Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Use Amazon Macie sensitive-data discovery for targeted S3 buckets addresses a separate condition: sensitive identifiers stored in S3 need managed discovery and inventory. Macie classifies sensitive data in S3 objects. The actual requirement is an application must detect anomalous API activity rather than only resource configuration drift. Recommended corrective action: Monitor CloudTrail-informed threat detection rather than relying exclusively on AWS Config. API threat signals and resource configuration rules serve different purposes.

Enable and respond to Amazon GuardDuty findings for the affected accounts would help if unusual cryptocurrency mining API activity must be surfaced from account signals. GuardDuty analyzes AWS telemetry for threat patterns. That is not the symptom described here: an application must detect anomalous API activity rather than only resource configuration drift. The matching response is Monitor CloudTrail-informed threat detection rather than relying exclusively on AWS Config, because API threat signals and resource configuration rules serve different purposes.

For the alternative failure several accounts need aggregated security findings for prioritization, the control Use AWS Security Hub CSPM aggregation and supported integrations is relevant: security Hub consolidates security signals from supported providers. Here the evidence instead is an application must detect anomalous API activity rather than only resource configuration drift. The selected technical mechanism is Monitor CloudTrail-informed threat detection rather than relying exclusively on AWS Config: API threat signals and resource configuration rules serve different purposes.

Integrate Gateway Load Balancer and its endpoints with appliance targets would help if third-party firewall appliances must inspect traffic inline at scale. GWLB routes transparent flows through network appliances. That is not the symptom described here: the app requires cookie-aware HTTP path routing to different microservices. The matching response is Use an Application Load Balancer with path or host listener rules, because aLB supports Layer-7 request routing.

For the alternative failure a TLS/TCP workload requires very high performance and client IP preservation, the control Use an appropriate Network Load Balancer listener and target group is relevant: nLB operates at Layer 4 with high-throughput behavior. Here the evidence instead is the app requires cookie-aware HTTP path routing to different microservices. The selected technical mechanism is Use an Application Load Balancer with path or host listener rules: aLB supports Layer-7 request routing.

Correct target-group health-check protocol/path and success criteria solves a different operational problem where a target group marks servers unhealthy because the check requests a nonexistent endpoint. Health-check configuration determines eligible traffic targets. It does not directly address the app requires cookie-aware HTTP path routing to different microservices. The case calls for Use an Application Load Balancer with path or host listener rules, since aLB supports Layer-7 request routing.

Use private integration or internal backend targets with restricted inbound paths solves a different operational problem where an API is public but its backend should remain inaccessible from the internet. Public entry and private service tiers should be decoupled. It does not directly address a TLS/TCP workload requires very high performance and client IP preservation. The case calls for Use an appropriate Network Load Balancer listener and target group, since nLB operates at Layer 4 with high-throughput behavior.

The competing option Integrate Gateway Load Balancer and its endpoints with appliance targets would be useful when third-party firewall appliances must inspect traffic inline at scale. GWLB routes transparent flows through network appliances. The present issue is a TLS/TCP workload requires very high performance and client IP preservation; it is more directly addressed by Use an appropriate Network Load Balancer listener and target group. NLB operates at Layer 4 with high-throughput behavior.

The option Correct target-group health-check protocol/path and success criteria addresses a separate condition: a target group marks servers unhealthy because the check requests a nonexistent endpoint. Health-check configuration determines eligible traffic targets. The actual requirement is a TLS/TCP workload requires very high performance and client IP preservation. Recommended corrective action: Use an appropriate Network Load Balancer listener and target group. NLB operates at Layer 4 with high-throughput behavior.

Use an appropriate Network Load Balancer listener and target group solves a different operational problem where a TLS/TCP workload requires very high performance and client IP preservation. NLB operates at Layer 4 with high-throughput behavior. It does not directly address third-party firewall appliances must inspect traffic inline at scale. The case calls for Integrate Gateway Load Balancer and its endpoints with appliance targets, since gWLB routes transparent flows through network appliances.

The competing option Correct target-group health-check protocol/path and success criteria would be useful when a target group marks servers unhealthy because the check requests a nonexistent endpoint. Health-check configuration determines eligible traffic targets. The present issue is third-party firewall appliances must inspect traffic inline at scale; it is more directly addressed by Integrate Gateway Load Balancer and its endpoints with appliance targets. GWLB routes transparent flows through network appliances.

