management account or a delegated administrator, so every member account is covered automatically. Member accounts cannot change or delete that trail, which removes the gap the investigation found. Delivering to a bucket in a separate log-archive account with log file validation, and optionally S3 Object Lock, protects the evidence itself. Config and flow logs are valuable but answer different questions than who called which API.
Determine a strategy to improve security
Kestrel Manufacturing runs Amazon RDS, Amazon EBS and Amazon EFS workloads in 20 accounts in AWS Organizations, all in eu-west-1. Backups today are manual snapshots kept in the same account as the data. After a ransomware incident at a competitor, the board requires backups that are created consistently in every account, copied to a separate account in another Region, and impossible to delete before 35 days even by administrators of the backup account.
Which two actions should the solutions architect recommend? Each correct answer presents part of the solution.
- AAttach an AWS Backup backup policy in AWS Organizations that defines the backup plan for all accounts and copies each recovery point to a vault in a dedicated backup account in eu-central-1.Organization backup policies deploy the same backup plan to every member account, and AWS Backup supports cross-account, cross-Region copy into a central vault.
- BApply AWS Backup Vault Lock in compliance mode to the destination vault with a minimum retention of 35 days.After the grace period ends, a vault locked in compliance mode cannot have its lock removed or recovery points deleted early by any user, including the root user.
- CApply AWS Backup Vault Lock in governance mode to the destination vault.Governance mode can be changed or removed by users with sufficient IAM permissions, so it does not meet the requirement that administrators cannot delete backups.
- DUse Amazon Data Lifecycle Manager policies in each account to create and copy snapshots.Data Lifecycle Manager handles EBS snapshots and AMIs only, so RDS and EFS are not covered, and it offers no immutable vault.
- EConfigure S3 Cross-Region Replication to copy the snapshots to a bucket in the backup account.RDS, EBS and EFS backups are not objects in a customer S3 bucket, so S3 replication cannot copy them.
Why: A resilient backup process covers every data store with one policy, isolates copies from the source account and Region, and protects them from deletion. AWS Backup organization backup policies remove per-account drift, and cross-account copy places recovery points behind a separate security boundary. Vault Lock in compliance mode makes the retention immutable, which is the property ransomware protection depends on. Governance mode is the trap because it looks similar but can be lifted by privileged users.