Amazon AWS Certified Solutions Architect - Professional SAP-C02 Bundle

Although Centralize Security Hub aggregation and route prioritized findings via EventBridge can be valid when Security Hub findings are scattered across accounts and remediation owners miss severe issues, it targets a different technical condition. A consolidated posture dashboard plus event routing improves remediation ownership.

Associate AWS Config noncompliance events with approved remediation automation would address a different requirement: A regulated service needs to track and remediate public S3 buckets immediately after configuration drift. Config rule state changes can trigger controlled repair when resource policy becomes unsafe.

This alternative, Investigate GuardDuty findings and isolate the affected workload through approved response, is appropriate when An EKS node begins making suspicious DNS queries to an apparent command-and-control domain. Threat-detection signals identify anomalous behavior but require triage and containment.

Apply AWS Backup Vault Lock and segregated backup account permissions would address a different requirement: Backups can be deleted by compromised operators with broad production permissions. Immutable backup retention limits attacker ability to destroy recovery points.

For the separate situation A suspected credential theft incident requires rapid containment without deleting all historical evidence, Revoke compromised role sessions where feasible, rotate secrets and preserve CloudTrail logs could be useful. Credential containment limits ongoing access while audit evidence supports investigation.

Build and test a supported patched image pipeline using EC2 Image Builder solves the related scenario A production service depends on a third-party AMI that has not received updates for a year; golden-image pipelines automate controlled image hardening and refresh.

For the separate situation Backups can be deleted by compromised operators with broad production permissions, Apply AWS Backup Vault Lock and segregated backup account permissions could be useful. Immutable backup retention limits attacker ability to destroy recovery points.

Use Systems Manager Patch Manager with patch baselines and compliant maintenance schedules solves the related scenario A critical Linux fleet needs predictable security patch compliance and auditable exceptions; managed patch baselines define approved versions and report host patch state.

Although Build and test a supported patched image pipeline using EC2 Image Builder can be valid when A production service depends on a third-party AMI that has not received updates for a year, it targets a different technical condition. Golden-image pipelines automate controlled image hardening and refresh.

Use Systems Manager Patch Manager with patch baselines and compliant maintenance schedules solves the related scenario A critical Linux fleet needs predictable security patch compliance and auditable exceptions; managed patch baselines define approved versions and report host patch state.

Although Scan ECR repositories and enforce immutable versioned image promotion can be valid when Container images contain critical CVEs but developers deploy mutable latest tags, it targets a different technical condition. Scanning and image identity reduce unreviewed vulnerable deployments.

Revoke compromised role sessions where feasible, rotate secrets and preserve CloudTrail logs would address a different requirement: A suspected credential theft incident requires rapid containment without deleting all historical evidence. Credential containment limits ongoing access while audit evidence supports investigation.

Build and test a supported patched image pipeline using EC2 Image Builder solves the related scenario A production service depends on a third-party AMI that has not received updates for a year; golden-image pipelines automate controlled image hardening and refresh.

Although Revoke compromised role sessions where feasible, rotate secrets and preserve CloudTrail logs can be valid when A suspected credential theft incident requires rapid containment without deleting all historical evidence, it targets a different technical condition. Credential containment limits ongoing access while audit evidence supports investigation.

Use Systems Manager Patch Manager with patch baselines and compliant maintenance schedules would address a different requirement: A critical Linux fleet needs predictable security patch compliance and auditable exceptions. Managed patch baselines define approved versions and report host patch state.

Although Apply AWS Backup Vault Lock and segregated backup account permissions can be valid when Backups can be deleted by compromised operators with broad production permissions, it targets a different technical condition. Immutable backup retention limits attacker ability to destroy recovery points.

Scan ECR repositories and enforce immutable versioned image promotion would address a different requirement: Container images contain critical CVEs but developers deploy mutable latest tags. Scanning and image identity reduce unreviewed vulnerable deployments.

This alternative, Build and test a supported patched image pipeline using EC2 Image Builder, is appropriate when A production service depends on a third-party AMI that has not received updates for a year. Golden-image pipelines automate controlled image hardening and refresh.

For the separate situation A slow SQL query scans millions of rows despite narrow search predicates, Add appropriate indexes and benchmark query plans before scaling instances could be useful. Better execution plans can reduce I/O far more than adding compute capacity.

Redesign hot partition keys or spread partition traffic according to access pattern solves the related scenario A DynamoDB table throttles only one tenant despite ample total provisioned capacity; hot partitions impose per-partition throughput limits even with excess table capacity.

Although Add RDS Proxy and control client connection concurrency can be valid when A database experiences rising connection counts during Lambda traffic spikes, it targets a different technical condition. RDS Proxy pools application connections to reduce database connection pressure.

For the separate situation An RDS database's transactional reads grow rapidly while writes remain steady, Add appropriate read replicas and route read-only queries away from the writer could be useful. Read scaling isolates analytics and reads from transactional write load.

Although Add RDS Proxy and control client connection concurrency can be valid when A database experiences rising connection counts during Lambda traffic spikes, it targets a different technical condition. RDS Proxy pools application connections to reduce database connection pressure.

Add appropriate indexes and benchmark query plans before scaling instances would address a different requirement: A slow SQL query scans millions of rows despite narrow search predicates. Better execution plans can reduce I/O far more than adding compute capacity.

Redesign hot partition keys or spread partition traffic according to access pattern solves the related scenario A DynamoDB table throttles only one tenant despite ample total provisioned capacity; hot partitions impose per-partition throughput limits even with excess table capacity.

Add RDS Proxy and control client connection concurrency would address a different requirement: A database experiences rising connection counts during Lambda traffic spikes. RDS Proxy pools application connections to reduce database connection pressure.

This alternative, Inspect CloudWatch Database Insights wait events and I/O saturation, is appropriate when A relational database's average CPU is low but client requests stall waiting on storage reads. Database wait analysis identifies I/O bottlenecks that CPU metrics alone can miss.

Although Add appropriate indexes and benchmark query plans before scaling instances can be valid when A slow SQL query scans millions of rows despite narrow search predicates, it targets a different technical condition. Better execution plans can reduce I/O far more than adding compute capacity.

This alternative, Inspect CloudWatch Database Insights wait events and I/O saturation, is appropriate when A relational database's average CPU is low but client requests stall waiting on storage reads. Database wait analysis identifies I/O bottlenecks that CPU metrics alone can miss.

For the separate situation A DynamoDB table throttles only one tenant despite ample total provisioned capacity, Redesign hot partition keys or spread partition traffic according to access pattern could be useful. Hot partitions impose per-partition throughput limits even with excess table capacity.

This alternative, Inspect CloudWatch Database Insights wait events and I/O saturation, is appropriate when A relational database's average CPU is low but client requests stall waiting on storage reads. Database wait analysis identifies I/O bottlenecks that CPU metrics alone can miss.

For the separate situation An RDS database's transactional reads grow rapidly while writes remain steady, Add appropriate read replicas and route read-only queries away from the writer could be useful. Read scaling isolates analytics and reads from transactional write load.

Add RDS Proxy and control client connection concurrency solves the related scenario A database experiences rising connection counts during Lambda traffic spikes; rDS Proxy pools application connections to reduce database connection pressure.