The option Use private integration or internal backend targets with restricted inbound paths addresses a separate condition: an API is public but its backend should remain inaccessible from the internet. Public entry and private service tiers should be decoupled. The actual requirement is third-party firewall appliances must inspect traffic inline at scale. Recommended corrective action: Integrate Gateway Load Balancer and its endpoints with appliance targets. GWLB routes transparent flows through network appliances.

The competing option Use an appropriate Network Load Balancer listener and target group would be useful when a TLS/TCP workload requires very high performance and client IP preservation. NLB operates at Layer 4 with high-throughput behavior. The present issue is an API is public but its backend should remain inaccessible from the internet; it is more directly addressed by Use private integration or internal backend targets with restricted inbound paths. Public entry and private service tiers should be decoupled.

The option Use an Application Load Balancer with path or host listener rules addresses a separate condition: the app requires cookie-aware HTTP path routing to different microservices. ALB supports Layer-7 request routing. The actual requirement is an API is public but its backend should remain inaccessible from the internet. Recommended corrective action: Use private integration or internal backend targets with restricted inbound paths. Public entry and private service tiers should be decoupled.

Correct target-group health-check protocol/path and success criteria would help if a target group marks servers unhealthy because the check requests a nonexistent endpoint. Health-check configuration determines eligible traffic targets. That is not the symptom described here: an API is public but its backend should remain inaccessible from the internet. The matching response is Use private integration or internal backend targets with restricted inbound paths, because public entry and private service tiers should be decoupled.

Use an Application Load Balancer with path or host listener rules would help if the app requires cookie-aware HTTP path routing to different microservices. ALB supports Layer-7 request routing. That is not the symptom described here: a target group marks servers unhealthy because the check requests a nonexistent endpoint. The matching response is Correct target-group health-check protocol/path and success criteria, because health-check configuration determines eligible traffic targets.

For the alternative failure third-party firewall appliances must inspect traffic inline at scale, the control Integrate Gateway Load Balancer and its endpoints with appliance targets is relevant: gWLB routes transparent flows through network appliances. Here the evidence instead is a target group marks servers unhealthy because the check requests a nonexistent endpoint. The selected technical mechanism is Correct target-group health-check protocol/path and success criteria: health-check configuration determines eligible traffic targets.

Use private integration or internal backend targets with restricted inbound paths solves a different operational problem where an API is public but its backend should remain inaccessible from the internet. Public entry and private service tiers should be decoupled. It does not directly address a target group marks servers unhealthy because the check requests a nonexistent endpoint. The case calls for Correct target-group health-check protocol/path and success criteria, since health-check configuration determines eligible traffic targets.

Use instance security groups for intra-subnet instance traffic controls would help if a subnet NACL is expected to filter traffic between instances in the same subnet. NACLs govern subnet boundaries, not every local host-to-host exchange. That is not the symptom described here: each application VPC has inconsistent egress filtering and inspection. The matching response is Route approved egress through a centralized inspection VPC or firewall design, because shared egress controls provide consistent filtering.

For the alternative failure a central inspection policy needs managed domain and threat filtering, the control Evaluate AWS Network Firewall with rule groups and correct routing is relevant: network Firewall can inspect traffic traversing its endpoints. Here the evidence instead is each application VPC has inconsistent egress filtering and inspection. The selected technical mechanism is Route approved egress through a centralized inspection VPC or firewall design: shared egress controls provide consistent filtering.

The competing option Restrict egress rules to required prefixes or destination security groups would be useful when a workload's security group allows all outbound destinations contrary to policy. Outbound security-group rules limit permitted initiated connections. The present issue is each application VPC has inconsistent egress filtering and inspection; it is more directly addressed by Route approved egress through a centralized inspection VPC or firewall design. Shared egress controls provide consistent filtering.

For the alternative failure each application VPC has inconsistent egress filtering and inspection, the control Route approved egress through a centralized inspection VPC or firewall design is relevant: shared egress controls provide consistent filtering. Here the evidence instead is stateful inspection appliances show asymmetric paths through different Availability Zones. The selected technical mechanism is Use appliance mode and symmetric routing where required for the TGW attachment: stateful inspection depends on forward and return packets hitting compatible state.

