AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 24
Question 230
A developer places a NAT gateway in a public subnet and asks whether external clients can now initiate inbound TCP connections directly to EC2 application hosts in private subnets. What should the architect explain?
- Increase NAT gateway bandwidth until the service begins accepting all public inbound TCP SYN packets.
- A NAT gateway does not accept unsolicited internet-initiated connections to private instances; expose applications through an appropriate public load balancer or other ingress design.
- NAT gateways automatically expose every private instance through a random public port and register it in Route 53.
- Add an S3 bucket policy and expect it to publish a private EC2 TCP listener through the NAT gateway.
Explanation
Correct Answer
B:Managed NAT gateways translate permitted outbound flows and their responses. They are not a public reverse proxy or port-forwarding service for arbitrary private hosts.
Incorrect Answers
A:Throughput capacity does not change the NAT gateway's outbound-only connection behavior for private instance clients.
C:No such general port forwarding or DNS registration is provided. A deliberate ingress endpoint is required for public clients.
D:S3 permissions cannot configure VPC inbound translation. They operate on object resources rather than packet ingress.
Question 231
A container task in a private subnet must call AWS Secrets Manager but policy prohibits sending service calls through a public NAT gateway. Which private AWS networking component should be used?
- Assign a public IPv4 address to every private task and call Secrets Manager directly over the internet.
- Use an inbound Application Load Balancer as the API endpoint for Secrets Manager.
- Create an interface VPC endpoint for Secrets Manager with appropriate endpoint subnet security groups and permissions.
- Create a gateway VPC endpoint for Secrets Manager using an S3-style route-table target.
Explanation
Correct Answer
C:Interface endpoints provide private ENI addresses for supported AWS service APIs. With routing, security groups and policies configured, the task can access Secrets Manager without general internet egress.
Incorrect Answers
A:Public addresses violate the private-service requirement and are unnecessary when an interface endpoint is available.
B:An ALB routes to registered application targets, not AWS Secrets Manager's managed API. It does not substitute for PrivateLink.
D:Secrets Manager uses an interface endpoint integration rather than an S3/DynamoDB-style gateway endpoint. The gateway pattern does not provide this API path.
Question 232
A private EC2 application uses the standard regional Secrets Manager hostname. An interface endpoint exists but DNS still resolves the public service address and traffic takes the NAT route. Which setting most directly corrects service resolution when supported?
- Increase the NAT gateway connection count because DNS records change to private addresses at high bandwidth.
- Remove all VPC DNS hostnames and expect AWS service names to map themselves to endpoint ENIs.
- Add a public Route 53 A record pointing the service name to an EC2 instance in another account.
- Enable private DNS on the interface endpoint and ensure the VPC DNS resolution features needed for that integration are enabled.
Explanation
Correct Answer
D:Private DNS can resolve the ordinary AWS service hostname to endpoint ENI addresses inside the VPC. That allows existing SDK calls to use the private path without a custom hostname.
Incorrect Answers
A:NAT throughput is unrelated to whether DNS resolves the regional service name to endpoint private IPs.
B:Disabling VPC DNS capabilities can prevent private endpoint name resolution. The appropriate private DNS integration must be configured.
C:A custom public record cannot replace the AWS service endpoint and may misdirect signed API calls. Use the supported PrivateLink DNS mechanism.
Question 233
An engineer treats an Amazon S3 gateway endpoint like an interface endpoint and attempts to assign it security groups and private ENI IP addresses. Which correction reflects the gateway endpoint architecture?
- Attach an ENI security group to the gateway endpoint so S3 traffic can enter on TCP 443.
- Set the gateway endpoint as an ALB listener target because it receives HTTP requests at a private IP.
- Give the gateway endpoint a public Elastic IP and treat it as a NAT gateway.
- Associate the S3 gateway endpoint with the relevant route tables and configure endpoint and bucket policies instead of attaching ENI security groups.
Explanation
Correct Answer
D:Gateway endpoints use service prefix-list routes and endpoint policy controls. Unlike interface endpoints, they are not ENIs with their own private addresses and security groups.
Incorrect Answers
A:An S3 gateway endpoint is route-table based and has no endpoint ENI for that security-group attachment. Interface endpoint semantics do not apply.
B:Gateway endpoints do not provide a private IP target for an application load balancer. They alter routing to supported AWS services.
C:Gateway endpoints do not translate generic internet traffic and do not require public Elastic IP addresses.
Question 234
Patch-download workers in an IPv4-only private subnet have no public addresses and cannot reach an external repository. A public NAT gateway is Available, has an Elastic IP, and its public subnet routes 0.0.0.0/0 to an attached internet gateway. The workers’ private-subnet route table still sends 0.0.0.0/0 directly to the internet gateway. Their security groups allow outbound HTTPS. Which change corrects this route-level failure without making the workers public?
- Change the workers’ private subnet route table so its 0.0.0.0/0 route points to the existing NAT gateway, retaining the NAT public subnet route to the internet gateway.
- Give each private worker a public Elastic IP while keeping the default route that sends its outbound traffic directly toward the internet gateway.
- Replace the NAT gateway’s public-subnet default route with a route targeting that same NAT gateway, leaving the private subnet’s route unchanged.
- Open the private workers’ security-group inbound HTTPS rules to all sources and leave the private default route pointing at the internet gateway.
Explanation
Correct Answer
A:Private instances without public IPv4 addresses need a private-subnet route to the public NAT gateway for ordinary external IPv4 access. The public NAT gateway separately needs the public subnet’s internet-gateway route and Elastic IP. Correcting the private 0.0.0.0/0 target addresses the observed failure while retaining private hosts.
Incorrect Answers
B:Public addressing conflicts with the no-public-IP requirement and would change the host exposure model; the correct subnet route via the NAT gateway remains necessary for the intended private outbound topology.
C:A public NAT gateway needs the public subnet route toward an internet gateway, not a route to itself. It also cannot compensate for a private subnet that does not route traffic to the NAT gateway.
D:Ingress rules affect permitted inbound flows, not the missing outbound next hop. Exposing inbound HTTPS would be unrelated and would not change the incorrectly targeted private subnet default route.
Question 235
A partner only permits API calls from a stable public source IPv4 address. Hundreds of EC2 instances in private subnets autoscale and must call that partner without maintaining per-instance public IPs. Which egress design simplifies the allowlist?
- Create an ALB for inbound browser traffic and assume its public IP is the source of outbound calls from every EC2 target.
- Send the private fleet's outbound traffic through a public NAT gateway with its associated Elastic IP and supply that EIP to the partner.
- Allow each autoscaled EC2 instance to select a new random public address per request.
- Use an S3 gateway endpoint because it assigns a permanent public IPv4 address to all VPC internet traffic.
Explanation
Correct Answer
B:A public NAT gateway presents its Elastic IP for appropriate outbound IPv4 flows. The instances can change without adding each instance address to the partner's allowlist.
Incorrect Answers
A:An ALB receives and forwards application requests; it is not a NAT device for arbitrary outbound traffic initiated by targets.
C:Random public client addresses defeat a stable source allowlist and require constant partner changes.
D:S3 gateway endpoints do not present a generic public source EIP to arbitrary partner APIs.
Question 236
Two peered application VPCs exchange private database requests. A proposal routes that traffic through a NAT gateway and out an internet gateway to reach the peer's private address range. What is the correct routing approach?
- Translate every peer-private destination to the NAT gateway's public Elastic IP and send it to the internet.
- Create an S3 bucket policy allowing GetObject and assume this enables EC2 subnet routing to the peer VPC.
- Use the supported private VPC-to-VPC routes and security controls rather than a public NAT egress path for peer-private traffic.
- Publish each peer VPC's RFC1918 CIDR as a public Route 53 DNS answer and remove peering routes.
Explanation
Correct Answer
C:VPC peering and transit attachments carry traffic on private AWS network paths using explicit route tables. Internet NAT is neither required nor appropriate for routing private peer CIDRs.
Incorrect Answers
A:Private peer addresses are not public destinations. NAT EIP translation would not replace supported private VPC connectivity.
B:S3 object authorization cannot provision network routes between VPCs or make private database addresses reachable.
D:DNS name resolution does not create a path to private RFC1918 addresses through the public internet.
Question 237
A private subnet reaches the internet through a NAT gateway. A developer assumes that this NAT performs deep packet inspection and blocks SQL injection against a private application. What additional security architecture is needed for that requirement?
- Apply the appropriate security controls separately, such as AWS WAF for supported HTTP entry or Network Firewall for inspected network paths.
- Increase the NAT gateway Elastic IP count so it automatically enables WAF managed rule groups.
- Disable all application authentication because outbound NAT translation guarantees every user is trusted.
- Rely on NAT alone because it decrypts every HTTPS payload and filters SQL query parameters.
Explanation
Correct Answer
A:A NAT gateway translates network addresses and ports for outbound flows; it is not a managed layer-7 web firewall or general stateful inspection policy engine for applications.
Incorrect Answers
B:Public source addresses are unrelated to HTTP inspection rule activation. A separate WAF association and rules are needed where supported.
C:Network address translation does not authenticate end users. Removing authentication would create a much larger application security exposure.
D:NAT gateways do not terminate every TLS connection or inspect application payloads for SQL injection. The feature belongs to suitable inspection controls.
Question 238
A payroll application's database password must change automatically every thirty days without developers scheduling their own scripts. It is already stored in Secrets Manager and the target database has a supported rotation pattern. Which configuration should be added?
- Add an S3 lifecycle transition to archive the secret's current JSON value every thirty days.
- Configure Secrets Manager automatic rotation using the supported rotation mechanism and a correctly authorized rotation function or integration.
- Enable a CloudFront cache policy with a thirty-day TTL for the secret value.
- Grant every application principal read/write permission to all secrets and ask operators to change passwords manually.
Explanation
Correct Answer
B:Secrets Manager can manage a secret's rotation schedule and workflow with the supported database integration. The rotation component updates the actual credential and the stored secret coherently.
Incorrect Answers
A:S3 lifecycle moves objects between storage classes; it does not update the database's authentication credential or secret versions.
C:Caching secrets for a fixed period neither rotates the underlying password nor ensures new credentials are used promptly.
D:Unrestricted secret access violates least privilege and does not deliver the required managed periodic rotation.
Question 239
A CI pipeline currently copies the latest database password from Secrets Manager into its Git repository during each release. The architect wants applications to obtain authorized credentials without leaving plaintext secrets in source history. Which retrieval pattern is best?
- Embed the secret in a container image label, because registries automatically delete all historical image layers.
- Make the Secrets Manager secret public-readable to avoid runtime identity permission failures.
- Encrypt the secret string once and commit both the ciphertext and decryption key beside the application.
- Have the workload retrieve the secret at runtime through the Secrets Manager API using a scoped IAM role.
Explanation
Correct Answer
D:Runtime retrieval removes the secret from persistent repository history and permits rotation without committing new credentials. IAM and KMS permissions can scope which workload may access it.
Incorrect Answers
A:Container images and registries can retain previous layers and deployments. Embedding a password there persists it beyond the runtime secret lifecycle.
B:Secrets Manager secret access must remain authorized. Public exposure is not a safe substitute for role-based retrieval.
C:Storing the decryption key with ciphertext defeats much of the protection and creates a reusable long-term secret distribution problem.
Question 240
A central platform role can read every Secrets Manager secret in the account. Its only task is to retrieve one application's payment-database secret, encrypted under a customer-managed KMS key. Which permission design reduces unnecessary exposure?
- Create an internet gateway route to the role's VPC so all Secrets Manager access requests skip IAM.
- Grant secretsmanager:* on Resource '*' and disable KMS authorization checks for convenience.
- Limit GetSecretValue to the specific secret ARN and grant only the appropriate use of its KMS key to the requesting role.
- Allow the role to list every S3 bucket and assume this is equivalent to Secrets Manager read permission.
Explanation
Correct Answer
C:Secret retrieval can involve both a Secrets Manager resource and a KMS authorization boundary. Scoping each to the application reduces compromise impact.
Incorrect Answers
A:Network routing does not bypass Secrets Manager and KMS authorization; the role still needs appropriately scoped permissions.
B:Wildcard secret administration enables unrelated credential disclosure and modification, contrary to the single-secret requirement.
D:S3 object listing is a different API permission and cannot authorize retrieval or KMS decrypt of Secrets Manager values.
