Question 260
An application creates signed CloudFront URLs for premium media and requires only users whose entitlement is still valid to fetch content. The S3 origin must not be publicly readable. Which paired authorization design fits?
- Use CloudFront signed URLs or cookies with controlled key management and private S3 origin access through OAC.
- Make all S3 objects public and rely solely on hard-to-guess CloudFront object paths as authorization.
- Use CloudFront Origin Access Control on the S3 bucket but omit signed viewer requests so every viewer of the public distribution can read premium media.
- Issue indefinite signed CloudFront URLs without verifying user entitlements or handling expired access rights.
Explanation
Correct Answer
A:Signed viewer access limits permitted downloads while OAC ensures clients cannot bypass CloudFront to read the S3 origin directly.
Incorrect Answers
B:An obscured URL is not an authorization control and the public S3 path bypasses entitlement checks.
C:OAC secures origin access from CloudFront; viewer entitlements still require CloudFront signed URL or signed cookie checks.
D:Signature verification alone does not preserve a changing entitlement boundary if links remain valid indefinitely after subscription expiry.
Question 261
A company is migrating a global website from a regional Application Load Balancer to CloudFront. It has an ACM public certificate for example.org in eu-west-1, but CloudFront refuses to attach that certificate to its viewer HTTPS distribution. DNS ownership has already been validated. What certificate placement resolves the issue?
- Request or import the viewer certificate into ACM in us-east-1 (N. Virginia), ensure hostname coverage and appropriate validation, then select it for the CloudFront distribution.
- Attach the eu-west-1 ALB certificate to CloudFront without changing anything because every ACM Region is equivalent for a viewer certificate.
- Import the viewer certificate into ACM in the S3 origin Region but leave the us-east-1 CloudFront viewer certificate requirement unmet.
- Configure CloudFront Origin Shield in the original certificate Region and assume the edge now accepts a viewer certificate from any ACM Region.
Explanation
Correct Answer
A:CloudFront requires ACM certificates for its viewer HTTPS configuration in us-east-1; the selected certificate still must cover alternate domain names and be valid.
Incorrect Answers
B:The ACM region for the current ALB certificate is not the special CloudFront viewer certificate Region.
C:CloudFront custom viewer TLS requires the certificate to be in us-east-1 regardless of origin placement.
D:Origin Shield optimizes origin requests and cannot substitute for CloudFront viewer certificate Region requirements.
Question 262
A security log archive bucket grants the CloudTrail service principal permission to write organization audit objects. The bucket owner must ensure a different AWS customer cannot configure its own CloudTrail trail to write into the same bucket through that broad service principal permission. What additional resource-policy constraint should be applied?
- Use an STS ExternalId condition on a human administrator IAM role, but leave the S3 policy granting CloudTrail service-principal writes without origin-scoping conditions.
- Allow s3:PutObject from all CloudTrail trails in all AWS accounts, because AWS service principals always prove ownership of the intended source.
- Add the supported aws:SourceArn and aws:SourceAccount conditions in the S3 bucket policy to restrict CloudTrail writes to the expected trail and owning AWS account.
- Restrict the S3 bucket policy by only the CloudTrail service principal, without any source trail or account condition.
Explanation
Correct Answer
C:Conditioning CloudTrail resource access on the expected source trail ARN and account helps prevent use of that service principal on behalf of another customer.
Incorrect Answers
A:ExternalId is associated with a third-party STS AssumeRole trust use case; it is not the relevant bucket policy constraint for a cross-service principal request.
B:A shared AWS service principal alone can act on behalf of more than one resource or customer, so source checks are important.
D:The shared service principal is not itself proof of the customer-specific source resource; origin-scoping conditions are needed.
Question 263
A finance pipeline already has the necessary cross-account bucket and KMS decrypt permissions for its own reports. The bucket encrypts objects with SSE-KMS and S3 Bucket Keys are disabled. Security now needs the consuming role to use that customer-managed KMS key only when the cryptographic request is associated with the approved report object ARN prefix, not for unrelated ciphertext using the same key. Which fine-grained condition should be evaluated?
- Add a broader kms:Decrypt allow on all resources to the consuming role, because the policy already has the narrowest cryptographic access possible.
- Restrict the relevant symmetric KMS key/identity permissions using a validated kms:EncryptionContext:aws:s3:arn condition matching permitted S3 object ARNs.
- Set an S3 bucket policy on the object prefix but leave the same KMS key usable to decrypt arbitrary ciphertext outside S3.
- Use kms:ViaService for s3 only and assume it scopes decrypt rights to a particular report object prefix without an encryption-context condition.
Explanation
Correct Answer
B:KMS encryption-context condition keys can scope symmetric-key cryptographic operations to authenticated S3 object contexts; Bucket Key behavior must be accounted for.
Incorrect Answers
A:An unrestricted key permission broadens access to unrelated ciphertext and does not use the encryption context supplied during permitted S3 reads.
C:S3 bucket authorization restricts S3 API paths, not arbitrary direct KMS Decrypt operations under an overly broad key policy.
D:ViaService can constrain requests through the S3 service but does not isolate a permitted object ARN prefix within all S3 objects using the key.
Question 264
A central platform creates application IAM roles with resource-specific permissions, but cloud teams can attach their own broad inline policies afterwards. Security wants a maximum bound on each role even when application policies change. What should it enforce?
- Use an IAM identity policy that currently grants a narrow resource ARN without imposing an immutable maximum permission boundary.
- Apply only an SCP to the sandbox OU while the affected production roles still lack the approved per-role permissions boundary.
- Tag each IAM role with a department and assume that tag metadata automatically denies actions added to new inline policies.
- Apply permissions boundaries to approved roles and deny unauthorized changes or removal of the boundaries.
Explanation
Correct Answer
D:Effective identity permissions cannot exceed a correctly enforced boundary even if an inline or attached policy contains broader actions.
Incorrect Answers
A:If developers can add broader inline policies, the initial identity allowlist is not a lasting maximum cap.
B:SCPs provide organization maximums where applicable but do not implement the requested role-specific delegated-permission ceiling.
C:Tags can support conditions but do not independently restrict the maximum permissions of an IAM role without evaluated boundaries or policies.
Question 265
A company uses CloudFront to protect private customer reports stored in S3. Viewer authorization depends on a session cookie, and a malicious user can otherwise bypass CloudFront by fetching the S3 object directly. Which combined security pattern is appropriate?
- Configure only CloudFront Origin Access Control so the S3 origin is private, while leaving every distribution viewer request anonymous.
- Require CloudFront signed cookies or URLs for viewer access and Origin Access Control with restrictive bucket policy for the origin.
- Make the report bucket public and rely on the obscurity of the CloudFront distribution hostname.
- Require a signed CloudFront cookie but leave the origin S3 bucket public to direct requests that bypass the CDN.
Explanation
Correct Answer
B:Viewer signing controls entitlement, while OAC prevents unapproved direct S3 origin reads that would bypass CloudFront.
Incorrect Answers
A:Private origin access prevents direct bucket bypass but does not authenticate or authorize premium viewers at the CDN.
C:A public origin bypasses viewer authorization, and an unguessable name is not access control.
D:Signed viewer requests protect the CloudFront path but public origin access still permits bypassing all entitlement controls.
Question 266
A platform team exposes an internet-facing REST API through AWS API Gateway. Customer requests contain JWTs issued by a known identity provider, and security needs signature, issuer, audience and expiry validation before invoking Lambda. Which authorization method fits?
- Use an API Gateway REST API Lambda TOKEN/REQUEST authorizer that verifies the external IdP JWT signature against trusted keys and validates issuer, audience and expiration before granting invoke permission.
- Configure only an API usage-plan key and assume it cryptographically proves the user identity and all JWT claims.
- Use API Gateway REST request validation on the Authorization header format only, without cryptographically verifying JWT signature or claims.
- Use IAM SigV4 authorization on the REST method alone and assume it independently verifies the identity provider JWT in the bearer header.
Explanation
Correct Answer
A:API Gateway REST APIs use Lambda authorizers for arbitrary trusted external JWTs; native API Gateway JWT authorizers are supported on HTTP APIs, not REST APIs. The Lambda authorizer must verify signature, issuer, audience and expiry before authorization.
Incorrect Answers
B:Usage-plan API keys are not a secure replacement for signed identity token validation.
C:Request validators can check headers and payload shape but are not a trusted JWT signature/issuer/audience/expiry authorization mechanism.
D:SigV4 verifies AWS request signing credentials, not the unrelated external IdP JWT and its issuer, audience and expiry claims.
Question 267
An API Gateway REST API applies API keys and a usage plan to customer applications. Management assumes a client that has a valid API key is a trusted authenticated user and can read all account records. Which design correction is essential?
- Use Cognito, IAM or an appropriate custom authorizer for authentication and authorization; treat API keys as usage-plan identification and throttling controls.
- Treat the secrecy of an API usage-plan key as proof of a user’s account ownership without checking any identity token.
- Enable an API Gateway usage plan with per-client quotas and rate limits but omit downstream user and record ownership authorization.
- Enable API Gateway request validation for required userId parameters and assume their presence proves their authenticity.
Explanation
Correct Answer
A:API Gateway API keys are not user authorization credentials and must not independently grant sensitive data access.
Incorrect Answers
B:Usage keys can be shared and do not attest the end-user principal or resource entitlement.
C:Usage plans regulate API clients and throughput; they do not establish ownership of a customer’s account records.
D:A parameter’s presence and shape do not establish signed user identity or per-resource authorization.
Question 268
A bank requires TLS on an Application Load Balancer and must verify client certificates issued by its approved corporate CA for a specific B2B endpoint. Server-side ACM certificate validation alone is not sufficient. Which ALB feature should be assessed?
- Use ALB mutual TLS authentication with an approved trust store and enforce client certificate validation and revocation handling as supported.
- Configure only an ACM server certificate and assume HTTPS automatically validates certificates presented by every client.
- Configure ALB listener SSL security policies and ACM server-certificate rotation only, without a mutual TLS trust store.
- Configure a backend HTTPS target group while leaving the ALB listener in server-only TLS mode.
Explanation
Correct Answer
A:Mutual TLS adds authentication of the client certificate, whereas ordinary HTTPS verifies only the server identity.
Incorrect Answers
B:Server-only TLS authentication does not require or validate client certificates.
C:TLS version/cipher policy and server certificate lifecycle do not authenticate client certificates from the approved corporate CA.
D:Encryption to backends does not provide the required front-end client-certificate verification at the ALB.
Question 269
A private application behind an ALB uses an ACM public certificate. The company wants backend targets to receive HTTPS traffic rather than plaintext HTTP between the load balancer and EC2. What listener and target configuration is needed?
- Change the ALB listener to HTTPS while leaving the target-group protocol set to HTTP for requests to EC2.
- Configure an HTTPS target group and appropriate target certificates and health checks, while retaining TLS from client to ALB.
- Set the ALB listener to HTTPS but retain an HTTP target group, assuming the backend hop is automatically encrypted.
- Set an HTTPS health-check protocol while retaining the actual target-group forwarding protocol as HTTP.
Explanation
Correct Answer
B:ALB can re-encrypt traffic from the load balancer to targets using HTTPS target group connections.
Incorrect Answers
A:HTTPS listener encryption stops at the ALB if the backend target-group protocol stays HTTP.
C:TLS termination at the ALB does not encrypt the downstream hop when the target group protocol is HTTP.
D:An HTTPS health check verifies a probe path but does not change the actual ALB-to-EC2 listener target forwarding protocol.
Question 270
A private VPC workload must call DynamoDB without NAT, and security needs to restrict the permitted table operations through the approved private route. Which integrated solution supplies the correct network path and authorization controls?
- Use a DynamoDB gateway endpoint but leave all endpoint and IAM access unrestricted instead of limiting the approved table operations.
- Use a DynamoDB interface endpoint security group alone without enforcing the table-level IAM permissions requested.
- Create a DynamoDB gateway VPC endpoint associated with the appropriate route tables, and apply scoped endpoint and identity permissions for the table operations.
- Create the DynamoDB gateway endpoint but omit associating the route tables used by the private application subnets.
Explanation
Correct Answer
C:A DynamoDB gateway endpoint supplies private service routing for selected subnets, while endpoint and IAM policies govern what actions and principals may use the service.
Incorrect Answers
A:The gateway endpoint provides private routing, but without scoped endpoint and identity policies it does not satisfy the requested action boundary.
B:Network reachability controls do not replace the IAM or endpoint-policy authorization for selected DynamoDB operations.
D:The endpoint only routes traffic for the associated VPC route tables; unassociated private subnets may not use its path.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests