Domain 3: Design Secure Applications and Architectures

Question 1

Scenario:

Encrypt EBS volumes restored from the unencrypted
EBS snapshots

Answer 1

Solution:

Copy the snapshot and enable encryption with a
new symmetric CMK while creating an EBS volume
using the snapshot.

Question 2

Scenario:

Limit the maximum number of requests from a single
IP address.

Answer 2

Solution:

Create a rate-based rule i n AWS WAF and set the
rate l imit.

Question 3

Scenario:

Grant the bucket owner full access to all uploaded
objects i n the S3 bucket.

Answer 3

Solution:

Create a bucket policy that requires users to set the
object’s ACL to bucket-owner-full-control.

Question 4

Scenario:

Protect objects i n the S3 bucket from accidental
deletion or overwrite.

Answer 4

Solution:

Enable versioning and MFA delete.

Question 5

Scenario:

Access resources on both on-premises and AWS
using on-premises credentials that are stored in Active
Directory.

Answer 5

Solution:

Set up SAML 2.0-Based Federation by using a
Microsoft Active Directory Federation Service.

Question 6

Scenario:

Secure the sensitive data stored in EBS volumes

Answer 6

Solution:

Enable EBS Encryption

Question 7

Scenario:

Ensure that the data-in-transit and data-at-rest of the
Amazon S3 bucket i s always encrypted

Answer 7

Solution:

Enable Amazon S3 Server-Side or use Client-Side
Encryption

Question 8

Scenario:

Secure the web application by allowing multiple
domains to serve SSL traffic over the same IP
address.

Answer 8

Solution:

Use AWS Certificate Manager to generate an SSL
certificate. Associate the certificate to the
CloudFront distribution and enable Server Name
Indication (SNI).

Question 9

Scenario:

Control the access for several S3 buckets by using a
gateway endpoint to allow access to trusted buckets.

Answer 9

Solution:

Create an endpoint policy for trusted S3 buckets.

Question 10

Scenario:

Enforce strict compliance by tracking all the
configuration changes made to any AWS services.

Answer 10

Solution:

Set up a rule i n AWS Config to i dentify compliant
and non-compliant services.

Question 11

Scenario:

Provide short-lived access tokens that acts as
temporary security credentials to allow access to AWS
resources.

Answer 11

Solution:

Use AWS Security Token Service

Question 12

Scenario:

Encrypt and rotate all the database credentials, API
keys, and other secrets on a regular basis.

Answer 12

Solution:

Use AWS Secrets Manager and enable automatic
rotation of credentials.

Question 13

Scenario:

A cost-effective solution for over-provisioning of
resources.

Answer 13

Solution:

Configure a target tracking scalingn ASG.