Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

Restore supported DNS validation CNAME records for ACM renewal would help if certificate renewal fails because DNS validation records were deleted. DNS-validated certificates require ongoing domain-validation evidence. That is not the symptom described here: an application uses HTTPS to a server but disables certificate validation. The matching response is Enable client hostname and certificate-chain verification, because TLS without peer validation cannot reliably authenticate the endpoint.

For the alternative failure clients reject a renewed certificate because its SAN does not include the API hostname, the control Request the certificate with required subject alternative names is relevant: sAN coverage is required for TLS host matching. Here the evidence instead is an application uses HTTPS to a server but disables certificate validation. The selected technical mechanism is Enable client hostname and certificate-chain verification: TLS without peer validation cannot reliably authenticate the endpoint.

Use ACM-managed public certificates and attach them to supported listeners solves a different operational problem where private key material is copied across engineer laptops to deploy ALB certificates. Managed TLS avoids distributing private keys across hosts. It does not directly address an application uses HTTPS to a server but disables certificate validation. The case calls for Enable client hostname and certificate-chain verification, since TLS without peer validation cannot reliably authenticate the endpoint.

Cancel deletion and review dependent ciphertext and retention needs would help if a KMS key is scheduled for deletion before encrypted backups expire. Deleting the only decrypt key can render remaining data unrecoverable. That is not the symptom described here: a key policy allows arbitrary decrypt attempts from unintended applications. The matching response is Restrict approved kms:Decrypt requests with appropriate encryption-context conditions, because kMS encryption context can bind key use to a specific workload.

Use an appropriately constrained KMS grant for the service principal solves a different operational problem where a service supports KMS grants and needs time-bounded access for an AWS resource. KMS grants authorize specified cryptographic operations under conditions. It does not directly address a key policy allows arbitrary decrypt attempts from unintended applications. The case calls for Restrict approved kms:Decrypt requests with appropriate encryption-context conditions, since kMS encryption context can bind key use to a specific workload.

The competing option Implement IAM/key-policy separation and CloudTrail monitoring of KMS state changes would be useful when a customer managed key needs an auditable disable/enable approval process. Key lifecycle changes require controlled administrative authority. The present issue is a key policy allows arbitrary decrypt attempts from unintended applications; it is more directly addressed by Restrict approved kms:Decrypt requests with appropriate encryption-context conditions. KMS encryption context can bind key use to a specific workload.

Cancel deletion and review dependent ciphertext and retention needs solves a different operational problem where a KMS key is scheduled for deletion before encrypted backups expire. Deleting the only decrypt key can render remaining data unrecoverable. It does not directly address a service supports KMS grants and needs time-bounded access for an AWS resource. The case calls for Use an appropriately constrained KMS grant for the service principal, since kMS grants authorize specified cryptographic operations under conditions.

The competing option Implement IAM/key-policy separation and CloudTrail monitoring of KMS state changes would be useful when a customer managed key needs an auditable disable/enable approval process. Key lifecycle changes require controlled administrative authority. The present issue is a service supports KMS grants and needs time-bounded access for an AWS resource; it is more directly addressed by Use an appropriately constrained KMS grant for the service principal. KMS grants authorize specified cryptographic operations under conditions.

The option Remove plaintext key logging and keep decrypted key material in volatile protected memory addresses a separate condition: a data key is encrypted but its plaintext is accidentally logged. Envelope encryption still requires protecting in-memory plaintext keys. The actual requirement is a service supports KMS grants and needs time-bounded access for an AWS resource. Recommended corrective action: Use an appropriately constrained KMS grant for the service principal. KMS grants authorize specified cryptographic operations under conditions.

Cancel deletion and review dependent ciphertext and retention needs solves a different operational problem where a KMS key is scheduled for deletion before encrypted backups expire. Deleting the only decrypt key can render remaining data unrecoverable. It does not directly address a data key is encrypted but its plaintext is accidentally logged. The case calls for Remove plaintext key logging and keep decrypted key material in volatile protected memory, since envelope encryption still requires protecting in-memory plaintext keys.

The competing option Restrict approved kms:Decrypt requests with appropriate encryption-context conditions would be useful when a key policy allows arbitrary decrypt attempts from unintended applications. KMS encryption context can bind key use to a specific workload. The present issue is a data key is encrypted but its plaintext is accidentally logged; it is more directly addressed by Remove plaintext key logging and keep decrypted key material in volatile protected memory. Envelope encryption still requires protecting in-memory plaintext keys.

Use an appropriately constrained KMS grant for the service principal would help if a service supports KMS grants and needs time-bounded access for an AWS resource. KMS grants authorize specified cryptographic operations under conditions. That is not the symptom described here: a data key is encrypted but its plaintext is accidentally logged. The matching response is Remove plaintext key logging and keep decrypted key material in volatile protected memory, because envelope encryption still requires protecting in-memory plaintext keys.

The competing option Remove plaintext key logging and keep decrypted key material in volatile protected memory would be useful when a data key is encrypted but its plaintext is accidentally logged. Envelope encryption still requires protecting in-memory plaintext keys. The present issue is a KMS key is scheduled for deletion before encrypted backups expire; it is more directly addressed by Cancel deletion and review dependent ciphertext and retention needs. Deleting the only decrypt key can render remaining data unrecoverable.

The option Use an appropriately constrained KMS grant for the service principal addresses a separate condition: a service supports KMS grants and needs time-bounded access for an AWS resource. KMS grants authorize specified cryptographic operations under conditions. The actual requirement is a KMS key is scheduled for deletion before encrypted backups expire. Recommended corrective action: Cancel deletion and review dependent ciphertext and retention needs. Deleting the only decrypt key can render remaining data unrecoverable.

Implement IAM/key-policy separation and CloudTrail monitoring of KMS state changes would help if a customer managed key needs an auditable disable/enable approval process. Key lifecycle changes require controlled administrative authority. That is not the symptom described here: a KMS key is scheduled for deletion before encrypted backups expire. The matching response is Cancel deletion and review dependent ciphertext and retention needs, because deleting the only decrypt key can render remaining data unrecoverable.

The option Restrict approved kms:Decrypt requests with appropriate encryption-context conditions addresses a separate condition: a key policy allows arbitrary decrypt attempts from unintended applications. KMS encryption context can bind key use to a specific workload. The actual requirement is a customer managed key needs an auditable disable/enable approval process. Recommended corrective action: Implement IAM/key-policy separation and CloudTrail monitoring of KMS state changes. Key lifecycle changes require controlled administrative authority.

Remove plaintext key logging and keep decrypted key material in volatile protected memory would help if a data key is encrypted but its plaintext is accidentally logged. Envelope encryption still requires protecting in-memory plaintext keys. That is not the symptom described here: a customer managed key needs an auditable disable/enable approval process. The matching response is Implement IAM/key-policy separation and CloudTrail monitoring of KMS state changes, because key lifecycle changes require controlled administrative authority.

For the alternative failure a KMS key is scheduled for deletion before encrypted backups expire, the control Cancel deletion and review dependent ciphertext and retention needs is relevant: deleting the only decrypt key can render remaining data unrecoverable. Here the evidence instead is a customer managed key needs an auditable disable/enable approval process. The selected technical mechanism is Implement IAM/key-policy separation and CloudTrail monitoring of KMS state changes: key lifecycle changes require controlled administrative authority.

Grant only secret-specific read actions to its role and key-decrypt when required would help if an AWS service should access a secret without broad administrator permission. Service roles should not inherit global secret-management powers. That is not the symptom described here: a Lambda runtime has environment secrets encrypted using an AWS managed key but policy demands customer key control. The matching response is Configure a customer managed KMS key for supported Lambda environment encryption, because customer managed keys allow more key policy oversight.

For the alternative failure an ECS task logs injected secret values on startup, the control Avoid logging secret environment values and restrict container log viewers is relevant: log confidentiality is separate from runtime secret injection. Here the evidence instead is a Lambda runtime has environment secrets encrypted using an AWS managed key but policy demands customer key control. The selected technical mechanism is Configure a customer managed KMS key for supported Lambda environment encryption: customer managed keys allow more key policy oversight.

The competing option Pass secret references and retrieve sensitive values within restricted tasks would be useful when a Step Functions workflow stores a token in its visible state history. Workflow execution histories may expose state data to readers. The present issue is a Lambda runtime has environment secrets encrypted using an AWS managed key but policy demands customer key control; it is more directly addressed by Configure a customer managed KMS key for supported Lambda environment encryption. Customer managed keys allow more key policy oversight.

For the alternative failure an ECS task logs injected secret values on startup, the control Avoid logging secret environment values and restrict container log viewers is relevant: log confidentiality is separate from runtime secret injection. Here the evidence instead is a Step Functions workflow stores a token in its visible state history. The selected technical mechanism is Pass secret references and retrieve sensitive values within restricted tasks: workflow execution histories may expose state data to readers.

Grant only secret-specific read actions to its role and key-decrypt when required solves a different operational problem where an AWS service should access a secret without broad administrator permission. Service roles should not inherit global secret-management powers. It does not directly address a Step Functions workflow stores a token in its visible state history. The case calls for Pass secret references and retrieve sensitive values within restricted tasks, since workflow execution histories may expose state data to readers.

The competing option Configure a customer managed KMS key for supported Lambda environment encryption would be useful when a Lambda runtime has environment secrets encrypted using an AWS managed key but policy demands customer key control. Customer managed keys allow more key policy oversight. The present issue is a Step Functions workflow stores a token in its visible state history; it is more directly addressed by Pass secret references and retrieve sensitive values within restricted tasks. Workflow execution histories may expose state data to readers.

Restart or redeploy affected tasks to load refreshed injected secrets solves a different operational problem where a secret is rotated but an ECS service retains old environment values. Environment-injected secrets do not automatically refresh running containers. It does not directly address an ECS task logs injected secret values on startup. The case calls for Avoid logging secret environment values and restrict container log viewers, since log confidentiality is separate from runtime secret injection.

The competing option Grant only secret-specific read actions to its role and key-decrypt when required would be useful when an AWS service should access a secret without broad administrator permission. Service roles should not inherit global secret-management powers. The present issue is an ECS task logs injected secret values on startup; it is more directly addressed by Avoid logging secret environment values and restrict container log viewers. Log confidentiality is separate from runtime secret injection.

Configure a customer managed KMS key for supported Lambda environment encryption would help if a Lambda runtime has environment secrets encrypted using an AWS managed key but policy demands customer key control. Customer managed keys allow more key policy oversight. That is not the symptom described here: an ECS task logs injected secret values on startup. The matching response is Avoid logging secret environment values and restrict container log viewers, because log confidentiality is separate from runtime secret injection.

The competing option Avoid logging secret environment values and restrict container log viewers would be useful when an ECS task logs injected secret values on startup. Log confidentiality is separate from runtime secret injection. The present issue is a secret is rotated but an ECS service retains old environment values; it is more directly addressed by Restart or redeploy affected tasks to load refreshed injected secrets. Environment-injected secrets do not automatically refresh running containers.

The option Configure a customer managed KMS key for supported Lambda environment encryption addresses a separate condition: a Lambda runtime has environment secrets encrypted using an AWS managed key but policy demands customer key control. Customer managed keys allow more key policy oversight. The actual requirement is a secret is rotated but an ECS service retains old environment values. Recommended corrective action: Restart or redeploy affected tasks to load refreshed injected secrets. Environment-injected secrets do not automatically refresh running containers.

Pass secret references and retrieve sensitive values within restricted tasks would help if a Step Functions workflow stores a token in its visible state history. Workflow execution histories may expose state data to readers. That is not the symptom described here: a secret is rotated but an ECS service retains old environment values. The matching response is Restart or redeploy affected tasks to load refreshed injected secrets, because environment-injected secrets do not automatically refresh running containers.

Configure a customer managed KMS key for supported Lambda environment encryption would help if a Lambda runtime has environment secrets encrypted using an AWS managed key but policy demands customer key control. Customer managed keys allow more key policy oversight. That is not the symptom described here: an AWS service should access a secret without broad administrator permission. The matching response is Grant only secret-specific read actions to its role and key-decrypt when required, because service roles should not inherit global secret-management powers.

For the alternative failure a secret is rotated but an ECS service retains old environment values, the control Restart or redeploy affected tasks to load refreshed injected secrets is relevant: environment-injected secrets do not automatically refresh running containers. Here the evidence instead is an AWS service should access a secret without broad administrator permission. The selected technical mechanism is Grant only secret-specific read actions to its role and key-decrypt when required: service roles should not inherit global secret-management powers.

Avoid logging secret environment values and restrict container log viewers solves a different operational problem where an ECS task logs injected secret values on startup. Log confidentiality is separate from runtime secret injection. It does not directly address an AWS service should access a secret without broad administrator permission. The case calls for Grant only secret-specific read actions to its role and key-decrypt when required, since service roles should not inherit global secret-management powers.