Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 10

Question 90

A shared audit bucket permits one AWS service principal with aws:SourceAccount set correctly, but aws:SourceArn uses a wildcard that matches ANY trail from that account. Security requires only a single approved trail to write. What tightening most directly enforces that narrower source identity?

Constrain aws:SourceArn to the exact supported ARN of the approved trail, retaining the appropriate aws:SourceAccount condition and service principal.
Remove aws:SourceArn entirely because SourceAccount by itself proves which named trail invoked the service.
Use the VPC subnet CIDR as the only condition even though the AWS service principal performs the write on a customer’s behalf.
Match aws:SourceAccount to the correct account but leave aws:SourceArn wildcarded across all CloudTrail trails in that account.

Explanation

Correct Answer

The account condition identifies the originating account while a properly scoped source ARN restricts a particular service resource within that account.

Incorrect Answers

Multiple service resources in one account can share the same account identifier; account-only filtering cannot distinguish their trail ARNs.

Network location is not a substitute for supported service-origin authorization context in a resource policy.

SourceAccount distinguishes the service customer account, not the particular trail. To restrict one trail, match a supported exact SourceArn alongside the account condition.

Question 91

A retailer needs a public HTTPS entry point for a web store, but its application EC2 instances must have no public IP addresses. Which AWS design provides public access without exposing the application subnet?

Assign public IPs to every backend EC2 instance and skip the load balancer.
Put an internal ALB in private subnets and expect it to be directly reachable from arbitrary Internet clients.
Expose each private EC2 instance through a NAT gateway as if it were a bidirectional HTTPS reverse proxy rather than deploying an internet-facing load balancer.
Deploy an internet-facing Application Load Balancer in public subnets and route to application targets in private subnets using tightly scoped security groups.

Explanation

Correct Answer

The ALB accepts public HTTP(S) clients while its targets can remain in private subnets; only the target listener port from the ALB security group is exposed internally.

Incorrect Answers

Directly publishing application instances violates the requirement to keep the application tier private.

Internal load balancers expose private endpoints rather than public Internet ingress.

Public NAT gateways support outbound translation and replies to initiated connections; they do not act as public inbound HTTPS listeners that independently route requests to private app targets.

Question 92

A batch-processing instance has only a private IPv4 address and must download operating-system packages from public repositories. It must not accept unsolicited inbound Internet sessions. Which route architecture meets the IPv4 requirement?

Set the private subnet default route to an Internet gateway while keeping every instance without a public address.
Route the private subnet’s default outbound traffic through a public NAT gateway with an Internet gateway path in its public subnet.
Open a TCP/22 inbound security group rule from 0.0.0.0/0.
Add a Route 53 private hosted zone for the public package repository.

Explanation

Correct Answer

A public NAT gateway gives private instances outbound IPv4 connectivity and return traffic while not providing direct inbound Internet reachability.

Incorrect Answers

Internet gateways do not source-NAT private IPv4 addresses for hosts without suitable public addressing.

Inbound SSH does not create an outbound translation path and increases exposure.

Private DNS naming does not replace IPv4 routing and NAT to external networks.

Question 93

An architect adds 0.0.0.0/0 → internet gateway to a subnet route table but every EC2 instance in the subnet has only an RFC1918 private address. Public websites are still unreachable. Which addition is needed without assigning public addresses to the instances?

Disable all instance security groups so the Internet gateway automatically translates private addresses.
Add a local VPC route for the same private CIDR and assume public destinations become reachable.
Associate an S3 gateway endpoint with the subnet route table and assume it will forward arbitrary public HTTP and package repository traffic.
Use a correctly routed public NAT gateway for the private-addressed instances’ outbound IPv4 access.

Explanation

Correct Answer

An Internet gateway alone does not translate privately addressed EC2 sources; NAT provides a public source address for outgoing traffic.

Incorrect Answers

Security group changes cannot supply public IPv4 translation or substitute for NAT.

The local route only carries traffic inside the VPC CIDR.

An S3 gateway endpoint changes routing only for supported S3 service prefixes, not Internet addresses generally. The private EC2 source still needs a NAT translation path for arbitrary public IPv4.

Question 94

A public ALB forwards traffic to private application instances on TCP/8443. The instances must reject direct connections from unrelated VPC machines. Which target security group ingress rule most precisely enforces the allowed path?

Allow TCP/8443 from 0.0.0.0/0 because private instances have no public IPs.
Allow only port 443 inbound from the ALB when the target listens on port 8443.
Allow TCP/8443 from the ALB security group rather than from the entire VPC CIDR.
Attach a role policy permitting elasticloadbalancing:DescribeTargetHealth to the instances while leaving inbound TCP/8443 closed to the ALB node interfaces.

Explanation

Correct Answer

Security group references allow traffic originating from interfaces associated with that group; the application tier accepts the ALB path without granting broad VPC access.

Incorrect Answers

This allows other routable sources and fails the narrowly scoped ALB-only requirement.

The target security group must allow the actual backend target port.

A management API permission does not grant packet access through the instance security group. ALB target health and request forwarding require an ingress source/port rule.

Question 95

An EC2 client opens an outbound TCP connection through a subnet network ACL that permits outbound 443, but response packets are dropped. Its instance security group allows responses automatically. What should be checked?

Explicit matching inbound ephemeral-port rules on the stateless subnet network ACL for the return traffic.
Permit only the destination web server TCP/443 address as a return source in the NACL but leave the inbound ephemeral destination-port rules denied.
Allow inbound TCP/443 only on the client subnet NACL because that is the destination port of the original HTTPS request.
Disable the EC2 security group stateful tracking to force replies to be dropped.

Explanation

Correct Answer

NACLs are stateless; unlike security groups, they require explicit allow rules in both directions for the request and response ports.

Incorrect Answers

The response packet arrives at a client ephemeral port, not destination 443. A stateless NACL must allow the relevant ephemeral return port range even when outbound 443 is permitted.

The remote server sends a reply from port 443 to the client ephemeral port. Permitting only inbound destination 443 on the client subnet does not admit those responses.

Security groups are stateful and already permit established reply traffic in this case.

Question 96

Two private EC2 instances read objects from Amazon S3. The company wants to avoid public IPs and NAT gateway data processing for this S3-only traffic. What VPC design is generally simplest?

Add an internet-facing ALB for every S3 request and leave the subnet route to NAT.
Create an S3 gateway VPC endpoint, associate its route tables with the instance subnets, and use appropriate S3 permissions.
Give the EC2 instances public IPv4 addresses to eliminate NAT cost.
Create a VPC peering connection to an arbitrary AWS-owned S3 VPC.

Explanation

Correct Answer

A gateway endpoint routes regional S3 traffic privately using endpoint routing, avoiding a NAT gateway for these supported S3 calls.

Incorrect Answers

An ALB is a web application entry point, not the standard path for private S3 API access.

Public addresses violate the private-only requirement and may add new exposures.

S3 gateway endpoints are AWS-managed routing targets, not peering to a customer-visible S3 VPC.

Question 97

Private Lambda and EC2 workloads must reach an AWS API that supports AWS PrivateLink without routing through the public Internet. The service is not S3 or DynamoDB and has no gateway endpoint. What should they deploy?

Create an S3 gateway endpoint and expect it to provide private reachability to every AWS API.
Configure an interface VPC endpoint for the supported service, appropriate endpoint security group and private DNS, and valid IAM access.
Attach a public Internet gateway to the private subnet and disable IAM checks.
Create only a Route 53 private hosted zone alias pointing the public service name to an arbitrary RFC1918 address without provisioning an interface endpoint.

Explanation

Correct Answer

Interface endpoints create private network interfaces for supported APIs; endpoint DNS and security controls determine how the private clients connect.

Incorrect Answers

Gateway endpoints are service-specific and cannot act as a universal AWS API proxy.

An Internet gateway is not PrivateLink connectivity, and IAM authorization remains necessary.

A private DNS alias alone creates neither the managed PrivateLink network interface nor the service-side connection. Eligible APIs require the specific service interface endpoint and routing controls.

Question 98

A product API runs behind an Application Load Balancer. Bots send bursts of thousands of HTTP requests from a small set of client IP addresses. The team wants to rate-limit application-layer requests before backend execution. Which AWS control fits?

Apply a VPC network ACL rule for a client /32 address after calculating its HTTP request count, treating the ACL as a managed WAF rate statement.
Attach an AWS WAF web ACL with a tuned rate-based rule to the supported ALB resource and validate its action and rate criteria.
Increase the backend instance type and assume request rate is controlled.
Use only a security group inbound CIDR rule to count HTTP requests per URL.

Explanation

Correct Answer

AWS WAF can apply rate-based HTTP request controls before the load balancer forwards requests to targets; tune thresholds against legitimate client traffic.

Incorrect Answers

A NACL can statically allow or deny network traffic by address and port, but has no native HTTP request rate counter, URL inspection or automatic time-window aggregation for rate enforcement.

More compute may absorb traffic but does not enforce a request-rate policy.

Security groups filter network flows, not WAF HTTP request-rate conditions.

Question 99

A financial website already receives baseline DDoS protections but faces sustained targeted attacks requiring specialized support and additional DDoS mitigation capabilities. Which tradeoff should be assessed?

Disable AWS Shield Standard because it conflicts with all other protections.
Evaluate AWS Shield Advanced for its additional protections, response support and cost, while retaining appropriate edge and WAF safeguards.
Use only an RDS read replica to mitigate network-layer flooding of the website.
Increase the CloudFront cache TTL and assume it automatically includes the incident response team and extra DDoS cost protections of Shield Advanced.

Explanation

Correct Answer

Shield Standard is baseline; Shield Advanced provides additional DDoS-specific capabilities and a subscription cost that must be justified by risk.

Incorrect Answers

Baseline AWS DDoS protections do not need to be disabled to consider Advanced.

Database read scaling does not handle Internet-facing DDoS traffic.

Caching may reduce origin load but does not enable the paid Shield Advanced service tier or the associated specialized DDoS response capabilities.

Question 100

A streaming platform sells short-lived access to video files through CloudFront. It must prevent viewers from reusing a public URL indefinitely. Which feature directly binds delivery to authorized time-limited access?

Set the distribution TTL to five seconds and allow every unsigned public request.
Apply S3 lifecycle deletion to every object five seconds after it is requested.
Use an application-generated unguessable object key with no expiry in a public origin and assume its obscurity enforces a short purchase authorization window.
Issue CloudFront signed URLs or signed cookies with verified signature and expiry, and protect the origin from direct bypass.

Explanation

Correct Answer

Signed CloudFront access tokens constrain cache delivery by expiry and optional conditions; origin restriction prevents users circumventing the signed edge path.

Incorrect Answers

Cache time-to-live affects freshness, not viewer identity or authorization.

Lifecycle is not a per-viewer access token and would destroy content rather than control viewing rights.

An opaque path can be copied and reused when the resource is public; it does not impose a cryptographic expiry or viewer authorization requirement like signed URLs/cookies.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 90

Explanation

Correct Answer

Incorrect Answers

Question 91

Explanation

Correct Answer

Incorrect Answers

Question 92

Explanation

Correct Answer

Incorrect Answers

Question 93

Explanation

Correct Answer

Incorrect Answers

Question 94

Explanation

Correct Answer

Incorrect Answers

Question 95

Explanation

Correct Answer

Incorrect Answers

Question 96

Explanation

Correct Answer

Incorrect Answers

Question 97

Explanation

Correct Answer

Incorrect Answers

Question 98

Explanation

Correct Answer

Incorrect Answers

Question 99

Explanation

Correct Answer

Incorrect Answers

Question 100

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests