Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 15

Question 140

Security has attached a standard AWS WAF rule to a single account while assuming AWS Firewall Manager will centrally enforce that rule in every other account without enrollment or policy assignment. Why does the organization remain inconsistent?

A manually attached local WAF web ACL is not an organization-wide Firewall Manager policy with required admin scope and targets.
Organizations automatically makes every member account share the same WAF web ACL without configuration.
Deploy a Firewall Manager delegated administrator but leave all policies scoped only to the administrator account, assuming they propagate automatically to every member account.
The issue is that AWS Firewall Manager cannot manage any WAF resources.

Explanation

Correct Answer

Central policy deployment requires proper Firewall Manager/Organizations configuration and policy scopes across supported accounts/resources.

Incorrect Answers

Organizational membership is necessary for some central controls but does not automatically clone every application policy.

Delegating an administrator does not by itself associate organizational policy targets. Supported Firewall Manager policy scope and resource settings must include the desired member accounts.

Firewall Manager is specifically intended for supported centralized network security controls.

Question 141

An application team stores the current RDS database secret directly in its Lambda deployment template. The team rotates the database password in Secrets Manager but the function continues using the template value. What is the root integration defect?

Lambda IAM roles cannot read Secrets Manager under any circumstances.
Change the KMS encryption key alias for the deployment-time environment variable and assume the rotated RDS password will be substituted automatically.
The application must disable all environment encryption before retrieving a secret.
The function is bound to a static deployment-time password rather than retrieving and refreshing the current authorized secret version.

Explanation

Correct Answer

Rotation is useful only when consuming workloads obtain the updated credential; embedding an old value creates drift.

Incorrect Answers

Lambda roles can be granted scoped GetSecretValue permission when appropriately configured.

Changing a KMS key alias affects key selection/reference, not the plaintext secret value embedded in a Lambda template. The function must retrieve and refresh the current secret.

Encryption of configuration is not the cause of cached credential mismatch.

Question 142

A service shares one S3 presigned upload URL with hundreds of clients. The URL was intended for one request but the signer's broad permissions allow writes to a key that every client reuses. What weakness should be reviewed?

A presigned URL can never write an S3 object; uploads are impossible.
Set a short S3 object lifecycle retention period and assume it makes the presigned PUT URL single-use across all clients.
The presigned operation, object key, expiry and signing-principal permissions are too broadly or jointly delegated for the intended recipient isolation.
Route 53 automatically revokes S3 presigned URLs after the first successful upload.

Explanation

Correct Answer

A presigned URL inherits the signer’s allowed operation for its target and duration; a shared token is not a separate per-user authenticated authorization.

Incorrect Answers

Presigned PUT operations are supported subject to correct signing and request parameters.

S3 lifecycle manages stored object age, not one-time use of a shared signed request. A shared presigned URL remains usable under its signer permission and expiry constraints.

DNS is not a one-time-token enforcement mechanism for presigned URLs.

Question 143

A production feature flag is deployed to every instance instantly. Errors spike but there is no configured alarm and no gradual rollout stage. The team claims it used AppConfig safely. What required safeguard is absent?

AppConfig must always be replaced by AWS KMS for any configuration value.
All feature flags must be placed in EC2 user data to be effective.
Enable a CloudWatch alarm but deploy the AppConfig feature flag without linking the alarm to any monitored rollout strategy.
A staged deployment and monitored rollback signal to stop or revert a bad configuration before full exposure.

Explanation

Correct Answer

AppConfig rollout strategies and configured alarms can limit blast radius; an immediate unmonitored release defeats that operational purpose.

Incorrect Answers

KMS handles encryption and key policy rather than staged feature-flag exposure.

User data is not a monitored progressive configuration service.

An alarm can detect failure but cannot automatically stop or roll back the deployment unless the deployment strategy and monitoring/rollback are connected appropriately.

Question 144

Systems Manager Patch Manager targets private instances but reports them unmanaged. The instances do not run an active SSM Agent and lack a managed-instance role. Why can the patch window not reach them?

Systems Manager must open inbound public SSH on every instance to deploy patches.
Systems Manager requires appropriately registered managed nodes, agent connectivity and effective permissions before patch operations can execute.
Create a Systems Manager maintenance window and targets for the instances but omit the SSM Agent, instance profile permissions and outbound SSM service connection.
Changing CloudFront cache TTL will install the missing SSM Agent.

Explanation

Correct Answer

A maintenance schedule alone cannot manage instances that have no SSM control-plane channel or permissions.

Incorrect Answers

Supported SSM management can operate without public inbound SSH.

A maintenance window is only a schedule and target selection. Agents must be managed-node registered and authorized before Patch Manager can reach them.

CDN caching cannot configure the OS agent on EC2.

Question 145

An engineer enables CloudTrail but expects it to capture every ACCEPT/REJECT decision from a subnet NACL. Which service boundary is being confused?

CloudTrail and VPC Flow Logs are identical file formats with the same event names.
CloudTrail logs supported AWS API events; VPC Flow Logs are the network-flow evidence for ACCEPT/REJECT dispositions.
NACLs are stateful and therefore produce no accepted-flow metadata.
Use only ALB access logs for API activity and treat those HTTP access records as the VPC subnet NACL ACCEPT/REJECT flow evidence.

Explanation

Correct Answer

Network data-plane metadata and cloud control-plane API auditing use different telemetry services and contain different fields.

Incorrect Answers

Their purposes and record schemas differ.

NACL filtering is stateless; VPC flow records can still describe traffic outcomes.

ALB access logging covers received HTTP requests, not generic ENI network traffic blocked or passed by NACLs. VPC Flow Logs expose relevant flow dispositions.

Question 146

An interface endpoint policy allows one role to invoke a service action, yet the caller’s IAM role has no identity permission for the API and receives AccessDenied. Why did endpoint policy not suffice?

PrivateLink connections bypass all IAM policy evaluation by design.
VPC endpoint policy permission cannot independently grant AWS API access that the caller lacks in its IAM and applicable service policy.
Attach an interface endpoint policy granting the role an API action and remove the role identity Allow, assuming the endpoint policy grants service permissions independently.
The endpoint DNS name has to be publicly registered before IAM authorization works.

Explanation

Correct Answer

Endpoint policies are an additional filter; effective request authorization still depends on identity and resource permissions.

Incorrect Answers

Private network reachability does not replace service API permissions.

An endpoint policy is an additional path filter rather than an independent identity permission grant. A private endpoint does not bypass caller IAM evaluation.

Private endpoint DNS is a routing setting, not a substitute for caller API permission.

Question 147

A web app is protected only by EC2 TCP/443 security group ingress rules. A malicious HTTP request with SQL injection reaches the app. Why did the security group fail to classify it?

Security groups evaluate network protocol/ports and sources, not SQL injection content in HTTP request parameters.
Security groups automatically decrypt and scan HTTP bodies on port 443 before forwarding.
Attach a subnet network ACL rule allowing the user’s IPv4 CIDR and expect the NACL to parse SQL injection strings inside TLS requests.
CloudWatch CPU metrics always block SQL injection by default.

Explanation

Correct Answer

An application-layer filter such as AWS WAF or application validation is needed to inspect malicious request payload patterns.

Incorrect Answers

They do not function as HTTP payload inspection engines.

NACLs operate at network source/destination/port layers and cannot inspect HTTP request content. WAF/application logic must evaluate SQL injection data.

Metrics can indicate performance symptoms but do not enforce input validation.

Question 148

An organization configures HTTPS for clients connecting to an ALB, but the target group protocol remains HTTP. Security claims all transit legs are encrypted because ACM is attached. What is wrong?

Client-to-ALB TLS does not imply ALB-to-target encryption; configure an HTTPS target group and backend TLS for the second hop.
ACM certificates are never supported on ALBs.
Request a new viewer certificate in ACM but leave the target group HTTP, assuming certificate renewal enables target encryption automatically.
The HTTP target group already uses TLS because port 80 is inside a VPC.

Explanation

Correct Answer

TLS terminates at the ALB’s viewer listener; the target protocol determines how the balancer reaches instances.

Incorrect Answers

ALB HTTPS listeners can use ACM certificates.

A changed client-side certificate does not change the protocol used by the ALB to connect to targets. Backend TLS requires HTTPS target group/target configuration.

Private VPC placement does not transform plaintext HTTP into TLS.

Question 149

A security team inserts a Gateway Load Balancer inspection service into VPC egress routing. All workloads in AZ-b route inspection flows to the only Gateway Load Balancer endpoint located in AZ-a; the inspection service has healthy appliance capacity elsewhere. When AZ-a fails, AZ-b traffic loses the inspection path. Which network design boundary was missed?

Use one shared public NAT gateway across all AZs and assume it automatically performs the same appliance inspection as Gateway Load Balancer.
Gateway Load Balancer endpoints are zonal; provision supported endpoint placement per required AZ and update each relevant subnet route to its appropriate endpoint while maintaining appliance health.
Enable S3 versioning on the inspection logs, which automatically recreates a missing Gateway Load Balancer endpoint in AZ-b.
Configure cross-Region S3 replication of appliance reports as the only packet-forwarding path between private subnets.

Explanation

Correct Answer

AWS recommends a zonal Gateway Load Balancer endpoint per required Availability Zone; routed inspection should avoid a sole endpoint in the failed AZ when AZ survival is required.

Incorrect Answers

Ordinary NAT egress does not replace the configured in-line network appliance inspection service or its GWLB endpoint routing.

Object history cannot create a missing endpoint ENI or change the live VPC packet path.

Storage replication is not a Gateway Load Balancer endpoint and cannot inspect network packets.

Question 150

A browser-based internal app is reachable over a simple VPN but the organization needs per-request user/device trust checks. A proposed solution treats VPN network location as permanent authorization. What is the gap?

A VPN tunnel automatically verifies the health of every user device before each web request.
Network location alone does not enforce an identity- and device-posture-aware application access policy at the app boundary.
Authorize employees through a single Client VPN membership rule and assume it evaluates their current browser device-health posture on every app request.
Any private subnet ACL can validate a user’s identity provider claims.

Explanation

Correct Answer

AWS Verified Access can incorporate configured trust-provider context into an application authorization decision rather than trusting all tunnel clients.

Incorrect Answers

Network tunnel connectivity alone does not imply posture checks for every application transaction.

VPN membership can control network access but does not implement per-request trust signals at the web app. Identity-aware application authorization must evaluate the intended user/device attributes.

NACLs filter IP/protocol/ports, not app user or device identity signals.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 140

Explanation

Correct Answer

Incorrect Answers

Question 141

Explanation

Correct Answer

Incorrect Answers

Question 142

Explanation

Correct Answer

Incorrect Answers

Question 143

Explanation

Correct Answer

Incorrect Answers

Question 144

Explanation

Correct Answer

Incorrect Answers

Question 145

Explanation

Correct Answer

Incorrect Answers

Question 146

Explanation

Correct Answer

Incorrect Answers

Question 147

Explanation

Correct Answer

Incorrect Answers

Question 148

Explanation

Correct Answer

Incorrect Answers

Question 149

Explanation

Correct Answer

Incorrect Answers

Question 150

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests