1.2 Design secure workloads and applications.
Objective 1.2 sits in Design Secure Architectures, which carries 30% of the Solutions Architect Associate exam. The questions below are original, written from the official objective title above, and each explanation cites the AWS page it rests on.
Objective title verbatim from the official objectives. AWS exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A team allows 443 inbound on the security group and on a custom network ACL for the subnet. Clients still time out. What is missing?
The concept
A filter that keeps no state has to be told about both halves of a conversation. The reply to a permitted request is another packet arriving at the boundary, matched against its own entries.
Why this answer
Replies leave the subnet from a high numbered client port picked by the requester, so the subnet boundary needs an entry permitting that range in the leaving direction.
- Correct. Responses exit the subnet from ports 1024 to 65535, and the inbound entry for 443 says nothing about them.
- BTraffic on the way in is already permitted on 443. Widening the client range inward would matter on a subnet that holds the calling side.
- CSecurity groups track the request and let its reply back on their own, which is why no second entry is needed there.
- DA subnet holds one association at a time. Attaching another simply replaces the first and evaluates nothing extra.
Now you: objective 1.2 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A team must stop one abusive source address from reaching any instance in a subnet, without listing every other client. Which control does that?
Sample question 2 of 3
A web app carries database credentials in its source code. Your security team wants them rotated on a schedule without a redeploy. What do you use?
Sample question 3 of 3
A mobile app signs users in through a Cognito user pool. The app must now upload objects to S3 as those users. What supplies the AWS credentials?
Full Solutions Architect Associate question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.