Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Use S3 Object Lock governance mode with narrowly approved bypass privilege addresses a separate condition: a governance administrator needs a controlled override of a retention hold. Governance retention can be bypassed by authorized principals. The actual requirement is audit operators must prove which principal changed an object-lock setting. Recommended corrective action: Enable relevant CloudTrail object data events and track retention-setting calls. CloudTrail data events aid attribution for object-level API activity.

For the alternative failure regulated log objects must be protected from deletion before a mandated retention date, the control Configure S3 Object Lock compliance mode with appropriate retention is relevant: compliance-mode retention prevents protected version deletion during the period. Here the evidence instead is audit operators must prove which principal changed an object-lock setting. The selected technical mechanism is Enable relevant CloudTrail object data events and track retention-setting calls: cloudTrail data events aid attribution for object-level API activity.

Apply an approved S3 lifecycle expiration rule after retention requirements solves a different operational problem where historical records may be deleted after seven years under legal policy. Lifecycle policies automate object expiration where deletion is allowed. It does not directly address audit operators must prove which principal changed an object-lock setting. The case calls for Enable relevant CloudTrail object data events and track retention-setting calls, since cloudTrail data events aid attribution for object-level API activity.

Use KMS data keys with local data encryption rather than sending the payload to KMS would help if an application requires envelope encryption for large objects. KMS data keys support encrypting data beyond direct API size limits. That is not the symptom described here: application workloads need to decrypt data with a particular customer-managed key. The matching response is Allow kms:Decrypt in the key policy and relevant IAM permissions for the workload, because kMS access depends on effective key authorization.

For the alternative failure security wants routine key material rotation for eligible symmetric customer managed keys, the control Enable supported automatic KMS key rotation where applicable is relevant: managed rotation updates key material while preserving key identity. Here the evidence instead is application workloads need to decrypt data with a particular customer-managed key. The selected technical mechanism is Allow kms:Decrypt in the key policy and relevant IAM permissions for the workload: kMS access depends on effective key authorization.

Disable the customer-managed KMS key after assessing data availability risk solves a different operational problem where a key owner wants to disable a compromised key while reviewing access. Disabled KMS keys cannot perform normal cryptographic operations. It does not directly address application workloads need to decrypt data with a particular customer-managed key. The case calls for Allow kms:Decrypt in the key policy and relevant IAM permissions for the workload, since kMS access depends on effective key authorization.

For the alternative failure security wants routine key material rotation for eligible symmetric customer managed keys, the control Enable supported automatic KMS key rotation where applicable is relevant: managed rotation updates key material while preserving key identity. Here the evidence instead is a cross-account role can read an S3 object but KMS returns AccessDenied. The selected technical mechanism is Grant the external role approved customer-key use in both accounts: s3 object access and KMS decrypt authorization are separate.

Use KMS data keys with local data encryption rather than sending the payload to KMS solves a different operational problem where an application requires envelope encryption for large objects. KMS data keys support encrypting data beyond direct API size limits. It does not directly address a cross-account role can read an S3 object but KMS returns AccessDenied. The case calls for Grant the external role approved customer-key use in both accounts, since s3 object access and KMS decrypt authorization are separate.

The competing option Disable the customer-managed KMS key after assessing data availability risk would be useful when a key owner wants to disable a compromised key while reviewing access. Disabled KMS keys cannot perform normal cryptographic operations. The present issue is a cross-account role can read an S3 object but KMS returns AccessDenied; it is more directly addressed by Grant the external role approved customer-key use in both accounts. S3 object access and KMS decrypt authorization are separate.

Allow kms:Decrypt in the key policy and relevant IAM permissions for the workload solves a different operational problem where application workloads need to decrypt data with a particular customer-managed key. KMS access depends on effective key authorization. It does not directly address an application requires envelope encryption for large objects. The case calls for Use KMS data keys with local data encryption rather than sending the payload to KMS, since kMS data keys support encrypting data beyond direct API size limits.

The option Enable supported automatic KMS key rotation where applicable addresses a separate condition: security wants routine key material rotation for eligible symmetric customer managed keys. Managed rotation updates key material while preserving key identity. The actual requirement is an application requires envelope encryption for large objects. Recommended corrective action: Use KMS data keys with local data encryption rather than sending the payload to KMS. KMS data keys support encrypting data beyond direct API size limits.

Disable the customer-managed KMS key after assessing data availability risk would help if a key owner wants to disable a compromised key while reviewing access. Disabled KMS keys cannot perform normal cryptographic operations. That is not the symptom described here: an application requires envelope encryption for large objects. The matching response is Use KMS data keys with local data encryption rather than sending the payload to KMS, because kMS data keys support encrypting data beyond direct API size limits.

The option Use KMS data keys with local data encryption rather than sending the payload to KMS addresses a separate condition: an application requires envelope encryption for large objects. KMS data keys support encrypting data beyond direct API size limits. The actual requirement is a key owner wants to disable a compromised key while reviewing access. Recommended corrective action: Disable the customer-managed KMS key after assessing data availability risk. Disabled KMS keys cannot perform normal cryptographic operations.

Allow kms:Decrypt in the key policy and relevant IAM permissions for the workload would help if application workloads need to decrypt data with a particular customer-managed key. KMS access depends on effective key authorization. That is not the symptom described here: a key owner wants to disable a compromised key while reviewing access. The matching response is Disable the customer-managed KMS key after assessing data availability risk, because disabled KMS keys cannot perform normal cryptographic operations.

For the alternative failure a cross-account role can read an S3 object but KMS returns AccessDenied, the control Grant the external role approved customer-key use in both accounts is relevant: s3 object access and KMS decrypt authorization are separate. Here the evidence instead is a key owner wants to disable a compromised key while reviewing access. The selected technical mechanism is Disable the customer-managed KMS key after assessing data availability risk: disabled KMS keys cannot perform normal cryptographic operations.

The option Allow kms:Decrypt in the key policy and relevant IAM permissions for the workload addresses a separate condition: application workloads need to decrypt data with a particular customer-managed key. KMS access depends on effective key authorization. The actual requirement is security wants routine key material rotation for eligible symmetric customer managed keys. Recommended corrective action: Enable supported automatic KMS key rotation where applicable. Managed rotation updates key material while preserving key identity.

Disable the customer-managed KMS key after assessing data availability risk would help if a key owner wants to disable a compromised key while reviewing access. Disabled KMS keys cannot perform normal cryptographic operations. That is not the symptom described here: security wants routine key material rotation for eligible symmetric customer managed keys. The matching response is Enable supported automatic KMS key rotation where applicable, because managed rotation updates key material while preserving key identity.

Grant the external role approved customer-key use in both accounts solves a different operational problem where a cross-account role can read an S3 object but KMS returns AccessDenied. S3 object access and KMS decrypt authorization are separate. It does not directly address security wants routine key material rotation for eligible symmetric customer managed keys. The case calls for Enable supported automatic KMS key rotation where applicable, since managed rotation updates key material while preserving key identity.

For the alternative failure a service needs to rotate a pinned certificate without breaking trusting clients, the control Deploy and test a certificate trust-transition plan before retiring the old cert is relevant: coordinated trust rotation avoids certificate validation outages. Here the evidence instead is an internet-facing ALB certificate expires during a product release. The selected technical mechanism is Request and attach an ACM-managed certificate with valid domain validation: managed ACM certificates can renew eligible public TLS certificates.

Use AWS Private CA and supported mutual TLS endpoint configuration solves a different operational problem where a private service needs internal CA-issued mutual TLS certificates. Private PKI can issue internal certificates under controlled trust. It does not directly address an internet-facing ALB certificate expires during a product release. The case calls for Request and attach an ACM-managed certificate with valid domain validation, since managed ACM certificates can renew eligible public TLS certificates.

The competing option Attach a certificate covering the requested DNS name in its SAN entries would be useful when clients reject a valid-looking certificate because the hostname differs. TLS name matching requires the requested host to be covered. The present issue is an internet-facing ALB certificate expires during a product release; it is more directly addressed by Request and attach an ACM-managed certificate with valid domain validation. Managed ACM certificates can renew eligible public TLS certificates.

For the alternative failure a CloudFront distribution uses a certificate requested outside its required region, the control Request/import the viewer certificate in us-east-1 for CloudFront is relevant: cloudFront viewer ACM certificates have a specific regional requirement. Here the evidence instead is a private service needs internal CA-issued mutual TLS certificates. The selected technical mechanism is Use AWS Private CA and supported mutual TLS endpoint configuration: private PKI can issue internal certificates under controlled trust.

The competing option Deploy and test a certificate trust-transition plan before retiring the old cert would be useful when a service needs to rotate a pinned certificate without breaking trusting clients. Coordinated trust rotation avoids certificate validation outages. The present issue is a private service needs internal CA-issued mutual TLS certificates; it is more directly addressed by Use AWS Private CA and supported mutual TLS endpoint configuration. Private PKI can issue internal certificates under controlled trust.

The option Attach a certificate covering the requested DNS name in its SAN entries addresses a separate condition: clients reject a valid-looking certificate because the hostname differs. TLS name matching requires the requested host to be covered. The actual requirement is a private service needs internal CA-issued mutual TLS certificates. Recommended corrective action: Use AWS Private CA and supported mutual TLS endpoint configuration. Private PKI can issue internal certificates under controlled trust.

Request and attach an ACM-managed certificate with valid domain validation solves a different operational problem where an internet-facing ALB certificate expires during a product release. Managed ACM certificates can renew eligible public TLS certificates. It does not directly address a CloudFront distribution uses a certificate requested outside its required region. The case calls for Request/import the viewer certificate in us-east-1 for CloudFront, since cloudFront viewer ACM certificates have a specific regional requirement.

The competing option Attach a certificate covering the requested DNS name in its SAN entries would be useful when clients reject a valid-looking certificate because the hostname differs. TLS name matching requires the requested host to be covered. The present issue is a CloudFront distribution uses a certificate requested outside its required region; it is more directly addressed by Request/import the viewer certificate in us-east-1 for CloudFront. CloudFront viewer ACM certificates have a specific regional requirement.

The option Use AWS Private CA and supported mutual TLS endpoint configuration addresses a separate condition: a private service needs internal CA-issued mutual TLS certificates. Private PKI can issue internal certificates under controlled trust. The actual requirement is a CloudFront distribution uses a certificate requested outside its required region. Recommended corrective action: Request/import the viewer certificate in us-east-1 for CloudFront. CloudFront viewer ACM certificates have a specific regional requirement.

The option Request/import the viewer certificate in us-east-1 for CloudFront addresses a separate condition: a CloudFront distribution uses a certificate requested outside its required region. CloudFront viewer ACM certificates have a specific regional requirement. The actual requirement is clients reject a valid-looking certificate because the hostname differs. Recommended corrective action: Attach a certificate covering the requested DNS name in its SAN entries. TLS name matching requires the requested host to be covered.

Request and attach an ACM-managed certificate with valid domain validation would help if an internet-facing ALB certificate expires during a product release. Managed ACM certificates can renew eligible public TLS certificates. That is not the symptom described here: clients reject a valid-looking certificate because the hostname differs. The matching response is Attach a certificate covering the requested DNS name in its SAN entries, because TLS name matching requires the requested host to be covered.

For the alternative failure a service needs to rotate a pinned certificate without breaking trusting clients, the control Deploy and test a certificate trust-transition plan before retiring the old cert is relevant: coordinated trust rotation avoids certificate validation outages. Here the evidence instead is clients reject a valid-looking certificate because the hostname differs. The selected technical mechanism is Attach a certificate covering the requested DNS name in its SAN entries: TLS name matching requires the requested host to be covered.

The option Request/import the viewer certificate in us-east-1 for CloudFront addresses a separate condition: a CloudFront distribution uses a certificate requested outside its required region. CloudFront viewer ACM certificates have a specific regional requirement. The actual requirement is a service needs to rotate a pinned certificate without breaking trusting clients. Recommended corrective action: Deploy and test a certificate trust-transition plan before retiring the old cert. Coordinated trust rotation avoids certificate validation outages.

Attach a certificate covering the requested DNS name in its SAN entries would help if clients reject a valid-looking certificate because the hostname differs. TLS name matching requires the requested host to be covered. That is not the symptom described here: a service needs to rotate a pinned certificate without breaking trusting clients. The matching response is Deploy and test a certificate trust-transition plan before retiring the old cert, because coordinated trust rotation avoids certificate validation outages.

Request and attach an ACM-managed certificate with valid domain validation solves a different operational problem where an internet-facing ALB certificate expires during a product release. Managed ACM certificates can renew eligible public TLS certificates. It does not directly address a service needs to rotate a pinned certificate without breaking trusting clients. The case calls for Deploy and test a certificate trust-transition plan before retiring the old cert, since coordinated trust rotation avoids certificate validation outages.