Amazon AWS Certified Solutions Architect - Professional SAP-C02 Bundle

This alternative, Check KMS key policy, grants and role permissions before changing the application, is appropriate when A trusted EC2 role can call AWS APIs but fails to decrypt a KMS-encrypted file. KMS evaluates key access separately from ordinary application permissions.

Replace broad permissions with required S3 actions and resource or prefix constraints solves the related scenario Several roles use the wildcard s3:* on all buckets despite needing one prefix; narrow IAM authorization limits unintended storage actions and data scope.

Although Use IAM Access Analyzer findings to remove unintended cross-account trust can be valid when An external account unexpectedly can read a snapshot through resource permissions, it targets a different technical condition. External-access analysis identifies resource policies granting access beyond the intended boundary.

Update stateless NACL return-path rules for ephemeral source and destination ports solves the related scenario A subnet NACL was tightened but the application now intermittently drops response packets; nACLs require both inbound and outbound permission unlike stateful security groups.

Although Attach a tuned AWS WAF web ACL to CloudFront and test managed rules can be valid when A CloudFront application is exposed to common automated web exploitation attempts, it targets a different technical condition. Edge web ACL inspection can reject malicious HTTP requests before origin processing.

This alternative, Enforce default SSE-KMS with the approved KMS key and reject noncompliant writes, is appropriate when A company must prove that stored S3 objects use customer-controlled encryption keys. Encryption enforcement and bucket-policy restrictions make key choice auditable.

Although Disable public RDS accessibility and restrict inbound security group reachability can be valid when A security review discovers a customer database has an internet-accessible endpoint despite private app tiers, it targets a different technical condition. Public endpoints and permissive ingress create direct database exposure.

Require authenticated TLS for the internal connection with managed certificate issuance would address a different requirement: An internal service sends sensitive records to another microservice over plaintext HTTP. East-west encryption protects data even after passing the public ingress boundary.

For the separate situation A subnet NACL was tightened but the application now intermittently drops response packets, Update stateless NACL return-path rules for ephemeral source and destination ports could be useful. NACLs require both inbound and outbound permission unlike stateful security groups.

Require authenticated TLS for the internal connection with managed certificate issuance would address a different requirement: An internal service sends sensitive records to another microservice over plaintext HTTP. East-west encryption protects data even after passing the public ingress boundary.

This alternative, Update stateless NACL return-path rules for ephemeral source and destination ports, is appropriate when A subnet NACL was tightened but the application now intermittently drops response packets. NACLs require both inbound and outbound permission unlike stateful security groups.

For the separate situation A CloudFront application is exposed to common automated web exploitation attempts, Attach a tuned AWS WAF web ACL to CloudFront and test managed rules could be useful. Edge web ACL inspection can reject malicious HTTP requests before origin processing.

This alternative, Enforce default SSE-KMS with the approved KMS key and reject noncompliant writes, is appropriate when A company must prove that stored S3 objects use customer-controlled encryption keys. Encryption enforcement and bucket-policy restrictions make key choice auditable.

For the separate situation A security review discovers a customer database has an internet-accessible endpoint despite private app tiers, Disable public RDS accessibility and restrict inbound security group reachability could be useful. Public endpoints and permissive ingress create direct database exposure.

Although Attach a tuned AWS WAF web ACL to CloudFront and test managed rules can be valid when A CloudFront application is exposed to common automated web exploitation attempts, it targets a different technical condition. Edge web ACL inspection can reject malicious HTTP requests before origin processing.

Disable public RDS accessibility and restrict inbound security group reachability solves the related scenario A security review discovers a customer database has an internet-accessible endpoint despite private app tiers; public endpoints and permissive ingress create direct database exposure.

Although Attach a tuned AWS WAF web ACL to CloudFront and test managed rules can be valid when A CloudFront application is exposed to common automated web exploitation attempts, it targets a different technical condition. Edge web ACL inspection can reject malicious HTTP requests before origin processing.

Require authenticated TLS for the internal connection with managed certificate issuance would address a different requirement: An internal service sends sensitive records to another microservice over plaintext HTTP. East-west encryption protects data even after passing the public ingress boundary.

Although Centralize Security Hub aggregation and route prioritized findings via EventBridge can be valid when Security Hub findings are scattered across accounts and remediation owners miss severe issues, it targets a different technical condition. A consolidated posture dashboard plus event routing improves remediation ownership.

Associate AWS Config noncompliance events with approved remediation automation would address a different requirement: A regulated service needs to track and remediate public S3 buckets immediately after configuration drift. Config rule state changes can trigger controlled repair when resource policy becomes unsafe.

This alternative, Correlate CloudTrail assumption attempts, identity policy changes and detective alerts, is appropriate when Production users experience repeated unauthorized STS role assumptions from a suspicious source. Identity attack investigation requires joining actor, policy and event chronology.

Associate AWS Config noncompliance events with approved remediation automation would address a different requirement: A regulated service needs to track and remediate public S3 buckets immediately after configuration drift. Config rule state changes can trigger controlled repair when resource policy becomes unsafe.

For the separate situation A team discovers many EC2 vulnerabilities but needs severity-based patch queues, Aggregate Amazon Inspector findings and prioritize by exploit risk and asset criticality could be useful. Inspector identifies vulnerabilities so remediation can be based on risk rather than ad hoc scanning.

Investigate GuardDuty findings and isolate the affected workload through approved response solves the related scenario An EKS node begins making suspicious DNS queries to an apparent command-and-control domain; threat-detection signals identify anomalous behavior but require triage and containment.

This alternative, Aggregate Amazon Inspector findings and prioritize by exploit risk and asset criticality, is appropriate when A team discovers many EC2 vulnerabilities but needs severity-based patch queues. Inspector identifies vulnerabilities so remediation can be based on risk rather than ad hoc scanning.

Investigate GuardDuty findings and isolate the affected workload through approved response solves the related scenario An EKS node begins making suspicious DNS queries to an apparent command-and-control domain; threat-detection signals identify anomalous behavior but require triage and containment.

Although Correlate CloudTrail assumption attempts, identity policy changes and detective alerts can be valid when Production users experience repeated unauthorized STS role assumptions from a suspicious source, it targets a different technical condition. Identity attack investigation requires joining actor, policy and event chronology.

For the separate situation Security Hub findings are scattered across accounts and remediation owners miss severe issues, Centralize Security Hub aggregation and route prioritized findings via EventBridge could be useful. A consolidated posture dashboard plus event routing improves remediation ownership.

Although Associate AWS Config noncompliance events with approved remediation automation can be valid when A regulated service needs to track and remediate public S3 buckets immediately after configuration drift, it targets a different technical condition. Config rule state changes can trigger controlled repair when resource policy becomes unsafe.

Aggregate Amazon Inspector findings and prioritize by exploit risk and asset criticality would address a different requirement: A team discovers many EC2 vulnerabilities but needs severity-based patch queues. Inspector identifies vulnerabilities so remediation can be based on risk rather than ad hoc scanning.

Although Centralize Security Hub aggregation and route prioritized findings via EventBridge can be valid when Security Hub findings are scattered across accounts and remediation owners miss severe issues, it targets a different technical condition. A consolidated posture dashboard plus event routing improves remediation ownership.

Associate AWS Config noncompliance events with approved remediation automation would address a different requirement: A regulated service needs to track and remediate public S3 buckets immediately after configuration drift. Config rule state changes can trigger controlled repair when resource policy becomes unsafe.

This alternative, Investigate GuardDuty findings and isolate the affected workload through approved response, is appropriate when An EKS node begins making suspicious DNS queries to an apparent command-and-control domain. Threat-detection signals identify anomalous behavior but require triage and containment.