AWS Solutions Architect

A company needs to allow an EC2 instance to read objects from an S3 bucket without embedding AWS credentials in the application. What is the recommended approach?

• AStore access keys in the EC2 instance user data
• BAssign an IAM role to the EC2 instance with the required S3 permissions
• CCreate an IAM user, attach an S3 policy, and store the credentials in a config file
• DEnable public access on the S3 bucket

An IAM policy contains the following statement: `{"Effect": "Deny", "Action": "s3:DeleteObject", "Resource": "*"}`. A user has another policy that grants `s3:DeleteObject`. What happens when the user attempts to delete an S3 object?

• AThe delete succeeds because the Allow policy takes precedence
• BThe delete is denied because Deny always overrides Allow
• CThe outcome depends on which policy was created first
• DThe delete succeeds only if the user is an IAM admin

A developer needs temporary access to an AWS account owned by a different company to perform a security audit. Which IAM feature enables this without creating a permanent user in the target account?

• AIAM user with cross-account permissions
• BIAM cross-account role with an external ID
• CAWS Directory Service federation
• DAmazon Cognito identity pool

A security team wants to ensure that no IAM principal in an AWS account can disable CloudTrail logging, even if they have full admin privileges. What is the most effective solution?

• AApply an IAM policy to all users that denies cloudtrail:StopLogging
• BUse AWS Organizations Service Control Policies (SCPs) to deny cloudtrail:StopLogging
• CEnable MFA delete on the CloudTrail S3 bucket
• DConfigure CloudTrail with a log file validation checksum

A company uses AWS Organizations with multiple accounts. A solutions architect needs to prevent developers in sandbox accounts from launching EC2 instances larger than t3.medium. Which approach satisfies this requirement with the least operational overhead?

• ACreate IAM permission boundaries in each sandbox account
• BApply an SCP at the Organizational Unit (OU) level that denies ec2:RunInstances for insta…
• CUse AWS Config rules to automatically terminate oversized instances
• DConfigure IAM policies for every developer IAM user in each sandbox account

What is the primary difference between a Security Group and a Network ACL (NACL) in Amazon VPC?

• ASecurity Groups operate at the subnet level; NACLs operate at the instance level
• BSecurity Groups are stateful and NACLs are stateless
• CNACLs support only Allow rules; Security Groups support both Allow and Deny
• DSecurity Groups apply to VPCs; NACLs apply to individual EC2 instances

A web application runs on EC2 instances in a private subnet. The application must communicate with an external payment processor API over HTTPS. The company does not want to use a NAT Gateway due to cost concerns. Which solution allows outbound HTTPS while keeping instances private?

• AAttach an Internet Gateway directly to the private subnet
• BUse a VPC endpoint for the payment processor API
• CPlace a NAT instance in a public subnet and configure the private subnet route table
• DAssign Elastic IP addresses to the EC2 instances

A company needs to connect its on-premises data center to AWS securely using a private, dedicated connection that does NOT traverse the public internet. Which service should they use?

• AAWS Site-to-Site VPN
• BAWS Direct Connect
• CAmazon VPC Peering
• DAWS Transit Gateway

A three-tier web application has a web tier, application tier, and database tier. What is the best practice for network security group design?

• AUse a single shared security group for all three tiers to reduce management complexity
• BEach tier should only allow traffic from the security group of the tier directly in front…
• CAllow all inbound traffic from the VPC CIDR range in each tier for simplicity
• DAll tiers should share the same NACL to centralize firewall rules

A company stores sensitive customer data in Amazon S3. They require that all data be encrypted at rest using keys managed by the company, with full audit capability of every key usage event. Which encryption option meets these requirements?

• ASSE-S3 (Server-Side Encryption with Amazon S3-managed keys)
• BSSE-KMS with a customer-managed CMK
• CSSE-C (Server-Side Encryption with Customer-Provided Keys)
• DClient-side encryption with an on-premises key

An application uses Amazon RDS for MySQL. A compliance requirement mandates that the encryption key be stored in hardware that the company physically controls and that AWS cannot access. Which solution meets this requirement?

• AEnable RDS encryption using AWS-managed keys (aws/rds)
• BEnable RDS encryption using a customer-managed KMS CMK
• CUse AWS CloudHSM to store the encryption keys and configure RDS with custom key material
• DEncrypt the data at the application layer before writing to RDS

A company wants to encrypt data in transit between EC2 instances within the same VPC. Which approach is most appropriate?

• AEnable VPC Flow Logs to monitor unencrypted traffic
• BUse TLS/SSL at the application layer between instances
• CCreate a dedicated encrypted VPC with a separate CIDR block
• DAWS encrypts all intra-VPC traffic automatically, so no action is needed

A security team wants to detect if any EC2 instances in their AWS account are communicating with known malicious IP addresses or are being used for cryptocurrency mining. Which AWS service provides this capability?

• AAmazon Inspector
• BAWS Security Hub
• CAmazon GuardDuty
• DAWS Shield Advanced

A company's web application is experiencing a surge of SQL injection and cross-site scripting (XSS) attacks. Which AWS service should be deployed to block these layer-7 attacks?

• AAWS Shield Standard
• BAmazon Route 53 DNSSEC
• CAWS WAF (Web Application Firewall)
• DAmazon CloudFront with geo-restriction

An application stores API keys and database passwords in AWS Secrets Manager. A Lambda function needs to retrieve these secrets at runtime. What is the most secure way to grant the Lambda function access?

• APass the secret ARN as an environment variable in plaintext
• BHard-code the secret values in the Lambda deployment package
• CAssign an IAM execution role to the Lambda function with a policy allowing secretsmanager…
• DMake the secrets public in Secrets Manager to avoid IAM complexity