Amazon AWS Certified Solutions Architect - Professional SAP-C02 Bundle

For the separate situation An organization requires MFA for human console access while backend EC2 services run unattended, Enforce strong workforce MFA through federated identity and use roles for service workloads could be useful. Human sign-in controls and machine roles are separate identity responsibilities.

Attach an execution role policy scoped to the table ARN and required actions solves the related scenario A Lambda function needs to read only one named DynamoDB table and no other table; resource-scoped role permissions limit data access to the intended table.

Configure execution identity and the Lambda resource-based invoke permission for the trusted principal would address a different requirement: A service in one account needs to invoke a private Lambda function in a second account. Cross-account Lambda invocation requires the function policy to authorize the caller.

Enforce permitted encryption headers and key conditions with S3 bucket policies where applicable would address a different requirement: A confidential S3 archive must prevent inadvertent plaintext uploads by older clients. Bucket policy conditions reject uploads that do not meet stated encryption requirements.

This alternative, Attach a valid ACM public certificate to the public Application Load Balancer HTTPS listener, is appropriate when A payment API must terminate public TLS with managed certificate lifecycle. ALB TLS listeners integrate certificate management with traffic termination.

For the separate situation A data-processing job needs to decrypt its source KMS data key but must not administer the key, Grant the job role only the needed KMS decrypt permissions and applicable key-policy authorization could be useful. Key-use privileges can be separated from KMS administrative rights.

Set SSE-KMS default encryption and tightly scope key and bucket policies would address a different requirement: An S3-based data lake must encrypt new objects under a centrally controlled customer-managed key. SSE-KMS combines S3 data encryption with auditable customer-managed key authorization.

This alternative, Require TLS on internal service connections with suitable certificate issuance and trust, is appropriate when A new multi-Region application must use HTTPS between internal microservices, not just at the public ALB. Public-edge TLS termination alone does not encrypt internal application hops.

For the separate situation A confidential S3 archive must prevent inadvertent plaintext uploads by older clients, Enforce permitted encryption headers and key conditions with S3 bucket policies where applicable could be useful. Bucket policy conditions reject uploads that do not meet stated encryption requirements.

This alternative, Require TLS on internal service connections with suitable certificate issuance and trust, is appropriate when A new multi-Region application must use HTTPS between internal microservices, not just at the public ALB. Public-edge TLS termination alone does not encrypt internal application hops.

For the separate situation A confidential S3 archive must prevent inadvertent plaintext uploads by older clients, Enforce permitted encryption headers and key conditions with S3 bucket policies where applicable could be useful. Bucket policy conditions reject uploads that do not meet stated encryption requirements.

Attach a valid ACM public certificate to the public Application Load Balancer HTTPS listener solves the related scenario A payment API must terminate public TLS with managed certificate lifecycle; aLB TLS listeners integrate certificate management with traffic termination.

For the separate situation A data-processing job needs to decrypt its source KMS data key but must not administer the key, Grant the job role only the needed KMS decrypt permissions and applicable key-policy authorization could be useful. Key-use privileges can be separated from KMS administrative rights.

Set SSE-KMS default encryption and tightly scope key and bucket policies solves the related scenario An S3-based data lake must encrypt new objects under a centrally controlled customer-managed key; sSE-KMS combines S3 data encryption with auditable customer-managed key authorization.

Attach a valid ACM public certificate to the public Application Load Balancer HTTPS listener would address a different requirement: A payment API must terminate public TLS with managed certificate lifecycle. ALB TLS listeners integrate certificate management with traffic termination.

Set SSE-KMS default encryption and tightly scope key and bucket policies solves the related scenario An S3-based data lake must encrypt new objects under a centrally controlled customer-managed key; sSE-KMS combines S3 data encryption with auditable customer-managed key authorization.

Although Attach a valid ACM public certificate to the public Application Load Balancer HTTPS listener can be valid when A payment API must terminate public TLS with managed certificate lifecycle, it targets a different technical condition. ALB TLS listeners integrate certificate management with traffic termination.

This alternative, Require TLS on internal service connections with suitable certificate issuance and trust, is appropriate when A new multi-Region application must use HTTPS between internal microservices, not just at the public ALB. Public-edge TLS termination alone does not encrypt internal application hops.

Evaluate AWS Shield Advanced and appropriate protected resources would address a different requirement: A public service must withstand large volumetric DDoS events and needs specialized incident support. Shield Advanced adds advanced DDoS capabilities and response support beyond standard protections.

This alternative, Use GuardDuty threat findings and an approved isolation response procedure, is appropriate when A container workload shows suspicious outbound calls to a known command-and-control address. GuardDuty detects suspicious account and network behavior for investigation.

For the separate situation A public web server needs managed prevention for known malicious SQL-injection patterns, Enable suitable AWS WAF managed rule groups with staged false-positive evaluation could be useful. Managed WAF rules inspect web requests for common attack signatures.

This alternative, Use GuardDuty threat findings and an approved isolation response procedure, is appropriate when A container workload shows suspicious outbound calls to a known command-and-control address. GuardDuty detects suspicious account and network behavior for investigation.

For the separate situation A production VPC needs inline stateful filtering of suspicious east-west and egress traffic, Route relevant paths through AWS Network Firewall endpoints and rule groups could be useful. Stateful network inspection applies packet and protocol policy beyond HTTP-only WAF.

Attach AWS WAF rate-based rules to the protected API or CloudFront distribution solves the related scenario A public API experiences HTTP request flooding and needs customizable managed request-rate blocking; aWS WAF filters HTTP-layer requests using configurable web ACL rules.

For the separate situation A production VPC needs inline stateful filtering of suspicious east-west and egress traffic, Route relevant paths through AWS Network Firewall endpoints and rule groups could be useful. Stateful network inspection applies packet and protocol policy beyond HTTP-only WAF.

Attach AWS WAF rate-based rules to the protected API or CloudFront distribution solves the related scenario A public API experiences HTTP request flooding and needs customizable managed request-rate blocking; aWS WAF filters HTTP-layer requests using configurable web ACL rules.

Enable suitable AWS WAF managed rule groups with staged false-positive evaluation would address a different requirement: A public web server needs managed prevention for known malicious SQL-injection patterns. Managed WAF rules inspect web requests for common attack signatures.

Although Evaluate AWS Shield Advanced and appropriate protected resources can be valid when A public service must withstand large volumetric DDoS events and needs specialized incident support, it targets a different technical condition. Shield Advanced adds advanced DDoS capabilities and response support beyond standard protections.

Use GuardDuty threat findings and an approved isolation response procedure would address a different requirement: A container workload shows suspicious outbound calls to a known command-and-control address. GuardDuty detects suspicious account and network behavior for investigation.

This alternative, Route relevant paths through AWS Network Firewall endpoints and rule groups, is appropriate when A production VPC needs inline stateful filtering of suspicious east-west and egress traffic. Stateful network inspection applies packet and protocol policy beyond HTTP-only WAF.

Evaluate AWS Shield Advanced and appropriate protected resources would address a different requirement: A public service must withstand large volumetric DDoS events and needs specialized incident support. Shield Advanced adds advanced DDoS capabilities and response support beyond standard protections.

This alternative, Use GuardDuty threat findings and an approved isolation response procedure, is appropriate when A container workload shows suspicious outbound calls to a known command-and-control address. GuardDuty detects suspicious account and network behavior for investigation.

For the separate situation A public API experiences HTTP request flooding and needs customizable managed request-rate blocking, Attach AWS WAF rate-based rules to the protected API or CloudFront distribution could be useful. AWS WAF filters HTTP-layer requests using configurable web ACL rules.