Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

Terminate supported TLS at an ALB using AWS Certificate Manager would help if users need HTTPS certificates without exporting private keys onto web instances. ACM-managed certificates enable managed TLS termination. That is not the symptom described here: a private internal application is accidentally exposed through an internet-facing ALB. The matching response is Deploy an internal-facing load balancer and restrict its security groups, because internal ALBs use private addressing instead of public ingress.

For the alternative failure a web application must redirect all HTTP requests to HTTPS, the control Configure an ALB port-80 listener redirect to HTTPS is relevant: listener actions can enforce HTTPS canonical entry. Here the evidence instead is a private internal application is accidentally exposed through an internet-facing ALB. The selected technical mechanism is Deploy an internal-facing load balancer and restrict its security groups: internal ALBs use private addressing instead of public ingress.

Configure a dedicated health path returning allowed success codes solves a different operational problem where a health endpoint returns 403 for unauthenticated probes and marks every target unhealthy. Target health checks need a reachable healthy response. It does not directly address a private internal application is accidentally exposed through an internet-facing ALB. The case calls for Deploy an internal-facing load balancer and restrict its security groups, since internal ALBs use private addressing instead of public ingress.

Restrict DynamoDB access using table ARNs and supported LeadingKeys conditions would help if an application role needs only write access to its own DynamoDB partition. DynamoDB IAM conditions can constrain partition-key access. That is not the symptom described here: a browser user should authenticate to a public app without receiving administrator AWS keys. The matching response is Use Cognito user pool tokens at the application boundary, because user pools handle end-user authentication.

For the alternative failure a container receives AWS-wide permissions via the EC2 host instance profile, the control Provide an ECS task role scoped to the container's operations is relevant: task roles separate workload privileges from host credentials. Here the evidence instead is a browser user should authenticate to a public app without receiving administrator AWS keys. The selected technical mechanism is Use Cognito user pool tokens at the application boundary: user pools handle end-user authentication.

Configure token verification or a supported API JWT authorizer with correct claims solves a different operational problem where a backend must validate JWT issuer/audience and reject expired access tokens. Claim verification prevents accepting unrelated or expired bearer tokens. It does not directly address a browser user should authenticate to a public app without receiving administrator AWS keys. The case calls for Use Cognito user pool tokens at the application boundary, since user pools handle end-user authentication.

Enforce tenant-to-record authorization in business logic and data queries solves a different operational problem where an application must not authorize tenant records based solely on a valid JWT. Authentication does not imply rights to every tenant's records. It does not directly address a backend must validate JWT issuer/audience and reject expired access tokens. The case calls for Configure token verification or a supported API JWT authorizer with correct claims, since claim verification prevents accepting unrelated or expired bearer tokens.

The competing option Provide an ECS task role scoped to the container's operations would be useful when a container receives AWS-wide permissions via the EC2 host instance profile. Task roles separate workload privileges from host credentials. The present issue is a backend must validate JWT issuer/audience and reject expired access tokens; it is more directly addressed by Configure token verification or a supported API JWT authorizer with correct claims. Claim verification prevents accepting unrelated or expired bearer tokens.

The option Restrict DynamoDB access using table ARNs and supported LeadingKeys conditions addresses a separate condition: an application role needs only write access to its own DynamoDB partition. DynamoDB IAM conditions can constrain partition-key access. The actual requirement is a backend must validate JWT issuer/audience and reject expired access tokens. Recommended corrective action: Configure token verification or a supported API JWT authorizer with correct claims. Claim verification prevents accepting unrelated or expired bearer tokens.

Use Cognito user pool tokens at the application boundary solves a different operational problem where a browser user should authenticate to a public app without receiving administrator AWS keys. User pools handle end-user authentication. It does not directly address an application role needs only write access to its own DynamoDB partition. The case calls for Restrict DynamoDB access using table ARNs and supported LeadingKeys conditions, since dynamoDB IAM conditions can constrain partition-key access.

The competing option Enforce tenant-to-record authorization in business logic and data queries would be useful when an application must not authorize tenant records based solely on a valid JWT. Authentication does not imply rights to every tenant's records. The present issue is an application role needs only write access to its own DynamoDB partition; it is more directly addressed by Restrict DynamoDB access using table ARNs and supported LeadingKeys conditions. DynamoDB IAM conditions can constrain partition-key access.

