Design Secure Architectures

IAM: Who Can Do What, and How AWS Decides

Almost every security question on this exam reduces to identity. You need to know which identity type belongs where, how policies combine, and which controls act as ceilings rather than grants.

Exam tip. If a question says an account administrator must not be able to override the control, the answer is an SCP. If it says a developer-created role must stay within limits, it is a permissions boundary.

Encryption, Key Management and Keeping S3 Private

Data protection questions split into three: is it encrypted at rest, is it encrypted in transit, and can anyone reach it who should not. Each has a distinct set of correct answers, and the exam deliberately mixes the three.

Exam tip. Encryption never answers a public-exposure question and Block Public Access never answers an encryption question. Read which of the three the scenario is actually about.

How a VPC Is Put Together, and Where Traffic Can Actually Go

Most network questions on this exam are answered by knowing which component creates a path and which one filters it. Get the routing right first, then the filtering.

Exam tip. If a question forbids internet transit for S3 traffic, the answer is a gateway endpoint. If it forbids inbound access but allows patching, it is a NAT gateway.

The Security Services, Sorted by the Question They Answer

AWS has a dozen security services and the exam mostly tests whether you can pick the right one. Each answers a different question, and the wrong answers in a question are usually the other services in this list.

Exam tip. Read the verb in the question. Detect, classify, scan, investigate and aggregate each map to exactly one service.

Which Control Blocks What, and Where

Traffic questions are answered by knowing the layer each control operates at. Choosing a security group when the question needs a WAF, or a NACL when it needs a route change, is the most common way to lose these marks.

Exam tip. If the requirement names a domain or a URL pattern, the answer is layer 7. If it names an address or a port, it is a security group or NACL.

Every Way an Application Can Get AWS Credentials, Ranked

A large share of security questions reduce to: how does this thing authenticate? There is a clear ranking, and the wrong answers are always further down it.

Exam tip. If an answer stores a long-lived key anywhere, look for the role-based option. It is nearly always present and nearly always correct.

Proving What Happened, and Proving It Was Not Changed

Audit questions split into three: what is recorded, can it be trusted, and can it be destroyed. Each has a distinct AWS answer and they are frequently mixed in one question.

Exam tip. Read whether the requirement is detect, prove or prevent. Validation detects tampering; Object Lock prevents it.

1. A company is standing up dozens of new AWS accounts and wants them created with baseline logging, guardrails, and an account factory rather than configured by hand. Which service provides this?

• A. AWS Control Towercorrect
• B. AWS Systems Manager
• C. AWS Service Catalog on its own
• D. AWS Resource Access Manager

Control Tower sets up a multi-account landing zone with an account factory, centralised logging, and preventive and detective guardrails built on Organizations and Config. Systems Manager manages instances, Service Catalog alone publishes approved products, and RAM shares individual resources between accounts.

2. What happens when automatic key rotation is enabled on a KMS customer managed key?

• A. All existing ciphertext is re-encrypted automatically
• B. The key ID changes and applications must be updated
• C. The key is deleted and replaced
• D. New key material is created yearly and old material is retained so previously encrypted data still decryptscorrect

Rotation adds new backing material while retaining the old, and the key ID and ARN stay the same, so nothing in the application changes and old ciphertext remains readable. Existing data is not re-encrypted.

3. An application running on an EC2 instance needs to read objects from an S3 bucket. Which approach follows AWS security best practice for granting that access?

• A. Store an IAM user's access key and secret key in a file on the instance
• B. Embed the root account credentials in the application configuration
• C. Make the bucket public so no credentials are needed
• D. Attach an IAM role with an S3 read policy to the instance profilecorrect

An IAM role attached through an instance profile supplies temporary, automatically rotated credentials to the instance. Long-lived access keys on disk can be copied and rarely get rotated, root credentials should never be used by an application, and a public bucket exposes the data to everyone.