Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Reference the caller's security group in the destination security-group rule addresses a separate condition: two application servers must communicate without broad CIDR-based ingress. Group references express allowed source identities for supported VPC networking. The actual requirement is a higher-numbered NACL deny is ineffective because a lower-numbered Allow matches first. Recommended corrective action: Reorder NACL rules so the desired evaluation occurs first. Network ACL entries are evaluated in ascending rule number order.

Rely on stateful security-group connection tracking for return packets would help if the application's inbound traffic works despite no explicit security-group egress response rule. Security groups automatically permit responses to allowed connections. That is not the symptom described here: a higher-numbered NACL deny is ineffective because a lower-numbered Allow matches first. The matching response is Reorder NACL rules so the desired evaluation occurs first, because network ACL entries are evaluated in ascending rule number order.

For the alternative failure an EC2 server sends a request but its return packets are blocked by a custom network ACL, the control Add appropriate ephemeral return-port rules to the stateless network ACL is relevant: nACLs must permit both directions of a flow. Here the evidence instead is a higher-numbered NACL deny is ineffective because a lower-numbered Allow matches first. The selected technical mechanism is Reorder NACL rules so the desired evaluation occurs first: network ACL entries are evaluated in ascending rule number order.

For the alternative failure a TCP-only service cannot be inspected with an HTTP WAF rule, the control Use network-layer controls such as Shield and security groups for the TCP endpoint is relevant: aWS WAF protects supported HTTP(S) request entry points rather than arbitrary TCP packets. Here the evidence instead is hTTP clients exploit malicious SQL payloads in application parameters. The selected technical mechanism is Add AWS WAF SQL injection managed rules to the application web ACL: WAF examines HTTP requests for application-layer attacks.

Evaluate AWS Shield Advanced protections and response support for eligible resources solves a different operational problem where volumetric denial-of-service mitigation must be prioritized for a critical public endpoint. Shield Advanced provides enhanced DDoS mitigation features. It does not directly address hTTP clients exploit malicious SQL payloads in application parameters. The case calls for Add AWS WAF SQL injection managed rules to the application web ACL, since WAF examines HTTP requests for application-layer attacks.

The competing option Configure a WAF rate-based rule or API Gateway throttling at the proper layer would be useful when a public REST API must enforce client request rates by source identity. Edge rate rules and API throttles limit abusive request volume. The present issue is hTTP clients exploit malicious SQL payloads in application parameters; it is more directly addressed by Add AWS WAF SQL injection managed rules to the application web ACL. WAF examines HTTP requests for application-layer attacks.

For the alternative failure a TCP-only service cannot be inspected with an HTTP WAF rule, the control Use network-layer controls such as Shield and security groups for the TCP endpoint is relevant: aWS WAF protects supported HTTP(S) request entry points rather than arbitrary TCP packets. Here the evidence instead is volumetric denial-of-service mitigation must be prioritized for a critical public endpoint. The selected technical mechanism is Evaluate AWS Shield Advanced protections and response support for eligible resources: shield Advanced provides enhanced DDoS mitigation features.

Add AWS WAF SQL injection managed rules to the application web ACL solves a different operational problem where hTTP clients exploit malicious SQL payloads in application parameters. WAF examines HTTP requests for application-layer attacks. It does not directly address volumetric denial-of-service mitigation must be prioritized for a critical public endpoint. The case calls for Evaluate AWS Shield Advanced protections and response support for eligible resources, since shield Advanced provides enhanced DDoS mitigation features.

The competing option Configure a WAF rate-based rule or API Gateway throttling at the proper layer would be useful when a public REST API must enforce client request rates by source identity. Edge rate rules and API throttles limit abusive request volume. The present issue is volumetric denial-of-service mitigation must be prioritized for a critical public endpoint; it is more directly addressed by Evaluate AWS Shield Advanced protections and response support for eligible resources. Shield Advanced provides enhanced DDoS mitigation features.

Add AWS WAF SQL injection managed rules to the application web ACL solves a different operational problem where hTTP clients exploit malicious SQL payloads in application parameters. WAF examines HTTP requests for application-layer attacks. It does not directly address a WAF rule inadvertently blocks legitimate clients from one country. The case calls for Review sampled requests and tune a geographic match or exception, since web ACL geo rules can be tuned without disabling unrelated protections.

The competing option Evaluate AWS Shield Advanced protections and response support for eligible resources would be useful when volumetric denial-of-service mitigation must be prioritized for a critical public endpoint. Shield Advanced provides enhanced DDoS mitigation features. The present issue is a WAF rule inadvertently blocks legitimate clients from one country; it is more directly addressed by Review sampled requests and tune a geographic match or exception. Web ACL geo rules can be tuned without disabling unrelated protections.

Configure a WAF rate-based rule or API Gateway throttling at the proper layer would help if a public REST API must enforce client request rates by source identity. Edge rate rules and API throttles limit abusive request volume. That is not the symptom described here: a WAF rule inadvertently blocks legitimate clients from one country. The matching response is Review sampled requests and tune a geographic match or exception, because web ACL geo rules can be tuned without disabling unrelated protections.

The competing option Evaluate AWS Shield Advanced protections and response support for eligible resources would be useful when volumetric denial-of-service mitigation must be prioritized for a critical public endpoint. Shield Advanced provides enhanced DDoS mitigation features. The present issue is a public REST API must enforce client request rates by source identity; it is more directly addressed by Configure a WAF rate-based rule or API Gateway throttling at the proper layer. Edge rate rules and API throttles limit abusive request volume.

Use network-layer controls such as Shield and security groups for the TCP endpoint would help if a TCP-only service cannot be inspected with an HTTP WAF rule. AWS WAF protects supported HTTP(S) request entry points rather than arbitrary TCP packets. That is not the symptom described here: a public REST API must enforce client request rates by source identity. The matching response is Configure a WAF rate-based rule or API Gateway throttling at the proper layer, because edge rate rules and API throttles limit abusive request volume.

For the alternative failure hTTP clients exploit malicious SQL payloads in application parameters, the control Add AWS WAF SQL injection managed rules to the application web ACL is relevant: WAF examines HTTP requests for application-layer attacks. Here the evidence instead is a public REST API must enforce client request rates by source identity. The selected technical mechanism is Configure a WAF rate-based rule or API Gateway throttling at the proper layer: edge rate rules and API throttles limit abusive request volume.

The option Review sampled requests and tune a geographic match or exception addresses a separate condition: a WAF rule inadvertently blocks legitimate clients from one country. Web ACL geo rules can be tuned without disabling unrelated protections. The actual requirement is a TCP-only service cannot be inspected with an HTTP WAF rule. Recommended corrective action: Use network-layer controls such as Shield and security groups for the TCP endpoint. AWS WAF protects supported HTTP(S) request entry points rather than arbitrary TCP packets.

Add AWS WAF SQL injection managed rules to the application web ACL would help if hTTP clients exploit malicious SQL payloads in application parameters. WAF examines HTTP requests for application-layer attacks. That is not the symptom described here: a TCP-only service cannot be inspected with an HTTP WAF rule. The matching response is Use network-layer controls such as Shield and security groups for the TCP endpoint, because aWS WAF protects supported HTTP(S) request entry points rather than arbitrary TCP packets.

Configure a WAF rate-based rule or API Gateway throttling at the proper layer solves a different operational problem where a public REST API must enforce client request rates by source identity. Edge rate rules and API throttles limit abusive request volume. It does not directly address a TCP-only service cannot be inspected with an HTTP WAF rule. The case calls for Use network-layer controls such as Shield and security groups for the TCP endpoint, since aWS WAF protects supported HTTP(S) request entry points rather than arbitrary TCP packets.

Grant the application principal permitted kms:Decrypt access to the encryption key would help if a secret is encrypted with a customer KMS key inaccessible to the application. KMS key authorization is separate from secret ARN access. That is not the symptom described here: application code stores an RDS database password in a Git repository. The matching response is Move the password into AWS Secrets Manager and rotate the compromised credential, because secrets Manager decouples sensitive values from source code.

For the alternative failure an application needs scheduled automatic secret rotation with RDS integration, the control Configure a supported Secrets Manager rotation workflow for the database secret is relevant: secret rotation manages credential lifecycle without application code edits. Here the evidence instead is application code stores an RDS database password in a Git repository. The selected technical mechanism is Move the password into AWS Secrets Manager and rotate the compromised credential: secrets Manager decouples sensitive values from source code.

The competing option Store configuration using Systems Manager Parameter Store with appropriate parameter type would be useful when a deployment requires nonsecret environment settings without the cost of secret rotation. Parameter Store suits configuration values and controlled retrieval. The present issue is application code stores an RDS database password in a Git repository; it is more directly addressed by Move the password into AWS Secrets Manager and rotate the compromised credential. Secrets Manager decouples sensitive values from source code.

For the alternative failure application code stores an RDS database password in a Git repository, the control Move the password into AWS Secrets Manager and rotate the compromised credential is relevant: secrets Manager decouples sensitive values from source code. Here the evidence instead is an application needs scheduled automatic secret rotation with RDS integration. The selected technical mechanism is Configure a supported Secrets Manager rotation workflow for the database secret: secret rotation manages credential lifecycle without application code edits.

Grant the application principal permitted kms:Decrypt access to the encryption key solves a different operational problem where a secret is encrypted with a customer KMS key inaccessible to the application. KMS key authorization is separate from secret ARN access. It does not directly address an application needs scheduled automatic secret rotation with RDS integration. The case calls for Configure a supported Secrets Manager rotation workflow for the database secret, since secret rotation manages credential lifecycle without application code edits.

The competing option Allow the precise secretsmanager:GetSecretValue action on the secret ARN to its execution role would be useful when a Lambda function needs to fetch the secret but receives AccessDenied. Lambda's execution identity authorizes secret retrieval. The present issue is an application needs scheduled automatic secret rotation with RDS integration; it is more directly addressed by Configure a supported Secrets Manager rotation workflow for the database secret. Secret rotation manages credential lifecycle without application code edits.

Configure a supported Secrets Manager rotation workflow for the database secret solves a different operational problem where an application needs scheduled automatic secret rotation with RDS integration. Secret rotation manages credential lifecycle without application code edits. It does not directly address a Lambda function needs to fetch the secret but receives AccessDenied. The case calls for Allow the precise secretsmanager:GetSecretValue action on the secret ARN to its execution role, since lambda's execution identity authorizes secret retrieval.

The competing option Grant the application principal permitted kms:Decrypt access to the encryption key would be useful when a secret is encrypted with a customer KMS key inaccessible to the application. KMS key authorization is separate from secret ARN access. The present issue is a Lambda function needs to fetch the secret but receives AccessDenied; it is more directly addressed by Allow the precise secretsmanager:GetSecretValue action on the secret ARN to its execution role. Lambda's execution identity authorizes secret retrieval.

The option Move the password into AWS Secrets Manager and rotate the compromised credential addresses a separate condition: application code stores an RDS database password in a Git repository. Secrets Manager decouples sensitive values from source code. The actual requirement is a Lambda function needs to fetch the secret but receives AccessDenied. Recommended corrective action: Allow the precise secretsmanager:GetSecretValue action on the secret ARN to its execution role. Lambda's execution identity authorizes secret retrieval.

The competing option Allow the precise secretsmanager:GetSecretValue action on the secret ARN to its execution role would be useful when a Lambda function needs to fetch the secret but receives AccessDenied. Lambda's execution identity authorizes secret retrieval. The present issue is a secret is encrypted with a customer KMS key inaccessible to the application; it is more directly addressed by Grant the application principal permitted kms:Decrypt access to the encryption key. KMS key authorization is separate from secret ARN access.

Move the password into AWS Secrets Manager and rotate the compromised credential would help if application code stores an RDS database password in a Git repository. Secrets Manager decouples sensitive values from source code. That is not the symptom described here: a secret is encrypted with a customer KMS key inaccessible to the application. The matching response is Grant the application principal permitted kms:Decrypt access to the encryption key, because kMS key authorization is separate from secret ARN access.

For the alternative failure an application needs scheduled automatic secret rotation with RDS integration, the control Configure a supported Secrets Manager rotation workflow for the database secret is relevant: secret rotation manages credential lifecycle without application code edits. Here the evidence instead is a secret is encrypted with a customer KMS key inaccessible to the application. The selected technical mechanism is Grant the application principal permitted kms:Decrypt access to the encryption key: kMS key authorization is separate from secret ARN access.

The option Configure a supported Secrets Manager rotation workflow for the database secret addresses a separate condition: an application needs scheduled automatic secret rotation with RDS integration. Secret rotation manages credential lifecycle without application code edits. The actual requirement is a deployment requires nonsecret environment settings without the cost of secret rotation. Recommended corrective action: Store configuration using Systems Manager Parameter Store with appropriate parameter type. Parameter Store suits configuration values and controlled retrieval.

Allow the precise secretsmanager:GetSecretValue action on the secret ARN to its execution role would help if a Lambda function needs to fetch the secret but receives AccessDenied. Lambda's execution identity authorizes secret retrieval. That is not the symptom described here: a deployment requires nonsecret environment settings without the cost of secret rotation. The matching response is Store configuration using Systems Manager Parameter Store with appropriate parameter type, because parameter Store suits configuration values and controlled retrieval.

For the alternative failure application code stores an RDS database password in a Git repository, the control Move the password into AWS Secrets Manager and rotate the compromised credential is relevant: secrets Manager decouples sensitive values from source code. Here the evidence instead is a deployment requires nonsecret environment settings without the cost of secret rotation. The selected technical mechanism is Store configuration using Systems Manager Parameter Store with appropriate parameter type: parameter Store suits configuration values and controlled retrieval.