Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Route approved egress through a centralized inspection VPC or firewall design addresses a separate condition: each application VPC has inconsistent egress filtering and inspection. Shared egress controls provide consistent filtering. The actual requirement is a central inspection policy needs managed domain and threat filtering. Recommended corrective action: Evaluate AWS Network Firewall with rule groups and correct routing. Network Firewall can inspect traffic traversing its endpoints.

Use appliance mode and symmetric routing where required for the TGW attachment would help if stateful inspection appliances show asymmetric paths through different Availability Zones. Stateful inspection depends on forward and return packets hitting compatible state. That is not the symptom described here: a central inspection policy needs managed domain and threat filtering. The matching response is Evaluate AWS Network Firewall with rule groups and correct routing, because network Firewall can inspect traffic traversing its endpoints.

For the alternative failure a subnet NACL is expected to filter traffic between instances in the same subnet, the control Use instance security groups for intra-subnet instance traffic controls is relevant: nACLs govern subnet boundaries, not every local host-to-host exchange. Here the evidence instead is a central inspection policy needs managed domain and threat filtering. The selected technical mechanism is Evaluate AWS Network Firewall with rule groups and correct routing: network Firewall can inspect traffic traversing its endpoints.

Redact sensitive token fields before durable log export would help if a web server logs full access tokens in application logs. Secrets in logs bypass otherwise strong secret-storage controls. That is not the symptom described here: an application role unexpectedly reads another team's secret. The matching response is Scope secretsmanager:GetSecretValue resources to the intended secret ARNs and conditions, because secret resource permissions should be limited by workload ownership.

For the alternative failure a database is publicly accessible even though its security group denies the internet, the control Set RDS PubliclyAccessible to false and use private subnets is relevant: disabling public addressability reinforces network isolation. Here the evidence instead is an application role unexpectedly reads another team's secret. The selected technical mechanism is Scope secretsmanager:GetSecretValue resources to the intended secret ARNs and conditions: secret resource permissions should be limited by workload ownership.

Retrieve secrets through approved services and avoid logging secret values solves a different operational problem where a Lambda function logs database password environment variables in diagnostics. Secrets must not flow into broad telemetry. It does not directly address an application role unexpectedly reads another team's secret. The case calls for Scope secretsmanager:GetSecretValue resources to the intended secret ARNs and conditions, since secret resource permissions should be limited by workload ownership.

For the alternative failure an application role unexpectedly reads another team's secret, the control Scope secretsmanager:GetSecretValue resources to the intended secret ARNs and conditions is relevant: secret resource permissions should be limited by workload ownership. Here the evidence instead is a database is publicly accessible even though its security group denies the internet. The selected technical mechanism is Set RDS PubliclyAccessible to false and use private subnets: disabling public addressability reinforces network isolation.

Redact sensitive token fields before durable log export solves a different operational problem where a web server logs full access tokens in application logs. Secrets in logs bypass otherwise strong secret-storage controls. It does not directly address a database is publicly accessible even though its security group denies the internet. The case calls for Set RDS PubliclyAccessible to false and use private subnets, since disabling public addressability reinforces network isolation.

The option Implement bounded secret cache refresh or reconnect logic after rotation addresses a separate condition: the team rotates a password but old app containers retain stale cached credentials. Credential rotation needs consumers to recognize new secret versions. The actual requirement is a database is publicly accessible even though its security group denies the internet. Recommended corrective action: Set RDS PubliclyAccessible to false and use private subnets. Disabling public addressability reinforces network isolation.

The competing option Set RDS PubliclyAccessible to false and use private subnets would be useful when a database is publicly accessible even though its security group denies the internet. Disabling public addressability reinforces network isolation. The present issue is a web server logs full access tokens in application logs; it is more directly addressed by Redact sensitive token fields before durable log export. Secrets in logs bypass otherwise strong secret-storage controls.

The option Retrieve secrets through approved services and avoid logging secret values addresses a separate condition: a Lambda function logs database password environment variables in diagnostics. Secrets must not flow into broad telemetry. The actual requirement is a web server logs full access tokens in application logs. Recommended corrective action: Redact sensitive token fields before durable log export. Secrets in logs bypass otherwise strong secret-storage controls.

