Secure Architecture II

Equip yourself with the necessary understanding to confidently tackle exam questions by reviewing assessment questions and explanations against all options.

We'll cover the following

Question 19

An insurance company has important objects stored in S3. According to the new security compliance policy, the company must protect data from accidental deletion.

As a solution architect, provide a solution to meet these requirements. (Select two options.)

A. Enable default encryption on the S3 bucket.

B. Configure an MFA Delete on the S3 bucket.

C. Configuring the versioning of the S3 bucket.

D. Create a lifecycle policy for the S3 bucket objects.

E. Configure an S3 bucket policy.

Question 20

A company has a web application deployed on the AWS Cloud. The web application is designed to use Application Load Balancer (ALB) to use certificates imported into Amazon Certificate Manager (ACM). The team must be notified 45 days before the expiration of each certificate.

As a Solution Architect, provide a solution to meet these requirements with the least operational overhead.

A. Configure a rule in ACM to publish a message to the Simple Notification Service topic (SNS) once 45 days are left before certificate expiration.

B. Configure an AWS Config rule to check for certificates that expire within 45 days and publish the message using the Simple Notification Service topic (SNS).

C. Configure Amazon EventBridge to listen for the ACM Certificate Approaching Expiration event in 45 days. Configure the rule to invoke the Lambda function to send a custom message/alert using a Simple Notification Service topic (SNS).

D. Configure Amazon EventBridge to listen for the ACM Certificate Approaching Expiration event in 45 days. Configure the rule to invoke the Lambda function to send a custom message/alert using a Simple Queue Service topic (SQS).

Question 21

A company has different three-tier applications on the AWS Cloud. Per the company’s new policies, the company must track configuration changes on each application independently and maintain API calls to each resource.

As a solution architect, provide a solution to meet these requirements.

A. Configure AWS CloudTrail to track configuration changes and AWS Config to record API calls.

B. Configure AWS CloudWatch to track configuration changes and AWS Config to record API calls.

C. Configure AWS Config to track configuration changes and AWS CloudTrail to record API calls.

D. Configure AWS Config to track configuration changes and AWS CloudWatch to record API calls.

Question 22

A company plans to develop REST API for its loyal club application in the ap-south-1 and us-east-2 regions. The company compliance policy requires the protection of these APIs across multiple accounts from SQL injection and cross-site scripting.

As a solution architect, provide a solution to meet these requirements with the least operational overhead.

A. Configure WAF in both regions and associate web ACLs with an API stage.

B. Configure the AWS Firewall manager in both regions and set AWS WAF rules.

C. Configure AWS Sheild in both regions and associate web ACLs with an API stage.

D. Configure AWS Sheild Advance in both regions and associate web ACLs with an API stage.

Question 23

A company plans to develop a file-sharing application. The application will use an S3 bucket for storage. The company wants to serve the files through Amazon CloudFront and does not want the files to be accessed directly through the S3 URL.

A. Configure S3 policies to grant read permissions to CloudFront only.

B. Configure an IAM role with S3 read permissions and assign the role to CloudFront.

C. Create an S3 policy and set CloudFront as the principal. Set the target as the S3 Amazon Resource Name (ARN).

D. Configure an Origin Access Control. Assign the OAC to CloudFront and restrict S3 bucket permissions to OAC only.

Get hands-on with 1300+ tech skills courses.