SAP-C02 - Design for New Solutions (29% of the exam) - Section 2.3

Determine security controls for a new solution that enforce least privilege with IAM roles, scoped resource policies, security groups, network ACLs and VPC endpoints.

Apply least-privilege access to a new solution by scoping IAM roles, resource-based policies, security groups, and network ACLs to the minimum required permissions. Use VPC endpoints to keep traffic off the public internet and avoid broad principal wildcards in resource policies.

Least privilegeSecurity groupsVPC endpointsResource policies

Practice question for this objective

Free sampleDesign for New Solutionshard

A fintech firm is designing a new payments service whose EC2 instances run in private subnets and must call AWS Secrets Manager privately, with no route to the public internet. The security team requires that calls to Secrets Manager stay on the AWS network, that only this one application's instances can use the path to the service, and that the path can retrieve only secrets carrying a specific tag rather than every secret in the account. They want to enforce both a network-layer restriction on who may use the endpoint and a service-layer restriction on what may be retrieved through it. Which TWO controls together meet these requirements? (Select TWO.)

AAttach a security group to the interface VPC endpoint for Secrets Manager that allows inbound HTTPS only from the application instances' security group, so just those instances can send requests through the endpoint over private connectivity. Correct
BAttach a VPC endpoint policy to the Secrets Manager interface endpoint that allows GetSecretValue only on secrets matching the required resource tag, so requests through the endpoint can reach only those tagged secrets. Correct
CReplace the interface endpoint with a gateway VPC endpoint for Secrets Manager and attach an endpoint policy that allows retrieval only of the tagged secrets, keeping the traffic on the AWS network without any elastic network interface to secure.
DAdd a network ACL on the private subnets that permits outbound HTTPS only to the Secrets Manager service prefix list and denies all other egress, relying on the stateless subnet rules to identify which application instances may use the endpoint.
EAttach a resource-based policy to each individual secret that allows access from the application's IAM role, expecting these secret policies alone to keep traffic on the AWS network and to restrict which instances reach the endpoint.

Combine an interface endpoint security group for network-layer access with a VPC endpoint policy for service-layer scoping to enforce private, least-privilege access to an AWS service. An interface VPC endpoint is backed by an elastic network interface, so its security group governs which instances may send requests over the private path, giving the network-layer control. A VPC endpoint policy then governs what may be called through that endpoint, so a tag-conditioned allow limits retrieval to the intended secrets, giving the service-layer control. Together they enforce both who uses the path and what it can fetch. Gateway endpoints do not support Secrets Manager, network ACLs match only CIDRs statelessly, and secret resource policies do not provide a private network path.

Why A is correct: An interface endpoint is an elastic network interface that carries its own security group, so allowing inbound HTTPS only from the application's security group restricts at the network layer which instances may use the private path to Secrets Manager.

Why B is correct: A VPC endpoint policy scopes what may be called through that specific endpoint, so a tag-conditioned allow on GetSecretValue limits retrieval through the path to only the tagged secrets, enforcing the service-layer least-privilege restriction.

Why C is wrong: Gateway endpoints exist only for Amazon S3 and DynamoDB, so Secrets Manager cannot be reached through a gateway endpoint, making this option technically impossible despite sounding like the low-cost private path.

Why D is wrong: A network ACL is stateless and matches only CIDR ranges, so it cannot identify a particular application's instances by identity and cannot scope which secrets are retrievable, failing both the per-instance and per-secret requirements.

Why E is wrong: Secret resource policies can scope which principals read a secret, but they neither keep traffic on a private network path nor restrict which instances may use the endpoint, so they do not satisfy the network-layer requirement.

See more SAP-C02 practice questions, answers explained.

Exam traps in Design for New Solutions

Answers that look right on this material and are not. Each one is a distractor from a different question in the SAP-C02 bank for this domain.

Add the malicious IP ranges as deny rules inside the web tier's security group so that the blocked ranges are rejected at the instance level, since security groups evaluate before network ACLs at the subnet edge.
Why it is wrong: Security groups support only allow rules and cannot express an explicit deny, and they apply at the instance rather than the subnet boundary, so they cannot deliver the coarse subnet-wide block the requirement describes.
Deploy interface VPC endpoints powered by AWS PrivateLink for DynamoDB and S3 in each private subnet, attach security groups and endpoint policies to them, and point the application at the endpoint-specific DNS names so all calls to the two services stay on private network paths.
Why it is wrong: Interface endpoints keep traffic private and support policies, but DynamoDB and in-Region S3 are reached through gateway endpoints at no hourly charge, so using interface endpoints here adds per-endpoint cost and DNS handling without any benefit for this in-Region case.
Attach an identity-based deny policy to each account's administrator role that blocks out-of-Region actions and external resource sharing, relying on those administrator policies to enforce the guardrails for the whole account.
Why it is wrong: An identity policy on the administrator role binds only that role and another administrator can detach or replace it, so it cannot guarantee the guardrails apply to every principal in the account the way an organisation policy does.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.