Provide an ECS task role scoped to the container's operations would help if a container receives AWS-wide permissions via the EC2 host instance profile. Task roles separate workload privileges from host credentials. That is not the symptom described here: an application role needs only write access to its own DynamoDB partition. The matching response is Restrict DynamoDB access using table ARNs and supported LeadingKeys conditions, because dynamoDB IAM conditions can constrain partition-key access.

The competing option Configure token verification or a supported API JWT authorizer with correct claims would be useful when a backend must validate JWT issuer/audience and reject expired access tokens. Claim verification prevents accepting unrelated or expired bearer tokens. The present issue is a container receives AWS-wide permissions via the EC2 host instance profile; it is more directly addressed by Provide an ECS task role scoped to the container's operations. Task roles separate workload privileges from host credentials.

The option Enforce tenant-to-record authorization in business logic and data queries addresses a separate condition: an application must not authorize tenant records based solely on a valid JWT. Authentication does not imply rights to every tenant's records. The actual requirement is a container receives AWS-wide permissions via the EC2 host instance profile. Recommended corrective action: Provide an ECS task role scoped to the container's operations. Task roles separate workload privileges from host credentials.

Use Cognito user pool tokens at the application boundary would help if a browser user should authenticate to a public app without receiving administrator AWS keys. User pools handle end-user authentication. That is not the symptom described here: a container receives AWS-wide permissions via the EC2 host instance profile. The matching response is Provide an ECS task role scoped to the container's operations, because task roles separate workload privileges from host credentials.

The option Use Cognito user pool tokens at the application boundary addresses a separate condition: a browser user should authenticate to a public app without receiving administrator AWS keys. User pools handle end-user authentication. The actual requirement is an application must not authorize tenant records based solely on a valid JWT. Recommended corrective action: Enforce tenant-to-record authorization in business logic and data queries. Authentication does not imply rights to every tenant's records.

For the alternative failure a container receives AWS-wide permissions via the EC2 host instance profile, the control Provide an ECS task role scoped to the container's operations is relevant: task roles separate workload privileges from host credentials. Here the evidence instead is an application must not authorize tenant records based solely on a valid JWT. The selected technical mechanism is Enforce tenant-to-record authorization in business logic and data queries: authentication does not imply rights to every tenant's records.

Configure token verification or a supported API JWT authorizer with correct claims solves a different operational problem where a backend must validate JWT issuer/audience and reject expired access tokens. Claim verification prevents accepting unrelated or expired bearer tokens. It does not directly address an application must not authorize tenant records based solely on a valid JWT. The case calls for Enforce tenant-to-record authorization in business logic and data queries, since authentication does not imply rights to every tenant's records.

Use Amazon Inspector findings and patch the vulnerable software would help if an EC2 instance has vulnerable software packages requiring vulnerability assessment. Inspector assesses supported compute and container vulnerabilities. That is not the symptom described here: unusual cryptocurrency mining API activity must be surfaced from account signals. The matching response is Enable and respond to Amazon GuardDuty findings for the affected accounts, because guardDuty analyzes AWS telemetry for threat patterns.

For the alternative failure sensitive identifiers stored in S3 need managed discovery and inventory, the control Use Amazon Macie sensitive-data discovery for targeted S3 buckets is relevant: macie classifies sensitive data in S3 objects. Here the evidence instead is unusual cryptocurrency mining API activity must be surfaced from account signals. The selected technical mechanism is Enable and respond to Amazon GuardDuty findings for the affected accounts: guardDuty analyzes AWS telemetry for threat patterns.

The competing option Use AWS Security Hub CSPM aggregation and supported integrations would be useful when several accounts need aggregated security findings for prioritization. Security Hub consolidates security signals from supported providers. The present issue is unusual cryptocurrency mining API activity must be surfaced from account signals; it is more directly addressed by Enable and respond to Amazon GuardDuty findings for the affected accounts. GuardDuty analyzes AWS telemetry for threat patterns.

Use Amazon Inspector findings and patch the vulnerable software solves a different operational problem where an EC2 instance has vulnerable software packages requiring vulnerability assessment. Inspector assesses supported compute and container vulnerabilities. It does not directly address sensitive identifiers stored in S3 need managed discovery and inventory. The case calls for Use Amazon Macie sensitive-data discovery for targeted S3 buckets, since macie classifies sensitive data in S3 objects.

The competing option Monitor CloudTrail-informed threat detection rather than relying exclusively on AWS Config would be useful when an application must detect anomalous API activity rather than only resource configuration drift. API threat signals and resource configuration rules serve different purposes. The present issue is sensitive identifiers stored in S3 need managed discovery and inventory; it is more directly addressed by Use Amazon Macie sensitive-data discovery for targeted S3 buckets. Macie classifies sensitive data in S3 objects.

The option Use AWS Security Hub CSPM aggregation and supported integrations addresses a separate condition: several accounts need aggregated security findings for prioritization. Security Hub consolidates security signals from supported providers. The actual requirement is sensitive identifiers stored in S3 need managed discovery and inventory. Recommended corrective action: Use Amazon Macie sensitive-data discovery for targeted S3 buckets. Macie classifies sensitive data in S3 objects.

Enable and respond to Amazon GuardDuty findings for the affected accounts solves a different operational problem where unusual cryptocurrency mining API activity must be surfaced from account signals. GuardDuty analyzes AWS telemetry for threat patterns. It does not directly address an EC2 instance has vulnerable software packages requiring vulnerability assessment. The case calls for Use Amazon Inspector findings and patch the vulnerable software, since inspector assesses supported compute and container vulnerabilities.

The competing option Use Amazon Macie sensitive-data discovery for targeted S3 buckets would be useful when sensitive identifiers stored in S3 need managed discovery and inventory. Macie classifies sensitive data in S3 objects. The present issue is an EC2 instance has vulnerable software packages requiring vulnerability assessment; it is more directly addressed by Use Amazon Inspector findings and patch the vulnerable software. Inspector assesses supported compute and container vulnerabilities.

The option Monitor CloudTrail-informed threat detection rather than relying exclusively on AWS Config addresses a separate condition: an application must detect anomalous API activity rather than only resource configuration drift. API threat signals and resource configuration rules serve different purposes. The actual requirement is an EC2 instance has vulnerable software packages requiring vulnerability assessment. Recommended corrective action: Use Amazon Inspector findings and patch the vulnerable software. Inspector assesses supported compute and container vulnerabilities.

The competing option Enable and respond to Amazon GuardDuty findings for the affected accounts would be useful when unusual cryptocurrency mining API activity must be surfaced from account signals. GuardDuty analyzes AWS telemetry for threat patterns. The present issue is several accounts need aggregated security findings for prioritization; it is more directly addressed by Use AWS Security Hub CSPM aggregation and supported integrations. Security Hub consolidates security signals from supported providers.

The option Monitor CloudTrail-informed threat detection rather than relying exclusively on AWS Config addresses a separate condition: an application must detect anomalous API activity rather than only resource configuration drift. API threat signals and resource configuration rules serve different purposes. The actual requirement is several accounts need aggregated security findings for prioritization. Recommended corrective action: Use AWS Security Hub CSPM aggregation and supported integrations. Security Hub consolidates security signals from supported providers.

Use Amazon Inspector findings and patch the vulnerable software would help if an EC2 instance has vulnerable software packages requiring vulnerability assessment. Inspector assesses supported compute and container vulnerabilities. That is not the symptom described here: several accounts need aggregated security findings for prioritization. The matching response is Use AWS Security Hub CSPM aggregation and supported integrations, because security Hub consolidates security signals from supported providers.

The option Use Amazon Macie sensitive-data discovery for targeted S3 buckets addresses a separate condition: sensitive identifiers stored in S3 need managed discovery and inventory. Macie classifies sensitive data in S3 objects. The actual requirement is an application must detect anomalous API activity rather than only resource configuration drift. Recommended corrective action: Monitor CloudTrail-informed threat detection rather than relying exclusively on AWS Config. API threat signals and resource configuration rules serve different purposes.

Enable and respond to Amazon GuardDuty findings for the affected accounts would help if unusual cryptocurrency mining API activity must be surfaced from account signals. GuardDuty analyzes AWS telemetry for threat patterns. That is not the symptom described here: an application must detect anomalous API activity rather than only resource configuration drift. The matching response is Monitor CloudTrail-informed threat detection rather than relying exclusively on AWS Config, because API threat signals and resource configuration rules serve different purposes.

For the alternative failure several accounts need aggregated security findings for prioritization, the control Use AWS Security Hub CSPM aggregation and supported integrations is relevant: security Hub consolidates security signals from supported providers. Here the evidence instead is an application must detect anomalous API activity rather than only resource configuration drift. The selected technical mechanism is Monitor CloudTrail-informed threat detection rather than relying exclusively on AWS Config: API threat signals and resource configuration rules serve different purposes.