Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 14

Question 130

A subscriber receives a CloudFront signed URL that expires at noon but can still fetch the same paid object directly from a public S3 URL at 12:30. Why did the paywall fail?

The S3 origin remains directly public, bypassing CloudFront’s viewer signed-URL validation and expiry.
CloudFront cannot validate any signed URLs for S3 content.
Shorten the CloudFront cache TTL below the subscriber URL expiry but leave the S3 origin public, assuming the short TTL prevents direct object access.
The CloudFront cache TTL must exactly equal the license expiry to authorize the user.

Explanation

Correct Answer

Signed CloudFront access is enforced at the distribution, so a public origin URL undermines the restriction unless origin access is separately locked down.

Incorrect Answers

Signed URLs are supported; the bypass comes from direct origin access.

Cache expiration controls how long edge nodes retain objects and does not authorize viewer requests or restrict a direct public S3 URL after the signed viewer URL expires.

Cache freshness controls content caching, not a viewer signature validation boundary.

Question 131

A company uses CloudFront signed URLs for private S3 content but sets the CloudFront S3 origin to a bucket website endpoint and configures OAC. Origin requests fail. What is the compatibility limitation?

OAC never supports SSE-KMS objects on regular S3 bucket origins.
An S3 website endpoint must be in us-east-1 for all OAC distributions.
CloudFront origin access control for S3 requires an ordinary S3 bucket origin, not an S3 website endpoint configured as a custom origin.
Give the CloudFront distribution an OAC and use a bucket policy granting the service principal, but keep the origin configured as the S3 website endpoint.

Explanation

Correct Answer

Website endpoints use custom-origin behavior and do not support the same OAC signed S3 API request mechanism.

Incorrect Answers

OAC supports supported SSE-KMS configurations when key policies grant the CloudFront distribution.

The issue is origin endpoint type, not a universal bucket region.

The origin endpoint type is decisive: a website endpoint is a custom origin and cannot use normal S3 OAC request signing, even if a bucket policy is modified.

Question 132

A CloudFront distribution already has a valid ACM viewer certificate in us-east-1 covering *.example.com. The team adds api.dev.example.com as an alternate domain name and CloudFront rejects it, although shop.example.com works. What certificate-name rule explains this?

CloudFront viewer certificates are valid for any number of nested subdomain levels under a single *.example.com wildcard automatically.
Route 53 weighted routing records must be present before any certificate can cover a deeply nested hostname.
Enabling S3 Transfer Acceleration extends TLS wildcard coverage to all descendant domain names.
A wildcard *.example.com covers only the matching one-label subdomain level, not api.dev.example.com; use a certificate SAN that explicitly covers the deeper name or an appropriate wildcard.

Explanation

Correct Answer

CloudFront checks that alternate hostnames match an exact certificate SAN or a wildcard at the same domain level. A deeper hostname needs matching certificate coverage.

Incorrect Answers

A one-level wildcard does not cover multiple subdomain labels; *.example.com can cover shop.example.com but not api.dev.example.com.

DNS routing and certificate subject alternative name validation are separate; weighted records cannot extend a certificate’s name coverage.

S3 transfer settings cannot change the TLS certificate SAN list that CloudFront checks against the alternate domain.

Question 133

A public customer mobile app asks for authentication tokens. A developer instead creates individual IAM account users and assigns console passwords to each customer. What boundary is wrong?

Customers require EC2 instance profiles before signing in to mobile applications.
IAM account principals are being used for application customers instead of a consumer identity mechanism such as Cognito user pools.
Register each customer only as an IAM Identity Center workforce user and give them an AWS account permission set rather than application-user JWT tokens.
A customer name in a Route 53 zone is sufficient proof of mobile sign-in identity.

Explanation

Correct Answer

Cognito user pools manage app customer identities and tokens without granting each shopper an AWS account principal.

Incorrect Answers

Instance profiles authenticate compute workloads, not end-user app sessions.

The IAM Identity Center workforce account-authorization contract is not the same as customer registration/token management. Cognito user pools serve the specified public application identities.

DNS records cannot issue or validate application authentication tokens.

Question 134

GuardDuty generates a suspicious-API-call finding, but the IAM role continues to accept API requests until an operator responds. What does this demonstrate about GuardDuty?

Managed threat detection does not itself guarantee that every detected threat has been isolated or remediated.
GuardDuty is an encryption algorithm that revokes STS credentials as a side effect of each alert.
Every GuardDuty finding means the IAM principal cannot issue any further AWS API call.
Turn on VPC Flow Logs for EC2 interfaces and treat the flow records as a guaranteed automatic IAM principal revocation action for every GuardDuty finding.

Explanation

Correct Answer

GuardDuty creates findings from supported telemetry; separate response automation or authorized intervention may be needed to block credentials or networking.

Incorrect Answers

GuardDuty is not a general automatic STS token revocation mechanism.

A finding does not universally enforce an IAM deny.

Flow logs are network observability; neither their existence nor a GuardDuty finding automatically revokes credentials. Containment requires a separately configured response.

Question 135

A team runs IAM Access Analyzer against all S3 buckets and concludes that none can contain regulated customer data because there are no external-access findings. What is their incorrect assumption?

Every S3 object is automatically publicly readable if Macie is disabled.
S3 bucket encryption makes it impossible for authorized users to read PII.
Review only S3 bucket policies that deny public access and infer that every encrypted object contains no personal or regulated content.
IAM Access Analyzer assesses permissions exposure; the absence of external-access findings does not classify object contents as nonsensitive.

Explanation

Correct Answer

External principal analysis and data classification are different; Macie or another content scanner is needed for supported sensitive-data discovery.

Incorrect Answers

Macie is a discovery service, not the universal determinant of S3 object authorization.

Encryption does not mean object content ceases to contain regulated data.

The access-control posture of a bucket does not determine the contents of its private objects. Content discovery is a separate task supported by Macie.

Question 136

A database password rotates in Secrets Manager, but a long-lived Lambda execution environment cached the old password forever. After rotation, DB connections fail. What integration oversight caused this?

Secrets Manager automatically removes IAM permission to retrieve any rotated secret.
The failure proves AWS KMS cannot encrypt secret versions.
Rotate the application’s IAM role session and make the RDS database publicly accessible, but continue using the previously cached stale DB password.
The application did not refresh or invalidate its cached secret version after managed rotation.

Explanation

Correct Answer

Rotation changes the valid credential; consumers must fetch a current version or use a bounded cache strategy to avoid persistent stale authentication.

Incorrect Answers

Secret rotation does not inherently revoke the configured identity’s GetSecretValue access.

Encrypted Secrets Manager versions are supported; the issue is stale consumption.

Refresh of AWS API credentials or public network routing does not replace the database authentication password. The client secret cache must obtain the updated version.

Question 137

An engineer expects a Parameter Store SecureString entry to rotate its database user password automatically at midnight. The parameter value has not changed. What is the false assumption?

All encrypted application parameters are immutable after their initial creation.
Store the value as SecureString with a KMS key-rotation policy and assume rotating the encryption key automatically changes the underlying RDS login password.
SecureString encrypts parameter values but does not by itself implement a database credential rotation workflow.
IAM policy conditions cannot restrict reads of secure parameters.

Explanation

Correct Answer

Parameter Store supports protected retrieval; automatic database password rotation is a separate capability available with appropriate Secrets Manager integration.

Incorrect Answers

Authorized users and services can update supported parameter versions.

KMS key material rotation changes protection of stored ciphertext but does not invoke a database credential-change workflow. SecureString values do not rotate database passwords on their own.

Parameter Store access can be controlled using appropriate IAM permissions and KMS checks.

Question 138

A hybrid architecture uses AWS Direct Connect and no separate IPsec or TLS protection. A data-protection review flags cleartext application traffic despite the private circuit. What was misunderstood?

Every AWS Direct Connect circuit always performs TLS encryption for all IP payloads.
Direct Connect supplies dedicated connectivity but does not automatically provide end-to-end data encryption.
Use a private Direct Connect virtual interface and assume the private AWS routing path also implies application-level TLS encryption.
The issue is that private circuits never support AWS connectivity.

Explanation

Correct Answer

A private transport path can carry unencrypted protocols; supported IPsec, MACsec where applicable, or application TLS must meet the encryption requirement.

Incorrect Answers

TLS is not universally added to arbitrary traffic simply because it uses a dedicated circuit.

A private VIF is a routing/connectivity construct, not encryption for arbitrary payloads. An explicit encryption solution is still required.

Direct Connect is supported; the missing property is encryption of the packets.

Question 139

A Network Firewall deployment uses stateful rules but puts the return path on a direct VPC route that bypasses the inspection endpoint. Many connections fail under asymmetric routing. Why?

Stateful firewall rules authorize all response packets even if no route sends them through the firewall.
Add Network Firewall rules allowing the required flow, but keep a shorter direct route from source to destination that bypasses the inspection endpoint.
The traffic-routing topology does not keep both directions through the stateful firewall endpoint.
Every Network Firewall rule requires a public IPv4 address on backend EC2 instances.

Explanation

Correct Answer

Stateful inspection needs a consistent flow path; asymmetric routes can leave the appliance without corresponding state for return packets.

Incorrect Answers

Firewall policy cannot inspect packets that do not traverse its endpoint.

Firewall rules cannot inspect or preserve state for packets that never traverse the endpoint. Both directions need routes through the stateful firewall path.

Stateful private inspection does not require publicly addressed workloads.

Question 140

Security has attached a standard AWS WAF rule to a single account while assuming AWS Firewall Manager will centrally enforce that rule in every other account without enrollment or policy assignment. Why does the organization remain inconsistent?

A manually attached local WAF web ACL is not an organization-wide Firewall Manager policy with required admin scope and targets.
Organizations automatically makes every member account share the same WAF web ACL without configuration.
Deploy a Firewall Manager delegated administrator but leave all policies scoped only to the administrator account, assuming they propagate automatically to every member account.
The issue is that AWS Firewall Manager cannot manage any WAF resources.

Explanation

Correct Answer

Central policy deployment requires proper Firewall Manager/Organizations configuration and policy scopes across supported accounts/resources.

Incorrect Answers

Organizational membership is necessary for some central controls but does not automatically clone every application policy.

Delegating an administrator does not by itself associate organizational policy targets. Supported Firewall Manager policy scope and resource settings must include the desired member accounts.

Firewall Manager is specifically intended for supported centralized network security controls.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 130

Explanation

Correct Answer

Incorrect Answers

Question 131

Explanation

Correct Answer

Incorrect Answers

Question 132

Explanation

Correct Answer

Incorrect Answers

Question 133

Explanation

Correct Answer

Incorrect Answers

Question 134

Explanation

Correct Answer

Incorrect Answers

Question 135

Explanation

Correct Answer

Incorrect Answers

Question 136

Explanation

Correct Answer

Incorrect Answers

Question 137

Explanation

Correct Answer

Incorrect Answers

Question 138

Explanation

Correct Answer

Incorrect Answers

Question 139

Explanation

Correct Answer

Incorrect Answers

Question 140

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests