Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Use AWS Global Accelerator with healthy regional endpoints addresses a separate condition: a highly available public global application needs static anycast entry points. Global Accelerator routes via static anycast addresses to suitable endpoints. The actual requirement is a DNS name must resolve to the nearest healthy web endpoint by latency. Recommended corrective action: Use Route 53 latency routing with appropriate health-aware behavior. DNS latency policies choose routing targets based on measured latency.

For the alternative failure a remote employee needs controlled application access without exposing the entire VPC, the control Use AWS Verified Access or a supported identity-aware access proxy per app requirement is relevant: identity-aware access enforces application context rather than whole-network connectivity. Here the evidence instead is a DNS name must resolve to the nearest healthy web endpoint by latency. The selected technical mechanism is Use Route 53 latency routing with appropriate health-aware behavior: dNS latency policies choose routing targets based on measured latency.

Use AWS PrivateLink endpoint service with approved consumer principals solves a different operational problem where an internal service must be exposed to another account without exchanging route tables. PrivateLink provides service-scoped private connectivity. It does not directly address a DNS name must resolve to the nearest healthy web endpoint by latency. The case calls for Use Route 53 latency routing with appropriate health-aware behavior, since dNS latency policies choose routing targets based on measured latency.

Trust only validated proxy chain metadata and authenticated user identity would help if an application accepts client-provided X-Forwarded-For as a trusted identity assertion. Spoofable headers cannot substitute for authentication. That is not the symptom described here: a public API allows unsigned administrator-level API methods. The matching response is Require IAM SigV4 or appropriate token authorization for privileged methods, because API authorization should precede privileged backend operations.

For the alternative failure a firewall rule changes without any forensic record, the control Capture relevant CloudTrail changes and AWS Config snapshots is relevant: change events and configuration history support audit investigation. Here the evidence instead is a public API allows unsigned administrator-level API methods. The selected technical mechanism is Require IAM SigV4 or appropriate token authorization for privileged methods: API authorization should precede privileged backend operations.

Enable narrowly scoped log bucket access plus Object Lock where retention requires it solves a different operational problem where security logs are stored in a mutable bucket without protection from insiders. Immutable retention can reduce tampering with audit objects. It does not directly address a public API allows unsigned administrator-level API methods. The case calls for Require IAM SigV4 or appropriate token authorization for privileged methods, since API authorization should precede privileged backend operations.

For the alternative failure an application accepts client-provided X-Forwarded-For as a trusted identity assertion, the control Trust only validated proxy chain metadata and authenticated user identity is relevant: spoofable headers cannot substitute for authentication. Here the evidence instead is a firewall rule changes without any forensic record. The selected technical mechanism is Capture relevant CloudTrail changes and AWS Config snapshots: change events and configuration history support audit investigation.

Require IAM SigV4 or appropriate token authorization for privileged methods solves a different operational problem where a public API allows unsigned administrator-level API methods. API authorization should precede privileged backend operations. It does not directly address a firewall rule changes without any forensic record. The case calls for Capture relevant CloudTrail changes and AWS Config snapshots, since change events and configuration history support audit investigation.

The competing option Enable narrowly scoped log bucket access plus Object Lock where retention requires it would be useful when security logs are stored in a mutable bucket without protection from insiders. Immutable retention can reduce tampering with audit objects. The present issue is a firewall rule changes without any forensic record; it is more directly addressed by Capture relevant CloudTrail changes and AWS Config snapshots. Change events and configuration history support audit investigation.

Enable narrowly scoped log bucket access plus Object Lock where retention requires it solves a different operational problem where security logs are stored in a mutable bucket without protection from insiders. Immutable retention can reduce tampering with audit objects. It does not directly address an application accepts client-provided X-Forwarded-For as a trusted identity assertion. The case calls for Trust only validated proxy chain metadata and authenticated user identity, since spoofable headers cannot substitute for authentication.

The competing option Require IAM SigV4 or appropriate token authorization for privileged methods would be useful when a public API allows unsigned administrator-level API methods. API authorization should precede privileged backend operations. The present issue is an application accepts client-provided X-Forwarded-For as a trusted identity assertion; it is more directly addressed by Trust only validated proxy chain metadata and authenticated user identity. Spoofable headers cannot substitute for authentication.

The option Configure appropriate cache policy and origin-request forwarding for authenticated paths addresses a separate condition: cloudFront forwards an Authorization header without matching the origin's expected cache behavior. Cache key and forwarded headers must align to avoid response leakage. The actual requirement is an application accepts client-provided X-Forwarded-For as a trusted identity assertion. Recommended corrective action: Trust only validated proxy chain metadata and authenticated user identity. Spoofable headers cannot substitute for authentication.

