AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 31
Question 300
A company consolidates findings from GuardDuty, Config and Inspector in Security Hub. It wants high-severity findings routed to an incident tracker and certain approved items auto-triaged. Which operational pattern is appropriate?
- Use a Security Hub automation rule to mark every high-severity finding as RESOLVED when it first arrives, without checking the originating detector.
- Forward separate GuardDuty and Inspector notifications directly to responders but bypass Security Hub finding status and the central incident tracker.
- Create an EventBridge rule that forwards every Security Hub finding to an SNS topic without severity filtering, status updates, or the incident-system integration.
- Use supported Security Hub automation rules and event integrations to classify and route findings into controlled response workflows.
Explanation
Correct Answer
D:Security Hub can manage finding workflow context and integrate with event-driven automation. The organization must define which actions are safe; a dashboard alone is not remediation.
Incorrect Answers
A:Automatically resolving every high-severity result suppresses active security issues instead of routing them for incident response. Automation rules require specific acceptance criteria and escalation integration.
B:Service-specific notifications may be useful, but do not meet this case's consolidated severity-aware Security Hub triage, controlled workflow updates, and incident-system routing requirement.
C:A broad SNS notification can announce findings, but it does not deliver the required severity-aware ticket routing or update selected finding workflow states. Security Hub automation rules and a configured response integration are needed for both outcomes.
Question 301
A production security dashboard permits ordinary application developers to disable standards and mark critical findings as resolved. The CISO wants the dashboard to be reliable evidence for risk decisions. Which access-control adjustment is needed?
- Restrict Security Hub standards and finding-workflow changes to authorized security operations roles, retaining auditable review and approval.
- Disable CloudTrail records of Security Hub changes to keep internal dashboard activity private.
- Increase the dashboard browser refresh interval and assume it prevents unauthorized finding modifications.
- Allow all application owners to suppress critical findings because the dashboard is only a visualization.
Explanation
Correct Answer
A:Finding status and enabled checks affect how posture is represented. Unrestricted modification lets compromised or conflicted operators conceal real issues from centralized review.
Incorrect Answers
B:Audit visibility of security configuration changes is valuable and should be protected, not deliberately removed.
C:Presentation timing does not change which IAM principals may call APIs to change standards or finding workflow state.
D:Security findings influence response priorities, and unrestricted suppression undermines the dashboard's integrity as a security control.
Question 302
An AWS Config remediation rule repeatedly invokes the same unsuccessful action against an EC2 resource that cannot be repaired automatically. The retries create alerts and unnecessary API calls. Which operational response is best?
- Set unlimited remediation retries and ignore all reported failures because the next attempt must eventually succeed.
- Bound automatic remediation attempts and investigate failures, using supported remediation exceptions for resources that cannot be remediated as expected.
- Delete the Config rule itself so compliance can no longer be evaluated on any resource.
- Silence the EventBridge rule that reports AWS Config remediation failures, but keep repeatedly invoking the same unsuccessful automation.
Explanation
Correct Answer
B:Config remediation controls can limit repeated attempts and handle known exceptions. This prevents an endless failure cycle while preserving visibility into noncompliant resources.
Incorrect Answers
A:A persistent unsupported or misconfigured action can fail indefinitely. Unbounded attempts waste resources and obscure the real error.
C:Removing detection hides the policy problem rather than making remediation safe or effective. Exception and attempt handling is more targeted.
D:Suppressing notifications hides an ongoing failure but does not bound automation retries or reduce API calls. Inspect the remediation action and use supported maximum-attempt and resource-exception controls.
Question 303
An auditor wants a history of whether an S3 bucket had public-access configuration enabled and which rule marked it noncompliant last week. A developer offers VPC Flow Logs containing TCP connection metadata instead. What evidence source better fits?
- Use CloudFront cache statistics as proof of which S3 access policies were enabled last week.
- Use an NACL rule count as the sole evidence of bucket encryption and public-access configuration.
- Use AWS Config configuration history and compliance-rule evaluations for the bucket's resource state.
- Use VPC Flow Logs as a complete authoritative history of all S3 bucket policy statements.
Explanation
Correct Answer
C:Config records supported resource configuration changes and checks them against rules over time. It answers configuration-compliance questions rather than raw packet-flow questions.
Incorrect Answers
A:Cache hit and miss metrics measure delivery behavior and cannot reconstruct bucket policy or Config rule state.
B:Subnet packet-filter rules do not define S3 bucket configuration compliance or provide its historical revisions.
D:Flow Logs describe IP traffic metadata, not a chronological inventory of S3 resource policy configurations.
Question 304
A multinational AWS organization must evaluate configuration compliance across dozens of accounts and Regions. Its current engineers inspect local AWS Config consoles manually and lack a central view. Which aggregation design is appropriate?
- Attach an internet gateway to the management VPC so all AWS Config findings automatically become visible there.
- Copy one account's Config rule names to a spreadsheet and assume that constitutes live aggregated compliance evidence.
- Create an S3 public website displaying the management account's Config state as a proxy for all Regions.
- Use supported AWS Config organization or multi-account aggregators to collect compliant and noncompliant resource state centrally.
Explanation
Correct Answer
D:Config aggregators provide cross-account and cross-Region visibility into supported recorded configuration and compliance results. They reduce manual account-by-account inspection.
Incorrect Answers
A:VPC routing does not substitute for the Config service's multi-account aggregation and authorization setup.
B:Rule names alone are not evaluated resource results in the other accounts. Aggregation needs supported data collection across locations.
C:One account's configuration does not represent all member accounts or regional resources, and public posture data adds risk.
Question 305
A company already exposes an internet-facing Application Load Balancer with a working HTTPS listener and validated ACM certificate; its EC2 targets remain private. Users still type http://portal.example.com and receive plaintext HTTP from an existing port-80 listener. Security needs all port-80 requests to upgrade automatically to HTTPS without requiring redirects in every application container. Which ALB change is appropriate?
- Set the ALB port-80 HTTP listener default action to redirect requests to HTTPS on port 443, using an appropriate redirect status code, while retaining the existing HTTPS listener.
- Give the backend EC2 targets public IPv4 addresses so browsers can negotiate TLS directly with each server rather than passing through the ALB.
- Change the ALB target group health-check path to an HTTPS URL and assume this redirects ordinary client requests from HTTP to HTTPS.
- Change the backend target group from HTTP to HTTPS and remove the ALB port-80 listener, assuming HTTPS targets automatically redirect client HTTP requests.
Explanation
Correct Answer
A:ALB listener rules support Redirect actions such as HTTP to HTTPS with a 301 or 302 response. The existing HTTPS listener and certificate then serve TLS while private targets remain behind the ALB.
Incorrect Answers
B:Public target addresses are not needed for client TLS termination at an internet-facing ALB, and they would unnecessarily expose application instances.
C:Target-group health checks monitor backend reachability. Their protocol/path settings do not issue client-facing 301 or 302 redirects for the HTTP listener.
D:Encrypting ALB-to-target traffic can be useful, but a target-group protocol does not issue browser-facing redirects. Removing the HTTP listener simply leaves requests on port 80 unanswered rather than returning a 301/302 upgrade.
Question 306
An enterprise has security data from GuardDuty, Inspector and AWS Config in several AWS accounts. Analysts need one prioritized cross-account view without claiming that a dashboard replaces the detectors. Which service is suitable?
- Give every account root access to every security console so the analyst can click between accounts manually.
- Use AWS Security Hub to aggregate and organize findings from supported security services across the governed accounts.
- Aggregate CloudTrail events into one log account and assume that raw API history automatically prioritizes GuardDuty, Inspector and Config findings as Security Hub controls do.
- Enable organization-wide GuardDuty only and assume it produces the same Inspector vulnerability and Config compliance results.
Explanation
Correct Answer
B:Security Hub provides centralized posture and findings workflows. GuardDuty, Inspector and Config continue to supply their specialized detections and configuration results.
Incorrect Answers
A:Shared root credentials create unnecessary privilege and do not provide a coherent, least-privilege organization-wide finding view.
C:Centralized CloudTrail helps analyze AWS API activity but does not replace the security-findings aggregation, control states and cross-account severity workflows provided by Security Hub.
D:GuardDuty is a threat-detection service and does not replace Inspector’s vulnerability assessment or Config’s resource-compliance evaluations. A consolidated view should retain all suitable source services.
Question 307
A company must continuously identify S3 buckets that deviate from a rule prohibiting public access. Today an auditor manually screenshots bucket settings once per quarter. Which AWS capability should generate ongoing compliance findings?
