Timed Mode Set 1 – AWS Certified Security Specialty Question 16, Ans not correct

[varunkumar]

An organization is implementing a security policy in which their cloud-based users must be contained in a separate authentication domain and prevented from accessing on-premises systems. Their IT Operations team is launching and maintaining a number of Amazon RDS for SQL Server databases and EC2 instances. The organization also has an on-premises Active Directory service that contains the administrator accounts that must have access to the databases and EC2 instances.

How would the Security Engineer manage the AWS resources of the organization in the MOST secure manner? (Select TWO.)

Here are correct option is given as
“Set up a one-way incoming trust relationship from the existing Active Directory in the on-premises data center to the new Active Directory service in AWS.”
which i think wrong as it violate the principal which says “The Direction of the trust is opposite to the direction of access”
so going by the above logic correct answer is “Set up a one-way incoming trust relationship from the new Active Directory in AWS to the existing Active Directory service in the on-premises data center.”

please check and clarify this.

[TutorialsDojo-Support]

Hi Varunkumar,

Thank you for you feedback.

Can you provide the AWS document reference where the “The Direction of the trust is opposite to the direction of access” is discussed?

We will review it and update the answer accordingly base on the document.

Thanks and Regards,

Kenneth Samonte @ Tutorials Dojo

• This reply was modified 4 years, 8 months ago by  TutorialsDojo-Support.

[varunkumar]

https://www.microsoftpressstore.com/articles/article.aspx?p=2217267&seqNum=3

please check this.

[Jon-Bonso]

Hi Varun,

The scenario says that you have to implement a security policy in which the cloud-based users are prevented from accessing the on-premises systems. The on-premises data center contains the administrator accounts that must have access to the AWS resources (RDS and EC2 instances). Therefore, we need a one-way trust relationship that allows requests from on-premises users to access the VPC resources.

It also depends on your “Direction of Trust” setting which could be One-way:incoming or One-way:outgoing type.

Just as mentioned in the explanation, there are three trust relationship directions:

1. One-way:incoming – Users in the specified realm will not be able to access any resources in this domain.

2. One-way:outgoing – Users in this domain will not be able to access any resources in the specified realm.

3. Two-way (Bi-directional) – Users in this domain and users in the specified realm will be able to access resources in either domain or realm.

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754706(v=ws.11)

I understand what you are saying since the correct option doesn’t mention the “Trust Direction” for the Active Directory integration. This is best represented by this diagram:

https://dmhnzl5mp9mj6.cloudfront.net/security_awsblog/images/RonCully_trustdiagram.png

For example, let’s say you have two domains: VPC-Domain and On-Prem-Domain. A one-way trust from VPC-Domain to On-Prem-Domain means that users authenticated in On-Prem-Domain are trusted in VPC-Domain (the trust direction indicated by the purple arrow in the above diagram). A one-way trust from On-Prem-Domain to VPC-Domain (the trust direction indicated by the green arrow in the above diagram) means users authenticated in VPC-Domain are trusted in On-Prem-Domain.

Reference:

https://aws.amazon.com/blogs/security/how-to-enable-windows-integrated-authentication-for-rds-for-sql-server-using-on-premises-active-directory/

I believe that you are referring to the relationship described above. So when you read the correct option: “Set up a one-way trust relationship from the existing Active Directory in the on-premises data center to the new Active Directory service in AWS.” – the “trust” seems reversed. The provided answer didn’t mention if it is an incoming or outgoing One-way trust.

Since this is more of an advanced Microsoft Active Directory setup, I chose to simplify the terms in the options to focus more on the AWS-side of things. The correct option simply means that we need a one-way trust relationship that allows requests from on-premises users to access the VPC resources, but not vice-versa.

Let us know if you need further assistance. The Tutorials Dojo team is dedicated to help you pass your AWS exam on your first try!

Regards,

Jon Bonso @ Tutorials Dojo

[jacky-shu]

I also think the proposed answer is wrong.

The direction of one-way trust from trust/resource domain to trusted/user domain, so it is the opposite to the direction resource is managed.

[Caloy]

Hello jacky-shu,

There are two ADs in this scenario — on-premises and AWS. The on-premises AD needs to manage resources in AWS. For this to happen, you have to configure a one-way incoming trust in the on-premises AD. This allows authentication requests that are sent by users in the on-premises domain to be routed successfully to resources in the other domain (AWS.)

The direction of trust is the opposite of the direction of access.

• This reply was modified 4 years, 1 month ago by  Caloy.

[robin-cher]

This is the answer i picked and it was incorrect.

Set up a one-way incoming trust relationship from the new Active Directory in AWS to the existing Active Directory service in the on-premises data center.

Maybe it will be clear if its is mentioned as one-way outgoing, instead of one-way incoming from AWS AD to on-Prem AD

Could the options for answer be clearer ? Not sure if its AWS intention to play with words and have us making assumption to questions.

• This reply was modified 4 years ago by  robin-cher.

[Carlo-TutorialsDojo]

Hello robin,

I fail to see how it’d be clearer had the correct option is just “one-way outgoing”.

Outgoing and incoming are relative directions.

“outgoing to where?, incoming from where?”

They depend on a point of reference. Hence, the need to say where the trust is coming from.

In this scenario, we want the on-premises AD to control resources in AWS and must be authenticated by another AD on AWS. The direction of access is On-prem AD -> AWS AD, therefore the direction of trust is the opposite.

I think the improvement that can be done here is to simply state the point of reference.

e.g, Set up a one-way incoming trust in the existing on-premises Active Directory a one-way outgoing trust in the AWS Active Directory.

Let me know your thoughts.

Regards,

Carlo

• This reply was modified 4 years ago by  Carlo-TutorialsDojo.
• This reply was modified 4 years ago by  Carlo-TutorialsDojo.

[timkeating1970]

I think this is the most confusing topic I’ve ever come across. Page 130 of the Security Specialty study guide indicates “When you configure a one-way outgoing trust from the on-premises Active Directory to the AWS Active Directory, you are allowing users from your on-premises environment to authenticate and access resources protected by the AWS Active Directory”. But the answer on the practice test indicates, ” Set up a one-way incoming trust in the existing on-premises
Active Directory and a one-way outgoing trust in the new Active
Directory in AWS”.

Aren’t these saying opposite things? I’m kind of mentally blocked here…