Design secure workloads and applications

Option C is correct because AWS Secrets Manager provides an alternating-users rotation strategy for Amazon RDS for Oracle. The strategy maintains two database users so that one user can remain valid while the credentials for the other user are rotated, reducing the risk of downtime during credential rotation. AWS provides an Oracle alternating-users rotation template that can be used as the basis for the rotation Lambda function. The application must retrieve the current secret and use the updated credentials for new connections; existing connections using the previous credentials can continue until they are closed. Option A is incorrect because directly changing the password of a single active database user can cause connection-pool or new-connection failures and requires custom scheduling and rotation logic. Option B is incorrect because IAM Database Authentication is not supported for Amazon RDS for Oracle. Option D is incorrect because KMS key rotation changes cryptographic key material and does not rotate Oracle database user passwords. Reference: https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html

Options A and B are correct. Option A is correct because AWS Secrets Manager supports custom Lambda rotation functions for secrets that do not have a built-in rotation integration. The alternating-users strategy maintains two database users and rotates one while the other remains valid, making it appropriate for applications that require high availability. For an on-premises MySQL database, the custom rotation Lambda must be able to reach the database through the appropriate hybrid network connectivity and must implement the database-specific credential-management logic correctly. Option B is correct because Parameter Store supports hierarchical parameter names and SecureString parameters encrypted using AWS KMS. Since the vendor-managed API keys do not require automatic rotation, Parameter Store can provide an appropriate lower-cost centralized configuration/secret store for this requirement. Option C is incorrect because AWS KMS manages cryptographic keys; it is not a general-purpose store for application API-key strings. Option D is incorrect because Parameter Store has no native database credential rotation capability, and executing rotation logic directly on EKS nodes creates unnecessary security, availability, and operational complexity. Option E is incorrect because CloudFormation parameters are intended primarily for stack deployment inputs and are not a purpose-built runtime secret-management or rotation service. Reference: https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotation-strategy.html and https://docs.aws.amazon.com/systems-manager/latest/userguide/secure-string-parameter-kms-encryption.html

Options A and D are correct. Option A is correct because a Security Group rule that references the same Security Group permits communication between resources associated with that group. Removing that self-referencing inbound rule prevents that Security Group from permitting unrestricted east-west communication between application servers. Option D is correct because Security Groups allow outbound traffic by default when the default 0.0.0.0/0 rule is present. Removing that broad rule and allowing only the required traffic to the RDS Security Group restricts application-tier egress and prevents direct internet access through a NAT Gateway or other permitted route. Security Groups are stateful, so response traffic for an allowed connection is automatically permitted. Option B is incorrect because NACLs are evaluated when traffic enters or leaves a subnet and do not filter traffic routed between resources within the same subnet. Option C is incorrect because AWS WAF is a Layer 7 web application firewall associated with supported application endpoints such as CloudFront distributions and Application Load Balancers; it is not attached to a subnet and does not filter arbitrary outbound EC2 traffic. Option E is incorrect because VPC route tables do not support explicit DENY routes. Reference: https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html and https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

Option B is correct because Amazon Macie is purpose-built to discover and classify sensitive data in Amazon S3. It uses managed data identifiers that combine techniques such as machine learning and pattern matching to detect financial information such as credit card numbers and personal information such as SSNs and other supported identifiers. Macie can perform automated sensitive data discovery or scheduled sensitive data discovery jobs across S3 buckets and generates sensitive-data findings for objects in which it detects sensitive data. Automated discovery uses sampling techniques to analyze representative objects, so it should not be interpreted as a guarantee that every newly uploaded object is inspected immediately. Option A is incorrect because Amazon Inspector focuses on workload vulnerabilities rather than sensitive data in S3 objects. Option C is incorrect because AWS Audit Manager helps collect evidence and assess compliance but does not itself perform Macie's S3 content classification. Option D is incorrect because GuardDuty detects threats and suspicious activity rather than classifying sensitive data in S3 objects. Option E is incorrect because Security Hub CSPM aggregates and manages security findings but does not perform the underlying S3 sensitive-data discovery. Reference: https://docs.aws.amazon.com/macie/latest/user/managed-data-identifiers.html

Options B and D are correct. Amazon Cognito user pools provide a managed customer identity service for web and mobile applications, including user registration, authentication, account recovery, and federation with social identity providers such as Google and Sign in with Apple (Option B). Amazon GuardDuty continuously analyzes foundational data sources including AWS CloudTrail management events, VPC Flow Logs, and Route 53 Resolver DNS query logs to detect suspicious activity, including compromised credentials and communication with known malicious IP addresses or domains (Option D). Option A is incorrect because IAM Identity Center is primarily intended for workforce identities and access to AWS accounts and applications, rather than acting as a customer-facing CIAM directory for a consumer application. Option C is incorrect because Amazon Macie focuses on discovering sensitive data and identifying security and privacy risks in Amazon S3; it is not a network threat detection service. Option E is incorrect because AWS Shield Advanced provides DDoS protection and does not inspect VPC Flow Logs or provide general-purpose C2 detection. References: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-provider.html and https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_data-sources.html

Option C is correct because AWS WAF provides managed rule groups for IP reputation and anonymous IP sources. The AWSManagedRulesAmazonIpReputationList rule group uses Amazon threat intelligence to identify IP addresses associated with malicious activity, while AWSManagedRulesAnonymousIpList identifies sources such as VPNs, proxies, Tor nodes, and other services that obscure client identity. These managed rule groups are maintained by AWS, eliminating the need to build and maintain custom IP lists. Option A is incorrect because maintaining large, frequently changing threat-intelligence lists in NACLs is operationally complex and NACLs are not designed for this application-layer reputation use case. Option B is incorrect because GuardDuty is primarily a detective service and the proposed workflow is reactive and does not provide native inline Layer 7 blocking at the application perimeter. Option D is incorrect because Shield Standard does not provide an application-layer IP reputation blacklist that can be configured through a VPC route table, and route tables are not inbound IP reputation filters. Reference: https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-ip-rep.html

Option B is correct because AWS Shield Standard is automatically provided to AWS customers at no additional charge. It provides protection against common network and transport layer DDoS attacks, including many Layer 3 and Layer 4 volumetric and protocol attacks. Amazon Route 53 hosted zones and Amazon CloudFront distributions receive particularly comprehensive edge protection from Shield Standard, while AWS infrastructure services such as Application Load Balancers also benefit from Shield's automatic protection. Option A is incorrect because Shield Advanced requires a paid subscription and is unnecessary for the stated baseline, zero-additional-cost requirement. Option C is incorrect because AWS Firewall Manager and AWS WAF add cost and operational configuration and are not required for the baseline Layer 3 and Layer 4 protection described. Option D is incorrect because deploying and operating Suricata infrastructure adds cost, management overhead, and network-routing complexity. Reference: https://docs.aws.amazon.com/waf/latest/developerguide/ddos-standard-summary.html

Options A and C are correct. Amazon DynamoDB supports interface VPC endpoints through AWS PrivateLink. These endpoints use private IP addresses from the VPC and can be accessed by on-premises applications through AWS Direct Connect or AWS Site-to-Site VPN, allowing the application to reach DynamoDB without using public IP addresses or the public internet (Option A). The application must use an appropriate DynamoDB interface-endpoint DNS name or private DNS configuration so that its requests resolve to the endpoint's private IP addresses (Option C). AWS documentation notes that endpoint-specific DynamoDB DNS names can resolve to the private endpoint addresses without requiring changes to the on-premises DNS resolver; therefore, the option is best understood as ensuring the application's DNS resolution uses the private interface endpoint rather than the public DynamoDB endpoint. Option B is incorrect because a DynamoDB gateway endpoint does not permit access from on-premises networks. Option D is incorrect because gateway endpoints are not reachable directly from on-premises through a Direct Connect Private VIF. Option E is incorrect because a Public VIF provides access using AWS public IP addressing, violating the stated requirement. Reference: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/privatelink-interface-endpoints.html

Option A is correct because AWS Systems Manager Parameter Store supports hierarchical parameter names and both String and SecureString parameter types, allowing configuration and sensitive values to be managed through a common service. Parameter Store retains recent parameter versions, allowing previous values to be reviewed or restored. IAM policies can restrict a production role to the appropriate production parameter resources and actions. Care must be taken with GetParametersByPath because authorization is evaluated against the requested path, so granting access to a parent path can expose parameters beneath that path. Option B is incorrect because Secrets Manager is well suited to secrets but does not provide Parameter Store-style hierarchical path retrieval, and using it for large amounts of ordinary configuration adds unnecessary cost. Option C is incorrect because S3 requires application-level configuration-file parsing and adds unnecessary complexity for parameter management. Option D is incorrect because AppConfig is designed for controlled application configuration deployments and feature flags, but custom Lambda validation does not provide a simpler replacement for IAM-based Parameter Store authorization. Reference: https://docs.aws.amazon.com/systems-manager/latest/userguide/what-is-a-parameter.html