Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 24

Question 230

A secret rotation process serves a critical database and occasional password changes break applications. What is the essential availability tradeoff of a well-designed rotation workflow?

Skip validation and promote any generated secret to current as soon as it exists.
Test the AWSPENDING credential against the database, promote it to AWSCURRENT only after success, and ensure clients subsequently refresh their cached secret.
Disable IAM read permissions for all applications after every rotation.
Move the password into an unencrypted user-data script to avoid rotation outages.

Explanation

Correct Answer

A supported rotation tests the pending password against the target before finishSecret promotes its staging label. Production consumers must refresh cached values as AWSCURRENT changes, with retriable connection handling to reduce rotation-related outages.

Incorrect Answers

An incorrect new secret could immediately stop production connections.

Consumers still need authorized access to the valid current secret.

Static secret exposure is not a secure availability solution.

Question 231

A finance team wants to guarantee that even fully authorized S3 users cannot access classified objects over cleartext HTTP. Which condition is independent of user role permissions?

Grant AdministratorAccess and assume all requests become TLS.
Use a KMS encryption key alone to mandate HTTPS.
Use S3 Object Lock compliance mode and assume WORM retention also prevents all requests over plaintext HTTP.
Use an explicit S3 bucket-policy deny when aws:SecureTransport is false, with service-compatible exceptions.

Explanation

Correct Answer

A request protocol condition can reject cleartext transport even for identities otherwise permitted to read the object.

Incorrect Answers

Authorization breadth does not force a client to use encrypted transport.

At-rest encryption is not a protocol requirement for client requests.

Object Lock enforces version-retention/deletion behavior, not transport protocol. A conditional explicit aws:SecureTransport Deny rejects HTTP independently of principal grants.

Question 232

A multi-application encryption key must permit decrypt only for requests associated with a particular business application, not every caller with kms:Decrypt. Which fine-grained condition fits?

Set an IAM user display name equal to the application ID.
Use an S3 storage class as the application identifier in KMS policy without an encryption-context check.
Scope kms:Decrypt by source IP network condition alone and omit the expected business AppID encryption context even though callers share the same network.
Use an appropriate KMS encryption-context condition tied to the expected application identifier and verify clients send the corresponding context.

Explanation

Correct Answer

KMS can authorize cryptographic operations based on request additional authenticated data rather than only broad key/action grants.

Incorrect Answers

An identity name does not validate the cryptographic context.

Storage tier is not a reliable per-operation KMS context condition.

A network attribute does not prove which application owns an encryption operation. KMS encryption-context condition keys can bind each request to the business AppID supplied as authenticated data.

Question 233

A data lake hosts many teams in one S3 bucket and policies have become hard to maintain. The team compares splitting dozens of buckets with using scoped access points. Which choice offers reusable policy entry points?

Disable every bucket policy and grant each team root access.
Assume creating an access point automatically replicates all bucket objects.
Keep a single bucket-wide Allow for all teams and attach different object lifecycle transitions to their prefixes, treating lifecycle rules as the team authorization model.
Use S3 Access Points with appropriate team policies and optional VPC network restrictions while retaining bucket policy limits.

Explanation

Correct Answer

Access Points supply separately named policy-controlled access paths to shared bucket data without forcing a bucket-per-team copy.

Incorrect Answers

Broad root grants do not provide fine-grained application isolation.

An access point is an access interface, not a second bucket copy.

Lifecycle may vary data retention by prefix but cannot restrict which principal may read or modify objects. Access Points provide separate policy-controlled ingress paths.

Question 234

A company already uses CloudTrail for account changes but must investigate exactly which principals downloaded specific confidential S3 objects. What logging distinction justifies additional cost?

Enable scoped S3 object-level CloudTrail data events and retain the needed requester/action evidence.
Management events always contain all GetObject requests by default.
Use S3 server access logs as the sole evidence but demand CloudTrail API-style session issuer and request context for every confidential object GET.
Increase S3 bucket version count to enable IAM caller logs.

Explanation

Correct Answer

CloudTrail data events capture supported object operations beyond default management events, with potentially higher event volume and charges.

Incorrect Answers

Data-plane object reads require the corresponding data-event selection.

Access logs capture useful S3 request details, but CloudTrail object data events provide the supported IAM principal/API event representation needed for the specified investigation.

Version history does not select CloudTrail data events.

Question 235

An application requires encrypted disk recovery in a second AWS Region. Which EBS snapshot arrangement is a valid tradeoff between regional isolation and key governance?

Copy the encrypted snapshot to the target Region with a suitable destination KMS key and verify the recovered volume.
Rely on a snapshot in the source Region to appear automatically in every other Region.
Share the source-region EBS snapshot to the secondary account and assume it appears as a local restorable snapshot in every destination Region without an explicit copy.
Remove encryption so any destination IAM principal can restore without KMS.

Explanation

Correct Answer

Cross-Region copies create regional recovery artifacts and require destination key permissions rather than assuming snapshots are globally visible.

Incorrect Answers

EBS snapshots are Region-scoped unless copied.

Snapshot sharing does not make the artifact multi-Region. A destination-region encrypted copy and compatible key permissions are needed for regional isolation.

Loss of encryption is unnecessary and violates the recovery policy.

Question 236

An auditor wants a continuously evaluated control that flags any EBS volume not encrypted as required. Should it rely solely on who called CreateVolume?

Treat a successful CreateVolume API response as proof of policy compliance.
Select CloudTrail S3 data events as the EBS compliance policy auditor, assuming GetObject logs indicate whether EC2 block volumes are encrypted.
Replace Config with a CloudFront viewer certificate.
Use AWS Config resource evaluation to assess encryption state, with CloudTrail as complementary API evidence.

Explanation

Correct Answer

Actual configuration compliance and audit identity are separate; Config can evaluate resource state even when API logs look ordinary.

Incorrect Answers

API success does not imply encryption configuration met the organization standard.

S3 data events concern object API operations and do not assess EC2 volume encryption configuration. AWS Config can evaluate the actual EBS resource state.

TLS identity has no role in EBS storage compliance.

Question 237

A DynamoDB table has had point-in-time recovery enabled for six months, but its configured recovery period is only seven days. A finance team asks to restore records to 20 days ago. Which statement about the available recovery points is correct?

PITR always retains the full 35 days once enabled, regardless of the configured recovery window.
The configured seven-day window does not contain the 20-day-old point. Increasing recovery retention now does not recreate expired history; use an older eligible backup if one exists and plan future retention accordingly.
PITR can overwrite the original table in place at any historical timestamp even if the period has expired.
DynamoDB global secondary indexes automatically retain full independent PITR history after the table recovery window expires.

Explanation

Correct Answer

The requested point precedes EarliestRestorableDateTime. Window changes affect available recovery history prospectively, and a separately retained on-demand or exported backup is needed for an older point.

Incorrect Answers

AWS permits a configurable shorter window (1–35 days); enabling PITR long ago does not override the configured seven-day history.

A normal full PITR restore creates a new table, and cannot restore a timestamp outside the recovery window.

Secondary indexes are components of a restored table, not an independent archival store that retains expired table recovery points.

Question 238

A company issues private TLS certificates to third-party equipment. ACM handles issuance but the devices cannot directly use an ACM-integrated endpoint. Which ownership task remains?

Assume every external server installs renewed ACM certs automatically when the CA exists.
Renew the AWS Private CA issuer certificate but omit certificate installation/rotation on the external devices and assume all device endpoints change automatically.
Replace TLS certificates with IAM root user passwords.
Deploy and renew the issued certificates on each supported device through a separate integration and distribute its trust chain.

Explanation

Correct Answer

Private certificate issuance is not equivalent to installing the new certificate at an arbitrary application endpoint.

Incorrect Answers

Managed deployment depends on service integration.

Issuer and certificate lifecycle operations do not install a renewed leaf certificate into an unmanaged appliance. Explicit endpoint deployment and trust-chain management are still required.

AWS account credentials are not trusted TLS server identities.

Question 239

A compliance team already exports S3 Inventory reports containing object keys, versions, encryption metadata and tags. It now must discover likely payment-card numbers INSIDE a selected set of invoice objects every month, with reviewable sensitive-data findings. What additional operation is appropriate?

Only add more columns to S3 Inventory; its scheduled metadata report inspects every object body for payment-card numbers.
Create a scoped recurring Amazon Macie sensitive-data discovery job for the selected S3 objects and review its findings and discovery results.
Enable CloudTrail S3 data events and treat each GetObject request record as a content classification finding.
Configure S3 Storage Lens cost metrics and assume they identify individual payment-card records within object bytes.

Explanation

Correct Answer

Macie jobs analyze supported S3 object contents using managed/custom identifiers and produce sensitive-data findings. Their scope and recurrence can align with the invoice audit.

Incorrect Answers

Inventory reports metadata and object attributes; it does not read and classify all object payload text as sensitive data.

CloudTrail records who accessed an object and when; API event logs are not sensitive-content discovery of stored invoices.

Storage Lens provides aggregated storage usage and activity metrics rather than inspecting data for card-number patterns.

Question 240

A company accepts S3 uploads from multiple contractors. It wants a uniform destination-owner policy instead of per-contractor ownership and ACL grants. Which tradeoff best matches the policy?

Choose S3 Object Ownership Bucket owner enforced and adapt upload clients to ACL-disabled requests.
Keep Object writer ownership and negotiate ACL access for each object.
Create a separate S3 Access Point for every vendor but retain Object writer ownership and per-object ACL grants for vendor uploads.
Give vendors shared AWS account root keys to upload without policies.

Explanation

Correct Answer

The destination account owns objects and manages permissions through policies, reducing dependence on external uploaders’ ACL behavior.

Incorrect Answers

This preserves the exact per-uploader administration the team wants to remove.

Access Points can scope requests but do not inherently change the bucket object ownership mode. Bucket owner enforced disables ACLs and makes the destination owner control uploaded objects.

Root sharing is unsafe and unnecessary for cross-account uploads.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 230

Explanation

Correct Answer

Incorrect Answers

Question 231

Explanation

Correct Answer

Incorrect Answers

Question 232

Explanation

Correct Answer

Incorrect Answers

Question 233

Explanation

Correct Answer

Incorrect Answers

Question 234

Explanation

Correct Answer

Incorrect Answers

Question 235

Explanation

Correct Answer

Incorrect Answers

Question 236

Explanation

Correct Answer

Incorrect Answers

Question 237

Explanation

Correct Answer

Incorrect Answers

Question 238

Explanation

Correct Answer

Incorrect Answers

Question 239

Explanation

Correct Answer

Incorrect Answers

Question 240

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests