AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 25
Question 240
A central platform role can read every Secrets Manager secret in the account. Its only task is to retrieve one application's payment-database secret, encrypted under a customer-managed KMS key. Which permission design reduces unnecessary exposure?
- Create an internet gateway route to the role's VPC so all Secrets Manager access requests skip IAM.
- Grant secretsmanager:* on Resource '*' and disable KMS authorization checks for convenience.
- Limit GetSecretValue to the specific secret ARN and grant only the appropriate use of its KMS key to the requesting role.
- Allow the role to list every S3 bucket and assume this is equivalent to Secrets Manager read permission.
Explanation
Correct Answer
C:Secret retrieval can involve both a Secrets Manager resource and a KMS authorization boundary. Scoping each to the application reduces compromise impact.
Incorrect Answers
A:Network routing does not bypass Secrets Manager and KMS authorization; the role still needs appropriately scoped permissions.
B:Wildcard secret administration enables unrelated credential disclosure and modification, contrary to the single-secret requirement.
D:S3 object listing is a different API permission and cannot authorize retrieval or KMS decrypt of Secrets Manager values.
Question 241
A production application requires about fifty non-secret configuration values: endpoint hostnames, retry counts and feature flags. Developers want an AWS-managed hierarchical parameter store rather than baking values into deployment images. Which service fits?
- Store the ordinary application configuration as appropriately named Systems Manager Parameter Store parameters with IAM-scoped reads.
- Put feature flags in IAM role trust policies and parse trust JSON as the application configuration system.
- Publish the configuration only through CloudTrail logs and have application workers scrape audit records.
- Use Amazon Route 53 geolocation routing policies to store retry counts and arbitrary feature flags.
Explanation
Correct Answer
A:Parameter Store provides hierarchical configuration storage and retrieval through AWS APIs. Ordinary non-secret values do not necessarily require managed password rotation workflows.
Incorrect Answers
B:Trust policies authorize role assumption rather than serving as general-purpose application configuration storage.
C:CloudTrail stores API audit evidence, not a reliable live configuration registry. Scraping it would be slow and inappropriate.
D:DNS routing policies choose answers based on location or routing criteria; they are not structured application parameter storage.
Question 242
A service stores an API token in Systems Manager Parameter Store. The parameter currently uses the ordinary String type and the security standard requires AWS KMS-backed encryption. What change should be made?
- Make the parameter public and encrypt only the EC2 instance's EBS volume.
- Store the sensitive value as a SecureString parameter with suitable KMS key authorization and restrict its retrieval.
- Use CloudFront TLS certificates to encrypt the parameter's plaintext stored value at rest.
- Change the parameter name to end with .secret and assume the String value is automatically encrypted under a customer key.
Explanation
Correct Answer
B:SecureString is designed for encrypting Parameter Store values with KMS. Callers must have the corresponding parameter and decrypt permissions for retrieval.
Incorrect Answers
A:Instance disk encryption does not replace encryption and authorization of the parameter within the managed service.
C:TLS certificates protect supported network connections, not the Parameter Store value type and KMS encryption mechanism.
D:A naming suffix does not change the parameter type or provide the required explicit KMS-backed SecureString behavior.
Question 243
A developer proposes Parameter Store alone for daily database password rotation and expects it to invoke a managed rotation workflow automatically. Which comparison should the architect make?
- Create an Amazon Route 53 latency record so the password is reissued after its DNS TTL.
- Treat every Parameter Store SecureString as a self-rotating password without configuring any rotation process.
- Use Secrets Manager with supported automatic rotation when managed secret-rotation workflow is required; use Parameter Store for configuration as appropriate.
- Enable S3 Versioning on a separate bucket to rotate the database user password.
Explanation
Correct Answer
C:Parameter Store can store encrypted parameters but does not provide the same integrated secret rotation workflow as Secrets Manager. Rotation needs a defined process that changes the target credential.
Incorrect Answers
A:DNS TTL controls caching of hostname answers; it has no relationship to secret credential rotation.
B:Encryption at rest is not rotation. The database password will not change merely because a parameter is stored as SecureString.
D:S3 object versions preserve file revisions and do not modify database authentication secrets or update Parameter Store.
Question 244
An application running on EC2 reads configuration from the /production/payments Parameter Store path. A proposed policy allows ssm:GetParametersByPath recursively for every parameter in the account. What least-privilege change is appropriate?
- Grant GetParametersByPath on every production and development parameter because path names cannot be authorization resources.
- Give the instance account-root credentials so it can read the path without IAM policy maintenance.
- Add an internet-facing ALB in front of Parameter Store and expect its listener rules to grant IAM path permissions.
- Restrict the instance role's Parameter Store reads to the required parameter ARNs or path and account for recursive path authorization.
Explanation
Correct Answer
D:Parameter Store authorization can be scoped to resource paths and specific retrieval actions. Proper path boundaries prevent the payment application from reading unrelated application secrets.
Incorrect Answers
A:Parameters support IAM resource scoping; broad recursive access can expose values belonging to unrelated services.
B:Root credentials expand authority far beyond configuration reads and create a permanent secret that is unnecessary for the workload.
C:An ALB is not a policy gateway for Systems Manager parameters. The API checks the caller's IAM authorization.
Question 245
An Application Load Balancer serves both billing.example.net and support.example.org through one HTTPS listener on port 443. Each hostname has a separate valid ACM certificate in the ALB Region. Currently the listener has only the billing certificate, so support clients see a hostname mismatch. How should the architect enable both TLS identities on the same listener?
- Change only the ALB listener host-header routing rules; TLS certificate matching happens after the HTTP Host header is evaluated.
- Keep the billing certificate as the sole listener certificate and point support.example.org DNS to the ALB, expecting DNS aliases to override certificate hostname validation.
- Attach the support certificate only to an EC2 target group while retaining the mismatched billing certificate for the client-facing HTTPS handshake.
- Keep a suitable default certificate and add the support hostname certificate to the ALB HTTPS listener certificate list so supported clients use SNI-based certificate selection.
Explanation
Correct Answer
D:ALB HTTPS listeners support a certificate list and SNI. The load balancer can select a certificate whose subject or SAN matches the requested host, while the default certificate handles clients without a matching SNI entry subject to TLS compatibility.
Incorrect Answers
A:The TLS handshake and server certificate selection occur before the ALB evaluates HTTP host-header listener rules. A routing rule cannot repair an untrusted hostname mismatch.
B:A DNS alias establishes where a client connects, but the presented certificate still must match the requested hostname. A single unrelated default certificate remains invalid for support.example.org.
C:A backend certificate can protect ALB-to-target traffic when configured, but does not replace a correctly matching certificate on the public ALB HTTPS listener.
Question 246
A team issues an ACM certificate in eu-west-1 and attempts to use it on an internet-facing CloudFront distribution. The console refuses the association even though the domain validation succeeded. What Region rule matters?
- For CloudFront viewer certificates, request or import the ACM certificate in us-east-1, while regional service consumers use certificates in their required Regions.
- Create another certificate in every AWS Region and assume CloudFront randomly selects one at each edge.
- Move the CloudFront origin S3 bucket to eu-west-1 because origin Region determines ACM viewer certificate Region.
- Disable DNS certificate validation, because a validated certificate can always attach to any AWS service Region.
Explanation
Correct Answer
A:CloudFront's ACM viewer certificate requirement uses US East (N. Virginia), unlike regional ALB integrations. Validating the DNS name does not override the consuming service's certificate location requirements.
Incorrect Answers
B:CloudFront does not use arbitrary regional ACM certificates for its viewer TLS configuration. The designated Region requirement must be met.
C:Origin location does not substitute for CloudFront's viewer-certificate integration rules. Moving the bucket will not fix the certificate association.
D:Certificate validation and location are separate requirements. Disabling validation would not make an unsupported regional attachment work.
Question 247
A company operates a private HTTPS API at an internal hostname that cannot be validated as a publicly trusted internet domain. Developers ask ACM for a regular public certificate and assume every internal name qualifies. What certificate approach should be evaluated?
- Turn off HTTPS because private subnets guarantee all applications are authenticated.
- Use an appropriate private CA certificate workflow, such as AWS Private CA, and distribute trust to internal clients.
- Publish the private CA signing key in an S3 public bucket so every client can trust the connection.
- Use a publicly trusted ACM certificate for any arbitrary internal-only hostname without domain validation.
Explanation
Correct Answer
B:Internal-only names and privately trusted identities often require a private PKI rather than public certificate validation. The clients must trust the issuing private authority.
Incorrect Answers
A:Network privacy does not replace application-server identity or confidentiality requirements. Internal traffic can still warrant TLS.
C:Distributing the CA private signing key would let attackers issue fraudulent certificates. Clients need the trusted public CA chain, not the signing key.
D:Public certificate issuance requires meeting the CA's supported naming and validation rules. An unvalidated internal name does not automatically qualify.
Question 248
A retail API behind an ALB already uses AWS WAF managed SQL-injection rules. Monitoring now shows a few source IPs producing thousands of otherwise valid HTTP GET requests per minute, exhausting worker capacity. The team wants a source-specific rate limit while leaving ordinary traffic unaffected. Which change best addresses the new pattern?
- Increase only the SQL-injection managed rule priority, although abusive requests do not contain injection payloads.
- Use an inbound security-group rule that counts HTTP requests per client and throttles those exceeding the threshold.
- Add a tuned AWS WAF rate-based rule to the ALB web ACL, aggregating by the desired source-IP criteria and applying the intended Block or Challenge action above the threshold.
- Configure a Route 53 TTL for the site because DNS response caching limits individual HTTP requests per second.
Explanation
Correct Answer
C:AWS WAF rate-based rules aggregate eligible requests over a configurable evaluation window and take an action for an aggregation instance above its limit. Tune and observe the rule to minimize false positives before blocking.
Incorrect Answers
A:Matching a different vulnerability pattern will not necessarily detect high-rate legitimate-looking requests.
B:Security groups filter network-level traffic but have no native per-client HTTP request-rate aggregation.
D:DNS TTL governs resolution caching, not the volume of already-resolved HTTP requests to an ALB.
Question 249
An HTTPS storefront behind CloudFront receives sign-in requests that a bot signal marks as suspicious. The fraud team needs those sessions to prove that a human is interacting, but wants to avoid outright blocking every suspicious shopper. Which AWS WAF rule action deliberately presents a puzzle to the end user?
- Select WAF Challenge, which silently verifies browser behavior without asking the shopper to solve a puzzle.
- Select AWS Shield Advanced, which replaces browser-level human checks with automatic account-wide HTTPS login CAPTCHA prompts.
- Select WAF CAPTCHA for the matching requests, while accounting for token validity, client support and additional charges.
- Configure an ALB listener fixed response for the bot category and rely on that response to generate WAF verification tokens.
Explanation
Correct Answer
C:WAF CAPTCHA displays a puzzle to verify a human when the rule matches, on supported HTTPS browser interactions; follow token and cost conditions.
Incorrect Answers
A:WAF Challenge is generally silent and checks client/browser legitimacy, so it does not satisfy a required visible human puzzle.
B:Shield Advanced focuses on DDoS protection; it does not by itself turn a login rule into a WAF CAPTCHA interaction.
D:ALB fixed responses are HTTP responses, not WAF CAPTCHA challenge token issuance or human-verification puzzles.
Question 250
A security assessment recommends AWS WAF as the sole protection against arbitrary UDP floods against a custom game server. The server is not a supported HTTP resource. Which limitation should the architect identify?
- Use appropriate network-layer DDoS and filtering controls; AWS WAF is primarily an HTTP application-layer service for supported resources.
- Increase the ALB idle timeout because an ALB listener automatically supports all UDP ports.
- Create a WAF SQL injection managed rule and expect it to decode and block every UDP datagram.
- Configure an S3 bucket policy to deny UDP packets before they reach EC2 instances.
Explanation
Correct Answer
A:WAF web ACLs inspect supported web requests, not raw UDP packets on arbitrary ports. Network DDoS protection and suitable firewall or architectural capacity controls must address the game transport.
Incorrect Answers
B:ALB is for HTTP/HTTPS traffic rather than arbitrary UDP forwarding, so idle-timeout tuning does not create the needed network-layer defense.
C:A SQL injection web rule evaluates HTTP request data, which is unrelated to an arbitrary UDP flood against a game protocol.
D:S3 resource policies authorize S3 API operations, not IP packets destined for an EC2 game service.
