Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Copy required snapshots to a second AWS Region with verified permissions addresses a separate condition: a backup must survive a regional outage. Cross-Region backup copies reduce regional single points of failure. The actual requirement is backups are successful but restoration duration exceeds the service RTO. Recommended corrective action: Run restoration exercises and tune snapshot/restore readiness or architecture. Backup completion alone does not prove recovery time objectives.

Create a supported AMI with block-device mappings and required snapshots would help if engineers assume an EBS snapshot is a bootable EC2 AMI automatically. An AMI includes launch metadata beyond a raw snapshot. That is not the symptom described here: backups are successful but restoration duration exceeds the service RTO. The matching response is Run restoration exercises and tune snapshot/restore readiness or architecture, because backup completion alone does not prove recovery time objectives.

Restore the snapshot as a volume in the instance's Availability Zone solves a different operational problem where a restored EBS volume is attached to an EC2 instance in another AZ. An EBS volume attaches to EC2 instances within its AZ. It does not directly address backups are successful but restoration duration exceeds the service RTO. The case calls for Run restoration exercises and tune snapshot/restore readiness or architecture, since backup completion alone does not prove recovery time objectives.

Share the eligible snapshot and required customer-managed encryption key access would help if an RDS snapshot must be accessible for restore from another account. Cross-account snapshot restore needs snapshot and KMS permissions. That is not the symptom described here: an RDS database must use encryption at rest before creation. The matching response is Enable RDS encryption with an approved KMS key at database creation, because rDS storage encryption is configured at creation for supported engines.

Require supported SSL/TLS connections with appropriate certificate verification solves a different operational problem where analysts want to encrypt all traffic from clients to RDS. Database client TLS protects data in transit. It does not directly address an RDS database must use encryption at rest before creation. The case calls for Enable RDS encryption with an approved KMS key at database creation, since rDS storage encryption is configured at creation for supported engines.

The competing option Enable automated RDS backups with sufficient retention and test PITR would be useful when a developer needs point-in-time rollback after an accidental SQL change. Automated backups enable recovery to selected moments in retention. The present issue is an RDS database must use encryption at rest before creation; it is more directly addressed by Enable RDS encryption with an approved KMS key at database creation. RDS storage encryption is configured at creation for supported engines.

Enable RDS encryption with an approved KMS key at database creation solves a different operational problem where an RDS database must use encryption at rest before creation. RDS storage encryption is configured at creation for supported engines. It does not directly address an existing unencrypted RDS instance must become encrypted. The case calls for Snapshot the instance and restore from an encrypted snapshot to a new instance, since existing unencrypted RDS storage cannot simply be toggled to encrypted in place.

The competing option Share the eligible snapshot and required customer-managed encryption key access would be useful when an RDS snapshot must be accessible for restore from another account. Cross-account snapshot restore needs snapshot and KMS permissions. The present issue is an existing unencrypted RDS instance must become encrypted; it is more directly addressed by Snapshot the instance and restore from an encrypted snapshot to a new instance. Existing unencrypted RDS storage cannot simply be toggled to encrypted in place.

The option Require supported SSL/TLS connections with appropriate certificate verification addresses a separate condition: analysts want to encrypt all traffic from clients to RDS. Database client TLS protects data in transit. The actual requirement is an existing unencrypted RDS instance must become encrypted. Recommended corrective action: Snapshot the instance and restore from an encrypted snapshot to a new instance. Existing unencrypted RDS storage cannot simply be toggled to encrypted in place.

Snapshot the instance and restore from an encrypted snapshot to a new instance solves a different operational problem where an existing unencrypted RDS instance must become encrypted. Existing unencrypted RDS storage cannot simply be toggled to encrypted in place. It does not directly address analysts want to encrypt all traffic from clients to RDS. The case calls for Require supported SSL/TLS connections with appropriate certificate verification, since database client TLS protects data in transit.

The option Share the eligible snapshot and required customer-managed encryption key access addresses a separate condition: an RDS snapshot must be accessible for restore from another account. Cross-account snapshot restore needs snapshot and KMS permissions. The actual requirement is analysts want to encrypt all traffic from clients to RDS. Recommended corrective action: Require supported SSL/TLS connections with appropriate certificate verification. Database client TLS protects data in transit.

Enable automated RDS backups with sufficient retention and test PITR would help if a developer needs point-in-time rollback after an accidental SQL change. Automated backups enable recovery to selected moments in retention. That is not the symptom described here: analysts want to encrypt all traffic from clients to RDS. The matching response is Require supported SSL/TLS connections with appropriate certificate verification, because database client TLS protects data in transit.

The option Snapshot the instance and restore from an encrypted snapshot to a new instance addresses a separate condition: an existing unencrypted RDS instance must become encrypted. Existing unencrypted RDS storage cannot simply be toggled to encrypted in place. The actual requirement is a developer needs point-in-time rollback after an accidental SQL change. Recommended corrective action: Enable automated RDS backups with sufficient retention and test PITR. Automated backups enable recovery to selected moments in retention.

Share the eligible snapshot and required customer-managed encryption key access would help if an RDS snapshot must be accessible for restore from another account. Cross-account snapshot restore needs snapshot and KMS permissions. That is not the symptom described here: a developer needs point-in-time rollback after an accidental SQL change. The matching response is Enable automated RDS backups with sufficient retention and test PITR, because automated backups enable recovery to selected moments in retention.

For the alternative failure analysts want to encrypt all traffic from clients to RDS, the control Require supported SSL/TLS connections with appropriate certificate verification is relevant: database client TLS protects data in transit. Here the evidence instead is a developer needs point-in-time rollback after an accidental SQL change. The selected technical mechanism is Enable automated RDS backups with sufficient retention and test PITR: automated backups enable recovery to selected moments in retention.

The option Require supported SSL/TLS connections with appropriate certificate verification addresses a separate condition: analysts want to encrypt all traffic from clients to RDS. Database client TLS protects data in transit. The actual requirement is an RDS snapshot must be accessible for restore from another account. Recommended corrective action: Share the eligible snapshot and required customer-managed encryption key access. Cross-account snapshot restore needs snapshot and KMS permissions.

Enable automated RDS backups with sufficient retention and test PITR would help if a developer needs point-in-time rollback after an accidental SQL change. Automated backups enable recovery to selected moments in retention. That is not the symptom described here: an RDS snapshot must be accessible for restore from another account. The matching response is Share the eligible snapshot and required customer-managed encryption key access, because cross-account snapshot restore needs snapshot and KMS permissions.

For the alternative failure an RDS database must use encryption at rest before creation, the control Enable RDS encryption with an approved KMS key at database creation is relevant: rDS storage encryption is configured at creation for supported engines. Here the evidence instead is an RDS snapshot must be accessible for restore from another account. The selected technical mechanism is Share the eligible snapshot and required customer-managed encryption key access: cross-account snapshot restore needs snapshot and KMS permissions.

Use version-aware secret retrieval with a bounded cache and reconnection logic would help if an application requires a secret refresh after a scheduled rotation. Rotated values must propagate to consumers safely. That is not the symptom described here: the app's database credential is embedded inside a container image. The matching response is Store the secret in Secrets Manager and inject it securely at runtime, because runtime secret access avoids shipping credentials within images.

Record key policy API activity in CloudTrail and alert as required solves a different operational problem where audit requires a record when a KMS key policy changes. KMS API management events provide key governance evidence. It does not directly address the app's database credential is embedded inside a container image. The case calls for Store the secret in Secrets Manager and inject it securely at runtime, since runtime secret access avoids shipping credentials within images.

The competing option Implement a custom rotation Lambda with controlled permissions and rollback would be useful when a credential manager needs rotation for an unsupported external service. Secrets Manager rotation workflows can invoke approved custom logic. The present issue is the app's database credential is embedded inside a container image; it is more directly addressed by Store the secret in Secrets Manager and inject it securely at runtime. Runtime secret access avoids shipping credentials within images.

For the alternative failure audit requires a record when a KMS key policy changes, the control Record key policy API activity in CloudTrail and alert as required is relevant: kMS API management events provide key governance evidence. Here the evidence instead is developers can modify KMS key policy and decrypt sensitive records. The selected technical mechanism is Separate key administration and key usage permissions: administrative KMS privileges need not include data decrypt rights.

Use version-aware secret retrieval with a bounded cache and reconnection logic solves a different operational problem where an application requires a secret refresh after a scheduled rotation. Rotated values must propagate to consumers safely. It does not directly address developers can modify KMS key policy and decrypt sensitive records. The case calls for Separate key administration and key usage permissions, since administrative KMS privileges need not include data decrypt rights.

The option Store the secret in Secrets Manager and inject it securely at runtime addresses a separate condition: the app's database credential is embedded inside a container image. Runtime secret access avoids shipping credentials within images. The actual requirement is developers can modify KMS key policy and decrypt sensitive records. Recommended corrective action: Separate key administration and key usage permissions. Administrative KMS privileges need not include data decrypt rights.

Implement a custom rotation Lambda with controlled permissions and rollback solves a different operational problem where a credential manager needs rotation for an unsupported external service. Secrets Manager rotation workflows can invoke approved custom logic. It does not directly address audit requires a record when a KMS key policy changes. The case calls for Record key policy API activity in CloudTrail and alert as required, since kMS API management events provide key governance evidence.

The competing option Separate key administration and key usage permissions would be useful when developers can modify KMS key policy and decrypt sensitive records. Administrative KMS privileges need not include data decrypt rights. The present issue is audit requires a record when a KMS key policy changes; it is more directly addressed by Record key policy API activity in CloudTrail and alert as required. KMS API management events provide key governance evidence.

Store the secret in Secrets Manager and inject it securely at runtime would help if the app's database credential is embedded inside a container image. Runtime secret access avoids shipping credentials within images. That is not the symptom described here: audit requires a record when a KMS key policy changes. The matching response is Record key policy API activity in CloudTrail and alert as required, because kMS API management events provide key governance evidence.

The competing option Implement a custom rotation Lambda with controlled permissions and rollback would be useful when a credential manager needs rotation for an unsupported external service. Secrets Manager rotation workflows can invoke approved custom logic. The present issue is an application requires a secret refresh after a scheduled rotation; it is more directly addressed by Use version-aware secret retrieval with a bounded cache and reconnection logic. Rotated values must propagate to consumers safely.

The option Store the secret in Secrets Manager and inject it securely at runtime addresses a separate condition: the app's database credential is embedded inside a container image. Runtime secret access avoids shipping credentials within images. The actual requirement is an application requires a secret refresh after a scheduled rotation. Recommended corrective action: Use version-aware secret retrieval with a bounded cache and reconnection logic. Rotated values must propagate to consumers safely.

Separate key administration and key usage permissions would help if developers can modify KMS key policy and decrypt sensitive records. Administrative KMS privileges need not include data decrypt rights. That is not the symptom described here: an application requires a secret refresh after a scheduled rotation. The matching response is Use version-aware secret retrieval with a bounded cache and reconnection logic, because rotated values must propagate to consumers safely.

The option Store the secret in Secrets Manager and inject it securely at runtime addresses a separate condition: the app's database credential is embedded inside a container image. Runtime secret access avoids shipping credentials within images. The actual requirement is a credential manager needs rotation for an unsupported external service. Recommended corrective action: Implement a custom rotation Lambda with controlled permissions and rollback. Secrets Manager rotation workflows can invoke approved custom logic.

Separate key administration and key usage permissions would help if developers can modify KMS key policy and decrypt sensitive records. Administrative KMS privileges need not include data decrypt rights. That is not the symptom described here: a credential manager needs rotation for an unsupported external service. The matching response is Implement a custom rotation Lambda with controlled permissions and rollback, because secrets Manager rotation workflows can invoke approved custom logic.

Use version-aware secret retrieval with a bounded cache and reconnection logic solves a different operational problem where an application requires a secret refresh after a scheduled rotation. Rotated values must propagate to consumers safely. It does not directly address a credential manager needs rotation for an unsupported external service. The case calls for Implement a custom rotation Lambda with controlled permissions and rollback, since secrets Manager rotation workflows can invoke approved custom logic.