Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 16

Question 150

A browser-based internal app is reachable over a simple VPN but the organization needs per-request user/device trust checks. A proposed solution treats VPN network location as permanent authorization. What is the gap?

A VPN tunnel automatically verifies the health of every user device before each web request.
Network location alone does not enforce an identity- and device-posture-aware application access policy at the app boundary.
Authorize employees through a single Client VPN membership rule and assume it evaluates their current browser device-health posture on every app request.
Any private subnet ACL can validate a user’s identity provider claims.

Explanation

Correct Answer

AWS Verified Access can incorporate configured trust-provider context into an application authorization decision rather than trusting all tunnel clients.

Incorrect Answers

Network tunnel connectivity alone does not imply posture checks for every application transaction.

VPN membership can control network access but does not implement per-request trust signals at the web app. Identity-aware application authorization must evaluate the intended user/device attributes.

NACLs filter IP/protocol/ports, not app user or device identity signals.

Question 151

An internet-facing ecommerce site needs publicly reachable HTTPS, but its business logic handles sensitive inventory records and must remain on unaddressed private instances. Which separation is preferable to assigning public IPs to every server?

Use a public IP on every application instance and remove all ingress restrictions.
Use NAT only to receive inbound buyer HTTP requests.
Host only static S3 website content as the storefront while removing the private transactional application tier required to update inventory.
A public ALB for ingress and private load-balanced application targets with ALB-sourced ingress rules.

Explanation

Correct Answer

This design isolates the public TLS and routing boundary from the application fleet, allowing horizontal scaling without directly exposing each instance.

Incorrect Answers

Direct Internet reachability violates the designated private backend boundary.

NAT gateways are not general inbound web listeners.

A static object-hosted site cannot replace dynamic inventory transaction processing. The ALB-to-private application design satisfies both public ingress and private business logic.

Question 152

A private EC2 worker in one AZ needs occasional outbound access to public package repositories. The app does not accept incoming connections and wants centralized source translation. Which choice is appropriate?

Route approved outbound IPv4 through a reachable public NAT gateway and keep the worker in a private subnet.
Give the worker an inbound SSH rule open to 0.0.0.0/0.
Add only an S3 gateway endpoint for a non-S3 public package repository.
Map the private subnet route directly to an Internet gateway without public addressing or NAT.

Explanation

Correct Answer

NAT allows initiated outbound connections and associated replies without exposing a direct public address on the worker.

Incorrect Answers

That expands attack surface without fixing private-source Internet egress.

S3 service endpoints do not provide general Internet routing.

The IGW path alone does not translate RFC1918 source addresses.

Question 153

A container host on private-only IPv4 is intermittently unable to access the Internet. One proposal adds an Internet gateway route but no public address; another adds a NAT path. Which architectural assumption differentiates them?

Private IPv4 addresses are globally routable if a route table names an IGW.
A private RFC1918 source requires an appropriate public address translation path for ordinary public IPv4 destinations.
The security group creates an Elastic IP automatically whenever it permits outbound HTTPS.
Every VPC has built-in outbound NAT for all private subnets at no configuration.

Explanation

Correct Answer

An IGW forwards eligible publicly addressed traffic; an outbound NAT solution supplies public translation for a private-addressed host.

Incorrect Answers

RFC1918 addressing is not globally publicly routed merely by changing a route.

Security groups do not allocate public IPv4 addresses.

A custom IPv4 NAT route/resource is needed when instances do not have public IPv4.

Question 154

An Application Load Balancer forwards HTTPS traffic to its private targets on port 8443. The target group uses a separate HTTP health check on port 9443. Real requests to 8443 work, but ALB health checks time out and deregister targets. The ALB outbound and target inbound security groups permit only 8443. Which change fixes the health check without exposing targets publicly?

Change the ALB public HTTPS listener to port 9443 and remove its certificate, while leaving backend SGs unchanged.
Open health-check port 9443 to 0.0.0.0/0 on every target rather than limiting traffic to the ALB.
Permit the ALB to send TCP/9443 to targets and permit target inbound TCP/9443 specifically from the ALB security group, with the health endpoint responding.
Increase target deregistration delay and keep target TCP/9443 blocked from the ALB security group, expecting drain time to authorize health checks.

Explanation

Correct Answer

With a custom health-check port, the ALB SG egress and target SG ingress must permit that exact port; successful app forwarding on 8443 does not establish connectivity on 9443.

Incorrect Answers

Listener port 443 is for clients and 8443 is for application forwarding; changing client TLS does not unblock the separately configured health-check target port.

Internet-wide access broadens the private target attack surface; the health-check source is the load balancer security group, not arbitrary clients.

Deregistration delay affects the handling of draining targets and does not make a separate health-check port reachable. Permit the configured check port on the ALB-to-target path.

Question 155

A client requires explicit subnet-level deny rules that can reject certain IP ranges independently of stateful instance firewall policy. Which VPC mechanism provides those controls, with what operational cost?

Use only security groups because they support numbered explicit Deny rules.
Use Route 53 DNS records as packet-level source-IP denies.
Create a permissions boundary denying ec2:AuthorizeSecurityGroupIngress and assume it adds ordered packet-level subnet Deny rules to all traffic.
Use subnet network ACL rules, accounting for stateless rules in both directions and their rule-order behavior.

Explanation

Correct Answer

NACLs can provide subnet-level allow/deny processing, but operators must manage request and response ports separately, unlike stateful security groups.

Incorrect Answers

Security groups have allow rules rather than NACL-style ordered deny statements.

DNS cannot enforce stateless IP filtering on subnet packets.

An IAM boundary can limit API changes but is not a stateless data-plane subnet ACL. NACLs provide the packet filtering/rule-order semantics requested.

Question 156

A private subnet downloads data only from S3 and DynamoDB. Security wants to avoid NAT charges and keep those service API routes within AWS network paths. Which approach is most cost and isolation conscious?

Deploy public Elastic IPs on every instance to save NAT cost.
Use an interface endpoint for every arbitrary Internet hostname and assume it replaces Internet access.
Use appropriate gateway endpoints for supported S3/DynamoDB services with route-table associations and least-privilege service policies.
Enable bucket versioning and S3 Object Lock on data sources but leave the private subnet default route through the NAT gateway for S3/DynamoDB.

Explanation

Correct Answer

Gateway endpoint routes avoid unnecessary NAT for these supported services while the caller still needs IAM/resource authorization.

Incorrect Answers

This adds public addressing when the requirement is private connectivity.

PrivateLink endpoints are service-specific rather than a universal public website proxy.

Data retention features do not change VPC route tables. Gateway endpoints are supported for those two AWS services and can avoid NAT processing on their API traffic.

Question 157

A workload reaches several supported AWS private APIs. The team wants network traffic to stay within the VPC using interface endpoints rather than NAT, but worries about ongoing endpoint hourly/data charges. Which tradeoff is valid?

Create one arbitrary S3 gateway endpoint and assume it covers every AWS API.
Treat interface endpoint fees as always zero for any number of AZs.
Create only needed interface endpoints and compare their AZ/hour/data costs against NAT while preserving private DNS and IAM controls.
Remove all IAM policies because a private endpoint proves caller authorization.

Explanation

Correct Answer

PrivateLink supplies private service connectivity but is priced by endpoint and data; it is not always cheaper than NAT for every traffic profile.

Incorrect Answers

Gateway endpoint coverage is service-specific.

Endpoint billing can include per-AZ hourly and data processing costs.

Private routing does not authorize AWS service operations.

Question 158

An API experiences abusive HTTP bursts but must not block a busy carrier-grade NAT address permanently. Which AWS WAF capability allows targeted request-rate control that can be tuned and evaluated?

Blacklist the entire Internet in an EC2 security group whenever CPU rises.
Use an IP address block rule matching the carrier-grade NAT source and deny all traffic from that shared IP indefinitely.
Scale the database vertically and assume bot requests are rejected.
Use a rate-based WAF statement with carefully chosen aggregation and threshold, monitoring false positives before enforcing blocks or challenges.

Explanation

Correct Answer

WAF evaluates supported HTTP request properties; tuning can limit high-rate abuse while reducing harm to legitimately shared addresses.

Incorrect Answers

That would deny legitimate traffic and does not use HTTP-level rate signals.

A fixed IP block may suppress abuse but also denies legitimate subscribers sharing the carrier NAT address. A tuned WAF rate-based rule supports measured and monitored enforcement.

Capacity increases do not implement an abuse-control decision.

Question 159

A commerce website has low DDoS risk and an aggressively limited security budget. Operations proposes the paid Shield Advanced tier for every resource. What should architecture review compare before subscribing?

Assume Shield Standard has no DDoS resilience unless Advanced is purchased.
Evaluate Shield Standard baseline versus Shield Advanced additional protection/support/cost against documented DDoS exposure and business recovery impact.
Disable the AWS WAF web ACL because Shield always handles all application payload attacks.
Evaluate only the storage price of the origin S3 bucket when deciding Shield Advanced subscriptions, without measuring edge DDoS exposure or required response support.

Explanation

Correct Answer

Advanced can be justified for critical exposed endpoints, but its added services and subscription cost should match actual risk and covered resources.

Incorrect Answers

Standard offers AWS baseline DDoS protections for supported services.

DDoS mitigation and application-layer request filtering are complementary.

Storage tiering does not reflect edge DDoS risk or the value of additional Shield Advanced response capabilities. Risk, eligible protected resources and subscription cost must drive the decision.

Question 160

A publisher has many subscriber accounts and changes entitlements frequently. Some users may download thousands of paid files during a short login session. Which CloudFront control is suitable when many individual URLs would be cumbersome?

Make the entire S3 origin public and rely on user profile pages to hide links.
Use only a CloudFront cache TTL to grant paid access.
Issue an IAM user access key per subscriber and make clients sign every CloudFront GET request with AWS SigV4, rather than using viewer access tokens.
Consider CloudFront signed cookies for a group of protected files, with expiration and origin access restrictions.

Explanation

Correct Answer

Signed cookies can authorize sets of files under policy while preserving private origin protections, reducing per-object signed-URL issuance.

Incorrect Answers

A public origin bypasses subscriber authorization controls.

Cache freshness does not authenticate a viewer or enforce purchase entitlement.

Ordinary CloudFront paid viewer access uses signed URLs/cookies; distributing persistent AWS credentials to public subscribers is unnecessary and exposes unrelated AWS API authorization.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 150

Explanation

Correct Answer

Incorrect Answers

Question 151

Explanation

Correct Answer

Incorrect Answers

Question 152

Explanation

Correct Answer

Incorrect Answers

Question 153

Explanation

Correct Answer

Incorrect Answers

Question 154

Explanation

Correct Answer

Incorrect Answers

Question 155

Explanation

Correct Answer

Incorrect Answers

Question 156

Explanation

Correct Answer

Incorrect Answers

Question 157

Explanation

Correct Answer

Incorrect Answers

Question 158

Explanation

Correct Answer

Incorrect Answers

Question 159

Explanation

Correct Answer

Incorrect Answers

Question 160

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests