AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 30
Question 290
A network engineer has VPC Flow Logs showing REJECT for several database connection attempts. The engineer asks for full packet payloads and exact SQL commands directly from the flow log records. Which diagnostic approach is correct?
- Correlate Flow Logs' metadata with security groups, NACLs, routes and application logs; use other tools if payload capture is required.
- Disable NACLs and security groups permanently so Flow Logs have fewer rejected events.
- Read the Flow Logs record as a decrypted full-packet capture containing every SQL statement.
- Assume a REJECT record always means the database password was incorrect.
Explanation
Correct Answer
A:Flow Logs describe flow attributes and acceptance status, not arbitrary decrypted application packet contents. They can point to network filtering that needs configuration review.
Incorrect Answers
B:Removing all filtering sacrifices security instead of using the records to identify the narrowly misconfigured rule.
C:Flow Logs are not packet captures and do not include the full TCP or SQL payload required for application-level reconstruction.
D:Network-layer rejects often occur before a database login is attempted. Authentication logs are a separate evidence source.
Question 291
A security team collects VPC Flow Logs to investigate private workload traffic. One engineer proposes storing these logs in a public S3 bucket so any developer can view network metadata. What logging design is safer?
- Allow unauthenticated GetObject on the log bucket, because flow records never contain sensitive information.
- Disable encryption and access logging on the log destination to improve Flow Logs throughput.
- Store the only copy of flow records on each instance's ephemeral disk without central collection.
- Deliver Flow Logs to properly access-controlled CloudWatch Logs or S3 locations with scoped access and retention.
Explanation
Correct Answer
D:Network flow metadata can reveal IP addresses and service behavior. Protected destinations preserve investigation value without creating public infrastructure visibility.
Incorrect Answers
A:IP and timing details may still be sensitive and useful to attackers. Public logging exposure is not necessary for operations.
B:Weakened protection would increase evidence exposure, while the appropriate objective is safe delivery and analysis.
C:Instance-local logs can disappear after host failure or compromise and are not a reliable controlled cross-instance investigation archive.
Question 292
A developer proposes enabling VPC Flow Logs as a replacement for a security group deny strategy, arguing that REJECT records automatically drop malicious traffic. Which statement is correct?
- Creating a CloudWatch Logs group automatically inserts explicit Deny rules into every security group in the VPC.
- Flow Logs record network-flow metadata; actual packet access is controlled by security groups, NACLs or other enforcement devices.
- Enabling Flow Logs makes NAT gateways perform WAF SQL inspection for the same subnet.
- Every flow marked REJECT is denied by the Flow Logs feature itself.
Explanation
Correct Answer
B:Flow logging is observational rather than a policy engine that inspects and changes packet forwarding. Use its records to investigate, then change the relevant control.
Incorrect Answers
A:Log groups store events and do not rewrite security group ingress or egress rules merely by existing.
C:Flow metadata collection has no connection to application-layer WAF evaluation or NAT translation behavior.
D:The accept or reject action reflects network controls, not an enforcement decision made by the logging service.
Question 293
An enterprise routes inspected VPC traffic through AWS Network Firewall endpoints. After introducing asymmetric return routing, some stateful TCP connections reset even though the forward path is allowed. What correction should the network architect make?
- Allow replies to bypass every inspection point and assume each firewall sees the same connection state automatically.
- Ensure supported symmetric routing so both directions of each stateful flow traverse the appropriate inspection endpoints.
- Add permit rules for ephemeral TCP ports to Network Firewall while leaving the forward and return packets on different stateful endpoints.
- Use an ALB listener rule as a route-table replacement for arbitrary non-HTTP return packets.
Explanation
Correct Answer
B:Stateful inspection tracks bidirectional connection context. If return traffic bypasses or reaches an incompatible firewall endpoint, the engine may not match it to the original session.
Incorrect Answers
A:Separate stateful endpoints do not share arbitrary flow state as a general route guarantee. Asymmetry can disrupt inspected sessions.
C:Allow rules alone cannot reconstruct connection state at a different stateful inspection endpoint. TCP return traffic must traverse a supported symmetric inspection path for the appliance to track the established flow.
D:ALB is an application load balancer, not a general VPC router for the stateful firewall path.
Question 294
A team deployed AWS Network Firewall in a centralized inspection VPC but left its policy with default pass behavior and no relevant stateful restrictions. They believe every unwanted application flow is now blocked. Which step is necessary?
- Configure appropriate stateless and stateful inspection rules and route the intended traffic through the firewall endpoints.
- Enable an unrelated EC2 instance's detailed monitoring to supply missing Network Firewall policy logic.
- Grant all workloads AdministratorAccess so they can bypass any missing firewall rules.
- Assume all Network Firewall deployments perform web application SQL injection blocking with no rules or traffic routing.
Explanation
Correct Answer
A:The firewall engine enforces its configured policy on traffic that actually reaches the endpoints. Deployment alone does not imply a universal default block of every undesired protocol.
Incorrect Answers
B:Instance metrics cannot create firewall allow/deny conditions or cause traffic to traverse a firewall endpoint.
C:Broad IAM permissions neither implement stateful network inspection nor reduce unwanted packet flows.
D:Inspection policy and path configuration matter, and WAF-style HTTP rules are not automatically installed for every workload.
Question 295
Two private VPC segments exchange raw database TCP traffic. Security requires a stateful network inspection policy on this traffic. A developer proposes AWS WAF because it can block SQL injection in supported HTTP requests. Which service selection is more appropriate?
- Enable S3 versioning on the database backup bucket as a replacement for live network filtering.
- Attach a WAF web ACL to an S3 website URL and assume it inspects every TCP packet between VPC segments.
- Use AWS Network Firewall in a correctly routed inspection path for the relevant non-HTTP network flows.
- Use CloudFront cache-key normalization to inspect arbitrary native database TCP payloads.
Explanation
Correct Answer
C:Network Firewall can enforce supported stateful or stateless traffic inspection across VPC paths. AWS WAF is a separate HTTP request firewall associated with supported web resources.
Incorrect Answers
A:Backup object versions can help data recovery but do not block or inspect packets between database clients and servers.
B:A web ACL does not become a general inter-VPC packet firewall merely because it protects a web endpoint.
D:CloudFront is an HTTP delivery service and does not provide an inline stateful firewall path for database protocols.
Question 296
An internal employee portal must be accessible only by clients inside a private VPC and connected corporate network. A team proposes an internet-facing ALB and relies solely on obscure DNS naming. What load balancer scheme fits the access requirement?
- Assign public Elastic IPs to each portal backend instance and disable the load balancer.
- Use S3 website hosting to turn the internal dynamic portal into a private application load balancer.
- Choose an internet-facing ALB because a private DNS record prevents the public endpoint from receiving traffic.
- Deploy an internal ALB in appropriate private subnets and allow only the authorized private network clients.
Explanation
Correct Answer
D:An internal load balancer uses private-address reachability rather than a public internet-facing endpoint. Network and application authorization still govern the permitted clients.
Incorrect Answers
A:Direct public backends would violate the employee-only private access requirement and remove centralized load balancing.
B:S3 website hosting does not provide internal ALB application routing and would not meet the existing dynamic service topology.
C:Public reachability is determined by ALB scheme and networking, not solely by whether a public DNS name is advertised.
Question 297
An application is already published through an internet-facing Application Load Balancer HTTPS listener. The company has an existing, publicly reachable OpenID Connect (OIDC) identity provider. It wants employees to complete sign-in before protected requests are sent to the application targets, without implementing a new login flow in each backend service. Which listener configuration meets the requirement?
- Add an authenticate-oidc action on the ALB HTTPS listener using the existing IdP, followed by the forward action for authenticated requests.
- Use an AWS WAF managed SQL-injection rule instead of identity-provider integration and assume all requests passing WAF are authenticated.
- Add the identity provider public IP ranges to the ALB security group and treat network-source filtering as proof of each employee login.
- Enable target-group sticky sessions and rely on the resulting cookie as a verified OIDC login token without an authentication action.
Explanation
Correct Answer
A:ALB HTTPS listener rules support authenticate-oidc with an OpenID Connect provider. The listener handles the browser redirect, token exchange and session and forwards matching requests to application targets after authentication.
Incorrect Answers
B:WAF request filtering may stop malicious HTTP patterns but does not, by itself, perform the ALB OIDC redirect-and-token authentication flow required for an employee login.
C:Security groups filter network connections; they cannot verify the identity of an individual employee through an OIDC sign-in. IdP server addresses are not a substitute for an authenticated browser session.
D:ALB stickiness influences target selection for a client session; it is not an identity-provider authentication mechanism and does not validate an OIDC login.
Question 298
An ecommerce application sends customer credentials through an internet-facing ALB. The listener currently accepts plaintext HTTP only, and security requires encrypted client connections with a managed certificate. Which listener setup should be used?
- Keep HTTP only because passwords are hidden when an application uses POST rather than GET.
- Configure HTTPS listeners with an appropriate trusted ACM certificate and TLS policy, redirecting plaintext HTTP where suitable.
- Use S3 default server-side encryption as a substitute for HTTPS on the client connection.
- Disable certificate validation and tell clients to ignore all browser warnings to increase compatibility.
Explanation
Correct Answer
B:An ALB TLS listener terminates supported HTTPS and presents a certificate for the browser hostname. TLS settings protect the client-to-load-balancer credential path.
Incorrect Answers
A:HTTP POST bodies are not encrypted merely by method choice. Credentials can be intercepted on an unprotected network path.
C:S3 encryption at rest has no effect on traffic confidentiality between browsers and the application load balancer.
D:Bypassing trust checks undermines server authentication and can enable interception despite using a TLS protocol.
Question 299
The security operations center uses AWS Security Hub as a centralized findings dashboard. A developer claims Security Hub itself performs every GuardDuty threat detection and Inspector software scan without those services. What design distinction matters?
- Make every finding public so another AWS account can perform the missing scans anonymously.
- Disable GuardDuty and Inspector because Security Hub always recreates all their findings from VPC route tables.
- Security Hub aggregates and correlates compatible findings; underlying security services still perform their own detection or assessment functions.
- Treat CloudFront as the source of all EC2 package vulnerability findings shown in Security Hub.
Explanation
Correct Answer
C:Centralized security posture and finding management are distinct from the originating detectors. GuardDuty and Inspector must be appropriately enabled for their respective analyses.
Incorrect Answers
A:Public finding disclosure increases security exposure and does not establish the detector's supported configuration.
B:Route tables cannot substitute for managed threat intelligence and vulnerability assessment. The underlying detection sources remain necessary.
D:A CDN does not scan instance operating-system packages or replace Inspector's software assessment.
Question 300
A company consolidates findings from GuardDuty, Config and Inspector in Security Hub. It wants high-severity findings routed to an incident tracker and certain approved items auto-triaged. Which operational pattern is appropriate?
- Use a Security Hub automation rule to mark every high-severity finding as RESOLVED when it first arrives, without checking the originating detector.
- Forward separate GuardDuty and Inspector notifications directly to responders but bypass Security Hub finding status and the central incident tracker.
- Create an EventBridge rule that forwards every Security Hub finding to an SNS topic without severity filtering, status updates, or the incident-system integration.
- Use supported Security Hub automation rules and event integrations to classify and route findings into controlled response workflows.
Explanation
Correct Answer
D:Security Hub can manage finding workflow context and integrate with event-driven automation. The organization must define which actions are safe; a dashboard alone is not remediation.
Incorrect Answers
A:Automatically resolving every high-severity result suppresses active security issues instead of routing them for incident response. Automation rules require specific acceptance criteria and escalation integration.
B:Service-specific notifications may be useful, but do not meet this case's consolidated severity-aware Security Hub triage, controlled workflow updates, and incident-system routing requirement.
C:A broad SNS notification can announce findings, but it does not deliver the required severity-aware ticket routing or update selected finding workflow states. Security Hub automation rules and a configured response integration are needed for both outcomes.