The competing option Capture relevant CloudTrail changes and AWS Config snapshots would be useful when a firewall rule changes without any forensic record. Change events and configuration history support audit investigation. The present issue is cloudFront forwards an Authorization header without matching the origin's expected cache behavior; it is more directly addressed by Configure appropriate cache policy and origin-request forwarding for authenticated paths. Cache key and forwarded headers must align to avoid response leakage.

The option Trust only validated proxy chain metadata and authenticated user identity addresses a separate condition: an application accepts client-provided X-Forwarded-For as a trusted identity assertion. Spoofable headers cannot substitute for authentication. The actual requirement is cloudFront forwards an Authorization header without matching the origin's expected cache behavior. Recommended corrective action: Configure appropriate cache policy and origin-request forwarding for authenticated paths. Cache key and forwarded headers must align to avoid response leakage.

For the alternative failure security logs are stored in a mutable bucket without protection from insiders, the control Enable narrowly scoped log bucket access plus Object Lock where retention requires it is relevant: immutable retention can reduce tampering with audit objects. Here the evidence instead is cloudFront forwards an Authorization header without matching the origin's expected cache behavior. The selected technical mechanism is Configure appropriate cache policy and origin-request forwarding for authenticated paths: cache key and forwarded headers must align to avoid response leakage.

Require IAM SigV4 or appropriate token authorization for privileged methods would help if a public API allows unsigned administrator-level API methods. API authorization should precede privileged backend operations. That is not the symptom described here: security logs are stored in a mutable bucket without protection from insiders. The matching response is Enable narrowly scoped log bucket access plus Object Lock where retention requires it, because immutable retention can reduce tampering with audit objects.

For the alternative failure a firewall rule changes without any forensic record, the control Capture relevant CloudTrail changes and AWS Config snapshots is relevant: change events and configuration history support audit investigation. Here the evidence instead is security logs are stored in a mutable bucket without protection from insiders. The selected technical mechanism is Enable narrowly scoped log bucket access plus Object Lock where retention requires it: immutable retention can reduce tampering with audit objects.

Configure appropriate cache policy and origin-request forwarding for authenticated paths solves a different operational problem where cloudFront forwards an Authorization header without matching the origin's expected cache behavior. Cache key and forwarded headers must align to avoid response leakage. It does not directly address security logs are stored in a mutable bucket without protection from insiders. The case calls for Enable narrowly scoped log bucket access plus Object Lock where retention requires it, since immutable retention can reduce tampering with audit objects.

Deploy public NAT gateway in a public subnet with suitable public address and route would help if a public subnet has a route to the internet gateway but the NAT gateway is placed in a private subnet. A public NAT gateway requires internet-gateway reachability for internet egress. That is not the symptom described here: instances in private subnets receive an endpoint security-group deny for AWS API calls. The matching response is Permit the required TCP 443 flows from the workload security group to interface endpoint ENIs, because interface endpoint ENIs have security groups that can block API traffic.

For the alternative failure a private subnet route sends S3 traffic to NAT despite an existing gateway endpoint, the control Associate the subnet route table with the S3 gateway endpoint is relevant: route association is required for the private S3 prefix route. Here the evidence instead is instances in private subnets receive an endpoint security-group deny for AWS API calls. The selected technical mechanism is Permit the required TCP 443 flows from the workload security group to interface endpoint ENIs: interface endpoint ENIs have security groups that can block API traffic.

Replace transitive peering assumptions with supported TGW design solves a different operational problem where a centralized VPC peer is expected to route traffic onward through another peering connection. VPC peering connections cannot provide arbitrary transitive routing. It does not directly address instances in private subnets receive an endpoint security-group deny for AWS API calls. The case calls for Permit the required TCP 443 flows from the workload security group to interface endpoint ENIs, since interface endpoint ENIs have security groups that can block API traffic.

Permit the required TCP 443 flows from the workload security group to interface endpoint ENIs solves a different operational problem where instances in private subnets receive an endpoint security-group deny for AWS API calls. Interface endpoint ENIs have security groups that can block API traffic. It does not directly address interface endpoint private DNS fails because VPC DNS settings are disabled. The case calls for Enable supported VPC DNS resolution and hostname settings, since private endpoint hostnames depend on VPC DNS configuration.

