Amazon AWS SAA-C03 Application Protection, WAF, Shield, Secrets, Cognito, and Threat Detection Practice Test 1

 

Topic 04 Practice Test 1 covers Application Protection, WAF, Shield, Secrets, Cognito, and Threat Detection for AWS SAA-C03. For broader exam preparation, review the AWS SAA-C03 Exam Dumps. Every option includes focused technical reasoning explaining both the AWS architecture concept and its fit to the scenario.

Question 1

A service owner has documented that an application needs Layer 7 request inspection and blocking. What should be implemented to meet it? Choose ONE.

1. AWS WAF web ACL
2. AWS WAF IP set
3. AWS Firewall Manager
4. Amazon Cognito user pool

Correct Answer(s)

 

A

Rationale

1. For selection, the capability applies because AWS WAF web ACL applies ordered web rules to protected HTTP or HTTPS resources. The design hinges on an application needs Layer 7 request inspection and blocking. That makes it the precise fit.
2. In selection, AWS WAF IP set maintains reusable IPv4 or IPv6 address collections referenced by WAF rules. This fits when security operations must centrally block a changing list of hostile addresses. Here, hard-coding addresses in many rules is harder to maintain; the tested decision contrasts AWS WAF IP set with AWS WAF web ACL, so it targets the wrong layer.
3. In selection, AWS Firewall Manager centrally deploys and audits security policies such as WAF across AWS Organizations accounts. This fits when a security team must enforce web protections consistently across many accounts. Here, configuring each web ACL manually does not scale governance; the tested decision contrasts AWS Firewall Manager with AWS WAF web ACL, making it unsuitable here.
4. In selection, Amazon Cognito user pool provides a user directory and authentication for application end users. This fits when a web or mobile app needs managed sign-up and sign-in. Here, identity pools primarily vend AWS credentials to authorized identities; the tested decision contrasts Amazon Cognito user pool with AWS WAF web ACL, so it fails this constraint.

 

Question 2

A post-incident review finds that the team wants baseline protection against known web exploit patterns without writing every rule. Which capability is the most precise fit? Choose ONE.

1. AWS WAF logging
2. AWS Secrets Manager
3. AWS WAF managed rule group
4. Amazon Cognito identity pool

Correct Answer(s)

 

C

Rationale

1. In selection, AWS WAF logging delivers detailed web ACL request records for investigation and tuning. This fits when analysts need evidence explaining which WAF rules matched requests. Here, CloudTrail records API activity rather than every inspected web request; the tested decision contrasts AWS WAF logging with AWS WAF managed rule group, leaving the requirement unmet.
2. In selection, AWS Secrets Manager stores, retrieves, and controls access to application secrets with encryption and auditing. This fits when applications must remove database credentials from source code and configuration files. Here, plain Parameter Store strings do not provide the same secret-focused rotation workflow; the tested decision contrasts AWS Secrets Manager with AWS WAF managed rule group, so it misses the requirement.
3. For selection, use this option because AWS WAF managed rule group uses maintained rule collections for common application threats. The relevant constraint is the team wants baseline protection against known web exploit patterns without writing every rule. The requirement maps to this capability.
4. In selection, Amazon Cognito identity pool exchanges authenticated or guest identities for temporary AWS credentials. This fits when an app user needs controlled temporary access to AWS resources such as S3. Here, a user pool alone is the user directory and token issuer; the tested decision contrasts Amazon Cognito identity pool with AWS WAF managed rule group, so the mismatch is decisive.

 

Question 3

A rollout cannot proceed unless a web endpoint is being abused by high request rates from individual sources. Which control should the team select? Choose ONE.

1. AWS Shield Standard
2. AWS WAF rate-based rule
3. Secrets Manager rotation
4. Cognito managed login

Correct Answer(s)

 

B

Rationale

1. In selection, AWS Shield Standard provides automatic baseline DDoS protection for supported AWS services at no additional charge. This fits when the architecture needs built-in common network and transport DDoS protection. Here, WAF focuses on Layer 7 request rules; the tested decision contrasts AWS Shield Standard with AWS WAF rate-based rule, therefore another control is needed.
2. For selection, this answer is strongest because AWS WAF rate-based rule counts matching requests and rate-limits sources that exceed a configured threshold. The evidence points to a web endpoint is being abused by high request rates from individual sources. That linkage resolves the stated need.
3. In selection, Secrets Manager rotation changes supported credentials automatically on a schedule or configured rotation strategy. This fits when long-lived database credentials must be replaced regularly without manual handling. Here, storing a secret without rotation leaves credential age unchanged; the tested decision contrasts Secrets Manager rotation with AWS WAF rate-based rule, making it unsuitable here.
4. In selection, Cognito managed login provides a hosted authentication interface for user-pool sign-in and federation. This fits when the application wants an AWS-managed sign-in experience instead of building every page. Here, an identity pool does not provide the same hosted user authentication UI; the tested decision contrasts Cognito managed login with AWS WAF rate-based rule, so it fails this constraint.

 

Question 4

A platform standard now requires that security operations must centrally block a changing list of hostile addresses. Which feature directly addresses it? Choose ONE.

1. AWS Shield Advanced
2. Secrets Manager interface VPC endpoint
3. Amazon GuardDuty
4. AWS WAF IP set

Correct Answer(s)

 

D

Rationale

1. In selection, AWS Shield Advanced adds enhanced DDoS detection, response support, and cost-protection features for protected resources. This fits when a high-value internet service needs stronger DDoS operations and response capabilities. Here, Shield Standard lacks the full advanced service features; the tested decision contrasts AWS Shield Advanced with AWS WAF IP set, leaving the requirement unmet.
2. In selection, Secrets Manager interface VPC endpoint keeps secret-retrieval traffic on private AWS networking from a VPC. This fits when private workloads must access Secrets Manager without traversing the public internet. Here, a NAT gateway still provides internet-routed egress; the tested decision contrasts Secrets Manager interface VPC endpoint with AWS WAF IP set, so it misses the requirement.
3. In selection, Amazon GuardDuty continuously analyzes AWS telemetry to detect suspicious or malicious activity. This fits when security teams need managed threat findings for accounts and workloads. Here, Inspector focuses primarily on vulnerability and exposure assessment; the tested decision contrasts Amazon GuardDuty with AWS WAF IP set, making it secondary here.
4. For selection, this is appropriate because AWS WAF IP set maintains reusable IPv4 or IPv6 address collections referenced by WAF rules. The operational requirement is security operations must centrally block a changing list of hostile addresses. That is why it wins here.

 

Question 5

A technical review highlights that analysts need evidence explaining which WAF rules matched requests. Which option best satisfies the requirement? Choose ONE.

1. AWS Firewall Manager
2. AWS WAF logging
3. Amazon Cognito user pool
4. Amazon Inspector

Correct Answer(s)

 

B

Rationale

1. In selection, AWS Firewall Manager centrally deploys and audits security policies such as WAF across AWS Organizations accounts. This fits when a security team must enforce web protections consistently across many accounts. Here, configuring each web ACL manually does not scale governance; the tested decision contrasts AWS Firewall Manager with AWS WAF logging, therefore another control is needed.
2. For selection, this answer is strongest because AWS WAF logging delivers detailed web ACL request records for investigation and tuning. The evidence points to analysts need evidence explaining which WAF rules matched requests. That linkage resolves the stated need.
3. In selection, Amazon Cognito user pool provides a user directory and authentication for application end users. This fits when a web or mobile app needs managed sign-up and sign-in. Here, identity pools primarily vend AWS credentials to authorized identities; the tested decision contrasts Amazon Cognito user pool with AWS WAF logging, making it unsuitable here.
4. In selection, Amazon Inspector scans supported workloads and images for software vulnerabilities and unintended exposure. This fits when the requirement is continuous vulnerability assessment of compute or container images. Here, GuardDuty detects suspicious activity rather than enumerating CVEs; the tested decision contrasts Amazon Inspector with AWS WAF logging, so it fails this constraint.

