Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 13

Question 120

A company wants employees to access an internal browser-based app without a traditional VPN. Access decisions must evaluate user identity and device security posture for each session and be centrally enforceable. Which AWS service is relevant?

Publish the application directly to 0.0.0.0/0 and rely only on a private DNS name.
Use AWS Client VPN with broad network membership as the only application access rule, without adding identity and device-condition checks to the app path.
Use an EC2 key pair as the only trust signal for every employee browser session.
Use AWS Verified Access with a supported trust provider and device/user context policy for the private application.

Explanation

Correct Answer

Verified Access provides identity-aware access to applications based on configured trust-provider signals instead of relying only on membership of a network tunnel.

Incorrect Answers

A private-looking DNS record is not identity-aware access enforcement for an Internet-exposed app.

An authenticated network tunnel alone does not deliver the specified per-request device posture and user-context policy; AWS Verified Access evaluates configured trust signals for application requests.

An SSH key pair is not a general per-session web identity and device posture policy.

Question 121

A private web fleet has an ALB target group in two AZs, but an architecture diagram puts the internet-facing ALB exclusively in private subnets. Customers cannot access its public hostname. What explains the failure?

EC2 backend instances must share the ALB public IP to receive traffic.
Create an internal ALB in additional private subnets while leaving the customer-facing DNS alias pointed at the internal scheme, expecting it to accept arbitrary Internet clients.
The web server needs an AWS IAM Identity Center permission set to accept HTTPS.
An internet-facing ALB requires public-facing subnet and route configuration to accept Internet clients, even when its targets reside privately.

Explanation

Correct Answer

Public client ingress belongs on the ALB network boundary; private application targets are accessible to the ALB by VPC routing and security groups.

Incorrect Answers

The backend targets can remain private and do not need ALB public addresses.

An internal load balancer provides VPC-private frontend addresses; adding private subnets does not produce the externally routable internet-facing ALB boundary required by this site.

Workforce AWS account authorization is not the public packet-ingress issue.

Question 122

A private IPv4 EC2 instance sends HTTPS requests to a public software repository. Its subnet default route points to a NAT gateway, but the NAT gateway has been placed in a subnet without a route to an Internet gateway. Why does outbound access fail?

The public NAT gateway lacks a working public-subnet Internet gateway route and cannot reach external Internet destinations.
The EC2 host must accept unsolicited inbound HTTPS sessions for its outbound downloads.
An S3 VPC endpoint automatically substitutes for arbitrary public package repositories.
Increase the public NAT gateway idle timeout and Elastic IP quota while leaving the NAT subnet route table without an Internet gateway default route.

Explanation

Correct Answer

A public NAT gateway must have a usable public path, including its public address and Internet gateway route, for client packets to exit.

Incorrect Answers

Established outbound HTTPS traffic does not require accepting new inbound client connections.

S3 endpoints are not a general Internet path for external hosts.

Gateway session timers and address quotas do not make an unusable public NAT egress path routable. Its hosting public subnet needs an Internet gateway route for arbitrary Internet destinations.

Question 123

A subnet’s route table includes 0.0.0.0/0 to an Internet gateway. An EC2 instance with only 10.0.6.21 tries to contact a public IPv4 endpoint and fails. What requirement is missing in the proposed direct-IGW design?

The instance requires a public S3 bucket for all HTTPS requests.
The VPC local route must be deleted before Internet traffic is allowed.
A publicly routable address or a supported NAT translation path for the private-only instance.
Use an interface VPC endpoint for one AWS API and assume that endpoint NATs the private instance to arbitrary third-party IPv4 sites.

Explanation

Correct Answer

An Internet gateway is not a universal source NAT for RFC1918-only instances, so those packets need appropriate public addressing or NAT.

Incorrect Answers

S3 resource public access is unrelated to arbitrary Internet IPv4 connectivity.

Deleting the local route could break intra-VPC traffic and does not add public address translation.

PrivateLink endpoints are specific private connectivity targets for supported services; they are not generic outbound public-address translation for unrelated Internet endpoints.

Question 124

An application target group is healthy from its own subnet but traffic from the public ALB fails. The instance security group allows TCP/8443 only from 10.1.2.0/24, while the ALB nodes have addresses from other subnets. What change best matches the requirement?

Reference the ALB security group as the source of TCP/8443 in the application target security group.
Expand ingress to 0.0.0.0/0 on the target group.
Allow the backend target port only from the ALB subnet CIDR used today and assume the rule remains correct when load balancer nodes use its other enabled subnets.
Attach an IAM role with ec2:DescribeInstances to the targets and leave ingress closed.

Explanation

Correct Answer

Security group references match the load balancer’s current associated interfaces, avoiding brittle hand-maintained ALB node CIDRs.

Incorrect Answers

Broad ingress is unnecessary and would not preserve the ALB-only trust boundary.

Subnet-CIDR guesses can fail when the ALB nodes originate from different enabled zones. Referencing the ALB security group matches its current permitted load-balancer interfaces.

Management API rights are not network permissions for ALB-to-target traffic.

Question 125

An application uses NACLs to allow outbound TCP/443, but a subnet ACL inbound rule denies ephemeral response ports. Instance security groups are stateful and correct. Which rule type is responsible for the return-path failure?

The stateless NACL requires appropriate inbound ephemeral return-port allowance even when the outbound request was accepted.
Security groups require explicit return-port allow rules for every TCP response.
Allow TCP/443 inbound on the NACL and expect reply packets directed to client ephemeral ports to be admitted.
An IAM role’s trust policy is evaluated for each TCP response packet.

Explanation

Correct Answer

Network ACLs assess both directions independently; a matching security group state does not override a subnet NACL deny.

Incorrect Answers

Security groups are stateful, so matching replies to established allowed flows are generally tracked.

TCP replies to an HTTPS client arrive at the client’s ephemeral destination port, so inbound destination 443 alone does not satisfy the stateless NACL return-flow rule.

IAM STS role trust does not authorize ordinary TCP return-path packets.

Question 126

An S3 gateway VPC endpoint is created, but one private subnet still sends S3 data through its NAT gateway and incurs NAT data-processing charges. Which configuration omission explains this?

The subnet is required to have a public IPv4 address before any S3 endpoint can work.
The S3 bucket must be a website bucket for endpoint routing.
Permit s3:GetObject on the EC2 instance role but leave its subnet route table unassociated with the S3 gateway endpoint, assuming IAM authorization determines packet routing.
The private subnet’s effective route table is not associated with the S3 gateway endpoint route target.

Explanation

Correct Answer

Gateway endpoints add service prefix-list routes to selected subnet route tables; a subnet without that association can continue using the default NAT route.

Incorrect Answers

Gateway endpoints support private subnet access without public IPv4 on instances.

S3 gateway endpoint routing applies to supported S3 APIs, not website-hosting configuration.

IAM permission is necessary to read an object but does not alter the routing decision. The VPC endpoint prefix-list route must be in the effective route table associated with this subnet.

Question 127

A private AWS API call still resolves to a public endpoint despite a new interface VPC endpoint. The team expected VPC-local connectivity. Which setting should be checked first?

Verify the endpoint is for the correct service and that private DNS is enabled and supported with proper VPC DNS resolution.
Create an interface endpoint for another AWS service with private DNS enabled and assume it rewrites this API’s public hostname as well.
Allow inbound SSH on every private instance as the only resolution fix.
Change the AWS account root password to the endpoint private IP.

Explanation

Correct Answer

Private DNS can remap normal service hostnames to interface endpoint ENI addresses; otherwise a client may continue using a public address.

Incorrect Answers

Private DNS integrates service-specific endpoint hostnames; an endpoint for an unrelated service does not reroute normal hostnames for the API under test.

SSH exposure does not cause AWS API DNS to use an endpoint.

Human credentials do not define DNS records for interface endpoints.

Question 128

An AWS WAF rule meant to block abusive request bursts never fires even though its rate threshold is exceeded. The rule exists in a web ACL that is not associated with the public ALB. Why is it ineffective?

Every rate-based WAF rule must be installed on each EC2 OS as an iptables rule.
The WAF web ACL is not attached to the supported entry point processing the HTTP requests.
The ALB target instance must have an IAM user password for WAF to act.
Increase the WAF rate threshold to an even higher value while keeping the web ACL unattached to the ALB that actually receives traffic.

Explanation

Correct Answer

Rate statements are evaluated only for requests flowing through resources associated with the applicable web ACL.

Incorrect Answers

WAF is managed application-layer filtering on supported AWS resources, not a per-instance firewall package.

An instance human credential is unrelated to web ACL association.

A rate limit cannot be enforced on requests that never pass through the ACL-associated resource. Association is required before threshold tuning has any effect.

Question 129

A company enabled basic AWS DDoS protections and still experiences a high-impact targeted attack. A consultant says Shield Standard includes every Shield Advanced capability and dedicated response service at no cost. What is incorrect?

Shield Standard provides no baseline DDoS protection on AWS resources.
Shield Standard and Shield Advanced are different protection tiers; advanced features and support require evaluation of the paid tier and eligible resources.
Attach an AWS WAF managed SQL injection rule group and assume it provides the full additional subscription response support of Shield Advanced.
CloudWatch cannot monitor any networking metrics during an attack.

Explanation

Correct Answer

The additional protections and response assistance associated with Advanced are not automatically identical to Shield Standard coverage.

Incorrect Answers

Standard offers built-in baseline mitigation for applicable infrastructure.

WAF detects and filters configured HTTP request patterns, but it does not automatically provide Shield Advanced DDoS response and subscription capabilities.

Observability continues to be relevant and is not generally disabled by DDoS activity.

Question 130

A subscriber receives a CloudFront signed URL that expires at noon but can still fetch the same paid object directly from a public S3 URL at 12:30. Why did the paywall fail?

The S3 origin remains directly public, bypassing CloudFront’s viewer signed-URL validation and expiry.
CloudFront cannot validate any signed URLs for S3 content.
Shorten the CloudFront cache TTL below the subscriber URL expiry but leave the S3 origin public, assuming the short TTL prevents direct object access.
The CloudFront cache TTL must exactly equal the license expiry to authorize the user.

Explanation

Correct Answer

Signed CloudFront access is enforced at the distribution, so a public origin URL undermines the restriction unless origin access is separately locked down.

Incorrect Answers

Signed URLs are supported; the bypass comes from direct origin access.

Cache expiration controls how long edge nodes retain objects and does not authorize viewer requests or restrict a direct public S3 URL after the signed viewer URL expires.

Cache freshness controls content caching, not a viewer signature validation boundary.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 120

Explanation

Correct Answer

Incorrect Answers

Question 121

Explanation

Correct Answer

Incorrect Answers

Question 122

Explanation

Correct Answer

Incorrect Answers

Question 123

Explanation

Correct Answer

Incorrect Answers

Question 124

Explanation

Correct Answer

Incorrect Answers

Question 125

Explanation

Correct Answer

Incorrect Answers

Question 126

Explanation

Correct Answer

Incorrect Answers

Question 127

Explanation

Correct Answer

Incorrect Answers

Question 128

Explanation

Correct Answer

Incorrect Answers

Question 129

Explanation

Correct Answer

Incorrect Answers

Question 130

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests