Question 250
A CloudFront distribution must serve private S3 origin objects without making the bucket publicly readable. The application is migrating away from older origin access identity configurations. Which modern origin access mechanism should the team adopt?
- Configure CloudFront Origin Access Control with signed origin requests and a scoped S3 bucket policy permitting the distribution.
- Configure an S3 bucket policy for the CloudFront service principal but omit the distribution-specific SourceArn condition and origin signing.
- Keep the legacy Origin Access Identity (OAI) and assume it is the current preferred mechanism for every new S3 origin.
- Require CloudFront signed viewer URLs only while leaving the S3 origin bucket directly accessible to authorized public identities.
Explanation
Correct Answer
A:OAC provides an appropriate CloudFront-to-private-S3 authorization path without enabling public S3 object access.
Incorrect Answers
B:CloudFront OAC requires appropriately signed origin requests and a scoped policy; a broad service-principal statement alone is insufficiently constrained.
C:OAI is the older pattern; OAC adds modern origin-request signing and broader supported configurations for a migration away from OAI.
D:Viewer authorization does not enforce private origin access. Direct S3 requests can bypass CloudFront unless the bucket policy limits origin access via OAC.
Question 251
A public ALB-backed API experiences Layer 7 bot traffic that targets a small group of URL paths and customer countries. The team wants managed rules and rate-based limits before requests reach the origin. Which service is the direct control?
- Use AWS Shield Standard alone and expect it to match URL paths, request bodies and bot signatures for the Layer 7 policy.
- Use an ALB listener rule with fixed responses for specified static paths but no adaptive source rate limits or managed web-threat patterns.
- Associate an AWS WAF web ACL with the supported endpoint and use appropriate managed rules, rate-based rules and match conditions.
- Apply a network ACL that blocks sources based on URL path and request count, assuming its stateless IP filters parse application-layer HTTP.
Explanation
Correct Answer
C:AWS WAF evaluates HTTP requests at the supported entry point and can block abusive path, geo and rate patterns before reaching the app.
Incorrect Answers
A:Shield Standard supplies baseline DDoS protection but does not replace a configurable AWS WAF web ACL for managed HTTP rules and per-path rate controls.
B:Listener routing can match conditions but lacks AWS WAF managed detection and rate-based enforcement required against variable bot traffic.
D:NACLs work at network/transport layers and cannot inspect HTTP paths, managed signatures or per-request rate aggregates.
Question 252
A microservice in a private VPC requires AWS Secrets Manager API calls without general internet or NAT egress. The security team also needs to limit usage to a known VPC endpoint where supported. Which design should be implemented?
- Add a gateway endpoint for Secrets Manager and route its prefixes privately without creating a service interface endpoint.
- Create the correct Secrets Manager interface endpoint but disable private DNS and leave the application calling the public regional hostname without internet egress.
- Create an interface endpoint for Secrets Manager with suitable endpoint security group, endpoint policy and identity/resource restrictions.
- Create a Secrets Manager interface endpoint and allow all source subnets in the endpoint security group, with no endpoint or identity scope.
Explanation
Correct Answer
C:Interface VPC endpoints give private AWS service connectivity; endpoint and IAM controls can restrict the approved network path and actions.
Incorrect Answers
A:Secrets Manager uses supported interface VPC endpoints, not S3/DynamoDB-style gateway endpoints. A gateway endpoint cannot deliver this API path.
B:Without correct private DNS or an explicitly selected endpoint hostname, API calls can resolve to unreachable public addresses despite the provisioned endpoint.
D:Network reachability alone does not meet the required restricted caller/endpoint boundary. Use scoped security group and compatible endpoint/IAM conditions.
Question 253
An AWS API role must grant access to resources only when the caller has a department principal tag matching the resource department tag, with all tags controlled through approved provisioning. Which IAM strategy enables this relationship?
- Require a static IAM role per department and allow access to every resource with the department name in its friendly Name tag.
- Compare only aws:PrincipalTag/department to a literal static value without evaluating the target resource department tag.
- Compare principal and resource tags but let a caller self-edit the department principal tag through unrestricted session tagging.
- Implement attribute-based access control using IAM condition keys that compare principal and resource tags, with safeguards for tag modification.
Explanation
Correct Answer
D:ABAC policies can restrict actions through principal and resource tags, provided tag assignment and mutation privileges are themselves controlled.
Incorrect Answers
A:A naming convention is not a dynamic principal/resource tag comparison; the requirement needs actual trusted IAM condition context.
B:A static caller value cannot enforce the requested relation for resources tagged to multiple departments; use principal-to-resource tag equality.
C:A tag comparison is not a security boundary when the principal can elevate by choosing arbitrary privileged tags. Tag issuance and modification must be trusted.
Question 254
A banking workload connects through an ALB over HTTPS and must use a certificate that renews through a supported managed workflow. Its private API uses a public domain that the company controls and can validate. Which certificate solution is appropriate?
- Import an externally issued certificate into ACM and assume ACM automatically renews that imported certificate for every issuer.
- Request an ACM public certificate only for the ALB default DNS name without validating ownership of the company-controlled API domain.
- Use a private certificate from AWS Private CA for a public customer domain, assuming all internet clients automatically trust the corporate root.
- Request an AWS Certificate Manager public certificate, complete domain validation and associate it with the ALB HTTPS listener.
Explanation
Correct Answer
D:ACM-managed eligible public certificates support the ALB listener and managed renewal when domain validation and service conditions remain satisfied.
Incorrect Answers
A:Imported third-party certificates do not receive the same ACM-managed renewal as eligible Amazon-issued public certificates. This does not meet the managed-renewal preference.
B:TLS clients validate the requested host against the certificate; a certificate for an unrelated hostname does not cover the public API domain.
C:Private CA roots are not inherently in public browser trust stores. The validated ACM public certificate fits the publicly verified domain and managed renewals.
Question 255
An S3 data lake contains regulatory records accessible to a fleet through a dedicated gateway VPC endpoint. The security requirement is that data-lake reads be denied unless they originate through the approved endpoint, even for identities using otherwise valid AWS credentials. Which resource control should be considered?
- Set aws:PrincipalOrgID on the bucket policy but do not require the approved VPC endpoint ID for reads from member identities.
- Allow all s3:GetObject requests from the corporate AWS Organization whether they arrive via NAT or the approved gateway endpoint.
- Apply a carefully scoped S3 bucket policy condition such as aws:SourceVpce for approved paths, with planned exceptions for required AWS services.
- Apply an interface endpoint security group to the S3 gateway endpoint and assume its group becomes the bucket authorization condition.
Explanation
Correct Answer
C:Endpoint-based resource policy conditions can restrict access origins, but service-to-service calls and recovery paths need explicit consideration.
Incorrect Answers
A:PrincipalOrgID constrains organization membership but does not enforce the required private data path through the designated endpoint.
B:An organization-wide identity check does not ensure the request passed the allowed endpoint; aws:SourceVpce is needed for that boundary.
D:Gateway endpoints do not have ordinary interface-endpoint ENI security groups; S3 evaluates supported bucket and IAM policy condition keys.
Question 256
A public Application Load Balancer is protected by AWS WAF. One client IP sends thousands of requests each minute to a password-reset path, while normal users require access. The team wants targeted automatic mitigation rather than blocking all countries. What should be configured?
- Configure an AWS WAF rate-based rule that aggregates requests by all client IPs globally rather than isolating the abusive IP on the password-reset path.
- Configure only an ALB listener path rule without an AWS WAF rate threshold or rate-based enforcement action.
- Enable AWS Shield Standard alone and assume its network protections enforce per-IP password-reset URL rate limits.
- Add a scoped WAF rate-based rule matching the password-reset path and apply an appropriate action after testing legitimate request levels.
Explanation
Correct Answer
D:Rate-based rules can count and mitigate high-volume requests that match a particular HTTP condition without blocking unrelated routes.
Incorrect Answers
A:An all-clients aggregate would penalize legitimate users across unrelated request paths and does not meet the targeted abuse requirement.
B:ALB listener routing can select backends by URL, but does not supply the required WAF per-client rate evaluation and mitigation.
C:Shield Standard is not a scoped application-layer WAF rate-based rule for a specific path and client request aggregate.
Question 257
A fintech platform uses CloudFront and an ALB. Its threat model includes large network-layer DDoS attacks against public ingress and it wants AWS support for additional DDoS protections and response assistance. Which AWS offering should it evaluate?
- Use AWS WAF rate-based rules only and assume a web ACL includes the Shield Advanced DDoS response-team engagement for eligible resources.
- Evaluate AWS Shield Advanced coverage for supported protected resources and integrate it with appropriately tuned WAF controls.
- Rely solely on Shield Standard automatic basic protection, without evaluating the additional support and resource coverage requirement.
- Purchase an AWS WAF Bot Control managed rule group only, treating it as the guaranteed large network-layer volumetric protection service.
Explanation
Correct Answer
B:Shield Advanced provides enhanced DDoS protection and response-related features for eligible AWS edge and network resources.
Incorrect Answers
A:WAF request filtering can reduce some HTTP attacks but does not itself provide Shield Advanced eligible-resource DDoS response assistance.
C:Shield Standard supplies baseline protection but not the additional contracted response and specialized support of Shield Advanced.
D:Bot Control targets application bot requests; it is not equivalent to Shield Advanced network-layer protected resource coverage and response support.
Question 258
A SaaS deployment role is authorized to create a narrow AWS KMS grant for a newly launched decrypt worker. CreateGrant succeeds, but the worker immediately receives AccessDenied in the first few seconds despite the intended principal and cryptographic operations being correct. Waiting briefly resolves the failure. For a workflow that must use the grant immediately, what AWS KMS mechanism should be supplied?
- The grant token returned by CreateGrant, passed in supported cryptographic requests while the new grant propagates.
- Wait for the grant to propagate before accessing the key and report that the operation succeeded immediately without an actual wait.
- Revoke the newly created KMS grant and create it again with the same grantee, expecting revocation to bypass propagation delays.
- Rely only on the worker’s sts:AssumeRole permission and omit the still-propagating KMS grant from the cryptographic call.
Explanation
Correct Answer
A:KMS grants are eventually consistent; passing the returned grant token enables immediate use of a new grant for eligible operations while it propagates.
Incorrect Answers
B:Waiting is a possible eventual-consistency workaround, but it cannot meet the explicit immediate-use requirement that grant tokens address.
C:Revoking removes the grant permissions, while recreation repeats eventual consistency rather than enabling immediate use.
D:Assuming an IAM role does not make a newly created KMS grant immediately visible across KMS endpoints.
Question 259
A sensitive workload already has a Secrets Manager interface VPC endpoint, an endpoint security group permitting TCP 443 from the clients, and IAM rights to read the intended secret. The application uses the standard regional secretsmanager hostname, but DNS resolves it to public AWS addresses and calls fail because the VPC has no internet route. What configuration should be repaired?
- Add an unrelated S3 gateway endpoint while leaving private DNS disabled on the already-correct Secrets Manager interface endpoint.
- Expand the service IAM permissions while leaving the VPC resolver returning the public Secrets Manager address.
- Enable the existing Secrets Manager interface endpoint private DNS integration and verify VPC DNS support, so the standard regional hostname resolves to the endpoint addresses.
- Use an endpoint policy that permits all Secrets Manager actions while retaining a public hostname resolution with no internet route.
Explanation
Correct Answer
C:Private DNS resolves the regional Secrets Manager hostname to interface endpoint IPs when the necessary VPC DNS settings are enabled, retaining private connectivity.
Incorrect Answers
A:S3 gateway routes do not alter resolution of the standard Secrets Manager hostname to its private interface addresses.
B:Authorization does not repair the DNS route to the intended endpoint, and broad privileges would be unnecessary.
D:Endpoint policy scope controls API authorization on traffic that reaches it, but does not make the application resolve the standard hostname privately.
Question 260
An application creates signed CloudFront URLs for premium media and requires only users whose entitlement is still valid to fetch content. The S3 origin must not be publicly readable. Which paired authorization design fits?
- Use CloudFront signed URLs or cookies with controlled key management and private S3 origin access through OAC.
- Make all S3 objects public and rely solely on hard-to-guess CloudFront object paths as authorization.
- Use CloudFront Origin Access Control on the S3 bucket but omit signed viewer requests so every viewer of the public distribution can read premium media.
- Issue indefinite signed CloudFront URLs without verifying user entitlements or handling expired access rights.
Explanation
Correct Answer
A:Signed viewer access limits permitted downloads while OAC ensures clients cannot bypass CloudFront to read the S3 origin directly.
Incorrect Answers
B:An obscured URL is not an authorization control and the public S3 path bypasses entitlement checks.
C:OAC secures origin access from CloudFront; viewer entitlements still require CloudFront signed URL or signed cookie checks.
D:Signature verification alone does not preserve a changing entitlement boundary if links remain valid indefinitely after subscription expiry.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests