Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Configure an IAM OIDC provider and restricted web-identity role trust addresses a separate condition: a provider needs an OIDC JWT trusted by AWS STS for a CI build. OIDC audience and subject conditions bound federation trust. The actual requirement is a departing employee still has working application tokens after IdP disablement. Recommended corrective action: Apply session-revocation and token-lifetime controls for the affected application. Identity disablement and existing token expiry have different timing.

Assign IAM Identity Center permission sets to the relevant account/group pairs would help if a new employee should gain access to three accounts based on team membership. Assignment provisioning distributes role access according to approved groups. That is not the symptom described here: a departing employee still has working application tokens after IdP disablement. The matching response is Apply session-revocation and token-lifetime controls for the affected application, because identity disablement and existing token expiry have different timing.

For the alternative failure an IdP-issued federation assertion is rejected because the AWS SAML provider ARN is wrong, the control Correct the trust policy's SAML federation principal and conditions is relevant: sAML role trust requires the configured identity provider and assertion audience. Here the evidence instead is a departing employee still has working application tokens after IdP disablement. The selected technical mechanism is Apply session-revocation and token-lifetime controls for the affected application: identity disablement and existing token expiry have different timing.

Route its outbound internet traffic through an appropriate NAT gateway would help if a private EC2 instance must download operating system packages without public inbound access. NAT gateways allow private subnet initiated IPv4 internet traffic. That is not the symptom described here: the application instances accept direct internet traffic on their public addresses. The matching response is Move the application instances to private subnets without public IPs, because private subnet placement removes direct inbound internet routing.

For the alternative failure workloads must retrieve S3 objects without crossing a NAT gateway or internet path, the control Add an S3 gateway VPC endpoint and route associations for the private subnets is relevant: gateway endpoints provide private S3 routes without NAT traversal. Here the evidence instead is the application instances accept direct internet traffic on their public addresses. The selected technical mechanism is Move the application instances to private subnets without public IPs: private subnet placement removes direct inbound internet routing.

The competing option Restrict application security-group ingress to the load balancer security group would be useful when only the Application Load Balancer may send HTTP requests to the application tier. Security-group references permit only traffic from the named source group. The present issue is the application instances accept direct internet traffic on their public addresses; it is more directly addressed by Move the application instances to private subnets without public IPs. Private subnet placement removes direct inbound internet routing.

Move the application instances to private subnets without public IPs solves a different operational problem where the application instances accept direct internet traffic on their public addresses. Private subnet placement removes direct inbound internet routing. It does not directly address only the Application Load Balancer may send HTTP requests to the application tier. The case calls for Restrict application security-group ingress to the load balancer security group, since security-group references permit only traffic from the named source group.

The competing option Add an S3 gateway VPC endpoint and route associations for the private subnets would be useful when workloads must retrieve S3 objects without crossing a NAT gateway or internet path. Gateway endpoints provide private S3 routes without NAT traversal. The present issue is only the Application Load Balancer may send HTTP requests to the application tier; it is more directly addressed by Restrict application security-group ingress to the load balancer security group. Security-group references permit only traffic from the named source group.

The option Route its outbound internet traffic through an appropriate NAT gateway addresses a separate condition: a private EC2 instance must download operating system packages without public inbound access. NAT gateways allow private subnet initiated IPv4 internet traffic. The actual requirement is only the Application Load Balancer may send HTTP requests to the application tier. Recommended corrective action: Restrict application security-group ingress to the load balancer security group. Security-group references permit only traffic from the named source group.

The competing option Move the application instances to private subnets without public IPs would be useful when the application instances accept direct internet traffic on their public addresses. Private subnet placement removes direct inbound internet routing. The present issue is a private EC2 instance must download operating system packages without public inbound access; it is more directly addressed by Route its outbound internet traffic through an appropriate NAT gateway. NAT gateways allow private subnet initiated IPv4 internet traffic.

The option Restrict application security-group ingress to the load balancer security group addresses a separate condition: only the Application Load Balancer may send HTTP requests to the application tier. Security-group references permit only traffic from the named source group. The actual requirement is a private EC2 instance must download operating system packages without public inbound access. Recommended corrective action: Route its outbound internet traffic through an appropriate NAT gateway. NAT gateways allow private subnet initiated IPv4 internet traffic.

Add an S3 gateway VPC endpoint and route associations for the private subnets would help if workloads must retrieve S3 objects without crossing a NAT gateway or internet path. Gateway endpoints provide private S3 routes without NAT traversal. That is not the symptom described here: a private EC2 instance must download operating system packages without public inbound access. The matching response is Route its outbound internet traffic through an appropriate NAT gateway, because nAT gateways allow private subnet initiated IPv4 internet traffic.

The competing option Restrict application security-group ingress to the load balancer security group would be useful when only the Application Load Balancer may send HTTP requests to the application tier. Security-group references permit only traffic from the named source group. The present issue is workloads must retrieve S3 objects without crossing a NAT gateway or internet path; it is more directly addressed by Add an S3 gateway VPC endpoint and route associations for the private subnets. Gateway endpoints provide private S3 routes without NAT traversal.

Attach appropriate public addressing and security controls only to intended public-tier instances would help if a subnet's route table points 0.0.0.0/0 to an internet gateway but instances remain unreachable without public addresses. An internet gateway alone does not assign an internet-routable address. That is not the symptom described here: workloads must retrieve S3 objects without crossing a NAT gateway or internet path. The matching response is Add an S3 gateway VPC endpoint and route associations for the private subnets, because gateway endpoints provide private S3 routes without NAT traversal.

For the alternative failure the application instances accept direct internet traffic on their public addresses, the control Move the application instances to private subnets without public IPs is relevant: private subnet placement removes direct inbound internet routing. Here the evidence instead is workloads must retrieve S3 objects without crossing a NAT gateway or internet path. The selected technical mechanism is Add an S3 gateway VPC endpoint and route associations for the private subnets: gateway endpoints provide private S3 routes without NAT traversal.

The option Route its outbound internet traffic through an appropriate NAT gateway addresses a separate condition: a private EC2 instance must download operating system packages without public inbound access. NAT gateways allow private subnet initiated IPv4 internet traffic. The actual requirement is a subnet's route table points 0.0.0.0/0 to an internet gateway but instances remain unreachable without public addresses. Recommended corrective action: Attach appropriate public addressing and security controls only to intended public-tier instances. An internet gateway alone does not assign an internet-routable address.

Restrict application security-group ingress to the load balancer security group would help if only the Application Load Balancer may send HTTP requests to the application tier. Security-group references permit only traffic from the named source group. That is not the symptom described here: a subnet's route table points 0.0.0.0/0 to an internet gateway but instances remain unreachable without public addresses. The matching response is Attach appropriate public addressing and security controls only to intended public-tier instances, because an internet gateway alone does not assign an internet-routable address.

Add an S3 gateway VPC endpoint and route associations for the private subnets solves a different operational problem where workloads must retrieve S3 objects without crossing a NAT gateway or internet path. Gateway endpoints provide private S3 routes without NAT traversal. It does not directly address a subnet's route table points 0.0.0.0/0 to an internet gateway but instances remain unreachable without public addresses. The case calls for Attach appropriate public addressing and security controls only to intended public-tier instances, since an internet gateway alone does not assign an internet-routable address.

Reference the caller's security group in the destination security-group rule would help if two application servers must communicate without broad CIDR-based ingress. Group references express allowed source identities for supported VPC networking. That is not the symptom described here: an EC2 server sends a request but its return packets are blocked by a custom network ACL. The matching response is Add appropriate ephemeral return-port rules to the stateless network ACL, because nACLs must permit both directions of a flow.

Rely on stateful security-group connection tracking for return packets solves a different operational problem where the application's inbound traffic works despite no explicit security-group egress response rule. Security groups automatically permit responses to allowed connections. It does not directly address an EC2 server sends a request but its return packets are blocked by a custom network ACL. The case calls for Add appropriate ephemeral return-port rules to the stateless network ACL, since nACLs must permit both directions of a flow.

The competing option Reorder NACL rules so the desired evaluation occurs first would be useful when a higher-numbered NACL deny is ineffective because a lower-numbered Allow matches first. Network ACL entries are evaluated in ascending rule number order. The present issue is an EC2 server sends a request but its return packets are blocked by a custom network ACL; it is more directly addressed by Add appropriate ephemeral return-port rules to the stateless network ACL. NACLs must permit both directions of a flow.

For the alternative failure a shared subnet must block a disallowed source CIDR before any instance sees it, the control Configure a subnet network ACL deny rule for that CIDR is relevant: nACLs support ordered stateless deny rules. Here the evidence instead is the application's inbound traffic works despite no explicit security-group egress response rule. The selected technical mechanism is Rely on stateful security-group connection tracking for return packets: security groups automatically permit responses to allowed connections.

The competing option Add appropriate ephemeral return-port rules to the stateless network ACL would be useful when an EC2 server sends a request but its return packets are blocked by a custom network ACL. NACLs must permit both directions of a flow. The present issue is the application's inbound traffic works despite no explicit security-group egress response rule; it is more directly addressed by Rely on stateful security-group connection tracking for return packets. Security groups automatically permit responses to allowed connections.

The option Reorder NACL rules so the desired evaluation occurs first addresses a separate condition: a higher-numbered NACL deny is ineffective because a lower-numbered Allow matches first. Network ACL entries are evaluated in ascending rule number order. The actual requirement is the application's inbound traffic works despite no explicit security-group egress response rule. Recommended corrective action: Rely on stateful security-group connection tracking for return packets. Security groups automatically permit responses to allowed connections.

Reference the caller's security group in the destination security-group rule solves a different operational problem where two application servers must communicate without broad CIDR-based ingress. Group references express allowed source identities for supported VPC networking. It does not directly address a shared subnet must block a disallowed source CIDR before any instance sees it. The case calls for Configure a subnet network ACL deny rule for that CIDR, since nACLs support ordered stateless deny rules.

The option Rely on stateful security-group connection tracking for return packets addresses a separate condition: the application's inbound traffic works despite no explicit security-group egress response rule. Security groups automatically permit responses to allowed connections. The actual requirement is a shared subnet must block a disallowed source CIDR before any instance sees it. Recommended corrective action: Configure a subnet network ACL deny rule for that CIDR. NACLs support ordered stateless deny rules.

Reorder NACL rules so the desired evaluation occurs first would help if a higher-numbered NACL deny is ineffective because a lower-numbered Allow matches first. Network ACL entries are evaluated in ascending rule number order. That is not the symptom described here: a shared subnet must block a disallowed source CIDR before any instance sees it. The matching response is Configure a subnet network ACL deny rule for that CIDR, because nACLs support ordered stateless deny rules.

The competing option Add appropriate ephemeral return-port rules to the stateless network ACL would be useful when an EC2 server sends a request but its return packets are blocked by a custom network ACL. NACLs must permit both directions of a flow. The present issue is two application servers must communicate without broad CIDR-based ingress; it is more directly addressed by Reference the caller's security group in the destination security-group rule. Group references express allowed source identities for supported VPC networking.

The option Rely on stateful security-group connection tracking for return packets addresses a separate condition: the application's inbound traffic works despite no explicit security-group egress response rule. Security groups automatically permit responses to allowed connections. The actual requirement is two application servers must communicate without broad CIDR-based ingress. Recommended corrective action: Reference the caller's security group in the destination security-group rule. Group references express allowed source identities for supported VPC networking.

Configure a subnet network ACL deny rule for that CIDR would help if a shared subnet must block a disallowed source CIDR before any instance sees it. NACLs support ordered stateless deny rules. That is not the symptom described here: two application servers must communicate without broad CIDR-based ingress. The matching response is Reference the caller's security group in the destination security-group rule, because group references express allowed source identities for supported VPC networking.

The option Reference the caller's security group in the destination security-group rule addresses a separate condition: two application servers must communicate without broad CIDR-based ingress. Group references express allowed source identities for supported VPC networking. The actual requirement is a higher-numbered NACL deny is ineffective because a lower-numbered Allow matches first. Recommended corrective action: Reorder NACL rules so the desired evaluation occurs first. Network ACL entries are evaluated in ascending rule number order.

Rely on stateful security-group connection tracking for return packets would help if the application's inbound traffic works despite no explicit security-group egress response rule. Security groups automatically permit responses to allowed connections. That is not the symptom described here: a higher-numbered NACL deny is ineffective because a lower-numbered Allow matches first. The matching response is Reorder NACL rules so the desired evaluation occurs first, because network ACL entries are evaluated in ascending rule number order.

For the alternative failure an EC2 server sends a request but its return packets are blocked by a custom network ACL, the control Add appropriate ephemeral return-port rules to the stateless network ACL is relevant: nACLs must permit both directions of a flow. Here the evidence instead is a higher-numbered NACL deny is ineffective because a lower-numbered Allow matches first. The selected technical mechanism is Reorder NACL rules so the desired evaluation occurs first: network ACL entries are evaluated in ascending rule number order.