The competing option Deploy public NAT gateway in a public subnet with suitable public address and route would be useful when a public subnet has a route to the internet gateway but the NAT gateway is placed in a private subnet. A public NAT gateway requires internet-gateway reachability for internet egress. The present issue is interface endpoint private DNS fails because VPC DNS settings are disabled; it is more directly addressed by Enable supported VPC DNS resolution and hostname settings. Private endpoint hostnames depend on VPC DNS configuration.

The option Replace transitive peering assumptions with supported TGW design addresses a separate condition: a centralized VPC peer is expected to route traffic onward through another peering connection. VPC peering connections cannot provide arbitrary transitive routing. The actual requirement is interface endpoint private DNS fails because VPC DNS settings are disabled. Recommended corrective action: Enable supported VPC DNS resolution and hostname settings. Private endpoint hostnames depend on VPC DNS configuration.

Deploy public NAT gateway in a public subnet with suitable public address and route solves a different operational problem where a public subnet has a route to the internet gateway but the NAT gateway is placed in a private subnet. A public NAT gateway requires internet-gateway reachability for internet egress. It does not directly address a private subnet route sends S3 traffic to NAT despite an existing gateway endpoint. The case calls for Associate the subnet route table with the S3 gateway endpoint, since route association is required for the private S3 prefix route.

The competing option Permit the required TCP 443 flows from the workload security group to interface endpoint ENIs would be useful when instances in private subnets receive an endpoint security-group deny for AWS API calls. Interface endpoint ENIs have security groups that can block API traffic. The present issue is a private subnet route sends S3 traffic to NAT despite an existing gateway endpoint; it is more directly addressed by Associate the subnet route table with the S3 gateway endpoint. Route association is required for the private S3 prefix route.

Enable supported VPC DNS resolution and hostname settings would help if interface endpoint private DNS fails because VPC DNS settings are disabled. Private endpoint hostnames depend on VPC DNS configuration. That is not the symptom described here: a private subnet route sends S3 traffic to NAT despite an existing gateway endpoint. The matching response is Associate the subnet route table with the S3 gateway endpoint, because route association is required for the private S3 prefix route.

The competing option Associate the subnet route table with the S3 gateway endpoint would be useful when a private subnet route sends S3 traffic to NAT despite an existing gateway endpoint. Route association is required for the private S3 prefix route. The present issue is a centralized VPC peer is expected to route traffic onward through another peering connection; it is more directly addressed by Replace transitive peering assumptions with supported TGW design. VPC peering connections cannot provide arbitrary transitive routing.

Deploy public NAT gateway in a public subnet with suitable public address and route would help if a public subnet has a route to the internet gateway but the NAT gateway is placed in a private subnet. A public NAT gateway requires internet-gateway reachability for internet egress. That is not the symptom described here: a centralized VPC peer is expected to route traffic onward through another peering connection. The matching response is Replace transitive peering assumptions with supported TGW design, because vPC peering connections cannot provide arbitrary transitive routing.

For the alternative failure interface endpoint private DNS fails because VPC DNS settings are disabled, the control Enable supported VPC DNS resolution and hostname settings is relevant: private endpoint hostnames depend on VPC DNS configuration. Here the evidence instead is a centralized VPC peer is expected to route traffic onward through another peering connection. The selected technical mechanism is Replace transitive peering assumptions with supported TGW design: vPC peering connections cannot provide arbitrary transitive routing.

The option Replace transitive peering assumptions with supported TGW design addresses a separate condition: a centralized VPC peer is expected to route traffic onward through another peering connection. VPC peering connections cannot provide arbitrary transitive routing. The actual requirement is a public subnet has a route to the internet gateway but the NAT gateway is placed in a private subnet. Recommended corrective action: Deploy public NAT gateway in a public subnet with suitable public address and route. A public NAT gateway requires internet-gateway reachability for internet egress.

Enable supported VPC DNS resolution and hostname settings would help if interface endpoint private DNS fails because VPC DNS settings are disabled. Private endpoint hostnames depend on VPC DNS configuration. That is not the symptom described here: a public subnet has a route to the internet gateway but the NAT gateway is placed in a private subnet. The matching response is Deploy public NAT gateway in a public subnet with suitable public address and route, because a public NAT gateway requires internet-gateway reachability for internet egress.

Associate the subnet route table with the S3 gateway endpoint solves a different operational problem where a private subnet route sends S3 traffic to NAT despite an existing gateway endpoint. Route association is required for the private S3 prefix route. It does not directly address a public subnet has a route to the internet gateway but the NAT gateway is placed in a private subnet. The case calls for Deploy public NAT gateway in a public subnet with suitable public address and route, since a public NAT gateway requires internet-gateway reachability for internet egress.