Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Replace transitive peering assumptions with supported TGW design addresses a separate condition: a centralized VPC peer is expected to route traffic onward through another peering connection. VPC peering connections cannot provide arbitrary transitive routing. The actual requirement is a public subnet has a route to the internet gateway but the NAT gateway is placed in a private subnet. Recommended corrective action: Deploy public NAT gateway in a public subnet with suitable public address and route. A public NAT gateway requires internet-gateway reachability for internet egress.

Enable supported VPC DNS resolution and hostname settings would help if interface endpoint private DNS fails because VPC DNS settings are disabled. Private endpoint hostnames depend on VPC DNS configuration. That is not the symptom described here: a public subnet has a route to the internet gateway but the NAT gateway is placed in a private subnet. The matching response is Deploy public NAT gateway in a public subnet with suitable public address and route, because a public NAT gateway requires internet-gateway reachability for internet egress.

Associate the subnet route table with the S3 gateway endpoint solves a different operational problem where a private subnet route sends S3 traffic to NAT despite an existing gateway endpoint. Route association is required for the private S3 prefix route. It does not directly address a public subnet has a route to the internet gateway but the NAT gateway is placed in a private subnet. The case calls for Deploy public NAT gateway in a public subnet with suitable public address and route, since a public NAT gateway requires internet-gateway reachability for internet egress.

Enforce supported geographic restrictions using CloudFront or WAF as appropriate would help if a public API allows requests from every country despite a legal restriction. Geo controls can limit delivery by viewer geography. That is not the symptom described here: a critical API is deployed in one AZ even though the region has multiple AZs. The matching response is Deploy backend endpoints across multiple Availability Zones behind an ALB, because multi-AZ target placement reduces AZ-specific failure.

Use a private API configuration with endpoint-restricted resource policy solves a different operational problem where a private API Gateway method must not be called directly from the public internet. Private API access relies on approved VPC endpoint paths. It does not directly address a critical API is deployed in one AZ even though the region has multiple AZs. The case calls for Deploy backend endpoints across multiple Availability Zones behind an ALB, since multi-AZ target placement reduces AZ-specific failure.

The competing option Use ACM-integrated certificates and supported renewal validation would be useful when an application entry requires managed custom-domain TLS renewal. ACM can manage renewal for eligible DNS-validated certificates. The present issue is a critical API is deployed in one AZ even though the region has multiple AZs; it is more directly addressed by Deploy backend endpoints across multiple Availability Zones behind an ALB. Multi-AZ target placement reduces AZ-specific failure.

Set API Gateway method or usage-plan throttling and monitor 429s solves a different operational problem where a regional REST API must throttle abusive clients while preserving valid demand. API Gateway throttles control request bursts and steady rates. It does not directly address a public API allows requests from every country despite a legal restriction. The case calls for Enforce supported geographic restrictions using CloudFront or WAF as appropriate, since geo controls can limit delivery by viewer geography.

The competing option Use ACM-integrated certificates and supported renewal validation would be useful when an application entry requires managed custom-domain TLS renewal. ACM can manage renewal for eligible DNS-validated certificates. The present issue is a public API allows requests from every country despite a legal restriction; it is more directly addressed by Enforce supported geographic restrictions using CloudFront or WAF as appropriate. Geo controls can limit delivery by viewer geography.

The option Use a private API configuration with endpoint-restricted resource policy addresses a separate condition: a private API Gateway method must not be called directly from the public internet. Private API access relies on approved VPC endpoint paths. The actual requirement is a public API allows requests from every country despite a legal restriction. Recommended corrective action: Enforce supported geographic restrictions using CloudFront or WAF as appropriate. Geo controls can limit delivery by viewer geography.

Set API Gateway method or usage-plan throttling and monitor 429s solves a different operational problem where a regional REST API must throttle abusive clients while preserving valid demand. API Gateway throttles control request bursts and steady rates. It does not directly address a private API Gateway method must not be called directly from the public internet. The case calls for Use a private API configuration with endpoint-restricted resource policy, since private API access relies on approved VPC endpoint paths.

The option Deploy backend endpoints across multiple Availability Zones behind an ALB addresses a separate condition: a critical API is deployed in one AZ even though the region has multiple AZs. Multi-AZ target placement reduces AZ-specific failure. The actual requirement is a private API Gateway method must not be called directly from the public internet. Recommended corrective action: Use a private API configuration with endpoint-restricted resource policy. Private API access relies on approved VPC endpoint paths.

Enforce supported geographic restrictions using CloudFront or WAF as appropriate would help if a public API allows requests from every country despite a legal restriction. Geo controls can limit delivery by viewer geography. That is not the symptom described here: a private API Gateway method must not be called directly from the public internet. The matching response is Use a private API configuration with endpoint-restricted resource policy, because private API access relies on approved VPC endpoint paths.

The competing option Deploy backend endpoints across multiple Availability Zones behind an ALB would be useful when a critical API is deployed in one AZ even though the region has multiple AZs. Multi-AZ target placement reduces AZ-specific failure. The present issue is a regional REST API must throttle abusive clients while preserving valid demand; it is more directly addressed by Set API Gateway method or usage-plan throttling and monitor 429s. API Gateway throttles control request bursts and steady rates.

The option Use a private API configuration with endpoint-restricted resource policy addresses a separate condition: a private API Gateway method must not be called directly from the public internet. Private API access relies on approved VPC endpoint paths. The actual requirement is a regional REST API must throttle abusive clients while preserving valid demand. Recommended corrective action: Set API Gateway method or usage-plan throttling and monitor 429s. API Gateway throttles control request bursts and steady rates.

Use ACM-integrated certificates and supported renewal validation would help if an application entry requires managed custom-domain TLS renewal. ACM can manage renewal for eligible DNS-validated certificates. That is not the symptom described here: a regional REST API must throttle abusive clients while preserving valid demand. The matching response is Set API Gateway method or usage-plan throttling and monitor 429s, because API Gateway throttles control request bursts and steady rates.

The option Deploy backend endpoints across multiple Availability Zones behind an ALB addresses a separate condition: a critical API is deployed in one AZ even though the region has multiple AZs. Multi-AZ target placement reduces AZ-specific failure. The actual requirement is an application entry requires managed custom-domain TLS renewal. Recommended corrective action: Use ACM-integrated certificates and supported renewal validation. ACM can manage renewal for eligible DNS-validated certificates.

For the alternative failure a private API Gateway method must not be called directly from the public internet, the control Use a private API configuration with endpoint-restricted resource policy is relevant: private API access relies on approved VPC endpoint paths. Here the evidence instead is an application entry requires managed custom-domain TLS renewal. The selected technical mechanism is Use ACM-integrated certificates and supported renewal validation: aCM can manage renewal for eligible DNS-validated certificates.

Set API Gateway method or usage-plan throttling and monitor 429s solves a different operational problem where a regional REST API must throttle abusive clients while preserving valid demand. API Gateway throttles control request bursts and steady rates. It does not directly address an application entry requires managed custom-domain TLS renewal. The case calls for Use ACM-integrated certificates and supported renewal validation, since aCM can manage renewal for eligible DNS-validated certificates.

Enforce application identity and authorization independent of subnet reachability would help if a legacy app assumes that putting the server in a private subnet removes all need for application authentication. Private routing is not an application authorization mechanism. That is not the symptom described here: a team assumes AWS patches the guest operating system on self-managed EC2 instances. The matching response is Patch the EC2 guest OS and installed software using customer operations, because customers manage guest OS security on EC2.

For the alternative failure an RDS database user password is shared with a public client application, the control Keep database credentials in backend secret storage and expose authenticated APIs is relevant: clients should not receive privileged database credentials. Here the evidence instead is a team assumes AWS patches the guest operating system on self-managed EC2 instances. The selected technical mechanism is Patch the EC2 guest OS and installed software using customer operations: customers manage guest OS security on EC2.

The competing option Apply the shared-responsibility model separately per managed service would be useful when security analysts need to distinguish AWS service-side infrastructure responsibility from customer configuration. Responsibility changes with managed service abstraction. The present issue is a team assumes AWS patches the guest operating system on self-managed EC2 instances; it is more directly addressed by Patch the EC2 guest OS and installed software using customer operations. Customers manage guest OS security on EC2.

For the alternative failure a legacy app assumes that putting the server in a private subnet removes all need for application authentication, the control Enforce application identity and authorization independent of subnet reachability is relevant: private routing is not an application authorization mechanism. Here the evidence instead is developers think enabling CloudTrail automatically protects against vulnerable application libraries. The selected technical mechanism is Use code dependency scanning and application remediation alongside CloudTrail: audit trails do not repair vulnerable software.

Apply the shared-responsibility model separately per managed service solves a different operational problem where security analysts need to distinguish AWS service-side infrastructure responsibility from customer configuration. Responsibility changes with managed service abstraction. It does not directly address developers think enabling CloudTrail automatically protects against vulnerable application libraries. The case calls for Use code dependency scanning and application remediation alongside CloudTrail, since audit trails do not repair vulnerable software.

The competing option Keep database credentials in backend secret storage and expose authenticated APIs would be useful when an RDS database user password is shared with a public client application. Clients should not receive privileged database credentials. The present issue is developers think enabling CloudTrail automatically protects against vulnerable application libraries; it is more directly addressed by Use code dependency scanning and application remediation alongside CloudTrail. Audit trails do not repair vulnerable software.

Patch the EC2 guest OS and installed software using customer operations solves a different operational problem where a team assumes AWS patches the guest operating system on self-managed EC2 instances. Customers manage guest OS security on EC2. It does not directly address security analysts need to distinguish AWS service-side infrastructure responsibility from customer configuration. The case calls for Apply the shared-responsibility model separately per managed service, since responsibility changes with managed service abstraction.

The option Use code dependency scanning and application remediation alongside CloudTrail addresses a separate condition: developers think enabling CloudTrail automatically protects against vulnerable application libraries. Audit trails do not repair vulnerable software. The actual requirement is security analysts need to distinguish AWS service-side infrastructure responsibility from customer configuration. Recommended corrective action: Apply the shared-responsibility model separately per managed service. Responsibility changes with managed service abstraction.

Keep database credentials in backend secret storage and expose authenticated APIs would help if an RDS database user password is shared with a public client application. Clients should not receive privileged database credentials. That is not the symptom described here: security analysts need to distinguish AWS service-side infrastructure responsibility from customer configuration. The matching response is Apply the shared-responsibility model separately per managed service, because responsibility changes with managed service abstraction.

The competing option Enforce application identity and authorization independent of subnet reachability would be useful when a legacy app assumes that putting the server in a private subnet removes all need for application authentication. Private routing is not an application authorization mechanism. The present issue is an RDS database user password is shared with a public client application; it is more directly addressed by Keep database credentials in backend secret storage and expose authenticated APIs. Clients should not receive privileged database credentials.

The option Apply the shared-responsibility model separately per managed service addresses a separate condition: security analysts need to distinguish AWS service-side infrastructure responsibility from customer configuration. Responsibility changes with managed service abstraction. The actual requirement is an RDS database user password is shared with a public client application. Recommended corrective action: Keep database credentials in backend secret storage and expose authenticated APIs. Clients should not receive privileged database credentials.

For the alternative failure developers think enabling CloudTrail automatically protects against vulnerable application libraries, the control Use code dependency scanning and application remediation alongside CloudTrail is relevant: audit trails do not repair vulnerable software. Here the evidence instead is an RDS database user password is shared with a public client application. The selected technical mechanism is Keep database credentials in backend secret storage and expose authenticated APIs: clients should not receive privileged database credentials.

The option Use code dependency scanning and application remediation alongside CloudTrail addresses a separate condition: developers think enabling CloudTrail automatically protects against vulnerable application libraries. Audit trails do not repair vulnerable software. The actual requirement is a legacy app assumes that putting the server in a private subnet removes all need for application authentication. Recommended corrective action: Enforce application identity and authorization independent of subnet reachability. Private routing is not an application authorization mechanism.

Apply the shared-responsibility model separately per managed service would help if security analysts need to distinguish AWS service-side infrastructure responsibility from customer configuration. Responsibility changes with managed service abstraction. That is not the symptom described here: a legacy app assumes that putting the server in a private subnet removes all need for application authentication. The matching response is Enforce application identity and authorization independent of subnet reachability, because private routing is not an application authorization mechanism.

Patch the EC2 guest OS and installed software using customer operations solves a different operational problem where a team assumes AWS patches the guest operating system on self-managed EC2 instances. Customers manage guest OS security on EC2. It does not directly address a legacy app assumes that putting the server in a private subnet removes all need for application authentication. The case calls for Enforce application identity and authorization independent of subnet reachability, since private routing is not an application authorization mechanism.