 

Question 6

An implementation team must address this condition: the architecture needs built-in common network and transport DDoS protection. What should be implemented to meet it? Choose ONE.

1. AWS Shield Standard
2. AWS Secrets Manager
3. Amazon Cognito identity pool
4. Amazon Macie

Correct Answer(s)

 

A

Rationale

1. For selection, this mechanism works because AWS Shield Standard provides automatic baseline DDoS protection for supported AWS services at no additional charge. The decisive condition is the architecture needs built-in common network and transport DDoS protection. That distinction determines the answer.
2. In selection, AWS Secrets Manager stores, retrieves, and controls access to application secrets with encryption and auditing. This fits when applications must remove database credentials from source code and configuration files. Here, plain Parameter Store strings do not provide the same secret-focused rotation workflow; the tested decision contrasts AWS Secrets Manager with AWS Shield Standard, so it misses the requirement.
3. In selection, Amazon Cognito identity pool exchanges authenticated or guest identities for temporary AWS credentials. This fits when an app user needs controlled temporary access to AWS resources such as S3. Here, a user pool alone is the user directory and token issuer; the tested decision contrasts Amazon Cognito identity pool with AWS Shield Standard, making it secondary here.
4. In selection, Amazon Macie discovers and helps protect sensitive data in Amazon S3 using classification and monitoring. This fits when the security team must identify buckets containing sensitive data. Here, WAF cannot classify stored S3 objects; the tested decision contrasts Amazon Macie with AWS Shield Standard, so the mismatch is decisive.

 

Question 7

A control validation exercise shows that a high-value internet service needs stronger DDoS operations and response capabilities. Which capability is the most precise fit? Choose ONE.

1. Secrets Manager rotation
2. Cognito managed login
3. AWS Security Hub
4. AWS Shield Advanced

Correct Answer(s)

 

D

Rationale

1. In selection, Secrets Manager rotation changes supported credentials automatically on a schedule or configured rotation strategy. This fits when long-lived database credentials must be replaced regularly without manual handling. Here, storing a secret without rotation leaves credential age unchanged; the tested decision contrasts Secrets Manager rotation with AWS Shield Advanced, therefore another control is needed.
2. In selection, Cognito managed login provides a hosted authentication interface for user-pool sign-in and federation. This fits when the application wants an AWS-managed sign-in experience instead of building every page. Here, an identity pool does not provide the same hosted user authentication UI; the tested decision contrasts Cognito managed login with AWS Shield Advanced, so it targets the wrong layer.
3. In selection, AWS Security Hub aggregates security findings and posture checks from AWS and partner services. This fits when analysts need a central view across GuardDuty, Inspector, and other findings. Here, a single detection service does not provide cross-service aggregation; the tested decision contrasts AWS Security Hub with AWS Shield Advanced, making it unsuitable here.
4. For selection, the feature matches because AWS Shield Advanced adds enhanced DDoS detection, response support, and cost-protection features for protected resources. The controlling need is a high-value internet service needs stronger DDoS operations and response capabilities. This directly matches the tested condition.

 

Question 8

A reliability review depends on this outcome: a security team must enforce web protections consistently across many accounts. Which control should the team select? Choose ONE.

1. Secrets Manager interface VPC endpoint
2. Amazon GuardDuty
3. AWS Firewall Manager
4. Amazon CloudTrail

Correct Answer(s)

 

C

Rationale

1. In selection, Secrets Manager interface VPC endpoint keeps secret-retrieval traffic on private AWS networking from a VPC. This fits when private workloads must access Secrets Manager without traversing the public internet. Here, a NAT gateway still provides internet-routed egress; the tested decision contrasts Secrets Manager interface VPC endpoint with AWS Firewall Manager, leaving the requirement unmet.
2. In selection, Amazon GuardDuty continuously analyzes AWS telemetry to detect suspicious or malicious activity. This fits when security teams need managed threat findings for accounts and workloads. Here, Inspector focuses primarily on vulnerability and exposure assessment; the tested decision contrasts Amazon GuardDuty with AWS Firewall Manager, so it misses the requirement.
3. For selection, use this option because AWS Firewall Manager centrally deploys and audits security policies such as WAF across AWS Organizations accounts. The relevant constraint is a security team must enforce web protections consistently across many accounts. The requirement maps to this capability.
4. In selection, Amazon CloudTrail records AWS API activity for governance and investigation. This fits when responders need evidence of who called an AWS API and when. Here, WAF logs describe web requests to applications instead; the tested decision contrasts Amazon CloudTrail with AWS Firewall Manager, so the mismatch is decisive.

 

Question 9

A governance review sets this requirement: applications must remove database credentials from source code and configuration files. Which feature directly addresses it? Choose ONE.

1. Amazon Cognito user pool
2. Amazon Inspector
3. AWS Secrets Manager
4. least-privilege secret resource policy

Correct Answer(s)

 

C

Rationale

1. In selection, Amazon Cognito user pool provides a user directory and authentication for application end users. This fits when a web or mobile app needs managed sign-up and sign-in. Here, identity pools primarily vend AWS credentials to authorized identities; the tested decision contrasts Amazon Cognito user pool with AWS Secrets Manager, therefore another control is needed.
2. In selection, Amazon Inspector scans supported workloads and images for software vulnerabilities and unintended exposure. This fits when the requirement is continuous vulnerability assessment of compute or container images. Here, GuardDuty detects suspicious activity rather than enumerating CVEs; the tested decision contrasts Amazon Inspector with AWS Secrets Manager, so it targets the wrong layer.
3. For selection, select this control because AWS Secrets Manager stores, retrieves, and controls access to application secrets with encryption and auditing. The requested outcome is applications must remove database credentials from source code and configuration files. The alternatives solve different problems.
4. In selection, least-privilege secret resource policy restricts which principals can retrieve or manage a secret. This fits when a shared secret must be accessible only to one workload role and administrators. Here, broad wildcard access contradicts least privilege; the tested decision contrasts least-privilege secret resource policy with AWS Secrets Manager, so it fails this constraint.

 

Question 10

A configuration review uncovers this need: long-lived database credentials must be replaced regularly without manual handling. Which option best satisfies the requirement? Choose ONE.

1. Amazon Cognito identity pool
2. Amazon Macie
3. AWS WAF web ACL
4. Secrets Manager rotation

Correct Answer(s)

 

D

Rationale

3. In selection, Amazon Cognito identity pool exchanges authenticated or guest identities for temporary AWS credentials. This fits when an app user needs controlled temporary access to AWS resources such as S3. Here, a user pool alone is the user directory and token issuer; the tested decision contrasts Amazon Cognito identity pool with Secrets Manager rotation, leaving the requirement unmet.
4. In selection, Amazon Macie discovers and helps protect sensitive data in Amazon S3 using classification and monitoring. This fits when the security team must identify buckets containing sensitive data. Here, WAF cannot classify stored S3 objects; the tested decision contrasts Amazon Macie with Secrets Manager rotation, so it misses the requirement.
5. In selection, AWS WAF web ACL applies ordered web rules to protected HTTP or HTTPS resources. This fits when an application needs Layer 7 request inspection and blocking. Here, security groups do not inspect HTTP request attributes; the tested decision contrasts AWS WAF web ACL with Secrets Manager rotation, making it secondary here.
6. For selection, this is appropriate because Secrets Manager rotation changes supported credentials automatically on a schedule or configured rotation strategy. The operational requirement is long-lived database credentials must be replaced regularly without manual handling. That is why it wins here.

 

Question 11

A solution assessment must satisfy this condition: private workloads must access Secrets Manager without traversing the public internet. What should be implemented to meet it? Choose ONE.

1. Secrets Manager interface VPC endpoint
2. Cognito managed login
3. AWS Security Hub
4. AWS WAF managed rule group

Correct Answer(s)

 

A

Rationale

1. For selection, the capability applies because Secrets Manager interface VPC endpoint keeps secret-retrieval traffic on private AWS networking from a VPC. The design hinges on private workloads must access Secrets Manager without traversing the public internet. That makes it the precise fit.
2. In selection, Cognito managed login provides a hosted authentication interface for user-pool sign-in and federation. This fits when the application wants an AWS-managed sign-in experience instead of building every page. Here, an identity pool does not provide the same hosted user authentication UI; the tested decision contrasts Cognito managed login with Secrets Manager interface VPC endpoint, so it targets the wrong layer.
3. In selection, AWS Security Hub aggregates security findings and posture checks from AWS and partner services. This fits when analysts need a central view across GuardDuty, Inspector, and other findings. Here, a single detection service does not provide cross-service aggregation; the tested decision contrasts AWS Security Hub with Secrets Manager interface VPC endpoint, making it unsuitable here.
4. In selection, AWS WAF managed rule group uses maintained rule collections for common application threats. This fits when the team wants baseline protection against known web exploit patterns without writing every rule. Here, a custom IP set covers addresses, not broad exploit signatures; the tested decision contrasts AWS WAF managed rule group with Secrets Manager interface VPC endpoint, so it fails this constraint.

 

Question 12

A design review identifies this requirement: a web or mobile app needs managed sign-up and sign-in. Which capability is the most precise fit? Choose ONE.

1. Amazon GuardDuty
2. Amazon Cognito user pool
3. Amazon CloudTrail
4. AWS WAF rate-based rule

Correct Answer(s)

 

B

Rationale

1. In selection, Amazon GuardDuty continuously analyzes AWS telemetry to detect suspicious or malicious activity. This fits when security teams need managed threat findings for accounts and workloads. Here, Inspector focuses primarily on vulnerability and exposure assessment; the tested decision contrasts Amazon GuardDuty with Amazon Cognito user pool, leaving the requirement unmet.
2. For selection, this choice fits because Amazon Cognito user pool provides a user directory and authentication for application end users. The scenario specifically requires a web or mobile app needs managed sign-up and sign-in. This is the narrowest correct choice.
3. In selection, Amazon CloudTrail records AWS API activity for governance and investigation. This fits when responders need evidence of who called an AWS API and when. Here, WAF logs describe web requests to applications instead; the tested decision contrasts Amazon CloudTrail with Amazon Cognito user pool, making it secondary here.
4. In selection, AWS WAF rate-based rule counts matching requests and rate-limits sources that exceed a configured threshold. This fits when a web endpoint is being abused by high request rates from individual sources. Here, Shield protects DDoS broadly but does not replace request-rate policy logic; the tested decision contrasts AWS WAF rate-based rule with Amazon Cognito user pool, so the mismatch is decisive.

 

Question 13

A production change is being evaluated because an app user needs controlled temporary access to AWS resources such as S3. Which control should the team select? Choose ONE.

1. Amazon Inspector
2. least-privilege secret resource policy
3. AWS WAF IP set
4. Amazon Cognito identity pool

Correct Answer(s)

 

D

Rationale

1. In selection, Amazon Inspector scans supported workloads and images for software vulnerabilities and unintended exposure. This fits when the requirement is continuous vulnerability assessment of compute or container images. Here, GuardDuty detects suspicious activity rather than enumerating CVEs; the tested decision contrasts Amazon Inspector with Amazon Cognito identity pool, therefore another control is needed.
2. In selection, least-privilege secret resource policy restricts which principals can retrieve or manage a secret. This fits when a shared secret must be accessible only to one workload role and administrators. Here, broad wildcard access contradicts least privilege; the tested decision contrasts least-privilege secret resource policy with Amazon Cognito identity pool, so it targets the wrong layer.
3. In selection, AWS WAF IP set maintains reusable IPv4 or IPv6 address collections referenced by WAF rules. This fits when security operations must centrally block a changing list of hostile addresses. Here, hard-coding addresses in many rules is harder to maintain; the tested decision contrasts AWS WAF IP set with Amazon Cognito identity pool, making it unsuitable here.
4. For selection, the feature matches because Amazon Cognito identity pool exchanges authenticated or guest identities for temporary AWS credentials. The controlling need is an app user needs controlled temporary access to AWS resources such as S3. This directly matches the tested condition.

 

Question 14

An operations team reports that the application wants an AWS-managed sign-in experience instead of building every page. Which feature directly addresses it? Choose ONE.

1. Amazon Macie
2. Cognito managed login
3. AWS WAF web ACL
4. AWS WAF logging

Correct Answer(s)

 

B

Rationale

1. In selection, Amazon Macie discovers and helps protect sensitive data in Amazon S3 using classification and monitoring. This fits when the security team must identify buckets containing sensitive data. Here, WAF cannot classify stored S3 objects; the tested decision contrasts Amazon Macie with Cognito managed login, leaving the requirement unmet.
2. For selection, this choice fits because Cognito managed login provides a hosted authentication interface for user-pool sign-in and federation. The scenario specifically requires the application wants an AWS-managed sign-in experience instead of building every page. This is the narrowest correct choice.
3. In selection, AWS WAF web ACL applies ordered web rules to protected HTTP or HTTPS resources. This fits when an application needs Layer 7 request inspection and blocking. Here, security groups do not inspect HTTP request attributes; the tested decision contrasts AWS WAF web ACL with Cognito managed login, making it secondary here.
4. In selection, AWS WAF logging delivers detailed web ACL request records for investigation and tuning. This fits when analysts need evidence explaining which WAF rules matched requests. Here, CloudTrail records API activity rather than every inspected web request; the tested decision contrasts AWS WAF logging with Cognito managed login, so the mismatch is decisive.

 

Question 15

A security assessment concludes that security teams need managed threat findings for accounts and workloads. Which option best satisfies the requirement? Choose ONE.

1. AWS Security Hub
2. AWS WAF managed rule group
3. Amazon GuardDuty
4. AWS Shield Standard

Correct Answer(s)

 

C

Rationale

1. In selection, AWS Security Hub aggregates security findings and posture checks from AWS and partner services. This fits when analysts need a central view across GuardDuty, Inspector, and other findings. Here, a single detection service does not provide cross-service aggregation; the tested decision contrasts AWS Security Hub with Amazon GuardDuty, therefore another control is needed.
2. In selection, AWS WAF managed rule group uses maintained rule collections for common application threats. This fits when the team wants baseline protection against known web exploit patterns without writing every rule. Here, a custom IP set covers addresses, not broad exploit signatures; the tested decision contrasts AWS WAF managed rule group with Amazon GuardDuty, so it targets the wrong layer.
3. For selection, select this control because Amazon GuardDuty continuously analyzes AWS telemetry to detect suspicious or malicious activity. The requested outcome is security teams need managed threat findings for accounts and workloads. The alternatives solve different problems.
4. In selection, AWS Shield Standard provides automatic baseline DDoS protection for supported AWS services at no additional charge. This fits when the architecture needs built-in common network and transport DDoS protection. Here, WAF focuses on Layer 7 request rules; the tested decision contrasts AWS Shield Standard with Amazon GuardDuty, so it fails this constraint.

 

Question 16

During troubleshooting, engineers determine that the requirement is continuous vulnerability assessment of compute or container images. What should be implemented to meet it? Choose ONE.

1. Amazon Inspector
2. Amazon CloudTrail
3. AWS WAF rate-based rule
4. AWS Shield Advanced

Correct Answer(s)

 

A

Rationale

1. For selection, this mechanism works because Amazon Inspector scans supported workloads and images for software vulnerabilities and unintended exposure. The decisive condition is the requirement is continuous vulnerability assessment of compute or container images. That distinction determines the answer.
2. In selection, Amazon CloudTrail records AWS API activity for governance and investigation. This fits when responders need evidence of who called an AWS API and when. Here, WAF logs describe web requests to applications instead; the tested decision contrasts Amazon CloudTrail with Amazon Inspector, so it misses the requirement.
3. In selection, AWS WAF rate-based rule counts matching requests and rate-limits sources that exceed a configured threshold. This fits when a web endpoint is being abused by high request rates from individual sources. Here, Shield protects DDoS broadly but does not replace request-rate policy logic; the tested decision contrasts AWS WAF rate-based rule with Amazon Inspector, making it secondary here.
4. In selection, AWS Shield Advanced adds enhanced DDoS detection, response support, and cost-protection features for protected resources. This fits when a high-value internet service needs stronger DDoS operations and response capabilities. Here, Shield Standard lacks the full advanced service features; the tested decision contrasts AWS Shield Advanced with Amazon Inspector, so the mismatch is decisive.

 

Question 17

A new deployment has a constraint: the security team must identify buckets containing sensitive data. Which capability is the most precise fit? Choose ONE.

1. Amazon Macie
2. least-privilege secret resource policy
3. AWS WAF IP set
4. AWS Firewall Manager

Correct Answer(s)

 

A

Rationale

1. For selection, the capability applies because Amazon Macie discovers and helps protect sensitive data in Amazon S3 using classification and monitoring. The design hinges on the security team must identify buckets containing sensitive data. That makes it the precise fit.
2. In selection, least-privilege secret resource policy restricts which principals can retrieve or manage a secret. This fits when a shared secret must be accessible only to one workload role and administrators. Here, broad wildcard access contradicts least privilege; the tested decision contrasts least-privilege secret resource policy with Amazon Macie, so it targets the wrong layer.
3. In selection, AWS WAF IP set maintains reusable IPv4 or IPv6 address collections referenced by WAF rules. This fits when security operations must centrally block a changing list of hostile addresses. Here, hard-coding addresses in many rules is harder to maintain; the tested decision contrasts AWS WAF IP set with Amazon Macie, making it unsuitable here.
4. In selection, AWS Firewall Manager centrally deploys and audits security policies such as WAF across AWS Organizations accounts. This fits when a security team must enforce web protections consistently across many accounts. Here, configuring each web ACL manually does not scale governance; the tested decision contrasts AWS Firewall Manager with Amazon Macie, so it fails this constraint.

 

Question 18

A migration review confirms that analysts need a central view across GuardDuty, Inspector, and other findings. Which control should the team select? Choose ONE.

1. AWS WAF web ACL
2. AWS Security Hub
3. AWS WAF logging
4. AWS Secrets Manager

Correct Answer(s)

 

B

Rationale

1. In selection, AWS WAF web ACL applies ordered web rules to protected HTTP or HTTPS resources. This fits when an application needs Layer 7 request inspection and blocking. Here, security groups do not inspect HTTP request attributes; the tested decision contrasts AWS WAF web ACL with AWS Security Hub, leaving the requirement unmet.
2. For selection, this choice fits because AWS Security Hub aggregates security findings and posture checks from AWS and partner services. The scenario specifically requires analysts need a central view across GuardDuty, Inspector, and other findings. This is the narrowest correct choice.
3. In selection, AWS WAF logging delivers detailed web ACL request records for investigation and tuning. This fits when analysts need evidence explaining which WAF rules matched requests. Here, CloudTrail records API activity rather than every inspected web request; the tested decision contrasts AWS WAF logging with AWS Security Hub, making it secondary here.
4. In selection, AWS Secrets Manager stores, retrieves, and controls access to application secrets with encryption and auditing. This fits when applications must remove database credentials from source code and configuration files. Here, plain Parameter Store strings do not provide the same secret-focused rotation workflow; the tested decision contrasts AWS Secrets Manager with AWS Security Hub, so the mismatch is decisive.

 

Question 19

An architecture board must ensure that responders need evidence of who called an AWS API and when. Which feature directly addresses it? Choose ONE.

1. AWS WAF managed rule group
2. AWS Shield Standard
3. Secrets Manager rotation
4. Amazon CloudTrail

Correct Answer(s)

 

D

Rationale

1. In selection, AWS WAF managed rule group uses maintained rule collections for common application threats. This fits when the team wants baseline protection against known web exploit patterns without writing every rule. Here, a custom IP set covers addresses, not broad exploit signatures; the tested decision contrasts AWS WAF managed rule group with Amazon CloudTrail, therefore another control is needed.
2. In selection, AWS Shield Standard provides automatic baseline DDoS protection for supported AWS services at no additional charge. This fits when the architecture needs built-in common network and transport DDoS protection. Here, WAF focuses on Layer 7 request rules; the tested decision contrasts AWS Shield Standard with Amazon CloudTrail, so it targets the wrong layer.
3. In selection, Secrets Manager rotation changes supported credentials automatically on a schedule or configured rotation strategy. This fits when long-lived database credentials must be replaced regularly without manual handling. Here, storing a secret without rotation leaves credential age unchanged; the tested decision contrasts Secrets Manager rotation with Amazon CloudTrail, making it unsuitable here.
4. For selection, the feature matches because Amazon CloudTrail records AWS API activity for governance and investigation. The controlling need is responders need evidence of who called an AWS API and when. This directly matches the tested condition.

 

Question 20

A compliance check requires that a shared secret must be accessible only to one workload role and administrators. Which option best satisfies the requirement? Choose ONE.

1. AWS WAF rate-based rule
2. AWS Shield Advanced
3. least-privilege secret resource policy
4. Secrets Manager interface VPC endpoint

Correct Answer(s)

 

C

Rationale

1. In selection, AWS WAF rate-based rule counts matching requests and rate-limits sources that exceed a configured threshold. This fits when a web endpoint is being abused by high request rates from individual sources. Here, Shield protects DDoS broadly but does not replace request-rate policy logic; the tested decision contrasts AWS WAF rate-based rule with least-privilege secret resource policy, leaving the requirement unmet.
2. In selection, AWS Shield Advanced adds enhanced DDoS detection, response support, and cost-protection features for protected resources. This fits when a high-value internet service needs stronger DDoS operations and response capabilities. Here, Shield Standard lacks the full advanced service features; the tested decision contrasts AWS Shield Advanced with least-privilege secret resource policy, so it misses the requirement.
3. For selection, use this option because least-privilege secret resource policy restricts which principals can retrieve or manage a secret. The relevant constraint is a shared secret must be accessible only to one workload role and administrators. The requirement maps to this capability.
4. In selection, Secrets Manager interface VPC endpoint keeps secret-retrieval traffic on private AWS networking from a VPC. This fits when private workloads must access Secrets Manager without traversing the public internet. Here, a NAT gateway still provides internet-routed egress; the tested decision contrasts Secrets Manager interface VPC endpoint with least-privilege secret resource policy, so the mismatch is decisive.

• < Amazon AWS SAA-C03 VPC Segmentation, Security Groups, NACLs, Routing, and Secure Endpoints Practice Test 2
• Amazon AWS SAA-C03 Application Protection, WAF, Shield, Secrets, Cognito, and Threat Detection Practice Test 2 >