AWS Certified Solutions Architect Professional SAP-C02 Practice Question
A financial-services company is reviewing the security of a multi-tier application hosted on AWS. The architecture consists of an Application Load Balancer (ALB) distributing traffic to an Auto Scaling group of EC2 instances in private subnets. These instances process sensitive data, retrieve database credentials from AWS Secrets Manager, and read/write reports to a specific Amazon S3 bucket. All outbound traffic from the EC2 instances, including calls to AWS services, is routed through a NAT Gateway.
A security audit has highlighted the following findings:
- The IAM role attached to the EC2 instances has an overly permissive policy granting
s3:*actions onarn:aws:s3:::*. - The security group for the EC2 instances allows all outbound traffic to
0.0.0.0/0. - All communication from the EC2 instances to AWS services such as S3 and Secrets Manager is sent through the NAT Gateway to the services' public endpoints.
A solutions architect must propose a strategy to implement defense-in-depth and remediate these findings. Which set of recommendations provides the most comprehensive security improvements across multiple layers?
Migrate the secrets from Secrets Manager to AWS Systems Manager Parameter Store for centralized configuration. Configure the security group outbound rules to allow traffic only to the public IP address ranges for S3 and Secrets Manager.
Create a VPC gateway endpoint for S3 and a VPC interface endpoint for Secrets Manager. Update the EC2 instance IAM role to allow only
s3:GetObjectands3:PutObjecton the specific S3 bucket. Modify the EC2 security group to restrict outbound traffic to the VPC endpoints.Configure Amazon EventBridge rules to trigger AWS Lambda functions for automated remediation of GuardDuty findings. Implement AWS Config rules to detect and alert on overly permissive IAM policies and security group rules.
Implement AWS WAF on the ALB and enable AWS Shield Advanced. Use AWS Network Firewall to create strict outbound filtering rules for all traffic leaving the VPC.