Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Use code dependency scanning and application remediation alongside CloudTrail addresses a separate condition: developers think enabling CloudTrail automatically protects against vulnerable application libraries. Audit trails do not repair vulnerable software. The actual requirement is a legacy app assumes that putting the server in a private subnet removes all need for application authentication. Recommended corrective action: Enforce application identity and authorization independent of subnet reachability. Private routing is not an application authorization mechanism.

Apply the shared-responsibility model separately per managed service would help if security analysts need to distinguish AWS service-side infrastructure responsibility from customer configuration. Responsibility changes with managed service abstraction. That is not the symptom described here: a legacy app assumes that putting the server in a private subnet removes all need for application authentication. The matching response is Enforce application identity and authorization independent of subnet reachability, because private routing is not an application authorization mechanism.

Patch the EC2 guest OS and installed software using customer operations solves a different operational problem where a team assumes AWS patches the guest operating system on self-managed EC2 instances. Customers manage guest OS security on EC2. It does not directly address a legacy app assumes that putting the server in a private subnet removes all need for application authentication. The case calls for Enforce application identity and authorization independent of subnet reachability, since private routing is not an application authorization mechanism.

For the alternative failure data owners need to restore accidentally deleted S3 object versions, the control Enable S3 Versioning and use version-aware recovery is relevant: versioning preserves prior object versions against overwrites. Here the evidence instead is a compliance policy requires identifiable ownership of encryption keys for a sensitive S3 bucket. The selected technical mechanism is Configure default SSE-KMS with a customer managed KMS key: customer managed keys support controlled policies and auditing.

Use a customer managed KMS key with cross-account key policy and IAM grants solves a different operational problem where security requires cross-account decryption of SSE-KMS objects. AWS managed aws/s3 keys cannot be shared cross-account by changing their policy. It does not directly address a compliance policy requires identifiable ownership of encryption keys for a sensitive S3 bucket. The case calls for Configure default SSE-KMS with a customer managed KMS key, since customer managed keys support controlled policies and auditing.

The competing option Add bucket policy deny when aws:SecureTransport is false would be useful when an S3 bucket must deny requests made over unencrypted HTTP. A resource policy can enforce TLS for object API requests. The present issue is a compliance policy requires identifiable ownership of encryption keys for a sensitive S3 bucket; it is more directly addressed by Configure default SSE-KMS with a customer managed KMS key. Customer managed keys support controlled policies and auditing.

For the alternative failure security requires cross-account decryption of SSE-KMS objects, the control Use a customer managed KMS key with cross-account key policy and IAM grants is relevant: aWS managed aws/s3 keys cannot be shared cross-account by changing their policy. Here the evidence instead is an S3 bucket must deny requests made over unencrypted HTTP. The selected technical mechanism is Add bucket policy deny when aws:SecureTransport is false: a resource policy can enforce TLS for object API requests.

Enable account and bucket S3 Block Public Access controls solves a different operational problem where the bucket cannot allow any direct public access, including accidentally added ACLs. Block Public Access overrides public grants in affected bucket access settings. It does not directly address an S3 bucket must deny requests made over unencrypted HTTP. The case calls for Add bucket policy deny when aws:SecureTransport is false, since a resource policy can enforce TLS for object API requests.

The competing option Enable S3 Versioning and use version-aware recovery would be useful when data owners need to restore accidentally deleted S3 object versions. Versioning preserves prior object versions against overwrites. The present issue is an S3 bucket must deny requests made over unencrypted HTTP; it is more directly addressed by Add bucket policy deny when aws:SecureTransport is false. A resource policy can enforce TLS for object API requests.

The competing option Configure default SSE-KMS with a customer managed KMS key would be useful when a compliance policy requires identifiable ownership of encryption keys for a sensitive S3 bucket. Customer managed keys support controlled policies and auditing. The present issue is data owners need to restore accidentally deleted S3 object versions; it is more directly addressed by Enable S3 Versioning and use version-aware recovery. Versioning preserves prior object versions against overwrites.

The option Add bucket policy deny when aws:SecureTransport is false addresses a separate condition: an S3 bucket must deny requests made over unencrypted HTTP. A resource policy can enforce TLS for object API requests. The actual requirement is data owners need to restore accidentally deleted S3 object versions. Recommended corrective action: Enable S3 Versioning and use version-aware recovery. Versioning preserves prior object versions against overwrites.

Enable account and bucket S3 Block Public Access controls would help if the bucket cannot allow any direct public access, including accidentally added ACLs. Block Public Access overrides public grants in affected bucket access settings. That is not the symptom described here: data owners need to restore accidentally deleted S3 object versions. The matching response is Enable S3 Versioning and use version-aware recovery, because versioning preserves prior object versions against overwrites.

The option Enable S3 Versioning and use version-aware recovery addresses a separate condition: data owners need to restore accidentally deleted S3 object versions. Versioning preserves prior object versions against overwrites. The actual requirement is security requires cross-account decryption of SSE-KMS objects. Recommended corrective action: Use a customer managed KMS key with cross-account key policy and IAM grants. AWS managed aws/s3 keys cannot be shared cross-account by changing their policy.

Add bucket policy deny when aws:SecureTransport is false would help if an S3 bucket must deny requests made over unencrypted HTTP. A resource policy can enforce TLS for object API requests. That is not the symptom described here: security requires cross-account decryption of SSE-KMS objects. The matching response is Use a customer managed KMS key with cross-account key policy and IAM grants, because aWS managed aws/s3 keys cannot be shared cross-account by changing their policy.

For the alternative failure a compliance policy requires identifiable ownership of encryption keys for a sensitive S3 bucket, the control Configure default SSE-KMS with a customer managed KMS key is relevant: customer managed keys support controlled policies and auditing. Here the evidence instead is security requires cross-account decryption of SSE-KMS objects. The selected technical mechanism is Use a customer managed KMS key with cross-account key policy and IAM grants: aWS managed aws/s3 keys cannot be shared cross-account by changing their policy.

The option Enable S3 Versioning and use version-aware recovery addresses a separate condition: data owners need to restore accidentally deleted S3 object versions. Versioning preserves prior object versions against overwrites. The actual requirement is the bucket cannot allow any direct public access, including accidentally added ACLs. Recommended corrective action: Enable account and bucket S3 Block Public Access controls. Block Public Access overrides public grants in affected bucket access settings.

Configure default SSE-KMS with a customer managed KMS key would help if a compliance policy requires identifiable ownership of encryption keys for a sensitive S3 bucket. Customer managed keys support controlled policies and auditing. That is not the symptom described here: the bucket cannot allow any direct public access, including accidentally added ACLs. The matching response is Enable account and bucket S3 Block Public Access controls, because block Public Access overrides public grants in affected bucket access settings.

Add bucket policy deny when aws:SecureTransport is false solves a different operational problem where an S3 bucket must deny requests made over unencrypted HTTP. A resource policy can enforce TLS for object API requests. It does not directly address the bucket cannot allow any direct public access, including accidentally added ACLs. The case calls for Enable account and bucket S3 Block Public Access controls, since block Public Access overrides public grants in affected bucket access settings.

For the alternative failure audit operators must prove which principal changed an object-lock setting, the control Enable relevant CloudTrail object data events and track retention-setting calls is relevant: cloudTrail data events aid attribution for object-level API activity. Here the evidence instead is regulated log objects must be protected from deletion before a mandated retention date. The selected technical mechanism is Configure S3 Object Lock compliance mode with appropriate retention: compliance-mode retention prevents protected version deletion during the period.

Apply an S3 Object Lock legal hold to the required object versions solves a different operational problem where an investigation needs to preserve an individual record indefinitely pending legal review. Legal holds preserve designated versions independent of retention expiry. It does not directly address regulated log objects must be protected from deletion before a mandated retention date. The case calls for Configure S3 Object Lock compliance mode with appropriate retention, since compliance-mode retention prevents protected version deletion during the period.

The competing option Use S3 Object Lock governance mode with narrowly approved bypass privilege would be useful when a governance administrator needs a controlled override of a retention hold. Governance retention can be bypassed by authorized principals. The present issue is regulated log objects must be protected from deletion before a mandated retention date; it is more directly addressed by Configure S3 Object Lock compliance mode with appropriate retention. Compliance-mode retention prevents protected version deletion during the period.

For the alternative failure audit operators must prove which principal changed an object-lock setting, the control Enable relevant CloudTrail object data events and track retention-setting calls is relevant: cloudTrail data events aid attribution for object-level API activity. Here the evidence instead is a governance administrator needs a controlled override of a retention hold. The selected technical mechanism is Use S3 Object Lock governance mode with narrowly approved bypass privilege: governance retention can be bypassed by authorized principals.

Apply an approved S3 lifecycle expiration rule after retention requirements solves a different operational problem where historical records may be deleted after seven years under legal policy. Lifecycle policies automate object expiration where deletion is allowed. It does not directly address a governance administrator needs a controlled override of a retention hold. The case calls for Use S3 Object Lock governance mode with narrowly approved bypass privilege, since governance retention can be bypassed by authorized principals.

The option Configure S3 Object Lock compliance mode with appropriate retention addresses a separate condition: regulated log objects must be protected from deletion before a mandated retention date. Compliance-mode retention prevents protected version deletion during the period. The actual requirement is a governance administrator needs a controlled override of a retention hold. Recommended corrective action: Use S3 Object Lock governance mode with narrowly approved bypass privilege. Governance retention can be bypassed by authorized principals.

Use S3 Object Lock governance mode with narrowly approved bypass privilege solves a different operational problem where a governance administrator needs a controlled override of a retention hold. Governance retention can be bypassed by authorized principals. It does not directly address an investigation needs to preserve an individual record indefinitely pending legal review. The case calls for Apply an S3 Object Lock legal hold to the required object versions, since legal holds preserve designated versions independent of retention expiry.

The option Apply an approved S3 lifecycle expiration rule after retention requirements addresses a separate condition: historical records may be deleted after seven years under legal policy. Lifecycle policies automate object expiration where deletion is allowed. The actual requirement is an investigation needs to preserve an individual record indefinitely pending legal review. Recommended corrective action: Apply an S3 Object Lock legal hold to the required object versions. Legal holds preserve designated versions independent of retention expiry.

Configure S3 Object Lock compliance mode with appropriate retention would help if regulated log objects must be protected from deletion before a mandated retention date. Compliance-mode retention prevents protected version deletion during the period. That is not the symptom described here: an investigation needs to preserve an individual record indefinitely pending legal review. The matching response is Apply an S3 Object Lock legal hold to the required object versions, because legal holds preserve designated versions independent of retention expiry.

The competing option Apply an S3 Object Lock legal hold to the required object versions would be useful when an investigation needs to preserve an individual record indefinitely pending legal review. Legal holds preserve designated versions independent of retention expiry. The present issue is historical records may be deleted after seven years under legal policy; it is more directly addressed by Apply an approved S3 lifecycle expiration rule after retention requirements. Lifecycle policies automate object expiration where deletion is allowed.

Use S3 Object Lock governance mode with narrowly approved bypass privilege would help if a governance administrator needs a controlled override of a retention hold. Governance retention can be bypassed by authorized principals. That is not the symptom described here: historical records may be deleted after seven years under legal policy. The matching response is Apply an approved S3 lifecycle expiration rule after retention requirements, because lifecycle policies automate object expiration where deletion is allowed.

For the alternative failure audit operators must prove which principal changed an object-lock setting, the control Enable relevant CloudTrail object data events and track retention-setting calls is relevant: cloudTrail data events aid attribution for object-level API activity. Here the evidence instead is historical records may be deleted after seven years under legal policy. The selected technical mechanism is Apply an approved S3 lifecycle expiration rule after retention requirements: lifecycle policies automate object expiration where deletion is allowed.

The option Use S3 Object Lock governance mode with narrowly approved bypass privilege addresses a separate condition: a governance administrator needs a controlled override of a retention hold. Governance retention can be bypassed by authorized principals. The actual requirement is audit operators must prove which principal changed an object-lock setting. Recommended corrective action: Enable relevant CloudTrail object data events and track retention-setting calls. CloudTrail data events aid attribution for object-level API activity.

For the alternative failure regulated log objects must be protected from deletion before a mandated retention date, the control Configure S3 Object Lock compliance mode with appropriate retention is relevant: compliance-mode retention prevents protected version deletion during the period. Here the evidence instead is audit operators must prove which principal changed an object-lock setting. The selected technical mechanism is Enable relevant CloudTrail object data events and track retention-setting calls: cloudTrail data events aid attribution for object-level API activity.

Apply an approved S3 lifecycle expiration rule after retention requirements solves a different operational problem where historical records may be deleted after seven years under legal policy. Lifecycle policies automate object expiration where deletion is allowed. It does not directly address audit operators must prove which principal changed an object-lock setting. The case calls for Enable relevant CloudTrail object data events and track retention-setting calls, since cloudTrail data events aid attribution for object-level API activity.