AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 36
Question 350
A catalog application stores confidential customer records in DynamoDB. Its owners want an AWS-managed table encryption mechanism using a customer-controlled KMS key with appropriate access governance. Which configuration addresses stored-table data?
- Enable HTTPS for API requests only and regard plaintext persisted table data as meeting the at-rest key requirement.
- Select DynamoDB server-side encryption with the permitted customer-managed AWS KMS key and authorize its use.
- Create a DynamoDB global secondary index and let it provide encryption key material for the base table.
- Put a NAT gateway in the DynamoDB request path so the gateway encrypts all stored records at rest.
Explanation
Correct Answer
B:DynamoDB supports server-side encryption at rest, including an eligible customer-managed KMS key. Access to that key must be governed independently of application item permissions.
Incorrect Answers
A:TLS protects transit; it is not a customer-managed encryption key for the persisted DynamoDB table data.
C:A GSI supports alternate access paths, not cryptographic key management for at-rest encryption.
D:NAT gateways enable certain outbound IPv4 traffic and cannot configure DynamoDB table encryption or manage its data keys.
Question 351
An application processes regulated orders in an Amazon DynamoDB table encrypted with a customer managed KMS key. A security test finds that a custom client has disabled TLS certificate validation after a proxy migration. The team must continue using the DynamoDB API while ensuring that requests cannot be intercepted by an impostor endpoint. Which design best addresses the transport security issue without confusing it with encryption at rest?
- Rely on DynamoDB server-side encryption with the customer managed KMS key; it also authenticates the remote server in every client connection.
- Add a DynamoDB VPC endpoint and allow the client to disable TLS server certificate checks because private routes provide equivalent identity assurance.
- Use a supported TLS connection to the DynamoDB API and restore server certificate validation in the client and any trusted TLS-terminating intermediary.
- Enable DynamoDB point-in-time recovery so retained backups prove that every API request was protected by a trusted transport certificate.
Explanation
Correct Answer
C:DynamoDB clients should use transport-layer encryption and verify the TLS endpoint identity. Restoring certificate validation prevents the custom client from trusting a forged endpoint, while proper trust handling is needed anywhere a proxy legitimately terminates TLS.
Incorrect Answers
A:KMS-backed table encryption protects stored data and supports key policy controls. It does not authenticate the server presenting a DynamoDB API endpoint or fix a TLS client that accepts an impostor certificate.
B:A VPC endpoint can keep service traffic on the AWS network and restrict the permitted route, but it is not a substitute for TLS peer validation. A compromised or misconfigured client must still authenticate the service endpoint and protect its request contents in transit.
D:Point-in-time recovery retains recoverable table states after mistakes or data damage, but it does not negotiate TLS, authenticate a server certificate, or prevent interception of an API session during normal reads and writes.
Question 352
Two tenants store orders in a shared DynamoDB table with tenantId as the partition-key component. Application roles must not read items belonging to another tenant. Which AWS permission boundary can reinforce the application checks?
- Enable DynamoDB Streams so unauthorized item reads are silently rejected by the stream processor.
- Give each tenant role dynamodb:* on every table and rely on JavaScript to hide other tenants' rows.
- Enable point-in-time recovery and treat backup history as a filter preventing cross-tenant reads.
- Use narrowly scoped DynamoDB IAM permissions with leading-key conditions aligned to each tenant's allowed partition keys.
Explanation
Correct Answer
D:DynamoDB fine-grained access policies can restrict item access by key attributes, including suitable dynamodb:LeadingKeys conditions. Correct key design and role scoping remain essential.
Incorrect Answers
A:Streams emit change events; they are not the primary request authorization control for direct table reads.
B:Client-only filtering does not provide a robust authorization boundary when the role can query arbitrary keys.
C:PITR helps restore data; it does not restrict an authenticated caller to its own tenant partition keys.
Question 353
A financial ledger uses DynamoDB and must be recoverable to a recent point in time after a bad batch update. Encryption is already configured. Which additional table capability addresses that recovery requirement?
- Enable DynamoDB point-in-time recovery and maintain an appropriate recovery/test procedure.
