AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 23
Question 220
An RDS database accepts TCP 5432 from its application instances. The database security group currently allows the entire corporate 10.0.0.0/8 network, including unrelated development hosts. The architect needs an automatically maintained least-privilege ingress boundary as application instances scale. Which rule is best?
- Allow all TCP ports from 10.0.0.0/8 so the database never needs another change.
- Move the broad ingress restriction to a subnet network ACL and allow PostgreSQL from the 10.0.0.0/8 CIDR.
- Allow TCP 5432 from 0.0.0.0/0 because only valid database passwords can authenticate.
- Reference the application's security group as the source on the database security group's TCP 5432 ingress rule.
Explanation
Correct Answer
D:A security-group source reference permits members of the approved application group rather than an entire changing address range. Autoscaled application instances inherit the intended network authorization.
Incorrect Answers
A:The broad CIDR still includes unrelated hosts and services. It fails to restrict ingress to actual application-tier members.
B:A subnet NACL remains CIDR- and subnet-oriented and is stateless. It cannot dynamically authorize only EC2 interfaces carrying the application security group, so it retains the unrelated-host exposure rather than matching the scaling application fleet.
C:Database authentication is not a substitute for limiting network exposure. Worldwide ingress broadens brute-force and exploitation paths.
Question 221
A fleet of EC2 Linux servers must be managed without exposing SSH directly to the internet. A proposed security group opens TCP 22 from every public address because access requires a key. What is the safer access plan?
- Remove world-open SSH and use approved private management paths such as Systems Manager Session Manager or restricted VPN/bastion access.
- Assign a second public IPv4 address to each server so scanners cannot identify the correct address.
- Keep TCP 22 open to 0.0.0.0/0 because key-based authentication removes all network exploitation risk.
- Open TCP 3389 instead because it is a more secure alternative for Linux SSH management.
Explanation
Correct Answer
A:Private management and scoped security-group ingress reduce attack surface without sacrificing authorized administration. SSH keys alone do not justify permitting direct global connection attempts.
Incorrect Answers
B:Additional public addresses increase exposure and do not create a supported management authorization control.
C:Keys help authenticate users but do not eliminate service vulnerabilities or credential abuse. The exposed management port is unnecessary.
D:RDP's usual Windows management port is not a blanket solution for Linux hosts and likewise requires restricted access.
Question 222
An application security group denies new inbound HTTPS connections from an ALB even though return traffic works for existing database connections. Engineers want to modify ephemeral inbound ports, believing security groups are stateless. Which diagnosis is more appropriate?
- Add every ephemeral port to application inbound rules to simulate a stateless network ACL.
- Verify the ALB's target connection source, the application's attached security group, its HTTPS ingress rule and the actual target port.
- Disable the ALB target health checks and expect AWS to treat previously blocked new flows as permitted.
- Change the VPC CIDR size and assume security groups allow new connections after subnet resizing.
Explanation
Correct Answer
B:Security groups are stateful, so permitted connection response packets do not require separate reverse rules. A new inbound connection depends on a matching ingress rule and the correct destination/port.
Incorrect Answers
A:Adding broad ephemeral ingress does not repair a missing listener-port rule and unnecessarily widens permitted new connections.
C:Health-check configuration affects routing eligibility, not the security group's inbound authorization for HTTPS connections.
D:VPC addressing changes do not correct a missing source-group or listener-port permission and can disrupt workloads.
Question 223
A security team must impose a subnet-wide stateless deny for traffic from a known malicious CIDR, supplementing application security groups. Which VPC control supports explicit ordered subnet-level deny rules?
- Apply an AWS Organizations SCP to the subnet to deny its IP packets.
- Configure a CloudFront behavior to block all EC2 TCP traffic from the CIDR.
- Apply a network ACL to the appropriate subnet with a matching Deny rule and necessary permitted traffic rules.
- Create a security group with a Deny rule listing the malicious CIDR.
Explanation
Correct Answer
C:Network ACLs operate at the subnet boundary, support explicit Allow and Deny entries, and are stateless. They can supplement stateful per-ENI security groups for broad CIDR restrictions.
Incorrect Answers
A:SCPs set AWS API permission ceilings for principals, not packet-level filtering rules on VPC subnets.
B:CloudFront controls supported HTTP delivery through its distribution, not arbitrary traffic to private EC2 subnets.
D:Security groups use Allow rules and implicit denial of unmatched traffic; they do not expose explicit Deny entries like subnet NACLs.
Question 224
An NACL permits TCP 443 inbound to a server subnet, but outbound rules deny client ephemeral destination ports. Browser connections fail during the handshake despite a matching security group. Which NACL property explains the failure?
- Add an S3 bucket policy allowing GetObject to let the EC2 host reply to HTTPS clients.
- Security groups automatically force a NACL to allow every return packet whenever the original request is accepted.
- Disable TCP TLS encryption so return packets no longer need outbound network rules.
- NACLs are stateless, so permit the necessary client return-traffic port range in the outbound direction.
Explanation
Correct Answer
D:Unlike security groups, network ACLs evaluate inbound and outbound packets independently. The reply path must have a matching rule for the client-side ephemeral ports.
Incorrect Answers
A:An S3 bucket policy has no bearing on NACL enforcement for TCP connections to the application subnet.
B:Statefulness is a property of security groups, not a mechanism that overrides independent subnet ACL rules. The NACL must allow reply packets itself.
C:TLS affects encrypted application traffic; the TCP reply packets still traverse the NACL and need permitted source/destination ports.
Question 225
A subnet NACL contains an early rule 100 denying a CIDR and a later rule 200 allowing the same CIDR on TCP 443. An operator expects the later Allow to override the Deny. What is the actual behavior?
- The Allow always wins because NACL rules use the same evaluation as an IAM identity policy.
- Both rules merge into a probabilistic allow when traffic volume is high enough.
- The lower-numbered matching NACL rule wins; reorder or refine rules if the intended HTTPS traffic should be allowed.
- Changing the subnet's S3 encryption setting to SSE-KMS causes TCP 443 NACL rules to become stateful.
Explanation
Correct Answer
C:NACL rules are processed in ascending rule-number order, and the first match determines the outcome. A later Allow never overrides an earlier matching Deny.
Incorrect Answers
A:NACLs use ordered packet-filter rules, not IAM's combined authorization evaluation. Rule number is decisive for the first match.
B:NACL decisions do not depend on connection volume or random selection. The first matching entry has consistent precedence.
D:Storage encryption configuration has no effect on NACL rule ordering or the stateless treatment of packets.
Question 226
An engineer wants a NACL rule allowing traffic from one particular EC2 application's security group ID. The engineer enters sg-... where the NACL expects a source CIDR. Which design distinction matters?
- Define the NACL rule using supported source/destination CIDRs, protocols, ports and rule numbers, and use SG references in supported security-group rules.
- Give the EC2 application an IAM policy that permits nacl:ReferToSecurityGroup for its network packets.
- Use a CloudWatch log group name as the NACL source selector.
- Attach the security group ID as the NACL rule number because NACLs interpret role identifiers as addresses.
Explanation
Correct Answer
A:NACLs match packet attributes such as address ranges and port numbers; security group IDs are not NACL source selectors. Security groups can reference other groups when supported.
Incorrect Answers
B:There is no NACL packet-matching feature that translates an IAM role or group into a CIDR source reference. The requested rule syntax is incompatible.
C:Log group names are observability resources, not packet source addresses. A NACL requires network-relevant match parameters.
D:A NACL rule number controls ordering and is numeric. It cannot stand in for an IP prefix or a security-group membership test.
Question 227
An EC2 web host has a public IPv4 address in a subnet whose route table contains only the VPC local route. It must be reachable directly from the internet. Which network components must be added, subject to security rules?
- Assign an extra private IPv4 address while leaving the subnet without an internet gateway route.
- Create an S3 gateway endpoint and use it as the subnet's default route to the public internet.
- Add only a private NAT gateway in a private subnet and expect unsolicited internet inbound to reach the instance.
- Attach an internet gateway to the VPC and route the public subnet's external IPv4 traffic to that gateway.
Explanation
Correct Answer
D:An IGW provides a VPC path between properly addressed resources and the public internet. A public IP plus security-group permissions is insufficient without an appropriate route to the attached gateway.
Incorrect Answers
A:Additional private addresses do not create internet reachability. The IGW attachment and subnet route are missing.
B:An S3 gateway endpoint is a route target for eligible S3 traffic, not a general internet gateway for public web clients.
C:NAT gateways support translation in appropriate paths but do not supply direct unsolicited inbound connectivity to an EC2 public IP.
Question 228
An instance sits in a subnet with a 0.0.0.0/0 route to an attached internet gateway. Its security group allows inbound HTTPS, but the instance has only private RFC1918 IPv4 addresses. Why is direct IPv4 ingress from public browsers still unavailable?
- An internet gateway automatically assigns a public IPv4 address to every private-only instance whenever a route exists.
- Direct IPv4 internet reachability also needs an appropriate public IPv4 address mapped to the instance, not merely a public route.
- An S3 bucket policy can translate public HTTPS requests into the private instance address.
- Increasing the instance memory adds a public internet listener at the private address.
Explanation
Correct Answer
B:For the standard IGW path, a public IPv4 address or Elastic IP provides the internet-routable mapping. A private-only instance cannot receive arbitrary public IPv4 client connections directly.
Incorrect Answers
A:Route-table entries do not automatically assign public addresses. Instance address assignment or Elastic IP association is a separate step.
C:S3 authorization policies do not perform IPv4 address translation for EC2 web servers. The missing element is public addressing.
D:Compute capacity cannot make an RFC1918 address globally routable through the IGW. Addressing and routing must be designed explicitly.
Question 229
Private EC2 application servers need periodic outbound IPv4 access to an external payment API. They must not receive public IPv4 addresses or unsolicited inbound internet traffic. Which egress design meets the constraint?
- Route the private subnet's internet-bound IPv4 traffic through a suitably placed public NAT gateway and configured public-subnet internet path.
- Use a VPC peering connection to an unrelated VPC as a general-purpose route to any internet host.
- Create only an S3 gateway endpoint and expect it to reach the external payment company's HTTPS API.
- Attach public Elastic IP addresses to every application server and open all inbound ports for return traffic.
Explanation
Correct Answer
A:A NAT gateway permits private IPv4 instances to initiate outbound connections and receive associated responses. The instances do not require their own public addresses or direct unsolicited ingress.
Incorrect Answers
B:Peering provides private connectivity to the peer and is not a supported transitive internet egress gateway.
C:An S3 gateway endpoint serves eligible Amazon S3 traffic; it is not an outbound path for an arbitrary third-party internet endpoint.
D:Direct public addressing contradicts the isolation requirement and is not necessary for outbound calls through NAT.
Question 230
A developer places a NAT gateway in a public subnet and asks whether external clients can now initiate inbound TCP connections directly to EC2 application hosts in private subnets. What should the architect explain?
- Increase NAT gateway bandwidth until the service begins accepting all public inbound TCP SYN packets.
- A NAT gateway does not accept unsolicited internet-initiated connections to private instances; expose applications through an appropriate public load balancer or other ingress design.
- NAT gateways automatically expose every private instance through a random public port and register it in Route 53.
- Add an S3 bucket policy and expect it to publish a private EC2 TCP listener through the NAT gateway.
Explanation
Correct Answer
B:Managed NAT gateways translate permitted outbound flows and their responses. They are not a public reverse proxy or port-forwarding service for arbitrary private hosts.
Incorrect Answers
A:Throughput capacity does not change the NAT gateway's outbound-only connection behavior for private instance clients.
C:No such general port forwarding or DNS registration is provided. A deliberate ingress endpoint is required for public clients.
D:S3 permissions cannot configure VPC inbound translation. They operate on object resources rather than packet ingress.
