AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 38
Question 370
An analytics workload must read bucket objects only through VPC-associated private access paths. The team plans a dedicated S3 access point for this workload and wants to constrain its network origin. Which access point configuration fits?
- Create an internet-origin access point and assert that an EC2 security group on one client enforces the bucket for every caller.
- Create an S3 access point with a VPC network origin and restrict its policy to authorized roles.
- Use AWS Global Accelerator to publish the access point worldwide because worldwide client access enforces VPC-only access.
- Create a public S3 website endpoint and assume private DNS resolution automatically makes the bucket VPC-only.
Explanation
Correct Answer
B:A VPC-origin S3 access point constrains requests to the selected VPC boundary. IAM and resource policies must still grant the specific object operations.
Incorrect Answers
A:An internet-origin access point lacks the requested VPC-origin restriction and client security groups do not govern all S3 request origins.
C:Global Accelerator optimizes network ingress and does not impose an S3 VPC-origin restriction.
D:Static website endpoints are not the same as VPC-restricted S3 access points and can introduce public exposure.
Question 371
A data team creates an S3 access point policy granting a job role GetObject. The underlying bucket policy still contains an explicit deny for that role. The job receives AccessDenied. How should authorization be interpreted?
- Grant the job a larger EBS disk so S3 GetObject no longer needs an allow in either policy.
- Set the access point alias as an ALB target; ALB registration rewrites all S3 policy evaluation results.
- Review both bucket and access point policies, because an access point allow does not override an applicable explicit deny.
- Ignore the bucket's explicit deny because the access point always supersedes the bucket policy.
Explanation
Correct Answer
C:S3 authorization evaluates relevant identity and resource policies. Using an access point creates an additional permission surface, not a universal bypass of bucket restrictions.
Incorrect Answers
A:Block-storage capacity cannot alter object-service permissions or the effects of a bucket explicit deny.
B:Application load balancing is unrelated to the S3 access point and bucket authorization policy union/denial rules.
D:An applicable explicit deny remains controlling and cannot be defeated solely by choosing a different authorized endpoint.
Question 372
A company has two requirements: give an internal processing team private S3 object access and allow a public CloudFront CDN to fetch images without public bucket ACLs. Which pairing correctly separates the mechanisms?
- Publish the bucket through a public-read ACL and assert that a private access point eliminates its public exposure.
- Use CloudFront Origin Access Control as the only authorization mechanism for every direct internal S3 API caller.
- Use S3 access points as CDN cache nodes, because an access point automatically provides a worldwide edge distribution.
- Use a VPC-restricted S3 access point for the internal team and CloudFront Origin Access Control for secure CDN-origin requests.
Explanation
Correct Answer
D:S3 access points govern access to shared S3 data for selected consumers. CloudFront OAC signs CDN-origin requests so the bucket need not be public.
Incorrect Answers
A:A private access point does not automatically correct public permissions independently configured on the bucket.
B:OAC is specifically a CloudFront-to-origin signing control and does not replace general internal S3 principal permissions.
C:An access point is an object access endpoint with policies, not a content-delivery caching tier.
Question 373
A data lake has thousands of project prefixes inside shared S3 buckets. Applications must access records on behalf of employees federated through IAM Identity Center, using directory groups rather than creating thousands of ad hoc IAM users or bucket-policy statements. Which AWS feature is designed to map those identities to bucket or prefix grants?
- Configure S3 Access Grants locations and prefix-scoped grants for the federated users/groups, obtaining controlled temporary access to the datasets.
- Disable S3 Block Public Access and publish each project prefix as a public website so directory mapping becomes unnecessary.
- Use CloudTrail management events as the only authorization rule, since a successful audit record directly grants GetObject on project prefixes.
- Create only a Route 53 private hosted zone with one DNS record per employee to authorize S3 GetObject.
Explanation
Correct Answer
A:S3 Access Grants maps IAM or directory users/groups to S3 locations and vends permissions for buckets or prefixes, simplifying fine-grained delegated data authorization.
Incorrect Answers
B:Making confidential data public fails group authorization requirements and bypasses intended data protection.
C:CloudTrail records activity; it is not an access-granting mechanism mapping directory groups to S3 objects.
D:DNS records resolve names and cannot grant IAM permissions to S3 prefixes on behalf of federated users.
Question 374
All AWS accounts deliver audit logs to one central S3 bucket. An application administrator currently has permission to overwrite or delete log objects and the bucket uses a broad shared KMS key policy. Which design reduces tampering and disclosure?
- Disable encryption for the log bucket because log records do not contain sensitive resource identifiers.
- Move the bucket to an instance profile security group, replacing all IAM, bucket and KMS permissions.
- Give all application teams s3:DeleteObject on the central archive so old evidence can be cleared quickly.
- Restrict log write/read/delete privileges to dedicated security roles and encrypt the central archive with appropriately scoped key permissions.
Explanation
Correct Answer
D:Audit evidence needs segregation from production roles. Strong access policies and KMS key governance reduce the likelihood that an application compromise can erase or disclose security records.
Incorrect Answers
A:Audit trails can reveal identities, request metadata and sensitive operational details and should be protected according to their classification.
B:S3 and KMS policy authorization cannot be replaced by attaching an EC2-style network security group to a bucket.
C:Unrestricted deletion by production principals defeats the forensic independence and retention requirement.
Question 375
A financial auditor must later verify that archived CloudTrail logs were not quietly altered during a long retention period. The team currently writes logs to an editable bucket and never checks archive integrity. What should be added?
- Configure EC2 enhanced networking on the log delivery client to prevent object-level tampering indefinitely.
- Enable suitable CloudTrail log-file validation and protect retained audit archives with appropriate immutability and access controls.
- Disable historical log retention because a smaller log archive is inherently more trustworthy than a retained one.
- Trust the object filename as a cryptographic checksum even when bucket administrators may overwrite its content.
Explanation
Correct Answer
B:Log-file integrity validation provides evidence about alteration, while a protected retention boundary reduces attacker ability to modify or delete archived records.
Incorrect Answers
A:Network adapter features affect packet performance, not retained audit-log integrity or immutable access policy.
C:Discarding records prevents later investigations and offers no proof that surviving entries were not changed.
D:A name is not a validation digest or trustworthy integrity chain and does not make arbitrary object writes detectable.
Question 376
A web API records the full Authorization header and plaintext user passwords in CloudWatch Logs for debugging. Security wants enough telemetry for troubleshooting without storing reusable credentials. Which change is essential?
- Continue logging plaintext secrets but set the log group retention to one year to satisfy audit completeness.
- Move the log group to another AWS Region while preserving all sensitive request headers unchanged.
- Remove or redact secrets from logs and restrict access to retained diagnostic records.
- Enable EC2 Auto Scaling for the API because scaling automatically removes sensitive headers from CloudWatch log streams.
Explanation
Correct Answer
C:Structured, minimally necessary logging preserves operational evidence while preventing passwords and bearer tokens from becoming a secondary credential repository.
Incorrect Answers
A:Extended retention increases the lifetime of exposed credentials and does not make their storage appropriate.
B:Geographic relocation does not sanitize credential values or reduce their misuse by an authorized log reader.
D:Compute elasticity has no built-in authority to scrub the contents that application code deliberately logs.
Question 377
A KMS administrator needs to retire an obsolete customer-managed key, but hundreds of encrypted records may still depend on it. A junior operator expects ScheduleKeyDeletion to erase the key immediately without warning. What actually happens?
- Assume KMS key deletion only changes the display alias and leaves all cryptographic operations available.
- Schedule deletion with the permitted waiting period and confirm no retained ciphertext depends on the key before the deletion completes.
- Use an ALB deletion protection flag to postpone KMS key deletion, because the two controls share one policy.
- Delete the key instantly and rely on AWS KMS to reconstruct the original material from any ciphertext later.
Explanation
Correct Answer
B:AWS KMS schedules eligible key deletion over a waiting period rather than immediately destroying standard keys. Data encrypted under a destroyed key can become unrecoverable.
Incorrect Answers
A:Key deletion is more consequential than alias management and can make dependent decrypt operations impossible.
C:Load balancer deletion settings do not govern KMS key schedules or the availability of encrypted data.
D:KMS cannot derive a destroyed cryptographic key from data it previously encrypted; irreversible loss threatens recovery.
Question 378
A vault owner wants to retire an AWS KMS key after a merger. Some S3 exports and archived database snapshots were encrypted under it, but they must remain readable for six years. What is required before removal?
- Inventory dependent ciphertext and migrate or re-encrypt preserved data under a key that will remain accessible.
- Set the affected S3 bucket policy to public-read so decryption no longer needs the retired KMS key.
- Delete the key now because AWS will always use the most recently created key to decrypt historical ciphertext.
- Rename the KMS key alias to retired and assume the ciphertext no longer references any underlying key.
Explanation
Correct Answer
A:Deleting a key that still protects long-lived records can destroy the ability to decrypt them. Migration needs tested access before retiring the old key.
Incorrect Answers
B:Read authorization and cryptographic decryption are independent; public bucket permissions cannot recover a lost key.
C:KMS ciphertext is associated with its actual cryptographic key lineage, not whichever key is newest in the account.
D:An alias name is a lookup convenience and does not change which cryptographic material protects past objects.
Question 379
A security analyst must suspend use of a questionable KMS key while investigating a suspected incident, but wants the option to restore service if the suspicion is unfounded. Which distinction should guide the action?
- Deletion and disablement are identical operations with the same automatic rollback behavior after thirty days.
- Disabling only hides the key in the console but continues allowing all Encrypt and Decrypt calls.
- Disabling a KMS key is reversible; completed KMS key deletion is destructive and makes dependent data inaccessible.
- Deleting an alias immediately deletes the underlying KMS key, which is the preferred reversible suspension procedure.
Explanation
Correct Answer
C:Disablement prevents use while retaining the key for possible re-enable. Deletion after the waiting period removes cryptographic material and can permanently strand ciphertext.
Incorrect Answers
A:Deletion removes key material after its waiting period, while a disabled key can be re-enabled if authorization permits.
B:A disabled key cannot normally perform authorized cryptographic operations until enabled again.
D:Alias deletion and KMS key lifecycle are separate; an alias can be removed while the underlying key still exists.
Question 380
A Lambda workload only needs permission to decrypt encrypted payloads with one KMS key. Its role also has kms:ScheduleKeyDeletion and full key-policy editing rights. What least-privilege redesign should be used?
- Grant the role unrestricted kms:* on all keys so missing key-policy statements never block API calls.
- Rotate the KMS key material monthly while leaving the Lambda role authorized for kms:ScheduleKeyDeletion and unrestricted key-policy administration.
- Keep ScheduleKeyDeletion because Lambda must be able to delete a key before every Decrypt invocation.
- Remove lifecycle administration from the workload role and grant narrowly scoped cryptographic usage to that key.
Explanation
Correct Answer
D:Applications that decrypt data do not need authority to destroy or reconfigure the key. Separating KMS administration from usage limits a compromised workload's blast radius.
Incorrect Answers
A:Account-wide cryptographic administration is unnecessary for one permitted decrypt and increases damaging operations.
B:Cryptographic key rotation does not restrict which principals can schedule key deletion or administer policies. Those administrative permissions must be separated from the function’s required decrypt usage.
C:Key destruction is not part of decryption and would endanger the data the function is supposed to process.
