A company is expecting rapid growth in the near future. A solutions architect needs to configure existing users and grant permissions to new users on AWS. The solutions architect has decided to create IAM groups. The solutions architect will add the new users to IAM groups based on department.Which additional action is the MOST secure way to grant permissions to the new users?
Answer(s): C
The correct answer is C.A) SCPs control by organizational unit at account/OU level, not for granting fine-grained permissions to individual IAM groups within an account; they are boundaries, not direct grant mechanisms. B) Attaching roles to IAM groups is not supported; roles are assumed by principals, not attached to groups. C) Attaching an IAM policy with least-privilege permissions to groups provides direct, scalable, and auditable access control aligned with department needs. D) Permissions boundaries limit how much a user or role can do, but tying this to roles for groups is less straightforward; boundaries are typically used with individual principals, not as the primary mechanism for group-based access.
A group requires permissions to list an Amazon S3 bucket and delete objects from that bucket. An administrator has created the following IAM policy to provide access to the bucket and applied that policy to the group. The group is not able to delete objects in the bucket. The company follows least-privilege access rules.Which statement should a solutions architect add to the policy to correct bucket access?
Answer(s): D
The correct statement should explicitly allow s3:DeleteObject on the bucket. The existing policy permits listing and other actions but lacks delete permissions scoped to the bucket or object ARNs. Adding a statement that allows s3:DeleteObject for the bucket/object path completes the least-privilege access needed to delete objects.A) Incorrect because it would grant delete permissions globally or without proper resource scope, potentially violating least-privilege.B) Incorrect because it may not specify the DeleteObject action or correct resource ARN.C) Incorrect because it might be missing the necessary bucket/object scope or uses an overly broad or insufficient action set.D) Correct because it grants s3:DeleteObject with the proper resource ARN, aligning with least-privilege and enabling delete operations on the target bucket.
A law firm needs to share information with the public. The information includes hundreds of files that must be publicly readable. Modifications or deletions of the files by anyone before a designated future date are prohibited.Which solution will meet these requirements in the MOST secure way?
Answer(s): B
S3 Object Lock with a retention period provides writable immutability (gate-keeping until the specified date) while allowing public read access for static website hosting, meeting both public readability and tamper-proof requirements.A) Grants read-only access to principals but does not enforce immutability or retention, so deletions/modifications could occur before the date.C) Uses a Lambda to revert changes, which is error-prone and not tamper-proof; lacks built-in immutability guarantees.D) Combines Object Lock with static hosting but selecting a folder is less reliable; proper bucket-level immutability and policy scope are required.
A company is making a prototype of the infrastructure for its new website by manually provisioning the necessary infrastructure. This infrastructure includes an Auto Scaling group, an Application Load Balancer and an Amazon RDS database. After the configuration has been thoroughly validated, the company wants the capability to immediately deploy the infrastructure for development and production use in two Availability Zones in an automated fashion.What should a solutions architect recommend to meet these requirements?
A concise explanation with the correct rationale:B) Defining infrastructure as code via CloudFormation templates from the prototype ensures repeatable, automated deployment across two Availability Zones, aligning with standard IaC practices for scalable environments.A) Systems Manager replication/provisioning is not designed to reproduce entire multi-resource architectures reliably across AZs in an automated launchable stack.C) Config records and deploys are not used to deploy or provision infrastructure; Config is for compliance and inventory, not provisioning.D) Elastic Beanstalk abstracts and manages apps, not a manual prototype with direct, reproducible infrastructure like ASG, ALB, and RDS; not a direct IaC approach.
A business application is hosted on Amazon EC2 and uses Amazon S3 for encrypted object storage. The chief information security officer has directed that no application traffic between the two services should traverse the public internet.Which capability should the solutions architect use to meet the compliance requirements?
A) VPC endpointB) VPC endpoint is correct because it enables private connectivity between EC2 and S3 over the AWS network, preventing traffic from traversing the public internet. Specifically, a Gateway VPC Endpoint for S3 keeps S3 requests within AWS’s private network.A) AWS KMS handles encryption keys, not network routing, so it does not prevent internet traversal.C) Private subnet ensures resources have no direct internet access but does not guarantee private access to S3 from EC2 APIs without a VPC endpoint.D) Virtual private gateway relates to VPN connections to on-premises networks, not S3 access within AWS.
Post your Comments and Discuss Amazon AWS-SOLUTION-ARCHITECT-ASSOCIATE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTION-ARCHITECT-ASSOCIATE content, but please register or login to continue.