Scope secretsmanager:GetSecretValue resources to the intended secret ARNs and conditions would help if an application role unexpectedly reads another team's secret. Secret resource permissions should be limited by workload ownership. That is not the symptom described here: a web server logs full access tokens in application logs. The matching response is Redact sensitive token fields before durable log export, because secrets in logs bypass otherwise strong secret-storage controls.

The competing option Scope secretsmanager:GetSecretValue resources to the intended secret ARNs and conditions would be useful when an application role unexpectedly reads another team's secret. Secret resource permissions should be limited by workload ownership. The present issue is a Lambda function logs database password environment variables in diagnostics; it is more directly addressed by Retrieve secrets through approved services and avoid logging secret values. Secrets must not flow into broad telemetry.

Implement bounded secret cache refresh or reconnect logic after rotation would help if the team rotates a password but old app containers retain stale cached credentials. Credential rotation needs consumers to recognize new secret versions. That is not the symptom described here: a Lambda function logs database password environment variables in diagnostics. The matching response is Retrieve secrets through approved services and avoid logging secret values, because secrets must not flow into broad telemetry.

For the alternative failure a web server logs full access tokens in application logs, the control Redact sensitive token fields before durable log export is relevant: secrets in logs bypass otherwise strong secret-storage controls. Here the evidence instead is a Lambda function logs database password environment variables in diagnostics. The selected technical mechanism is Retrieve secrets through approved services and avoid logging secret values: secrets must not flow into broad telemetry.

The option Retrieve secrets through approved services and avoid logging secret values addresses a separate condition: a Lambda function logs database password environment variables in diagnostics. Secrets must not flow into broad telemetry. The actual requirement is the team rotates a password but old app containers retain stale cached credentials. Recommended corrective action: Implement bounded secret cache refresh or reconnect logic after rotation. Credential rotation needs consumers to recognize new secret versions.

Scope secretsmanager:GetSecretValue resources to the intended secret ARNs and conditions would help if an application role unexpectedly reads another team's secret. Secret resource permissions should be limited by workload ownership. That is not the symptom described here: the team rotates a password but old app containers retain stale cached credentials. The matching response is Implement bounded secret cache refresh or reconnect logic after rotation, because credential rotation needs consumers to recognize new secret versions.

Set RDS PubliclyAccessible to false and use private subnets solves a different operational problem where a database is publicly accessible even though its security group denies the internet. Disabling public addressability reinforces network isolation. It does not directly address the team rotates a password but old app containers retain stale cached credentials. The case calls for Implement bounded secret cache refresh or reconnect logic after rotation, since credential rotation needs consumers to recognize new secret versions.

Rely on AWS Shield Standard baseline DDoS protection for supported endpoints would help if a global app requires baseline DDoS protection without buying advanced support. Shield Standard is included for supported AWS resources. That is not the symptom described here: a public app is vulnerable to common cross-site scripting payloads. The matching response is Configure supported AWS WAF XSS protections and validate exclusions, because WAF can detect characteristic malicious HTTP patterns.

For the alternative failure legitimate large uploads fail because a WAF body-inspection rule treats the entire body as suspicious, the control Adjust documented inspection limits and rule scope without dropping all coverage is relevant: WAF request-body inspection has service-specific size boundaries. Here the evidence instead is a public app is vulnerable to common cross-site scripting payloads. The selected technical mechanism is Configure supported AWS WAF XSS protections and validate exclusions: WAF can detect characteristic malicious HTTP patterns.

The competing option Use rule count mode and analyze sampled requests prior to enforcement would be useful when a security team needs to monitor potential WAF false positives before blocking. Count mode records would-be matches without imposing a block. The present issue is a public app is vulnerable to common cross-site scripting payloads; it is more directly addressed by Configure supported AWS WAF XSS protections and validate exclusions. WAF can detect characteristic malicious HTTP patterns.

For the alternative failure a security team needs to monitor potential WAF false positives before blocking, the control Use rule count mode and analyze sampled requests prior to enforcement is relevant: count mode records would-be matches without imposing a block. Here the evidence instead is an internet endpoint must block a known malicious IP range immediately. The selected technical mechanism is Add an IP set match rule to the relevant WAF web ACL: iP sets enable centrally managed address blocking.

