Amazon AWS Certified Solutions Architect - Professional SAP-C02 Bundle

Configure ECS service health-based replacement and load balancer health checks would address a different requirement: An ECS service's health check repeatedly fails and operators currently restart tasks manually. ECS services replace unhealthy tasks to restore desired capacity.

For the separate situation A regional failover requires two operators to approve any data-writer promotion, Orchestrate the failover with Step Functions approval steps and audited transitions could be useful. Human approval gates prevent automated promotion from violating recovery governance.

Define CloudWatch alarms on application errors and saturation signals with escalations solves the related scenario A cloud application must alert on elevated end-user error rate before its database exhausts connections; leading health and capacity signals trigger response before failure is total.

For the separate situation A private RDS database must never have an internet-routable endpoint, Deploy RDS in private subnets with public accessibility disabled and scoped security groups could be useful. Private subnet placement and endpoint settings eliminate direct public database reachability.

Apply narrowly scoped inbound security-group rules and complementary network controls solves the related scenario A development team permits outbound HTTPS broadly but must restrict server access to approved business CIDRs; security groups are stateful instance-level allow rules, not blanket organization-wide access grants.

Route IPv6 egress through an egress-only internet gateway would address a different requirement: A public service uses IPv6 and needs outbound-only initiated connections without unsolicited inbound IPv6 routes. Egress-only gateways permit initiated IPv6 access without open inbound internet routing.

Deploy RDS in private subnets with public accessibility disabled and scoped security groups solves the related scenario A private RDS database must never have an internet-routable endpoint; private subnet placement and endpoint settings eliminate direct public database reachability.

Although Apply narrowly scoped inbound security-group rules and complementary network controls can be valid when A development team permits outbound HTTPS broadly but must restrict server access to approved business CIDRs, it targets a different technical condition. Security groups are stateful instance-level allow rules, not blanket organization-wide access grants.

Configure the application security group ingress with the ALB security group as source would address a different requirement: An internet-facing ALB must reach a private app tier while the app tier must accept only ALB traffic. Security-group references bind access to the intended upstream tier.

Although Route IPv6 egress through an egress-only internet gateway can be valid when A public service uses IPv6 and needs outbound-only initiated connections without unsolicited inbound IPv6 routes, it targets a different technical condition. Egress-only gateways permit initiated IPv6 access without open inbound internet routing.

Configure the application security group ingress with the ALB security group as source would address a different requirement: An internet-facing ALB must reach a private app tier while the app tier must accept only ALB traffic. Security-group references bind access to the intended upstream tier.

This alternative, Add explicit deny entries in subnet network ACLs in correct numerical order, is appropriate when A bank needs stateless subnet-wide deny rules for a known prohibited IP range. NACLs support stateless allow and deny processing with ordered rules.

This alternative, Configure the application security group ingress with the ALB security group as source, is appropriate when An internet-facing ALB must reach a private app tier while the app tier must accept only ALB traffic. Security-group references bind access to the intended upstream tier.

For the separate situation A private RDS database must never have an internet-routable endpoint, Deploy RDS in private subnets with public accessibility disabled and scoped security groups could be useful. Private subnet placement and endpoint settings eliminate direct public database reachability.

Route IPv6 egress through an egress-only internet gateway solves the related scenario A public service uses IPv6 and needs outbound-only initiated connections without unsolicited inbound IPv6 routes; egress-only gateways permit initiated IPv6 access without open inbound internet routing.

For the separate situation A private RDS database must never have an internet-routable endpoint, Deploy RDS in private subnets with public accessibility disabled and scoped security groups could be useful. Private subnet placement and endpoint settings eliminate direct public database reachability.

Apply narrowly scoped inbound security-group rules and complementary network controls solves the related scenario A development team permits outbound HTTPS broadly but must restrict server access to approved business CIDRs; security groups are stateful instance-level allow rules, not blanket organization-wide access grants.

Although Add explicit deny entries in subnet network ACLs in correct numerical order can be valid when A bank needs stateless subnet-wide deny rules for a known prohibited IP range, it targets a different technical condition. NACLs support stateless allow and deny processing with ordered rules.

Enforce strong workforce MFA through federated identity and use roles for service workloads solves the related scenario An organization requires MFA for human console access while backend EC2 services run unattended; human sign-in controls and machine roles are separate identity responsibilities.

Although Use IAM Access Analyzer policy checks and least-privilege review to narrow actions and resources can be valid when A team must detect wildcard permissions newly granted to production roles, it targets a different technical condition. Policy analysis helps identify overly broad rights before deployment.

Have a trusted backend issue short-lived S3 presigned upload URLs with restricted conditions would address a different requirement: A browser app must upload objects without receiving long-lived AWS access keys. Presigned requests delegate bounded object operations without exposing backend credentials.

Although Use IAM Access Analyzer policy checks and least-privilege review to narrow actions and resources can be valid when A team must detect wildcard permissions newly granted to production roles, it targets a different technical condition. Policy analysis helps identify overly broad rights before deployment.

Configure execution identity and the Lambda resource-based invoke permission for the trusted principal would address a different requirement: A service in one account needs to invoke a private Lambda function in a second account. Cross-account Lambda invocation requires the function policy to authorize the caller.

This alternative, Enforce strong workforce MFA through federated identity and use roles for service workloads, is appropriate when An organization requires MFA for human console access while backend EC2 services run unattended. Human sign-in controls and machine roles are separate identity responsibilities.

Attach an execution role policy scoped to the table ARN and required actions would address a different requirement: A Lambda function needs to read only one named DynamoDB table and no other table. Resource-scoped role permissions limit data access to the intended table.

This alternative, Have a trusted backend issue short-lived S3 presigned upload URLs with restricted conditions, is appropriate when A browser app must upload objects without receiving long-lived AWS access keys. Presigned requests delegate bounded object operations without exposing backend credentials.

For the separate situation An organization requires MFA for human console access while backend EC2 services run unattended, Enforce strong workforce MFA through federated identity and use roles for service workloads could be useful. Human sign-in controls and machine roles are separate identity responsibilities.

This alternative, Have a trusted backend issue short-lived S3 presigned upload URLs with restricted conditions, is appropriate when A browser app must upload objects without receiving long-lived AWS access keys. Presigned requests delegate bounded object operations without exposing backend credentials.

Use IAM Access Analyzer policy checks and least-privilege review to narrow actions and resources solves the related scenario A team must detect wildcard permissions newly granted to production roles; policy analysis helps identify overly broad rights before deployment.

Although Attach an execution role policy scoped to the table ARN and required actions can be valid when A Lambda function needs to read only one named DynamoDB table and no other table, it targets a different technical condition. Resource-scoped role permissions limit data access to the intended table.

For the separate situation An organization requires MFA for human console access while backend EC2 services run unattended, Enforce strong workforce MFA through federated identity and use roles for service workloads could be useful. Human sign-in controls and machine roles are separate identity responsibilities.

Attach an execution role policy scoped to the table ARN and required actions solves the related scenario A Lambda function needs to read only one named DynamoDB table and no other table; resource-scoped role permissions limit data access to the intended table.

Configure execution identity and the Lambda resource-based invoke permission for the trusted principal would address a different requirement: A service in one account needs to invoke a private Lambda function in a second account. Cross-account Lambda invocation requires the function policy to authorize the caller.