Amazon AWS Certified Solutions Architect - Professional SAP-C02 Bundle

This alternative, Route traffic through a dedicated inspection VPC with AWS Network Firewall and Transit Gateway, is appropriate when A large VPC estate requires centrally managed stateful firewall inspection of east-west and egress flows. Centralized firewall endpoints provide managed stateful inspection with a shared routing architecture.

For the separate situation An egress design must keep NAT and inspection traffic in the same Availability Zone where possible, Configure AZ-specific routes and inspection endpoints rather than hairpinning traffic across AZs could be useful. AZ-local routing avoids unnecessary cross-AZ transfer and asymmetric inspection paths.

Add appropriate domain-list rule groups to AWS Network Firewall solves the related scenario An account must deny outbound access to an enumerated list of domain names at the VPC egress layer; network Firewall supports stateful domain-based egress filtering in supported protocols.

For the separate situation A route between a web instance and a database appears blocked before sending test traffic, Run VPC Reachability Analyzer between the specified source and destination could be useful. Reachability Analyzer statically evaluates AWS network configuration for a path.

Use CloudWatch Transit Gateway metrics and logs with appropriate traffic telemetry solves the related scenario A hybrid team needs to inspect every transit attachment's utilization and potential packet loss; transit Gateway observability helps isolate attachment and network path issues.

Although Configure VPC Traffic Mirroring to a supported collector target can be valid when A security analyst needs selected full-packet inspection rather than only VPC flow metadata, it targets a different technical condition. Traffic Mirroring duplicates packet traffic for network inspection appliances.

Although Review network ACL inbound and outbound ephemeral-port rules for the affected subnets can be valid when Packets fail only on outbound return traffic through custom stateless subnet filters, it targets a different technical condition. NACLs are stateless and require explicit rules in both directions.

Configure VPC Traffic Mirroring to a supported collector target would address a different requirement: A security analyst needs selected full-packet inspection rather than only VPC flow metadata. Traffic Mirroring duplicates packet traffic for network inspection appliances.

This alternative, Enable VPC Flow Logs for the relevant network interface and analyze records, is appropriate when A network incident requires accepted and rejected flow metadata for an EC2 interface. Flow Logs capture IP flow metadata but not full packet payloads.

Configure VPC Traffic Mirroring to a supported collector target would address a different requirement: A security analyst needs selected full-packet inspection rather than only VPC flow metadata. Traffic Mirroring duplicates packet traffic for network inspection appliances.

This alternative, Run VPC Reachability Analyzer between the specified source and destination, is appropriate when A route between a web instance and a database appears blocked before sending test traffic. Reachability Analyzer statically evaluates AWS network configuration for a path.

For the separate situation Packets fail only on outbound return traffic through custom stateless subnet filters, Review network ACL inbound and outbound ephemeral-port rules for the affected subnets could be useful. NACLs are stateless and require explicit rules in both directions.

This alternative, Enable VPC Flow Logs for the relevant network interface and analyze records, is appropriate when A network incident requires accepted and rejected flow metadata for an EC2 interface. Flow Logs capture IP flow metadata but not full packet payloads.

For the separate situation A route between a web instance and a database appears blocked before sending test traffic, Run VPC Reachability Analyzer between the specified source and destination could be useful. Reachability Analyzer statically evaluates AWS network configuration for a path.

Use CloudWatch Transit Gateway metrics and logs with appropriate traffic telemetry solves the related scenario A hybrid team needs to inspect every transit attachment's utilization and potential packet loss; transit Gateway observability helps isolate attachment and network path issues.

This alternative, Run VPC Reachability Analyzer between the specified source and destination, is appropriate when A route between a web instance and a database appears blocked before sending test traffic. Reachability Analyzer statically evaluates AWS network configuration for a path.

For the separate situation Packets fail only on outbound return traffic through custom stateless subnet filters, Review network ACL inbound and outbound ephemeral-port rules for the affected subnets could be useful. NACLs are stateless and require explicit rules in both directions.

Enable VPC Flow Logs for the relevant network interface and analyze records solves the related scenario A network incident requires accepted and rejected flow metadata for an EC2 interface; flow Logs capture IP flow metadata but not full packet payloads.

Grant the instance role permissions and configure the destination bucket resource policy as required solves the related scenario A service running on EC2 needs to access an S3 bucket in another account; cross-account access must satisfy both principal authorization and resource-side trust or policy.

Although Configure an appropriate KMS key policy and IAM permissions for the external principal can be valid when An analyst needs permission to decrypt a KMS-protected object from a different account, it targets a different technical condition. Cross-account KMS use requires key-policy authorization as well as IAM permissions.

Remove the organizational SCP deny if authorized while preserving least-privilege IAM controls would address a different requirement: An assumed role's policy allows an action but the member account SCP explicitly denies it. SCP denies form a permissions ceiling that IAM allows cannot override.

Although Require a vendor-specific external ID in the role trust-policy condition can be valid when An external vendor must assume a role without allowing confused-deputy access, it targets a different technical condition. The external ID binds role assumption to the intended customer relationship.

Configure a narrowly scoped cross-account IAM role trusted by the security account and use STS AssumeRole would address a different requirement: An auditing application in a security account must list resources in member accounts without long-lived keys. Temporary role sessions avoid distributing persistent credentials across accounts.

For the separate situation A service running on EC2 needs to access an S3 bucket in another account, Grant the instance role permissions and configure the destination bucket resource policy as required could be useful. Cross-account access must satisfy both principal authorization and resource-side trust or policy.

This alternative, Configure a narrowly scoped cross-account IAM role trusted by the security account and use STS AssumeRole, is appropriate when An auditing application in a security account must list resources in member accounts without long-lived keys. Temporary role sessions avoid distributing persistent credentials across accounts.

For the separate situation An analyst needs permission to decrypt a KMS-protected object from a different account, Configure an appropriate KMS key policy and IAM permissions for the external principal could be useful. Cross-account KMS use requires key-policy authorization as well as IAM permissions.

Require a vendor-specific external ID in the role trust-policy condition solves the related scenario An external vendor must assume a role without allowing confused-deputy access; the external ID binds role assumption to the intended customer relationship.

For the separate situation A service running on EC2 needs to access an S3 bucket in another account, Grant the instance role permissions and configure the destination bucket resource policy as required could be useful. Cross-account access must satisfy both principal authorization and resource-side trust or policy.

Require a vendor-specific external ID in the role trust-policy condition solves the related scenario An external vendor must assume a role without allowing confused-deputy access; the external ID binds role assumption to the intended customer relationship.

Although Remove the organizational SCP deny if authorized while preserving least-privilege IAM controls can be valid when An assumed role's policy allows an action but the member account SCP explicitly denies it, it targets a different technical condition. SCP denies form a permissions ceiling that IAM allows cannot override.

Grant the instance role permissions and configure the destination bucket resource policy as required solves the related scenario A service running on EC2 needs to access an S3 bucket in another account; cross-account access must satisfy both principal authorization and resource-side trust or policy.

Although Configure a narrowly scoped cross-account IAM role trusted by the security account and use STS AssumeRole can be valid when An auditing application in a security account must list resources in member accounts without long-lived keys, it targets a different technical condition. Temporary role sessions avoid distributing persistent credentials across accounts.

Remove the organizational SCP deny if authorized while preserving least-privilege IAM controls would address a different requirement: An assumed role's policy allows an action but the member account SCP explicitly denies it. SCP denies form a permissions ceiling that IAM allows cannot override.