Question 80
A security architect requires a high-confidence recovery process for a customer-managed KMS key that will encrypt critical backups. An operator proposes deleting the key immediately after a maintenance window, without understanding the impact on ciphertext. Which KMS safeguard is essential?
- Use KMS key deletion scheduling and explicit dependency inventory, ensuring backup ciphertext remains decryptable before any key retirement.
- Create a new key with the same alias after deleting the original and assume the alias preserves the original key material.
- Disable the old KMS key indefinitely during a test of backup restoration without verifying a usable recovery key first.
- Schedule deletion of the key with the minimum waiting period and only check usage after the deletion has completed.
Explanation
Correct Answer
A:A deleted KMS key cannot decrypt previously protected ciphertext; key deletion requires a controlled waiting period and recovery impact review.
Incorrect Answers
B:Aliases are mutable pointers, not cryptographic material. Deleting the only key that encrypted backups may make restore impossible.
C:Disabling an encryption key can block decrypt and restoration. Validate dependencies before any disable/delete operation.
D:KMS key deletion is irreversible for affected ciphertext. Inventory, verification and approval must precede any scheduled retirement.
Question 81
A customer uploads documents to S3 using presigned URLs. The architecture needs to prevent a leaked URL from remaining usable for its whole nominal TTL if the signing credentials are compromised or revoked. Which risk mitigation belongs in the design?
- Use short-lived presigned URLs, restrict signing-role permissions and enforce bucket-side conditions such as signature age where appropriate.
- Issue maximum-TTL presigned URLs signed by long-lived high-privilege credentials and rely on an unguessable URL alone.
- Set the bucket policy to allow all presigned uploads from any account as long as the request is HTTPS, omitting signer restrictions.
- Configure CloudFront viewer cache TTL for a direct S3 presigned upload endpoint and assume that determines the S3 authorization deadline.
Explanation
Correct Answer
A:Presigned URLs inherit the signer’s effective authorization; bounded validity and bucket-side controls reduce misuse of leaked URLs.
Incorrect Answers
B:A leaked signed URL remains usable during its valid period unless credentials/policy invalidation blocks it; minimize TTL and enforce signed-age bounds.
C:TLS protects transport but does not bound signer identity, grant scope or replay window of exposed upload requests.
D:Direct presigned S3 request authorization depends on signature, credential validity and S3 policy conditions, not unrelated CloudFront caching.
Question 82
An organization runs a managed API Gateway REST API requiring IAM authentication for AWS accounts. A partner signs API requests but receives HTTP 403 because the API resource policy permits only selected account roles. Which policy principle governs access?
- Grant the partner execute-api:Invoke in its IAM role but leave the API resource policy explicitly denying that role.
- Both the required IAM execute-api authorization and the API resource policy restrictions must allow the partner request.
- Use a valid SigV4 signature from an authorized AWS principal while omitting the required execute-api:Invoke permission.
- Configure a Lambda authorizer on a route that requires IAM authentication and assume its Allow response automatically supersedes the API resource policy.
Explanation
Correct Answer
B:IAM-authenticated API Gateway methods and resource policies together determine whether a signed caller may invoke the endpoint.
Incorrect Answers
A:An identity allow cannot override an applicable explicit resource-policy Deny; both authorization layers must allow the request.
C:Signature authentication proves identity; it does not grant an action that the identity or resource policy does not authorize.
D:Authorization modes and resource policy restrictions remain effective; another authorizer does not silently override an explicit resource-policy deny.
Question 83
An organization requires Amazon GuardDuty findings in 60 accounts, but the security account dashboard is missing all new accounts even though the original member accounts appear. How should the centralized detection plan be corrected?
- Enable supported organization account enrollment, delegated administrator configuration and auto-enable policies in required Regions.
- Enable GuardDuty only in the delegated administrator account and expect it to discover threat activity in newly created members without enabling their detectors.
- Use only Security Hub organization integration and assume its findings automatically turn on GuardDuty in all new accounts and Regions.
- Invite each new account manually to share a subset of findings while leaving all supported auto-enable policies off.
Explanation
Correct Answer
A:GuardDuty organization setup determines which new accounts are monitored, independently of already enrolled member findings.
Incorrect Answers
B:Member-account GuardDuty enrollment is required for coverage; central dashboard access does not automatically add every new member.
C:Service integrations and delegated administration are not interchangeable; GuardDuty auto-enable settings govern its own member coverage.
D:Manual invitations can work but are fragile at scale and do not meet the requirement to include future accounts consistently.
Question 84
A compliance team is examining an AWS account’s CloudTrail trail. It requires audit data to survive if an administrator in the source workload account disables or deletes local resources. What centralized logging architecture limits this risk?
- Enable CloudTrail event history in each workload account and assume it is an immutable, indefinite centralized archive.
- Export CloudTrail event files into the same workload account with a deny policy that the workload administrator can later change.
- Configure an organization trail delivering logs to an isolated log archive account with restrictive delivery and delete policies and retention protections.
- Configure an organization trail but deliver its only S3 objects into a member workload bucket with administrators allowed to delete versions.
Explanation
Correct Answer
C:Separating archive ownership from workload administration reduces the ability of a compromised member account to erase centralized records.
Incorrect Answers
A:Event history is bounded and linked to the source account; isolated cross-account log delivery provides stronger retention and blast-radius separation.
B:A compromised account administrator may be able to alter local permissions and delete its own log archive. Use independent log-account controls.
D:Organization-wide capture does not protect evidence if destination ownership and delete rights remain within compromised workload accounts.
Question 85
A group of EC2 instances retrieves a secret using a VPC interface endpoint. Identity policies grant access, but security wants calls to be denied when made from outside the approved endpoint. Which IAM condition is most appropriate where the service supports it?
- Restrict aws:SourceVpc to the application VPC and assume it distinguishes the one approved VPC endpoint from every other endpoint in that VPC.
- Allow any principal using the regional Secrets Manager public hostname because only the private VPC endpoint has the secret name.
- Use a policy condition on aws:SourceVpce identifying the approved endpoint ID, while accounting for AWS service-to-service call contexts.
- Use aws:SourceIp set to the client instance public IP while requiring every request to pass through an interface VPC endpoint.
Explanation
Correct Answer
C:SourceVpce conditions can constrain supported API requests to a specified VPC endpoint instead of merely trusting the caller role.
Incorrect Answers
A:SourceVpc can constrain the VPC but not a unique endpoint ID. SourceVpce matches the specific approved endpoint.
B:Resource names and DNS do not enforce endpoint-specific authorization; use supported IAM/source endpoint conditions.
D:Private endpoint calls may not have the expected public-source IP context, and SourceIp is not the precise endpoint identity condition.
Question 86
A Security Hub CSPM delegated administrator already receives findings from enrolled accounts in three AWS Regions. Production OUs must enforce a strict subset of security standards and specific control parameters, while sandbox OUs must use a different approved control configuration. Security wants these settings governed centrally from one home Region, inherited by newly joined accounts, rather than manually editing each member. What should be configured?
- Configure Security Hub finding aggregation across the linked Regions but retain per-account manual selection of standards and control parameters.
- Enable Security Hub CSPM central configuration with the intended home and linked Regions, then associate appropriate configuration policies with the production and sandbox OUs.
- Use Security Hub delegated administration but require every new member account to choose production/sandbox control settings individually.
- Attach SCPs denying securityhub:DisableSecurityHub only and assume they select CIS/FSBP control portfolios and customized parameters per OU.
Explanation
Correct Answer
B:Security Hub CSPM central configuration uses administrator-managed policies assigned to accounts and OUs, with policy inheritance across home and linked Regions for organization-wide standards and controls.
Incorrect Answers
A:Aggregation centralizes visibility, not the organization-level policy associations controlling enabled standards and parameter values.
C:Delegation does not by itself apply OU-linked control policies consistently to current and future members; central configuration policies do.
D:SCPs are permission boundaries, not the CSPM central configuration construct that assigns standard/control settings by OU.
Question 87
A security platform must search large volumes of historical AWS CloudTrail events using SQL-like queries across multiple accounts, without manually maintaining raw JSON scanners. It already collects governance events but needs an event-focused query store. Which managed feature is appropriate?
- Use CloudTrail event history in each account and assume its bounded event lookup is the persistent cross-account SQL analytics store.
- Write management events to S3 as gzipped logs and run a new manually maintained parser each time instead of using the managed event query service.
- Use AWS CloudTrail Lake event data stores with suitable event selectors, retention and organization-access controls.
- Use Amazon Athena to query CloudTrail Lake event data store directly as if Lake were a normal S3 bucket prefix, without CloudTrail Lake SQL queries.
Explanation
Correct Answer
C:CloudTrail Lake provides managed event ingestion and query capabilities for CloudTrail activity with configured data stores.
Incorrect Answers
A:Event history is not a long-term queryable event data store supporting the described organization-wide analytics.
B:Raw log analytics are possible but contradict the requirement for a managed event-focused query store without maintaining custom scanners.
D:CloudTrail Lake has its own managed event-data-store query model. Raw S3 trail logs can use Athena, but are a different architecture.
Question 88
An application uses S3 access points to separate access to a single sensitive bucket among departments. Security wants a one-purpose endpoint that can only be used within a specified VPC. Which policy approach supports the boundary?
- Create an S3 access point with internet network origin but rely on department-only IAM identity policies to enforce VPC locality.
- Configure an S3 access point bound to one VPC but give its resource policy wildcard principals and all object actions.
- Configure a VPC-restricted S3 access point and a resource policy granting only the authorized department principals and actions.
- Restrict only the access point policy to the VPC and leave the underlying bucket policy granting broad direct access to untrusted principals.
Explanation
Correct Answer
C:VPC-restricted access points add a network-origin boundary to S3 access point policy for callers with approved permissions.
Incorrect Answers
A:Principal authorization is valuable but the access point remains reachable outside the specified VPC absent VPC-origin restriction.
B:The VPC boundary alone does not satisfy the least-privilege department requirement; both origin and principal/action scopes matter.
D:Callers might bypass the access point through another still-permitted bucket access path. The bucket and access point policies must align.
Question 89
A customer portal currently runs in one AWS Region. Its business continuity target is recovery in about ten minutes after a whole-Region outage, with data loss of at most a few minutes. Management rejects the cost of running a fully active production fleet in both Regions, but accepts a continuously running smaller secondary environment. Which strategy is most appropriate?
- Configure a pilot-light secondary Region with replicated database state but no running application instances, and treat the untested capacity launch as guaranteed within ten minutes.
- Configure cross-Region database snapshots every twelve hours and rebuild all application infrastructure from templates after a Region outage.
- Maintain a warm standby in a second Region with scaled-down application capacity, replicated data, rehearsed promotion, and tested traffic failover.
- Keep two fully active Regions at complete production scale and continuously route all customers to both, even though management explicitly rejects that ongoing cost.
Explanation
Correct Answer
C:Warm standby keeps a functional but reduced secondary stack running, trades less idle cost than active-active for faster recovery than cold rebuild, and requires DR testing to prove RTO/RPO.
Incorrect Answers
A:Pilot light may be cheaper but still requires compute and integration startup. Without measured launch time it cannot demonstrate the stringent RTO; warm standby retains reduced working capacity.
B:A twelve-hour snapshot interval misses the few-minute RPO and complete rebuilds are unlikely to meet the ten-minute RTO without tested evidence.
D:Active-active might meet strict availability targets, but it violates the documented cost constraint that favors a smaller operational warm standby.
Question 90
A finance system permits 24 hours of recovery time and 12 hours of data loss after a regional disaster. The workload is rarely used, and the business prioritizes low standby expense over immediate failover. Which disaster-recovery model best matches these constraints?
- Use backup-and-restore with tested cross-Region recovery procedures and a backup schedule meeting the stated RPO.
- Operate a fully active dual-Region application fleet with synchronous client traffic even though recovery objectives allow an economical day-long restore.
- Use a warm standby with continually operating secondary application servers and database compute without comparing cost against tested backup-and-restore.
- Keep daily backups only in the primary Region and configure Route 53 failover DNS without building an off-Region recovery target.
Explanation
Correct Answer
A:Backup-and-restore minimizes continuously running standby compute and can meet relatively relaxed RTO and RPO requirements when recovery tests validate timing.
Incorrect Answers
B:Active-active may improve availability but incurs unnecessary standby and operational expense relative to proven cross-Region backup/restore for this low-priority workload.
C:Warm standby can achieve tighter RTOs but carries baseline running expense that conflicts with this unusually relaxed RTO and cost priority.
D:Failover records cannot restore the workload after a complete Region outage without recoverable backups and an actual secondary deployment plan.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests