Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Adjust documented inspection limits and rule scope without dropping all coverage addresses a separate condition: legitimate large uploads fail because a WAF body-inspection rule treats the entire body as suspicious. WAF request-body inspection has service-specific size boundaries. The actual requirement is a security team needs to monitor potential WAF false positives before blocking. Recommended corrective action: Use rule count mode and analyze sampled requests prior to enforcement. Count mode records would-be matches without imposing a block.

Rely on AWS Shield Standard baseline DDoS protection for supported endpoints would help if a global app requires baseline DDoS protection without buying advanced support. Shield Standard is included for supported AWS resources. That is not the symptom described here: a security team needs to monitor potential WAF false positives before blocking. The matching response is Use rule count mode and analyze sampled requests prior to enforcement, because count mode records would-be matches without imposing a block.

Configure supported AWS WAF XSS protections and validate exclusions solves a different operational problem where a public app is vulnerable to common cross-site scripting payloads. WAF can detect characteristic malicious HTTP patterns. It does not directly address a security team needs to monitor potential WAF false positives before blocking. The case calls for Use rule count mode and analyze sampled requests prior to enforcement, since count mode records would-be matches without imposing a block.

Reference the application-tier security group in database ingress would help if an RDS database is reachable from any instance in the VPC but should serve only the application tier. Source security-group rules restrict which workloads may reach the database. That is not the symptom described here: only TCP 443 may reach a public ALB from internet clients. The matching response is Permit TCP 443 on the ALB security group and avoid broad unrelated ingress, because security-group ingress rules control accepted listener ports.

Use an egress-only internet gateway with appropriate IPv6 routing solves a different operational problem where a VPC subnet must have outbound IPv6 connectivity without accepting inbound IPv6 initiations. Egress-only IGWs permit outbound initiated IPv6 sessions. It does not directly address only TCP 443 may reach a public ALB from internet clients. The case calls for Permit TCP 443 on the ALB security group and avoid broad unrelated ingress, since security-group ingress rules control accepted listener ports.

The competing option Design supported NAT64/DNS64 or egress-only IPv6 connectivity as appropriate would be useful when an IPv4-only NAT gateway is assumed to translate IPv6 packets by default. NAT gateway IPv4 and IPv6 behavior requires explicit architecture choices. The present issue is only TCP 443 may reach a public ALB from internet clients; it is more directly addressed by Permit TCP 443 on the ALB security group and avoid broad unrelated ingress. Security-group ingress rules control accepted listener ports.

For the alternative failure a VPC subnet must have outbound IPv6 connectivity without accepting inbound IPv6 initiations, the control Use an egress-only internet gateway with appropriate IPv6 routing is relevant: egress-only IGWs permit outbound initiated IPv6 sessions. Here the evidence instead is an RDS database is reachable from any instance in the VPC but should serve only the application tier. The selected technical mechanism is Reference the application-tier security group in database ingress: source security-group rules restrict which workloads may reach the database.

Permit TCP 443 on the ALB security group and avoid broad unrelated ingress solves a different operational problem where only TCP 443 may reach a public ALB from internet clients. Security-group ingress rules control accepted listener ports. It does not directly address an RDS database is reachable from any instance in the VPC but should serve only the application tier. The case calls for Reference the application-tier security group in database ingress, since source security-group rules restrict which workloads may reach the database.

The option Design supported NAT64/DNS64 or egress-only IPv6 connectivity as appropriate addresses a separate condition: an IPv4-only NAT gateway is assumed to translate IPv6 packets by default. NAT gateway IPv4 and IPv6 behavior requires explicit architecture choices. The actual requirement is an RDS database is reachable from any instance in the VPC but should serve only the application tier. Recommended corrective action: Reference the application-tier security group in database ingress. Source security-group rules restrict which workloads may reach the database.

Design supported NAT64/DNS64 or egress-only IPv6 connectivity as appropriate solves a different operational problem where an IPv4-only NAT gateway is assumed to translate IPv6 packets by default. NAT gateway IPv4 and IPv6 behavior requires explicit architecture choices. It does not directly address a VPC subnet must have outbound IPv6 connectivity without accepting inbound IPv6 initiations. The case calls for Use an egress-only internet gateway with appropriate IPv6 routing, since egress-only IGWs permit outbound initiated IPv6 sessions.

The option Permit TCP 443 on the ALB security group and avoid broad unrelated ingress addresses a separate condition: only TCP 443 may reach a public ALB from internet clients. Security-group ingress rules control accepted listener ports. The actual requirement is a VPC subnet must have outbound IPv6 connectivity without accepting inbound IPv6 initiations. Recommended corrective action: Use an egress-only internet gateway with appropriate IPv6 routing. Egress-only IGWs permit outbound initiated IPv6 sessions.

Reference the application-tier security group in database ingress would help if an RDS database is reachable from any instance in the VPC but should serve only the application tier. Source security-group rules restrict which workloads may reach the database. That is not the symptom described here: a VPC subnet must have outbound IPv6 connectivity without accepting inbound IPv6 initiations. The matching response is Use an egress-only internet gateway with appropriate IPv6 routing, because egress-only IGWs permit outbound initiated IPv6 sessions.

The competing option Reference the application-tier security group in database ingress would be useful when an RDS database is reachable from any instance in the VPC but should serve only the application tier. Source security-group rules restrict which workloads may reach the database. The present issue is an IPv4-only NAT gateway is assumed to translate IPv6 packets by default; it is more directly addressed by Design supported NAT64/DNS64 or egress-only IPv6 connectivity as appropriate. NAT gateway IPv4 and IPv6 behavior requires explicit architecture choices.

Use an egress-only internet gateway with appropriate IPv6 routing would help if a VPC subnet must have outbound IPv6 connectivity without accepting inbound IPv6 initiations. Egress-only IGWs permit outbound initiated IPv6 sessions. That is not the symptom described here: an IPv4-only NAT gateway is assumed to translate IPv6 packets by default. The matching response is Design supported NAT64/DNS64 or egress-only IPv6 connectivity as appropriate, because nAT gateway IPv4 and IPv6 behavior requires explicit architecture choices.

For the alternative failure a public EC2 host still cannot receive requests because its security group has no inbound allow, the control Add only the approved inbound port/source rule to that instance's security group is relevant: security groups block inbound sessions without a matching allow. Here the evidence instead is an IPv4-only NAT gateway is assumed to translate IPv6 packets by default. The selected technical mechanism is Design supported NAT64/DNS64 or egress-only IPv6 connectivity as appropriate: nAT gateway IPv4 and IPv6 behavior requires explicit architecture choices.

The option Use an egress-only internet gateway with appropriate IPv6 routing addresses a separate condition: a VPC subnet must have outbound IPv6 connectivity without accepting inbound IPv6 initiations. Egress-only IGWs permit outbound initiated IPv6 sessions. The actual requirement is a public EC2 host still cannot receive requests because its security group has no inbound allow. Recommended corrective action: Add only the approved inbound port/source rule to that instance's security group. Security groups block inbound sessions without a matching allow.

Permit TCP 443 on the ALB security group and avoid broad unrelated ingress would help if only TCP 443 may reach a public ALB from internet clients. Security-group ingress rules control accepted listener ports. That is not the symptom described here: a public EC2 host still cannot receive requests because its security group has no inbound allow. The matching response is Add only the approved inbound port/source rule to that instance's security group, because security groups block inbound sessions without a matching allow.

Design supported NAT64/DNS64 or egress-only IPv6 connectivity as appropriate solves a different operational problem where an IPv4-only NAT gateway is assumed to translate IPv6 packets by default. NAT gateway IPv4 and IPv6 behavior requires explicit architecture choices. It does not directly address a public EC2 host still cannot receive requests because its security group has no inbound allow. The case calls for Add only the approved inbound port/source rule to that instance's security group, since security groups block inbound sessions without a matching allow.

Use Route 53 latency routing with appropriate health-aware behavior would help if a DNS name must resolve to the nearest healthy web endpoint by latency. DNS latency policies choose routing targets based on measured latency. That is not the symptom described here: a remote employee needs controlled application access without exposing the entire VPC. The matching response is Use AWS Verified Access or a supported identity-aware access proxy per app requirement, because identity-aware access enforces application context rather than whole-network connectivity.

For the alternative failure a company must secure HTTP edge delivery to a private S3 origin, the control Deploy CloudFront origin access control and enforce TLS for viewers is relevant: cloudFront can serve a private origin while using encrypted viewer traffic. Here the evidence instead is a remote employee needs controlled application access without exposing the entire VPC. The selected technical mechanism is Use AWS Verified Access or a supported identity-aware access proxy per app requirement: identity-aware access enforces application context rather than whole-network connectivity.

Use AWS PrivateLink endpoint service with approved consumer principals solves a different operational problem where an internal service must be exposed to another account without exchanging route tables. PrivateLink provides service-scoped private connectivity. It does not directly address a remote employee needs controlled application access without exposing the entire VPC. The case calls for Use AWS Verified Access or a supported identity-aware access proxy per app requirement, since identity-aware access enforces application context rather than whole-network connectivity.

Use AWS Global Accelerator with healthy regional endpoints solves a different operational problem where a highly available public global application needs static anycast entry points. Global Accelerator routes via static anycast addresses to suitable endpoints. It does not directly address an internal service must be exposed to another account without exchanging route tables. The case calls for Use AWS PrivateLink endpoint service with approved consumer principals, since privateLink provides service-scoped private connectivity.

The competing option Deploy CloudFront origin access control and enforce TLS for viewers would be useful when a company must secure HTTP edge delivery to a private S3 origin. CloudFront can serve a private origin while using encrypted viewer traffic. The present issue is an internal service must be exposed to another account without exchanging route tables; it is more directly addressed by Use AWS PrivateLink endpoint service with approved consumer principals. PrivateLink provides service-scoped private connectivity.

The option Use AWS Verified Access or a supported identity-aware access proxy per app requirement addresses a separate condition: a remote employee needs controlled application access without exposing the entire VPC. Identity-aware access enforces application context rather than whole-network connectivity. The actual requirement is an internal service must be exposed to another account without exchanging route tables. Recommended corrective action: Use AWS PrivateLink endpoint service with approved consumer principals. PrivateLink provides service-scoped private connectivity.

The competing option Use AWS PrivateLink endpoint service with approved consumer principals would be useful when an internal service must be exposed to another account without exchanging route tables. PrivateLink provides service-scoped private connectivity. The present issue is a company must secure HTTP edge delivery to a private S3 origin; it is more directly addressed by Deploy CloudFront origin access control and enforce TLS for viewers. CloudFront can serve a private origin while using encrypted viewer traffic.

The option Use Route 53 latency routing with appropriate health-aware behavior addresses a separate condition: a DNS name must resolve to the nearest healthy web endpoint by latency. DNS latency policies choose routing targets based on measured latency. The actual requirement is a company must secure HTTP edge delivery to a private S3 origin. Recommended corrective action: Deploy CloudFront origin access control and enforce TLS for viewers. CloudFront can serve a private origin while using encrypted viewer traffic.

Use AWS Global Accelerator with healthy regional endpoints would help if a highly available public global application needs static anycast entry points. Global Accelerator routes via static anycast addresses to suitable endpoints. That is not the symptom described here: a company must secure HTTP edge delivery to a private S3 origin. The matching response is Deploy CloudFront origin access control and enforce TLS for viewers, because cloudFront can serve a private origin while using encrypted viewer traffic.

The option Use Route 53 latency routing with appropriate health-aware behavior addresses a separate condition: a DNS name must resolve to the nearest healthy web endpoint by latency. DNS latency policies choose routing targets based on measured latency. The actual requirement is a highly available public global application needs static anycast entry points. Recommended corrective action: Use AWS Global Accelerator with healthy regional endpoints. Global Accelerator routes via static anycast addresses to suitable endpoints.

Use AWS Verified Access or a supported identity-aware access proxy per app requirement would help if a remote employee needs controlled application access without exposing the entire VPC. Identity-aware access enforces application context rather than whole-network connectivity. That is not the symptom described here: a highly available public global application needs static anycast entry points. The matching response is Use AWS Global Accelerator with healthy regional endpoints, because global Accelerator routes via static anycast addresses to suitable endpoints.

For the alternative failure an internal service must be exposed to another account without exchanging route tables, the control Use AWS PrivateLink endpoint service with approved consumer principals is relevant: privateLink provides service-scoped private connectivity. Here the evidence instead is a highly available public global application needs static anycast entry points. The selected technical mechanism is Use AWS Global Accelerator with healthy regional endpoints: global Accelerator routes via static anycast addresses to suitable endpoints.

The option Use AWS Global Accelerator with healthy regional endpoints addresses a separate condition: a highly available public global application needs static anycast entry points. Global Accelerator routes via static anycast addresses to suitable endpoints. The actual requirement is a DNS name must resolve to the nearest healthy web endpoint by latency. Recommended corrective action: Use Route 53 latency routing with appropriate health-aware behavior. DNS latency policies choose routing targets based on measured latency.

For the alternative failure a remote employee needs controlled application access without exposing the entire VPC, the control Use AWS Verified Access or a supported identity-aware access proxy per app requirement is relevant: identity-aware access enforces application context rather than whole-network connectivity. Here the evidence instead is a DNS name must resolve to the nearest healthy web endpoint by latency. The selected technical mechanism is Use Route 53 latency routing with appropriate health-aware behavior: dNS latency policies choose routing targets based on measured latency.

Use AWS PrivateLink endpoint service with approved consumer principals solves a different operational problem where an internal service must be exposed to another account without exchanging route tables. PrivateLink provides service-scoped private connectivity. It does not directly address a DNS name must resolve to the nearest healthy web endpoint by latency. The case calls for Use Route 53 latency routing with appropriate health-aware behavior, since dNS latency policies choose routing targets based on measured latency.