Amazon AWS Certified Solutions Architect - Professional SAP-C02 Bundle

Although Configure SSE-KMS with a customer managed KMS key and appropriate CloudTrail auditing can be valid when A sensitive S3 bucket should use customer-controlled key permissions and usage auditing, it targets a different technical condition. SSE-KMS integrates object encryption with key-policy control and KMS API logging.

Use AWS KMS multi-Region primary and replica keys with carefully governed key policies would address a different requirement: A multi-Region application needs matching cryptographic key identities and interoperable ciphertext across Regions. Related multi-Region keys share key material and key identifiers for cross-Region cryptographic operations.

This alternative, Grant applications access through stable roles and preserve the KMS key and policy, is appropriate when Data encrypted with a customer managed KMS key must remain decryptable after an employee leaves the team. KMS access is evaluated against key and IAM policies, not tied to an employee's existence.

For the separate situation A team needs private certificates for internal service-to-service TLS identities, Issue certificates from AWS Private Certificate Authority and manage trust distribution could be useful. A private CA provides organization-controlled certificate issuance and lifecycle.

Move the secret to Secrets Manager and restrict function-role retrieval permissions solves the related scenario A Lambda function currently includes a plaintext API token in an environment variable; secret retrieval at runtime avoids directly embedding long-lived credentials in code or configuration.

Although Use a supported AWS Certificate Manager-issued public certificate with the ALB can be valid when A public TLS certificate for an Application Load Balancer should renew without custom scripts, it targets a different technical condition. ACM can automate renewal for supported integrated services and DNS validation.

Move the secret to Secrets Manager and restrict function-role retrieval permissions solves the related scenario A Lambda function currently includes a plaintext API token in an environment variable; secret retrieval at runtime avoids directly embedding long-lived credentials in code or configuration.

Although Store it in AWS Secrets Manager and configure a supported rotation strategy can be valid when A production database password must rotate automatically and be delivered to applications without storing it in source code, it targets a different technical condition. Secrets Manager supports managed secret versions and rotation workflows.

Use a supported pod-specific IAM role mechanism such as EKS Pod Identity would address a different requirement: An EKS workload needs short-lived AWS API credentials without mounting a shared node IAM access key. Per-pod role credentials reduce broad node credentials and static key exposure.

Use a supported AWS Certificate Manager-issued public certificate with the ALB solves the related scenario A public TLS certificate for an Application Load Balancer should renew without custom scripts; aCM can automate renewal for supported integrated services and DNS validation.

Although Use a supported pod-specific IAM role mechanism such as EKS Pod Identity can be valid when An EKS workload needs short-lived AWS API credentials without mounting a shared node IAM access key, it targets a different technical condition. Per-pod role credentials reduce broad node credentials and static key exposure.

This alternative, Move the secret to Secrets Manager and restrict function-role retrieval permissions, is appropriate when A Lambda function currently includes a plaintext API token in an environment variable. Secret retrieval at runtime avoids directly embedding long-lived credentials in code or configuration.

Use a supported AWS Certificate Manager-issued public certificate with the ALB would address a different requirement: A public TLS certificate for an Application Load Balancer should renew without custom scripts. ACM can automate renewal for supported integrated services and DNS validation.

This alternative, Issue certificates from AWS Private Certificate Authority and manage trust distribution, is appropriate when A team needs private certificates for internal service-to-service TLS identities. A private CA provides organization-controlled certificate issuance and lifecycle.

For the separate situation A production database password must rotate automatically and be delivered to applications without storing it in source code, Store it in AWS Secrets Manager and configure a supported rotation strategy could be useful. Secrets Manager supports managed secret versions and rotation workflows.

Use a supported pod-specific IAM role mechanism such as EKS Pod Identity would address a different requirement: An EKS workload needs short-lived AWS API credentials without mounting a shared node IAM access key. Per-pod role credentials reduce broad node credentials and static key exposure.

