Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 17

Question 160

A publisher has many subscriber accounts and changes entitlements frequently. Some users may download thousands of paid files during a short login session. Which CloudFront control is suitable when many individual URLs would be cumbersome?

Make the entire S3 origin public and rely on user profile pages to hide links.
Use only a CloudFront cache TTL to grant paid access.
Issue an IAM user access key per subscriber and make clients sign every CloudFront GET request with AWS SigV4, rather than using viewer access tokens.
Consider CloudFront signed cookies for a group of protected files, with expiration and origin access restrictions.

Explanation

Correct Answer

Signed cookies can authorize sets of files under policy while preserving private origin protections, reducing per-object signed-URL issuance.

Incorrect Answers

A public origin bypasses subscriber authorization controls.

Cache freshness does not authenticate a viewer or enforce purchase entitlement.

Ordinary CloudFront paid viewer access uses signed URLs/cookies; distributing persistent AWS credentials to public subscribers is unnecessary and exposes unrelated AWS API authorization.

Question 161

A distribution serves nonpublic S3 objects including SSE-KMS data. The team chooses between old OAI and OAC for new deployment. Which distinction favors OAC?

CloudFront OAC supports signed S3 origin requests with modern region/KMS capabilities and should be used for compatible ordinary S3 origins.
Use OAC on an S3 website endpoint and expect S3 API request signing.
Enable anonymous public read because signed origin requests cannot work with private buckets.
Move every S3 object to EFS before it can use CloudFront.

Explanation

Correct Answer

AWS recommends OAC for S3 bucket origins and documents improved SSE-KMS and newer Region support compared with OAI.

Incorrect Answers

Website endpoints are custom origins and cannot use OAC in the ordinary S3 origin pattern.

Private bucket policies can grant the CloudFront distribution scoped access.

CloudFront can serve private objects from ordinary S3 origins.

Question 162

A global CloudFront distribution serves viewers while the origin is an ALB in ap-southeast-2. Which certificate arrangement satisfies viewer and regional origin HTTPS requirements?

Put both certificates exclusively in ap-southeast-2 because the ALB runs there.
Put both certificates in us-east-1 because every regional ALB can attach a cross-region ACM certificate.
Use an ACM viewer certificate in us-east-1 for CloudFront, and a suitable origin certificate in the ALB’s own Region.
Turn off HTTPS between viewers and CloudFront when the ALB origin is encrypted.

Explanation

Correct Answer

CloudFront ACM viewer certificate placement is global-service specific; ALB origin certificates follow the regional load balancer.

Incorrect Answers

The CloudFront viewer certificate must be in us-east-1.

Regional ALBs generally use certificates in their own Region.

Origin TLS alone does not protect viewer-to-edge connections.

Question 163

A multi-tenant mobile SaaS needs millions of customer identities, password recovery, and sign-in tokens, but no AWS console accounts. Which IAM-related choice limits management burden?

Create a root user for every customer in the existing AWS account.
Use Cognito user pools for customers and reserve AWS IAM roles for app workloads that access AWS resources.
Use IAM Identity Center permission sets to grant each consumer an AWS account role, assuming these act as Cognito user-pool JWT sign-ins.
Assign all customer IDs to IAM Identity Center permission sets for production administrators.

Explanation

Correct Answer

Separating consumer identity from AWS account principals avoids administering individual IAM users for public app subscribers.

Incorrect Answers

Each account has its root principal; consumers should not receive root authority.

Workforce AWS account permissions and public consumer JWT tokens are different authentication contracts. The application requires consumer registration and token issuance by a user-pool identity service.

Workforce account SSO is not the default service for public SaaS user registration.

Question 164

A company needs both detection of suspicious AWS activity and immediate automated quarantine of confirmed high-severity findings. Should it rely on GuardDuty alone?

Treat any GuardDuty finding as proof the affected resource has already been quarantined.
Use GuardDuty to generate findings, then apply an explicitly authorized event-driven response or reviewed containment workflow.
Enable AWS WAF rules for a public endpoint and assume every GuardDuty finding on the account automatically invalidates any associated EC2 role credentials.
Turn off detection to avoid the need to write response automation.

Explanation

Correct Answer

GuardDuty is threat detection; quarantining identities or workloads requires separate enforcement actions and control checks.

Incorrect Answers

Findings are evidence, not necessarily remediation receipts.

WAF can filter supported HTTP requests but is not a generic responder to GuardDuty identity findings. A separate authorized event-to-IAM containment workflow is needed.

Removing threat visibility does not satisfy the security requirement.

Question 165

A company wants to know both which S3 buckets are externally accessible and which contain sensitive personal records. Which combination avoids treating policy exposure as content classification?

Use only S3 lifecycle inventory as a complete PII detector and access policy engine.
Use IAM Access Analyzer findings for cross-account resource grants but infer PII presence only from those findings, without ever scanning object contents.
Assume any bucket with no external access automatically contains no sensitive information.
Use Access Analyzer for supported external policy exposure and Macie sensitive data discovery for S3 content classification.

Explanation

Correct Answer

These services answer different questions: access policy analysis and sensitive-data content detection.

Incorrect Answers

Inventory metadata cannot by itself infer personal information inside each object.

Policy exposure reveals potential principal access, not whether supported object content contains sensitive personal values. Macie or a classifier must inspect data content.

A private bucket can still hold regulated records.

Question 166

A service authenticates to RDS with a credential that changes every month, but deployment occurs quarterly. Which architecture prevents forced code release for every rotation?

Hard-code the password in every deployment and turn off rotation whenever the deployment schedule is slower.
Manage database secrets with Secrets Manager and make application retrieval/refresh independent of release templates.
Keep the password in an encrypted application template and re-encrypt the same old plaintext after each Secrets Manager rotation.
Use an EC2 security group as the only database authentication control.

Explanation

Correct Answer

Secret rotation can proceed on its own cadence when consumers obtain the current credential through authorized managed retrieval.

Incorrect Answers

This couples security maintenance to code release and leaves static secrets exposed.

Encrypted deployment storage does not synchronize the application secret with the database’s newly valid password. The app must retrieve and refresh the current managed value.

Network reachability and DB authentication are separate boundaries.

Question 167

An application needs thousands of named configuration settings, but only some are secret and none needs automated database password rotation. Cost and hierarchy are priorities. What is a reasonable AWS service choice?

Use Secrets Manager rotation for every plain-text feature flag solely because it is available.
Use Systems Manager Parameter Store for named configuration, SecureString/KMS for secrets and per-path IAM access, evaluating tier/throughput needs.
Put configuration into an unprotected public S3 object and expose it to every employee.
Treat plain String parameters as encrypted secrets regardless of parameter type.

Explanation

Correct Answer

Parameter Store is suited to governed app parameters and may be simpler/cheaper where Secrets Manager rotation features are unnecessary.

Incorrect Answers

Automatic credential rotation is not a general requirement for nonsecret application configuration.

Public access is not a least-privilege parameter governance mechanism.

Sensitive values should use appropriate SecureString protection and key authorization.

Question 168

A corporation already has Direct Connect for predictable large transfers, but regulated traffic must be encrypted between its datacenter and AWS. What does the architecture require beyond a dedicated link?

Assume a private leased circuit guarantees all TCP payloads are cryptographically confidential.
Use only an encrypted Direct Connect private-VIF label and assume it switches the payload to IPsec without configuring an actual overlay or supported link encryption.
Use Route 53 health checks as the only data encryption mechanism.
A supported encryption layer such as VPN or validated link/application encryption, while retaining Direct Connect for dedicated transport if desirable.

Explanation

Correct Answer

Dedicated connectivity and encryption solve different concerns; an encrypted overlay can protect payloads while using existing capacity.

Incorrect Answers

A physically dedicated link does not itself mean packets are encrypted.

A private VIF provides connectivity and a routing boundary; it does not automatically negotiate payload encryption. A validated VPN, MACsec where eligible, or application TLS is needed.

DNS availability monitoring cannot encrypt network traffic.

Question 169

An enterprise centrally inspects east-west VPC traffic and wants to limit bypass paths. It is choosing between per-instance security groups alone and Network Firewall with explicit routing. What is the distinguishing capability?

AWS Network Firewall provides centralized stateful inspection only when forward and return routes direct eligible flows through its endpoints.
Route only request packets through the firewall and let return packets bypass it, assuming state remains valid.
Use AWS Network Firewall stateful rule groups but place only the rule group identifier on every EC2 IAM role instead of creating inspection endpoints/routes.
Disable VPC route tables because a centralized firewall automatically intercepts all VPC packets.

Explanation

Correct Answer

Security groups enforce local workload reachability; a routed firewall tier can apply centralized packet inspection policy across specified network paths.

Incorrect Answers

Asymmetric routing undermines stateful connection inspection.

IAM role policies do not route packets through a network firewall or establish flow state. Stateful packet inspection requires deployed firewall endpoints in the actual traffic path.

Network Firewall requires deliberate routing to its endpoints.

Question 170

A security team manages 200 AWS accounts with recurring WAF and network firewall compliance changes. It is comparing manual local rule edits with centralized AWS Firewall Manager. What favors central policy?

Every account will automatically share the same firewall rules by being in Organizations without any policy configuration.
A single EC2 security group in the management account becomes the firewall for all member VPCs.
Firewall Manager can coordinate supported network-security policies and compliance across organization accounts and target resources.
Use AWS Config compliance rules only to detect noncompliant WAF rules without configuring an organization-wide deployment/remediation policy.

Explanation

Correct Answer

Central administration provides consistent intended controls and visibility into out-of-policy resources, avoiding untracked account-by-account drift.

Incorrect Answers

Membership alone does not specify which resources receive the desired rules.

Security groups apply at resource interfaces, not as an automatic organization-level firewall.

Compliance reporting can identify drift but alone cannot provide the centralized managed WAF policy distribution or enforcement delivered by Firewall Manager.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 160

Explanation

Correct Answer

Incorrect Answers

Question 161

Explanation

Correct Answer

Incorrect Answers

Question 162

Explanation

Correct Answer

Incorrect Answers

Question 163

Explanation

Correct Answer

Incorrect Answers

Question 164

Explanation

Correct Answer

Incorrect Answers

Question 165

Explanation

Correct Answer

Incorrect Answers

Question 166

Explanation

Correct Answer

Incorrect Answers

Question 167

Explanation

Correct Answer

Incorrect Answers

Question 168

Explanation

Correct Answer

Incorrect Answers

Question 169

Explanation

Correct Answer

Incorrect Answers

Question 170

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests