Architecting on AWS Certification Welding Procedures & Techniques 3 — Questions and Answers
Question 1: An application must allow users to upload files directly to S3 without routing through the application server. Which mechanism enables this securely?
- Store AWS credentials in the browser JavaScript
- Generate a presigned S3 URL on the server and return it to the client (Correct answer)
- Make the S3 bucket publicly writable
- Use an API Gateway proxy for all S3 uploads
Correct answer: Generate a presigned S3 URL on the server and return it to the client
A presigned URL grants temporary, scoped upload access without exposing AWS credentials to the client.
Question 2: A company wants to prevent any IAM user in their AWS account from disabling AWS CloudTrail. Which is the most effective control?
- Create a CloudWatch alarm for CloudTrail API calls
- Apply an SCP in AWS Organizations that denies cloudtrail:StopLogging (Correct answer)
- Remove the cloudtrail:StopLogging permission from all IAM users
- Enable MFA Delete on the CloudTrail S3 bucket
Correct answer: Apply an SCP in AWS Organizations that denies cloudtrail:StopLogging
An SCP applied at the Organizations level enforces the deny across all accounts, overriding any IAM permission.
Question 3: Which AWS service helps identify security vulnerabilities in EC2 instances and container images automatically?
- AWS Shield
- Amazon Inspector (Correct answer)
- AWS Trusted Advisor
- Amazon GuardDuty
Correct answer: Amazon Inspector
Amazon Inspector performs automated vulnerability assessments on EC2 instances and ECR container images.
Question 4: A serverless application needs to call an internal microservice in a private VPC. How should the Lambda function be configured?
- Assign a public IP to the Lambda function
- Configure the Lambda function to run inside the VPC with appropriate security groups (Correct answer)
- Use VPC peering between Lambda and the microservice VPC
- Enable enhanced networking on the Lambda function
Correct answer: Configure the Lambda function to run inside the VPC with appropriate security groups
Placing the Lambda function in the VPC allows it to access private resources using standard VPC networking.
Question 5: What does Amazon CloudFront's Origin Access Control (OAC) accomplish?
- It speeds up dynamic content delivery via TCP optimization
- It restricts S3 bucket access so only CloudFront can read objects (Correct answer)
- It enables WAF rules on the CloudFront distribution
- It caches responses from API Gateway origins
Correct answer: It restricts S3 bucket access so only CloudFront can read objects
OAC ensures your S3 bucket is not publicly accessible and only CloudFront can fetch its content.
Question 6: An architect needs to enforce that all new S3 buckets created in an AWS account block public access. What is the most scalable solution?
- Train developers to enable the setting manually
- Enable S3 Block Public Access at the account level (Correct answer)
- Use AWS Config rules to detect and alert on public buckets
- Apply a bucket policy template to every new bucket
Correct answer: Enable S3 Block Public Access at the account level
Enabling S3 Block Public Access at the account level automatically applies to all existing and future buckets.
Question 7: Which AWS service provides DDoS protection automatically for all AWS customers at no additional cost for layer 3 and 4 attacks?
- AWS WAF
- Amazon GuardDuty
- AWS Shield Standard (Correct answer)
- AWS Firewall Manager
Correct answer: AWS Shield Standard
AWS Shield Standard is automatically included for all AWS customers and protects against common layer 3/4 DDoS attacks.
Architecting on AWS Certification Welding Procedures & Techniques 3
An application must allow users to upload files directly to S3 without routing through the application server.
Which mechanism enables this securely?