Configure supported AWS WAF XSS protections and validate exclusions solves a different operational problem where a public app is vulnerable to common cross-site scripting payloads. WAF can detect characteristic malicious HTTP patterns. It does not directly address an internet endpoint must block a known malicious IP range immediately. The case calls for Add an IP set match rule to the relevant WAF web ACL, since iP sets enable centrally managed address blocking.

The competing option Adjust documented inspection limits and rule scope without dropping all coverage would be useful when legitimate large uploads fail because a WAF body-inspection rule treats the entire body as suspicious. WAF request-body inspection has service-specific size boundaries. The present issue is an internet endpoint must block a known malicious IP range immediately; it is more directly addressed by Add an IP set match rule to the relevant WAF web ACL. IP sets enable centrally managed address blocking.

Configure supported AWS WAF XSS protections and validate exclusions solves a different operational problem where a public app is vulnerable to common cross-site scripting payloads. WAF can detect characteristic malicious HTTP patterns. It does not directly address legitimate large uploads fail because a WAF body-inspection rule treats the entire body as suspicious. The case calls for Adjust documented inspection limits and rule scope without dropping all coverage, since WAF request-body inspection has service-specific size boundaries.

The competing option Use rule count mode and analyze sampled requests prior to enforcement would be useful when a security team needs to monitor potential WAF false positives before blocking. Count mode records would-be matches without imposing a block. The present issue is legitimate large uploads fail because a WAF body-inspection rule treats the entire body as suspicious; it is more directly addressed by Adjust documented inspection limits and rule scope without dropping all coverage. WAF request-body inspection has service-specific size boundaries.

Add an IP set match rule to the relevant WAF web ACL would help if an internet endpoint must block a known malicious IP range immediately. IP sets enable centrally managed address blocking. That is not the symptom described here: legitimate large uploads fail because a WAF body-inspection rule treats the entire body as suspicious. The matching response is Adjust documented inspection limits and rule scope without dropping all coverage, because WAF request-body inspection has service-specific size boundaries.

The competing option Configure supported AWS WAF XSS protections and validate exclusions would be useful when a public app is vulnerable to common cross-site scripting payloads. WAF can detect characteristic malicious HTTP patterns. The present issue is a global app requires baseline DDoS protection without buying advanced support; it is more directly addressed by Rely on AWS Shield Standard baseline DDoS protection for supported endpoints. Shield Standard is included for supported AWS resources.

Use rule count mode and analyze sampled requests prior to enforcement would help if a security team needs to monitor potential WAF false positives before blocking. Count mode records would-be matches without imposing a block. That is not the symptom described here: a global app requires baseline DDoS protection without buying advanced support. The matching response is Rely on AWS Shield Standard baseline DDoS protection for supported endpoints, because shield Standard is included for supported AWS resources.

For the alternative failure legitimate large uploads fail because a WAF body-inspection rule treats the entire body as suspicious, the control Adjust documented inspection limits and rule scope without dropping all coverage is relevant: WAF request-body inspection has service-specific size boundaries. Here the evidence instead is a global app requires baseline DDoS protection without buying advanced support. The selected technical mechanism is Rely on AWS Shield Standard baseline DDoS protection for supported endpoints: shield Standard is included for supported AWS resources.

The option Adjust documented inspection limits and rule scope without dropping all coverage addresses a separate condition: legitimate large uploads fail because a WAF body-inspection rule treats the entire body as suspicious. WAF request-body inspection has service-specific size boundaries. The actual requirement is a security team needs to monitor potential WAF false positives before blocking. Recommended corrective action: Use rule count mode and analyze sampled requests prior to enforcement. Count mode records would-be matches without imposing a block.

Rely on AWS Shield Standard baseline DDoS protection for supported endpoints would help if a global app requires baseline DDoS protection without buying advanced support. Shield Standard is included for supported AWS resources. That is not the symptom described here: a security team needs to monitor potential WAF false positives before blocking. The matching response is Use rule count mode and analyze sampled requests prior to enforcement, because count mode records would-be matches without imposing a block.

Configure supported AWS WAF XSS protections and validate exclusions solves a different operational problem where a public app is vulnerable to common cross-site scripting payloads. WAF can detect characteristic malicious HTTP patterns. It does not directly address a security team needs to monitor potential WAF false positives before blocking. The case calls for Use rule count mode and analyze sampled requests prior to enforcement, since count mode records would-be matches without imposing a block.