Design secure access to AWS resources

Option B is correct because AWS Directory Service AD Connector acts as a directory gateway that redirects directory requests to the self-managed Active Directory without caching directory information in AWS. IAM Identity Center can use AD Connector as its Active Directory identity source. Option D is correct because an organization instance of AWS IAM Identity Center provides the centralized AWS access portal and can use the AD Connector directory as its identity source. Option E is correct because IAM Identity Center Permission Sets can be assigned to synchronized AD groups and provision the corresponding IAM roles in target AWS accounts, eliminating the need to manually create roles in each account. Option A is incorrect because the requirement specifically calls for direct use of the existing on-premises directory without storing password information in AWS, and AD Connector provides that pass-through model without requiring an AWS Managed Microsoft AD deployment. Option C is incorrect because manually deploying SAML providers and IAM roles across 100 accounts introduces significant operational overhead and does not provide the centralized IAM Identity Center access model. Reference: https://docs.aws.amazon.com/singlesignon/latest/userguide/connectonpremad.html

Options A, C, and E are correct because direct cross-account access to an SSE-KMS encrypted S3 bucket requires authorization at both the identity and resource levels. The EC2 IAM role in Account A needs an identity-based policy allowing the required S3 and KMS actions. The S3 bucket policy in Account B must explicitly allow the EC2 role from Account A to read the objects. Because the objects are encrypted with a customer managed KMS key owned by Account B, the KMS key policy must also permit the Account A role to use 'kms:Decrypt'. Option B is incorrect because AWS RAM does not provide general sharing of S3 buckets or KMS keys. Option D is incorrect because an IAM role trust policy controls which principals can assume the role; it does not authorize the role to access S3 or KMS resources. Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-walkthroughs-managing-access-example3.html

Option A is correct because SCPs provide centralized preventive authorization guardrails at the organization or OU level. They can deny API actions outside approved Regions using condition keys such as aws:RequestedRegion and can deny actions that would modify or delete VPC Flow Logs when those actions are explicitly covered by the policy. Option C is correct because AWS Control Tower provides a governed multi-account landing zone and preventive, detective, and proactive controls that can be applied to governed OUs. Option D is correct because AWS Config records resource configuration changes and evaluates resources against compliance rules, while AWS Systems Manager Automation can execute remediation runbooks when noncompliance is detected. Option B is incorrect because Amazon Inspector focuses on vulnerability management for supported compute resources and does not provide organization-wide Region restrictions or general configuration-drift remediation. Option E is incorrect because CloudTrail Lake and Athena provide audit and analysis capabilities for API activity but do not provide the preventive governance and AWS Config-based configuration remediation required by the scenario. Reference: https://docs.aws.amazon.com/controltower/latest/userguide/how-controls-work.html

Option C is correct because an AWS Organizations SCP provides centralized preventive enforcement across the applicable workload OUs. It can explicitly deny 'ec2:DeleteFlowLogs' and the relevant CloudTrail configuration actions, while allowing the AWS Control Tower execution role to perform required management operations. AWS Control Tower itself also provides mandatory preventive protection for its Control Tower-managed CloudTrail trails. Option E is correct because AWS Control Tower provides a strongly recommended detective control that uses the AWS Config 'ENCRYPTED_VOLUMES' rule to detect whether EBS volumes attached to EC2 instances are encrypted and report violations through the Control Tower governance experience. Option A is incorrect because EventBridge and Lambda provide reactive remediation and allow a potential logging gap before the resource is recreated. Option B is incorrect because Security Hub remediation is not the native Control Tower mechanism for detecting this specific EBS configuration, and the option describes automatically encrypting existing volumes rather than detecting and flagging noncompliance. Option D is incorrect because EBS volumes do not support resource-based policies for enforcing encryption, and AWS RAM is a resource-sharing service rather than an encryption-enforcement mechanism. Reference: https://docs.aws.amazon.com/controltower/latest/userguide/how-controls-work.html

Option A is correct because AWS recommends using a strong, unique root-user password and securely protecting the password and its recovery mechanisms. Option B is correct because MFA provides an additional authentication factor for the highly privileged root user, and AWS recommends phishing-resistant passkeys or security keys where possible. Option C is incorrect because IAM users should not be granted root-equivalent permissions merely to avoid using the root user; current AWS guidance favors IAM Identity Center or IAM roles with appropriate permissions and temporary credentials. Option D is incorrect because the root user cannot simply be disabled for a standalone or management account. Option E is incorrect because AWS recommends avoiding root-user access except when a task specifically requires root credentials. Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-best-practices.html

Option C is correct because AD Connector is a directory gateway that redirects authentication requests to the existing on-premises Active Directory without replicating the directory data into AWS. IAM Identity Center can use AD Connector as its identity source, allowing employees to authenticate using their existing domain credentials while providing centralized access to AWS accounts. Site-to-Site VPN supplies the private network connectivity required between the AWS VPC and the on-premises directory. Option A is incorrect because Simple AD is a separate directory and does not provide the required pass-through authentication to the existing AD. Option B is incorrect because AWS DataSync is not a directory password synchronization service, and synchronizing password-related data into AWS would violate the stated compliance requirement. Option D introduces a custom authentication system with unnecessary security and operational complexity.

Option A is correct because GuardDuty is already enabled in the scenario, so the required control is to prevent member-account administrators from deleting the detector and thereby disabling GuardDuty. An explicit SCP Deny for guardduty:DeleteDetector applies to member accounts and cannot be overridden by an IAM Allow, including permissions held by the member-account root user. Option B is incorrect because detective monitoring and remediation allow a period in which GuardDuty could be disabled. Option C is incorrect because an IAM permissions boundary is an identity-level control that is not inherently enforced on every future privileged identity in a member account. Option D is incorrect because event monitoring and manual intervention are reactive rather than preventive.

Option B is correct because AWS Resource Access Manager (AWS RAM) is the native mechanism for sharing a Transit Gateway across AWS accounts or across an AWS Organization. After the Transit Gateway is shared, the workload account can use the shared Transit Gateway for its VPC attachment. Option E is correct because the workload account creates its own VPC attachment to the shared Transit Gateway using IAM permissions in Account B, so the workload team does not need access to Account A or an IAM role in Account A. When the accounts are in the same AWS Organization and organization sharing is enabled, a RAM invitation may not be required; for supported external-account sharing scenarios, the recipient may need to accept the resource share. Option A is incorrect because Transit Gateway sharing is performed through AWS RAM rather than a resource-based IAM policy on the Transit Gateway. Option C is incorrect because it introduces cross-account role assumption and violates the stated separation-of-duties requirement. Option D is incorrect because VPC Peering is a separate point-to-point connectivity model and does not provide the requested use of the shared central Transit Gateway. Reference: https://docs.aws.amazon.com/vpc/latest/tgw/tgw-transit-gateways.html

Option B is correct because AWS recommends MFA for the root user and specifically recommends phishing-resistant passkeys or security keys wherever possible. Securing the physical security key appropriately supports a break-glass model. Option C is correct because AWS strongly recommends that root-user access keys not exist; workloads and automation should use temporary credentials through IAM roles instead. Option E is correct because everyday administration should be performed through AWS IAM Identity Center or IAM roles rather than the root user, allowing the root credentials to remain reserved for tasks that specifically require them. Option A is incorrect because AWS does not provide a feature to encrypt the root-user password with a customer-managed KMS key within the IAM console. Option D is incorrect because creating a root access key, even for disaster recovery, introduces unrestricted long-term programmatic credentials and contradicts AWS guidance to avoid root access keys. Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-best-practices.html