For the separate situation A production database password must rotate automatically and be delivered to applications without storing it in source code, Store it in AWS Secrets Manager and configure a supported rotation strategy could be useful. Secrets Manager supports managed secret versions and rotation workflows.

Use a supported AWS Certificate Manager-issued public certificate with the ALB solves the related scenario A public TLS certificate for an Application Load Balancer should renew without custom scripts; aCM can automate renewal for supported integrated services and DNS validation.

Aggregate compatible findings in AWS Security Hub with cross-Region settings as appropriate solves the related scenario A security team needs a consolidated posture and finding view from multiple AWS security products; security Hub normalizes and correlates findings from integrated security services.

Although Enable AWS Config rules and aggregate compliance results centrally can be valid when An organization wants to continuously identify publicly exposed S3 buckets without periodic manual audits, it targets a different technical condition. Config rules evaluate resource configuration against policies and emit noncompliance states.

Designate an organization administrator and enable organization-wide GuardDuty management would address a different requirement: Multiple accounts need a consolidated view of GuardDuty findings without signing in individually. Delegated GuardDuty administration centralizes threat findings across enrolled accounts.

Attach an AWS Organizations SCP that restricts Region-specific APIs with suitable global-service exceptions solves the related scenario Security must prevent a workload account from launching resources in prohibited AWS Regions; sCPs centrally constrain maximum allowed account permissions.

Although Designate an organization administrator and enable organization-wide GuardDuty management can be valid when Multiple accounts need a consolidated view of GuardDuty findings without signing in individually, it targets a different technical condition. Delegated GuardDuty administration centralizes threat findings across enrolled accounts.

This alternative, Use IAM Access Analyzer to review external access findings, is appropriate when An auditor needs to know which external principals can access KMS keys and IAM roles. Access Analyzer models resource-policy trust and reports potentially unintended outside access.

Although Aggregate compatible findings in AWS Security Hub with cross-Region settings as appropriate can be valid when A security team needs a consolidated posture and finding view from multiple AWS security products, it targets a different technical condition. Security Hub normalizes and correlates findings from integrated security services.

Use IAM Access Analyzer to review external access findings would address a different requirement: An auditor needs to know which external principals can access KMS keys and IAM roles. Access Analyzer models resource-policy trust and reports potentially unintended outside access.

This alternative, Attach an AWS Organizations SCP that restricts Region-specific APIs with suitable global-service exceptions, is appropriate when Security must prevent a workload account from launching resources in prohibited AWS Regions. SCPs centrally constrain maximum allowed account permissions.

Use IAM Access Analyzer to review external access findings would address a different requirement: An auditor needs to know which external principals can access KMS keys and IAM roles. Access Analyzer models resource-policy trust and reports potentially unintended outside access.

This alternative, Enable AWS Config rules and aggregate compliance results centrally, is appropriate when An organization wants to continuously identify publicly exposed S3 buckets without periodic manual audits. Config rules evaluate resource configuration against policies and emit noncompliance states.

Designate an organization administrator and enable organization-wide GuardDuty management solves the related scenario Multiple accounts need a consolidated view of GuardDuty findings without signing in individually; delegated GuardDuty administration centralizes threat findings across enrolled accounts.

This alternative, Attach an AWS Organizations SCP that restricts Region-specific APIs with suitable global-service exceptions, is appropriate when Security must prevent a workload account from launching resources in prohibited AWS Regions. SCPs centrally constrain maximum allowed account permissions.

Enable AWS Config rules and aggregate compliance results centrally solves the related scenario An organization wants to continuously identify publicly exposed S3 buckets without periodic manual audits; config rules evaluate resource configuration against policies and emit noncompliance states.

Although Designate an organization administrator and enable organization-wide GuardDuty management can be valid when Multiple accounts need a consolidated view of GuardDuty findings without signing in individually, it targets a different technical condition. Delegated GuardDuty administration centralizes threat findings across enrolled accounts.