Restrict egress rules to required prefixes or destination security groups solves a different operational problem where a workload's security group allows all outbound destinations contrary to policy. Outbound security-group rules limit permitted initiated connections. It does not directly address stateful inspection appliances show asymmetric paths through different Availability Zones. The case calls for Use appliance mode and symmetric routing where required for the TGW attachment, since stateful inspection depends on forward and return packets hitting compatible state.

The option Evaluate AWS Network Firewall with rule groups and correct routing addresses a separate condition: a central inspection policy needs managed domain and threat filtering. Network Firewall can inspect traffic traversing its endpoints. The actual requirement is stateful inspection appliances show asymmetric paths through different Availability Zones. Recommended corrective action: Use appliance mode and symmetric routing where required for the TGW attachment. Stateful inspection depends on forward and return packets hitting compatible state.

The competing option Use instance security groups for intra-subnet instance traffic controls would be useful when a subnet NACL is expected to filter traffic between instances in the same subnet. NACLs govern subnet boundaries, not every local host-to-host exchange. The present issue is a workload's security group allows all outbound destinations contrary to policy; it is more directly addressed by Restrict egress rules to required prefixes or destination security groups. Outbound security-group rules limit permitted initiated connections.

The option Route approved egress through a centralized inspection VPC or firewall design addresses a separate condition: each application VPC has inconsistent egress filtering and inspection. Shared egress controls provide consistent filtering. The actual requirement is a workload's security group allows all outbound destinations contrary to policy. Recommended corrective action: Restrict egress rules to required prefixes or destination security groups. Outbound security-group rules limit permitted initiated connections.

Evaluate AWS Network Firewall with rule groups and correct routing would help if a central inspection policy needs managed domain and threat filtering. Network Firewall can inspect traffic traversing its endpoints. That is not the symptom described here: a workload's security group allows all outbound destinations contrary to policy. The matching response is Restrict egress rules to required prefixes or destination security groups, because outbound security-group rules limit permitted initiated connections.

The option Route approved egress through a centralized inspection VPC or firewall design addresses a separate condition: each application VPC has inconsistent egress filtering and inspection. Shared egress controls provide consistent filtering. The actual requirement is a subnet NACL is expected to filter traffic between instances in the same subnet. Recommended corrective action: Use instance security groups for intra-subnet instance traffic controls. NACLs govern subnet boundaries, not every local host-to-host exchange.

Evaluate AWS Network Firewall with rule groups and correct routing would help if a central inspection policy needs managed domain and threat filtering. Network Firewall can inspect traffic traversing its endpoints. That is not the symptom described here: a subnet NACL is expected to filter traffic between instances in the same subnet. The matching response is Use instance security groups for intra-subnet instance traffic controls, because nACLs govern subnet boundaries, not every local host-to-host exchange.

For the alternative failure stateful inspection appliances show asymmetric paths through different Availability Zones, the control Use appliance mode and symmetric routing where required for the TGW attachment is relevant: stateful inspection depends on forward and return packets hitting compatible state. Here the evidence instead is a subnet NACL is expected to filter traffic between instances in the same subnet. The selected technical mechanism is Use instance security groups for intra-subnet instance traffic controls: nACLs govern subnet boundaries, not every local host-to-host exchange.

The option Route approved egress through a centralized inspection VPC or firewall design addresses a separate condition: each application VPC has inconsistent egress filtering and inspection. Shared egress controls provide consistent filtering. The actual requirement is a central inspection policy needs managed domain and threat filtering. Recommended corrective action: Evaluate AWS Network Firewall with rule groups and correct routing. Network Firewall can inspect traffic traversing its endpoints.

Use appliance mode and symmetric routing where required for the TGW attachment would help if stateful inspection appliances show asymmetric paths through different Availability Zones. Stateful inspection depends on forward and return packets hitting compatible state. That is not the symptom described here: a central inspection policy needs managed domain and threat filtering. The matching response is Evaluate AWS Network Firewall with rule groups and correct routing, because network Firewall can inspect traffic traversing its endpoints.

For the alternative failure a subnet NACL is expected to filter traffic between instances in the same subnet, the control Use instance security groups for intra-subnet instance traffic controls is relevant: nACLs govern subnet boundaries, not every local host-to-host exchange. Here the evidence instead is a central inspection policy needs managed domain and threat filtering. The selected technical mechanism is Evaluate AWS Network Firewall with rule groups and correct routing: network Firewall can inspect traffic traversing its endpoints.