Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Store the secret in Secrets Manager and inject it securely at runtime addresses a separate condition: the app's database credential is embedded inside a container image. Runtime secret access avoids shipping credentials within images. The actual requirement is a credential manager needs rotation for an unsupported external service. Recommended corrective action: Implement a custom rotation Lambda with controlled permissions and rollback. Secrets Manager rotation workflows can invoke approved custom logic.

Separate key administration and key usage permissions would help if developers can modify KMS key policy and decrypt sensitive records. Administrative KMS privileges need not include data decrypt rights. That is not the symptom described here: a credential manager needs rotation for an unsupported external service. The matching response is Implement a custom rotation Lambda with controlled permissions and rollback, because secrets Manager rotation workflows can invoke approved custom logic.

Use version-aware secret retrieval with a bounded cache and reconnection logic solves a different operational problem where an application requires a secret refresh after a scheduled rotation. Rotated values must propagate to consumers safely. It does not directly address a credential manager needs rotation for an unsupported external service. The case calls for Implement a custom rotation Lambda with controlled permissions and rollback, since secrets Manager rotation workflows can invoke approved custom logic.

Apply lifecycle/deletion processes with legal-hold and backup-retention checks would help if a data-retention policy requires deletion once lawful retention expires. Retention enforcement needs both expiration and hold-aware constraints. That is not the symptom described here: records must be stored in an approved geographical region. The matching response is Choose approved regional services and constrain deployment with organization guardrails, because region selection and guardrails support data residency controls.

For the alternative failure a reporting user can query all rows despite being assigned a restricted role, the control Enforce row-level access in the database query or application authorization layer is relevant: storage encryption alone does not implement row filtering. Here the evidence instead is records must be stored in an approved geographical region. The selected technical mechanism is Choose approved regional services and constrain deployment with organization guardrails: region selection and guardrails support data residency controls.

Tokenize or mask sensitive identifiers prior to downstream processing solves a different operational problem where a team needs to pseudonymize customer IDs before training analytics models. Reducing direct identifiers limits data disclosure impact. It does not directly address records must be stored in an approved geographical region. The case calls for Choose approved regional services and constrain deployment with organization guardrails, since region selection and guardrails support data residency controls.

For the alternative failure a security audit needs to know who read a particular S3 object, the control Enable S3 object-level CloudTrail data events for the targeted resources is relevant: s3 data events capture object API activity beyond management events. Here the evidence instead is a reporting user can query all rows despite being assigned a restricted role. The selected technical mechanism is Enforce row-level access in the database query or application authorization layer: storage encryption alone does not implement row filtering.

Apply lifecycle/deletion processes with legal-hold and backup-retention checks solves a different operational problem where a data-retention policy requires deletion once lawful retention expires. Retention enforcement needs both expiration and hold-aware constraints. It does not directly address a reporting user can query all rows despite being assigned a restricted role. The case calls for Enforce row-level access in the database query or application authorization layer, since storage encryption alone does not implement row filtering.

The competing option Tokenize or mask sensitive identifiers prior to downstream processing would be useful when a team needs to pseudonymize customer IDs before training analytics models. Reducing direct identifiers limits data disclosure impact. The present issue is a reporting user can query all rows despite being assigned a restricted role; it is more directly addressed by Enforce row-level access in the database query or application authorization layer. Storage encryption alone does not implement row filtering.

The competing option Apply lifecycle/deletion processes with legal-hold and backup-retention checks would be useful when a data-retention policy requires deletion once lawful retention expires. Retention enforcement needs both expiration and hold-aware constraints. The present issue is a team needs to pseudonymize customer IDs before training analytics models; it is more directly addressed by Tokenize or mask sensitive identifiers prior to downstream processing. Reducing direct identifiers limits data disclosure impact.

The option Enforce row-level access in the database query or application authorization layer addresses a separate condition: a reporting user can query all rows despite being assigned a restricted role. Storage encryption alone does not implement row filtering. The actual requirement is a team needs to pseudonymize customer IDs before training analytics models. Recommended corrective action: Tokenize or mask sensitive identifiers prior to downstream processing. Reducing direct identifiers limits data disclosure impact.

Enable S3 object-level CloudTrail data events for the targeted resources would help if a security audit needs to know who read a particular S3 object. S3 data events capture object API activity beyond management events. That is not the symptom described here: a team needs to pseudonymize customer IDs before training analytics models. The matching response is Tokenize or mask sensitive identifiers prior to downstream processing, because reducing direct identifiers limits data disclosure impact.

The competing option Choose approved regional services and constrain deployment with organization guardrails would be useful when records must be stored in an approved geographical region. Region selection and guardrails support data residency controls. The present issue is a security audit needs to know who read a particular S3 object; it is more directly addressed by Enable S3 object-level CloudTrail data events for the targeted resources. S3 data events capture object API activity beyond management events.

The option Tokenize or mask sensitive identifiers prior to downstream processing addresses a separate condition: a team needs to pseudonymize customer IDs before training analytics models. Reducing direct identifiers limits data disclosure impact. The actual requirement is a security audit needs to know who read a particular S3 object. Recommended corrective action: Enable S3 object-level CloudTrail data events for the targeted resources. S3 data events capture object API activity beyond management events.

For the alternative failure a reporting user can query all rows despite being assigned a restricted role, the control Enforce row-level access in the database query or application authorization layer is relevant: storage encryption alone does not implement row filtering. Here the evidence instead is a security audit needs to know who read a particular S3 object. The selected technical mechanism is Enable S3 object-level CloudTrail data events for the targeted resources: s3 data events capture object API activity beyond management events.

The option Choose approved regional services and constrain deployment with organization guardrails addresses a separate condition: records must be stored in an approved geographical region. Region selection and guardrails support data residency controls. The actual requirement is a data-retention policy requires deletion once lawful retention expires. Recommended corrective action: Apply lifecycle/deletion processes with legal-hold and backup-retention checks. Retention enforcement needs both expiration and hold-aware constraints.

Tokenize or mask sensitive identifiers prior to downstream processing would help if a team needs to pseudonymize customer IDs before training analytics models. Reducing direct identifiers limits data disclosure impact. That is not the symptom described here: a data-retention policy requires deletion once lawful retention expires. The matching response is Apply lifecycle/deletion processes with legal-hold and backup-retention checks, because retention enforcement needs both expiration and hold-aware constraints.

For the alternative failure a reporting user can query all rows despite being assigned a restricted role, the control Enforce row-level access in the database query or application authorization layer is relevant: storage encryption alone does not implement row filtering. Here the evidence instead is a data-retention policy requires deletion once lawful retention expires. The selected technical mechanism is Apply lifecycle/deletion processes with legal-hold and backup-retention checks: retention enforcement needs both expiration and hold-aware constraints.

Configure supported ownership settings and log service delivery permissions would help if a log-delivery bucket must reject writes that lack the expected object ownership behavior. Object Ownership and service principal permissions must align. That is not the symptom described here: service logs cannot be written to a KMS-encrypted destination because the delivery role lacks key access. The matching response is Allow the supported log delivery principal to use the intended KMS encryption key, because log delivery requires key permissions where SSE-KMS is supported.

Inspect S3 object encryption metadata and associated CloudTrail/KMS events solves a different operational problem where a customer enables encryption but has no evidence of which key was used. Encryption attributes and KMS audit traces support verification. It does not directly address service logs cannot be written to a KMS-encrypted destination because the delivery role lacks key access. The case calls for Allow the supported log delivery principal to use the intended KMS encryption key, since log delivery requires key permissions where SSE-KMS is supported.

The competing option Deny unapproved delete operations and apply retention locks as needed would be useful when a bucket used for centralized logs allows developers to delete audit records. Audit integrity requires explicit object deletion protections. The present issue is service logs cannot be written to a KMS-encrypted destination because the delivery role lacks key access; it is more directly addressed by Allow the supported log delivery principal to use the intended KMS encryption key. Log delivery requires key permissions where SSE-KMS is supported.

For the alternative failure service logs cannot be written to a KMS-encrypted destination because the delivery role lacks key access, the control Allow the supported log delivery principal to use the intended KMS encryption key is relevant: log delivery requires key permissions where SSE-KMS is supported. Here the evidence instead is a customer enables encryption but has no evidence of which key was used. The selected technical mechanism is Inspect S3 object encryption metadata and associated CloudTrail/KMS events: encryption attributes and KMS audit traces support verification.

Deny unapproved delete operations and apply retention locks as needed solves a different operational problem where a bucket used for centralized logs allows developers to delete audit records. Audit integrity requires explicit object deletion protections. It does not directly address a customer enables encryption but has no evidence of which key was used. The case calls for Inspect S3 object encryption metadata and associated CloudTrail/KMS events, since encryption attributes and KMS audit traces support verification.

The option Restrict PutObject to the approved log-delivery principal and target prefix addresses a separate condition: an S3 bucket's policy grants wildcard access to PutObject but not to read. Narrow log delivery permissions avoid indiscriminate object creation. The actual requirement is a customer enables encryption but has no evidence of which key was used. Recommended corrective action: Inspect S3 object encryption metadata and associated CloudTrail/KMS events. Encryption attributes and KMS audit traces support verification.

Inspect S3 object encryption metadata and associated CloudTrail/KMS events solves a different operational problem where a customer enables encryption but has no evidence of which key was used. Encryption attributes and KMS audit traces support verification. It does not directly address a bucket used for centralized logs allows developers to delete audit records. The case calls for Deny unapproved delete operations and apply retention locks as needed, since audit integrity requires explicit object deletion protections.

The competing option Configure supported ownership settings and log service delivery permissions would be useful when a log-delivery bucket must reject writes that lack the expected object ownership behavior. Object Ownership and service principal permissions must align. The present issue is a bucket used for centralized logs allows developers to delete audit records; it is more directly addressed by Deny unapproved delete operations and apply retention locks as needed. Audit integrity requires explicit object deletion protections.

Restrict PutObject to the approved log-delivery principal and target prefix would help if an S3 bucket's policy grants wildcard access to PutObject but not to read. Narrow log delivery permissions avoid indiscriminate object creation. That is not the symptom described here: a bucket used for centralized logs allows developers to delete audit records. The matching response is Deny unapproved delete operations and apply retention locks as needed, because audit integrity requires explicit object deletion protections.

The competing option Allow the supported log delivery principal to use the intended KMS encryption key would be useful when service logs cannot be written to a KMS-encrypted destination because the delivery role lacks key access. Log delivery requires key permissions where SSE-KMS is supported. The present issue is an S3 bucket's policy grants wildcard access to PutObject but not to read; it is more directly addressed by Restrict PutObject to the approved log-delivery principal and target prefix. Narrow log delivery permissions avoid indiscriminate object creation.

The option Inspect S3 object encryption metadata and associated CloudTrail/KMS events addresses a separate condition: a customer enables encryption but has no evidence of which key was used. Encryption attributes and KMS audit traces support verification. The actual requirement is an S3 bucket's policy grants wildcard access to PutObject but not to read. Recommended corrective action: Restrict PutObject to the approved log-delivery principal and target prefix. Narrow log delivery permissions avoid indiscriminate object creation.

Deny unapproved delete operations and apply retention locks as needed would help if a bucket used for centralized logs allows developers to delete audit records. Audit integrity requires explicit object deletion protections. That is not the symptom described here: an S3 bucket's policy grants wildcard access to PutObject but not to read. The matching response is Restrict PutObject to the approved log-delivery principal and target prefix, because narrow log delivery permissions avoid indiscriminate object creation.

The option Allow the supported log delivery principal to use the intended KMS encryption key addresses a separate condition: service logs cannot be written to a KMS-encrypted destination because the delivery role lacks key access. Log delivery requires key permissions where SSE-KMS is supported. The actual requirement is a log-delivery bucket must reject writes that lack the expected object ownership behavior. Recommended corrective action: Configure supported ownership settings and log service delivery permissions. Object Ownership and service principal permissions must align.

Restrict PutObject to the approved log-delivery principal and target prefix would help if an S3 bucket's policy grants wildcard access to PutObject but not to read. Narrow log delivery permissions avoid indiscriminate object creation. That is not the symptom described here: a log-delivery bucket must reject writes that lack the expected object ownership behavior. The matching response is Configure supported ownership settings and log service delivery permissions, because object Ownership and service principal permissions must align.

Inspect S3 object encryption metadata and associated CloudTrail/KMS events solves a different operational problem where a customer enables encryption but has no evidence of which key was used. Encryption attributes and KMS audit traces support verification. It does not directly address a log-delivery bucket must reject writes that lack the expected object ownership behavior. The case calls for Configure supported ownership settings and log service delivery permissions, since object Ownership and service principal permissions must align.