AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 27
Question 260
A regulatory API may be called only from approved VPC clients. Its owners have built a regional public API Gateway endpoint with an IAM authorization rule but want no publicly reachable API entry point. Which endpoint pattern is a better fit?
- Use an S3 website endpoint to replace the private authenticated API.
- Keep the public regional endpoint and add a DNS record containing the word private.
- Use a supported private API Gateway endpoint and appropriate interface endpoint and resource policy controls for authorized VPC access.
- Assign public IP addresses to every approved VPC client so the API can identify them.
Explanation
Correct Answer
C:A private API endpoint provides a privately reachable API pattern that can be limited to approved network and principal contexts. IAM authorization alone does not make a public hostname private.
Incorrect Answers
A:S3 website hosting is for static content delivery, not an equivalent private API Gateway authorization integration.
B:DNS naming does not change endpoint reachability. The public API remains exposed to the internet even if authorization blocks unauthorized calls.
D:Public client addresses are not necessary for a private API path and can increase external attack surface.
Question 261
A retailer offers a consumer mobile application to two million customers. Developers suggest creating an AWS IAM user with a console password for every shopper. Which authentication service better fits application-user sign-in?
- Create two million AWS IAM users with AdministratorAccess so every shopper can log in.
- Store a shared root password in the mobile application and allow the app to rotate it at startup.
- Use an Amazon Cognito user pool for customer authentication and application user lifecycle, with appropriate token validation.
- Make the application's DynamoDB table public-write and skip customer identity entirely.
Explanation
Correct Answer
C:Cognito user pools manage application users and issue supported sign-in tokens. They do not require each retail customer to become an AWS IAM console user.
Incorrect Answers
A:IAM users are for AWS principals, not a scalable end-consumer identity store. Administrator permissions would also be dangerously excessive.
B:Embedding root credentials in public client software would expose account-wide authority and prevent customer-specific access controls.
D:Public database writes would bypass customer authentication and permit unauthorized modification of application records.
Question 262
A photo-sharing app authenticates end users, then allows each user to upload to a tightly scoped S3 prefix directly from their client after sign-in. It needs short-lived AWS credentials mapped to an application identity. Which Cognito component addresses that exchange?
- Use an Amazon Cognito identity pool to issue scoped AWS credentials for supported authenticated identities.
- Configure only a Cognito user-pool token and assume S3 accepts it as an AWS SigV4 signature.
- Make the S3 bucket public-write so the app can upload without any AWS credentials.
- Create one root-user access key embedded in the client application for all uploads.
Explanation
Correct Answer
A:Identity pools federate application identities to temporary AWS credentials with IAM role permissions. User pools manage sign-in, but are not by themselves AWS API credentials for direct S3 calls.
Incorrect Answers
B:S3 API calls require supported AWS request authorization, not an arbitrary user-pool JWT as the SigV4 credential. An identity exchange or presigned flow is needed.
C:Anonymous write access is not a per-user scoped upload permission and invites abuse of the storage bucket.
D:A distributed root key would be recoverable from the app and give users excessive AWS authority. Scoped temporary credentials are the required pattern.
Question 263
A mobile API receives a valid Cognito user-pool JWT, but a developer assumes that it automatically grants the caller permission to call DynamoDB directly with AWS SDKs. Which distinction should the architect explain?
- Configure an S3 lifecycle policy for DynamoDB items to assign per-user permissions.
- Treat any valid JWT as an AWS IAM root signature for direct DynamoDB requests.
- Disable JWT signature verification because the user-pool issuer is an AWS service.
- Verify the JWT for API-user authorization and separately use an identity pool or suitable backend IAM role for AWS API access.
Explanation
Correct Answer
D:User-pool JWTs establish application identity and claims for an API. AWS service operations need appropriately authorized AWS credentials and IAM policies, which are a separate trust boundary.
Incorrect Answers
A:S3 lifecycle acts on S3 objects, not IAM identity or token authorization for DynamoDB item reads.
B:A user-pool token is not automatically a SigV4 AWS account credential and cannot replace DynamoDB's AWS authorization.
C:APIs must validate relevant token properties; accepting unsigned or unverified tokens would allow spoofed users.
Question 264
A consumer SaaS application uses Cognito user pools. Product leadership wants MFA for sensitive account changes and a tested recovery flow for users who lose devices, without issuing AWS administrative credentials. Which design is appropriate?
- Give every consumer the production AWS AdministratorAccess permission set so they can recover their own user account.
- Configure supported Cognito user-pool MFA and account recovery policies suited to customer risk while preserving separate AWS workforce roles.
- Use a root IAM access key stored in the mobile app as the fallback when a consumer loses MFA.
- Disable MFA permanently for every user because adding a recovery method always requires bypassing authentication.
Explanation
Correct Answer
B:Customer authentication and recovery are user-pool concerns; the business can require stronger factors and vetted recovery without turning app users into AWS account administrators.
Incorrect Answers
A:AWS administrative roles are unrelated to normal customer identity recovery and would expose cloud resources to application users.
C:Root credentials cannot safely be embedded in end-user applications and do not provide individual account recovery controls.
D:A defined recovery path can coexist with strong MFA. Removing all additional factors weakens sign-in and sensitive account changes.
Question 265
An AWS organization sees anomalous IAM activity and suspicious network indicators. The team wants managed threat findings but mistakenly expects that enabling a detector automatically blocks every bad request in-line. Which service behavior should guide the design?
- Enable Amazon GuardDuty for supported threat detection and connect its findings to appropriate investigation and response controls.
- Use AWS Config alone to block every malicious packet before it reaches an application.
- Use S3 Intelligent-Tiering as an IAM anomaly detector because it monitors object access frequencies.
- Enable GuardDuty and disable security groups because GuardDuty replaces every network firewall.
Explanation
Correct Answer
A:GuardDuty produces findings from supported account and workload signals. Findings may trigger automation, but detection does not by itself enforce a universal inline packet block.
Incorrect Answers
B:AWS Config evaluates configuration state and compliance; it is not a live traffic threat-detection or packet-blocking engine.
C:Storage tier monitoring is for cost/access classification, not managed account threat analysis and alerting.
D:GuardDuty is not a generic inline firewall for all traffic. Network and application filtering must remain separately designed.
Question 266
A security center administers fifty AWS accounts. Each workload team separately enables GuardDuty, and some newly created accounts lack coverage. Which administration change improves organization-wide detection consistency?
- Enable S3 bucket versioning in one central account and assume GuardDuty inherits the setting in all member accounts.
- Configure delegated GuardDuty administration and organization account enrollment settings as supported for the accounts and Regions.
- Create a single CloudFront cache behavior and assume it turns on GuardDuty in every linked AWS account.
- Give each workload account's root key to the central SOC so it can run detection scripts interactively.
Explanation
Correct Answer
B:Central administration can manage member enrollment and coverage without depending on each workload administrator to remember a separate detection setup.
Incorrect Answers
A:S3 object revision protection has no automatic effect on which accounts have GuardDuty detectors enabled.
C:CDN configuration does not govern threat detector enrollment across an AWS Organization.
D:Shared root credentials are unnecessary and dangerous for delegated security administration. Organization features provide appropriate control paths.
Question 267
GuardDuty issues a high-severity finding when an instance communicates with a known malicious endpoint. Responders want a repeatable containment workflow rather than waiting for someone to notice the console notification. What integration is appropriate?
- Assume GuardDuty findings always revoke instance credentials and quarantine EC2 automatically without any response integration.
- Set the instance's EBS snapshot schedule to hourly and treat backups as real-time threat containment.
- Route relevant GuardDuty findings through EventBridge to an authorized response workflow, such as Lambda or Systems Manager automation.
- Disable CloudTrail collection because the GuardDuty finding already includes every forensic detail.
Explanation
Correct Answer
C:EventBridge can route finding events to predefined handling logic. The workflow can isolate the affected instance or open an incident, subject to least-privilege safeguards and approval rules.
Incorrect Answers
A:A detection finding does not universally perform containment. The organization must implement or configure the response action.
B:Backups support recovery but do not stop an actively compromised instance's malicious network behavior.
D:CloudTrail and other logs provide valuable investigation context. Disabling them would remove evidence needed for diagnosis.
Question 268
A company has 45 AWS accounts in one organization with S3 buckets holding possible confidential records. Security needs centralized automated sensitive-data discovery for the existing member accounts and for new accounts as they join, without asking each account team to configure its own discovery settings. Which configuration should the team implement in each required AWS Region?
- Enable organization-wide GuardDuty S3 Protection, because its API anomaly detections automatically inspect every object body for sensitive identifiers.
- Have each Macie member account independently enable and control automated discovery after a central Macie administrator has been configured for the organization.
- Rely only on CloudTrail S3 data events to classify the contents of each object, because operation logs include the full body of every object read.
- Use the organization Macie administrator to enable automated sensitive-data discovery for member accounts and configure automatic coverage of new organization accounts.
Explanation
Correct Answer
D:The designated Macie administrator can enable automated discovery across existing member accounts and auto-enable new members, selecting the appropriate organizational configuration. Coverage and settings are regional and should be configured where required.
Incorrect Answers
A:GuardDuty S3 Protection analyzes activity and API usage signals for threats; it does not serve as the content-classification engine for identifiers inside stored S3 documents.
B:When accounts are centrally managed in Macie, the administrator controls organizational automated-discovery enablement and settings. Member accounts do not independently enable or manage that configuration.
C:CloudTrail data events record S3 object API activity, not complete file contents or managed sensitive-data classifications. They cannot replace content analysis for data discovery.
Question 269
A company uses a proprietary 12-character supplier account identifier that standard PII detectors do not reliably recognize. The identifier appears in S3 documents only when a nearby label such as SUPPLIER-ACCOUNT is present. The privacy team wants Macie to detect this organization-specific pattern while limiting false positives. What should it configure?
- Create a Macie custom data identifier with a regex for the account code and suitable keyword/proximity criteria, then include it in the relevant sensitive-data discovery jobs.
- Turn on GuardDuty S3 Protection and expect suspicious API activity detection to classify arbitrary custom text formats inside stored S3 objects.
- Enable S3 server access logging and treat log records as a complete indexed classification of proprietary values present in historical object bodies.
- Enable bucket default encryption and expect the KMS key to infer which object payloads contain the proprietary supplier identifier.
Explanation
Correct Answer
A:Amazon Macie custom data identifiers permit user-defined regular expressions refined by keywords, ignored words and proximity rules. Applying the identifier to the discovery scope enables detection of proprietary formats beyond managed PII identifiers.
Incorrect Answers
B:GuardDuty S3 Protection evaluates potentially malicious S3 activity and threats; it is not a substitute for Macie content analysis using a custom pattern within object bodies.
C:S3 access logs record requests and access patterns, not a complete scan or classification of the text contained in all S3 objects.
D:Server-side encryption protects data at rest. KMS key selection does not inspect and classify arbitrary proprietary textual identifiers in S3 content.
Question 270
Macie finds credit-card information in an S3 bucket exposed to an external partner. A developer says enabling Macie itself encrypts the affected files and revokes the partner automatically. What follow-up should be recommended?
- Rely on Macie classification as the sole encryption and authorization barrier for payment data.
- Delete all CloudTrail logs to remove references to the discovered sensitive object names.
- Use S3 Standard-IA instead of S3 Standard and assume the storage class automatically denies external partners.
- Review the Macie findings and remediate the bucket access or encryption policies separately according to data sensitivity.
Explanation
Correct Answer
D:Macie identifies sensitive content and related risk; data protection changes still require IAM, S3 encryption and other configured controls. Detection should inform a targeted remediation plan.
Incorrect Answers
A:Classification is evidence about content and location, not an enforcement policy granting or denying access to the object.
B:Removing audit logs would harm accountability and does not change the bucket's exposure or encryption.
C:Storage class affects billing and retrieval, not which principals may access credit-card data.