- Enable S3 Transfer Acceleration, which is an automatic compliance scanner for public bucket statements.
- Rely solely on quarterly screenshots because public access cannot change between audits.
- Use VPC Flow Logs alone to establish whether each S3 bucket's public-access configuration is enabled.
- Record supported resource configurations with AWS Config and evaluate the buckets using an appropriate Config rule.
Explanation
Correct Answer
D:Config maintains configuration-state evidence and can evaluate resource compliance against defined checks as settings change, improving on one-time screenshots.
Incorrect Answers
A:Transfer Acceleration optimizes data-transfer endpoints; it does not replace AWS Config policy evaluation.
B:Bucket policies and Block Public Access settings can change at any time; manual periodic evidence leaves substantial gaps.
C:Flow Logs concern network traffic metadata and do not provide authoritative configuration evaluation for S3 resource policies.
Question 308
A data lake accepts uploads from fifty different clients. The business policy requires encrypted S3 storage regardless of whether each client remembers an upload encryption header. Some sensitive prefixes need stronger KMS control. Which baseline design is suitable?
- Disable all S3 encryption to reduce upload API complexity, then rely on the S3 endpoint's HTTPS connection after objects are written.
- Store plaintext objects and assume a private bucket policy means the underlying object bytes are encrypted with the required KMS key.
- Set the bucket's required default server-side encryption configuration and enforce any SSE-KMS requirements through appropriate bucket policy and key access.
- Require every SDK caller to embed a permanent customer-managed KMS plaintext key in its application binary.
Explanation
Correct Answer
C:S3 automatically encrypts new objects with SSE-S3 by default, and bucket default settings or policy can enforce stronger requirements such as a particular KMS key. Client omissions should not cause unintended plaintext object storage.
Incorrect Answers
A:TLS protects transfer in flight but does not replace at-rest object encryption or meet a customer-managed key control.
B:Access control and encryption are distinct. A bucket can restrict readers without using the required customer-managed key.
D:Hardcoded key material creates serious exposure and is unnecessary for AWS-managed SSE-KMS workflows and server-side default encryption.
Question 309
A role is allowed to read objects in a protected S3 bucket. Some objects use SSE-KMS with a customer-managed key, and GetObject fails with KMS AccessDenied. Which authorization boundary must be addressed?
- Authorize the workload's principal to use the specific KMS key through its key policy and any required IAM permissions.
- Enable S3 Versioning on the bucket and expect all new versions to bypass KMS key access rules.
- Expand the bucket's ListBucket permissions and expect that to override the KMS key policy.
- Remove the role from the VPC security group because KMS uses group membership for cryptographic authorization.
Explanation
Correct Answer
A:S3 object permission does not automatically imply decrypt authorization on an independent customer-managed KMS key. Both services' applicable controls must allow the encrypted read.
Incorrect Answers
B:Versioning preserves object revisions but does not eliminate required KMS access to retrieve encrypted versions.
C:ListBucket controls object enumeration and does not grant KMS Decrypt or bypass a key policy.
D:Security groups regulate network traffic, not permission to invoke KMS cryptographic API operations.
Question 310
A compliance team needs evidence that confidential S3 objects are encrypted with the intended customer-managed KMS key. A developer proposes copying KMS plaintext key material into the application to inspect object bytes locally. What is the better validation strategy?
- Export the customer-managed KMS key's plaintext symmetric key from AWS KMS into the application repository.
- Disable S3 bucket policy validation because an object is automatically confidential whenever it is versioned.
- Change the bucket name to end with -encrypted and treat the naming convention as cryptographic evidence.
- Inspect relevant S3 encryption metadata, enforce bucket/key policies and use supported AWS audit or configuration evidence without exposing plaintext key material.
Explanation
Correct Answer
D:S3 can report server-side encryption attributes and AWS tools can evaluate policy. KMS-managed key material is not meant to be copied into application source to prove encryption.
Incorrect Answers
A:Standard KMS-managed key material is not exported as a plaintext secret through ordinary key-management APIs. Embedding secrets would also violate the protection objective.
B:Versioning preserves historical object versions and does not prove correct encryption key selection or access restriction.
C:Resource names are not proof of actual server-side encryption configuration, KMS key use or authorization.