- Rely on DynamoDB server-side encryption alone to reconstruct items deleted by an authorized buggy worker.
- Set an aggressive DynamoDB TTL so the service restores previous item values automatically after a bad write.
- Create a global secondary index and assume DynamoDB preserves every previous item value under its indexed keys.
Explanation
Correct Answer
A:PITR supports restoration to a selected point within its recovery window and addresses accidental changes. Encryption protects stored data confidentiality but does not provide historical rollback.
Incorrect Answers
B:Encryption cannot reverse a legitimate but incorrect delete or overwrite operation performed by an authorized client.
C:TTL expires items asynchronously; it does not maintain a queryable archive of past table states.
D:Secondary indexes support alternate query patterns rather than historical point-in-time table recovery.
Question 354
An attacker compromises the EC2 role running a backup-producing application. The role also holds broad backup-vault delete permissions, making stored recovery points easy to destroy. Which permission design best reduces blast radius?
- Keep delete permission but change the vault display name, assuming the attacker cannot find recovery points.
- Separate backup-vault administration and delete permissions from the production application role using least-privilege policies.
- Grant the application role AWSBackupFullAccess so all backup operations succeed even during an attack.
- Remove the EC2 security group because backup vault authorization is determined by network port openness.
Explanation
Correct Answer
B:The protected backup repository should have a security boundary distinct from the compromised production workload. Application identities need not administer vault retention or delete recovery points.
Incorrect Answers
A:Renaming resources is not an access-control mechanism and offers no reliable defense against an authorized malicious API caller.
C:Broad backup administration expands the damage an application-role compromise can cause and weakens recovery isolation.
D:Backup-vault API privileges are an authorization issue, not controlled by application instance ingress rules.
Question 355
A regulated backup archive must retain recovery points for seven years even if an AWS administrator later wants to shorten retention. Operations considers a reversible governance setting sufficient. Which AWS Backup protection best fits the strict WORM requirement?
- Rely only on an application-side cron job that refuses deletion requests while admins can disable it.
- Use a backup-vault access policy that denies DeleteRecoveryPoint to the named administrators, while allowing privileged operators to edit that policy later.
- Use AWS Backup Vault Lock with compliance-mode controls and configured retention settings appropriate to the legal mandate.
- Use AWS Backup Vault Lock in governance mode and assume even sufficiently authorized backup administrators can never remove the vault lock.
Explanation
Correct Answer
C:Compliance-mode Vault Lock is designed to enforce immutable retention after its applicable grace period, unlike an ordinary adjustable vault policy or governance override.
Incorrect Answers
A:An application task is not a tamper-resistant retention control against privileged users with administrative access.
B:An editable deny policy may deter accidental deletion, but it does not make retention immutable against principals who can alter the policy. The strict seven-year requirement needs a lock that remains effective after privileged compromise.
D:Governance-mode vault locks can be removed by appropriately privileged users. Compliance-mode Vault Lock after its grace period is the mechanism for retention that privileged administrators cannot shorten.
Question 356
A company keeps AWS Backup recovery points in the same account and Region as production. A regional disaster or compromised production administrator could make those backups inaccessible. Which architecture improves recovery independence?
- Increase backup job frequency but retain every recovery point in the original single account and Region.
- Create a second Route 53 alias record pointing to the production database without copying recovery data.
- Place an additional EBS volume on the production EC2 instance and call it a geographically independent backup.
- Configure supported AWS Backup copy operations into a separately governed account and an appropriate second Region.
Explanation
Correct Answer
D:Cross-account and cross-Region backup copies broaden failure-domain isolation. Permissions, service support, encryption keys and restore tests still need careful configuration.
Incorrect Answers
A:More frequent local backups improve point objectives, not the independent account and regional fault boundary requested.
B:DNS redundancy cannot provide restorable database contents if the original account or Region is unavailable.
C:A volume attached to the same compute and Region shares too many operational and compromise risks to satisfy isolation.
Question 357
A government agency contract states its personally identifiable information must remain in a specified AWS Region, including application processing and stored data. Teams currently select whichever AZ yields the lowest latency. What is the controlling architectural decision?
- Deploy the relevant storage and processing services in an approved AWS Region and enforce the geographic placement requirement.
- Enable CloudFront caching globally by default for every protected response regardless of the residency constraint.
- Use any Region but encrypt data with SSE-KMS, because encryption removes all data-location obligations.
- Select a named AZ such as us-east-1a in any account and assume identical AZ letters mean compliant geography.
Explanation
Correct Answer
A:An Availability Zone is a failure-isolation location inside a Region, not a substitute for selecting a contractually permitted Region for data processing and storage.
Incorrect Answers
B:Global edge distribution may create additional data placement considerations and is not an automatic solution to geographic restrictions.
C:Encryption protects confidentiality but does not relocate bytes or change a contract's residency definition.
D:AZ names are account-relative and do not replace Region-level residency governance or processing location requirements.
Question 358
An architect confines a regulated S3 data lake to an approved Region, yet CloudTrail logs are sent to another Region and cross-Region replication copies selected objects elsewhere. The compliance scope includes all copies. What should be inspected?
- Check only the primary bucket's console Region label because no other AWS service can create derived copies.
- Increase S3 Transfer Acceleration throughput and assume all bytes remain within the original Region.
- Inventory and restrict replication destinations, logging archives, backups and processing locations in addition to primary bucket placement.
- Apply object versioning and infer that every replica and security event is automatically confined to the same Region.
Explanation
Correct Answer
C:Data residency applies to the full data lifecycle, including replicas and possibly sensitive logs. A compliant primary bucket does not guarantee that auxiliary copies meet the same boundary.
Incorrect Answers
A:Backup, replication and logging services can create secondary datasets, so primary placement alone gives incomplete assurance.
B:Acceleration behavior does not constitute an end-to-end residency verification for replication, processing or logging destinations.
D:Versioning is an object-history mechanism and does not enforce geographic locality of other services and copies.
Question 359
A multi-account AWS organization wants to prevent most regional service creation outside an approved geographic set. App teams could otherwise bypass written policies. What preventive mechanism should be considered with appropriate service exceptions?
- Create a single EC2 security group called allowed-regions and assign it to every global AWS service.
- Use organization-level service control policies with aws:RequestedRegion conditions and carefully account for global-service behavior.
- Set a Route 53 public DNS policy to drop foreign requests, which automatically prevents all services from launching in those Regions.
- Rely on monthly budget alarms, which block unauthorized regional API calls as soon as spending increases.
Explanation
Correct Answer
B:An SCP can bound the maximum available permissions for member accounts and restrict API requests by Region. Global services and context-key limitations require explicit exceptions and testing.
Incorrect Answers
A:EC2 security groups control network reachability, not AWS API requests across Regions or services without VPC association.
C:DNS request routing does not constrain AWS control-plane API usage or the placement of resources in other Regions.
D:Budget notifications inform operators about cost; they are not a preventive IAM deny boundary for Region selection.
Question 360
A software vendor encrypts EU customer records with a KMS key but stores ciphertext and backups in a nonapproved Region. Its contract forbids storing the records outside designated geography even when encrypted. Is the design compliant?
- No, unless the application also enables Provisioned IOPS, which is the sole technical basis for regional residency.
- Yes. Any SSE-KMS ciphertext is no longer considered located in the Region holding its storage media.
- Yes. Global AWS IAM policies automatically designate every encrypted dataset as residing in the home account Region.
- No. Move the protected records and relevant copies to approved Regions; encryption does not waive the stated data-location restriction.
Explanation
Correct Answer
D:Residency and confidentiality are different controls. Strong cryptography reduces disclosure risk but cannot change where regulated data resides under an explicit regional contract.
Incorrect Answers
A:Database or block performance tiers have no causal effect on an object's geographic placement or contract interpretation.
B:Encryption transforms readability, not physical or logical storage location; a contract can still prohibit encrypted copies elsewhere.
C:IAM policies authorize API operations and do not alter the Region where the data and backups are stored.
