Question 280
An internal application requires TLS certificates for private service names that are not publicly verifiable domain names. The enterprise needs certificate issuance under its private PKI trust and controlled renewal. Which AWS capability should it evaluate?
- Use AWS Private Certificate Authority with supported ACM private certificate issuance and approved trust distribution.
- Request a public ACM certificate for an arbitrary unowned private hostname and skip domain validation.
- Use ACM public certificate issuance for a private, unowned internal DNS suffix without validating an eligible public domain.
- Issue an ACM private certificate but omit distributing the private CA trust anchor to its intended service clients.
Explanation
Correct Answer
A:A private CA can issue certificates for internal names under a managed enterprise trust hierarchy without public domain validation.
Incorrect Answers
B:Public certificates require approved domain validation and cannot be issued for arbitrary private namespaces.
C:Public ACM issuance depends on publicly verifiable domain control and is not a general private internal PKI for arbitrary hostnames.
D:Private certificates require a trusted enterprise CA chain on clients; issuance without trust distribution does not establish usable authenticated TLS.
Question 281
A public application wants to protect against complex web bots that can solve naive IP-rate-limit rules. Security needs a request-time control that can challenge suspicious clients while avoiding blanket block rules for all traffic. Which WAF capability should be assessed?
- Use AWS WAF rate-based IP blocking only and never deploy a CAPTCHA or Challenge action for the suspected sophisticated bot requests.
- Enable WAF Count action for every detected bot and assume the Count action itself challenges clients to prove they are human.
- Use a CloudFront signed URL on otherwise public resources as the only means of challenging suspicious interactive bot sessions.
- Use AWS WAF managed rules with suitable CAPTCHA or Challenge actions for suspicious request patterns and evaluate user impact.
Explanation
Correct Answer
D:WAF challenge actions can distinguish clients through a request-time friction mechanism rather than only static IP allow/deny lists.
Incorrect Answers
A:A plain IP rate threshold can be evaded by distributed or adaptive bots and does not supply the stated request-time challenge workflow.
B:Count records matches and permits a monitored phase, but does not execute CAPTCHA or Challenge verification against the client.
C:Signed URLs restrict access to configured content but are not a managed per-request CAPTCHA/Challenge verification for bot behavior.
Question 282
An organization attaches a new AWS WAF managed rule group to a production API. Security wants to observe rule matches and potential legitimate-user false positives before changing the rule to block requests. Which staged action is appropriate?
- Turn off all WAF monitoring and assume every managed signature is perfectly matched to the application.
- Enable block actions for the entire managed rule group before evaluating legitimate traffic or sampling false positives.
- Deploy in count mode for evaluation, inspect sampled requests and WAF logs/metrics, then promote validated rules to enforcement.
- Use a custom WAF allow-all rule above the managed group and assume it still records matches within every lower-priority subrule.
Explanation
Correct Answer
C:Count-mode evaluation exposes matching patterns without immediately blocking production users, supporting controlled rule tuning.
Incorrect Answers
A:Without telemetry, the team cannot assess false positives or measure rule effect.
B:Immediate blanket blocking contradicts the requirement to observe WAF rule matches safely before enforcing.
D:A terminating allow rule can prevent evaluation of lower-priority managed rules and defeats representative false-positive testing.
Question 283
A retail API already has Shield Advanced coverage for its network-layer DDoS exposure. In a 2026 exercise, a distributed HTTP request flood passes ordinary IP-rate limits and saturates valid-looking checkout endpoints. Security needs the AWS WAF layer that automatically learns and mitigates Layer 7 floods, while allowing a monitored count phase to check false positives. What should be configured?
- Replace AWS WAF with Shield Standard alone and assume the existing network-layer protections detect all application-layer request floods.
- Enable the AWS WAF Anti-DDoS managed rule group on the associated web ACL, initially assess matches and then enforce an appropriate action after testing.
- Increase the number of NAT gateways behind the private database subnets so that client HTTP floods are transparently filtered.
- Use an AWS WAF IP allowlist of every unknown public IP and assume this scales to identify distributed malicious traffic without inspection.
Explanation
Correct Answer
B:The current WAF Anti-DDoS managed rule group is designed for HTTP flood detection and mitigation and can be evaluated using a staged rule action.
Incorrect Answers
A:Shield Standard protects against common network-layer attacks but does not replace targeted Layer 7 WAF request classification and mitigation.
C:NAT gateway outbound translation does not inspect or reject malicious viewer HTTP requests arriving at the public ALB.
D:Blindly broad allowlisting public sources does not distinguish a distributed request flood from legitimate users and defeats the intended adaptive protection.
Question 284
A company centralizes outbound access through a VPC inspection path. Security needs stateful network packet filtering based on source/destination addresses, protocol and supported domain rules before packets leave AWS. Which managed firewall service belongs there?
- Use only AWS WAF web ACLs to inspect arbitrary non-HTTP TCP protocols at the VPC subnet gateway.
- Use VPC security groups and network ACLs alone while omitting the required centrally managed stateful domain-aware inspection service.
- Apply an AWS WAF web ACL to one ALB and assume it statefully filters arbitrary TCP, UDP and east-west packets through the egress VPC.
- Use AWS Network Firewall with stateful/stateless rule groups and correct transparent routing through firewall endpoints.
Explanation
Correct Answer
D:Network Firewall evaluates routed packet flows under configured stateful policies; subnet routes must actually traverse its endpoints.
Incorrect Answers
A:WAF is application-layer HTTP request protection and is not a generic stateful network firewall for every protocol.
B:Security groups/NACLs enforce networking rules but do not provide the specified Network Firewall-managed stateful firewall and supported domain filtering.
C:WAF inspects eligible HTTP(S) requests at supported resources, not all protocols at a network egress insertion point.
Question 285
A financial institution operates a remote workforce with managed devices. Employees need to access selected private HTTPS applications without granting broad network-layer VPN reachability. Security requires device posture and workforce identity evaluations before each access decision. What AWS service is relevant?
- Provide every employee an unrestricted Client VPN connection to all production CIDRs and stop evaluating device posture.
- Offer AWS Client VPN broad subnet-level reachability while using only IAM group membership and no device trust evaluation.
- Use IAM Identity Center sign-in alone and assume user authentication automatically checks managed endpoint-device posture on each private HTTPS application.
- Evaluate AWS Verified Access with supported identity and device trust providers and per-application access policies.
Explanation
Correct Answer
D:Verified Access evaluates user/device trust signals for private application requests instead of giving a broad VPN route to all subnets.
Incorrect Answers
A:Broad private network reachability contradicts the selective application access and contextual trust requirements.
B:Client VPN is a network-level access pattern; it does not directly enforce per-private-application device-posture decisions described in the request.
C:Workforce authentication can establish identity but requires Verified Access and suitable trust provider policies to evaluate device posture per application.
Question 286
An order API currently waits for a downstream fulfillment service before replying, and fulfillment maintenance causes client request timeouts. The business can accept eventual fulfillment but must never silently discard failed tasks. Which design best isolates the outage?
- Submit orders to Amazon SQS, return after durable enqueueing, process asynchronously with idempotent workers, and configure a dead-letter queue and redrive policy.
- Retry the synchronous fulfillment call with exponential backoff inside the original HTTP request until the downstream service returns.
- Publish orders to an SNS topic with no durable subscription or delivery-failure destination and acknowledge the API immediately.
- Write orders directly into an in-memory cache and acknowledge clients, relying on cache eviction handling to recover failed fulfillment.
Explanation
Correct Answer
A:SQS absorbs producer/consumer timing differences, and independently scaling idempotent workers plus DLQ handling limits the impact of downstream maintenance while retaining failed messages for investigation.
Incorrect Answers
B:Backoff can reduce immediate load but still holds clients and API threads open through prolonged maintenance; durable queue-based decoupling is required.
C:SNS can fan out events, but an unprotected delivery path without durable consumers/retry handling does not guarantee accepted fulfillment work is retained.
D:A cache is not a guaranteed durable work queue with failure redrive. Accepted order tasks could be lost during cache disruption.
Question 287
A worker reads SQS messages to perform a six-minute image conversion. The queue visibility timeout is currently one minute, and duplicate workers often begin processing the same job while the first worker is still active. What change addresses the immediate cause?
- Set or dynamically extend message visibility to cover processing and keep the worker idempotent for at-least-once delivery.
- Set the queue visibility timeout to the observed median conversion time instead of covering unusually slow but valid jobs.
- Set the SQS message retention period to ten minutes while retaining the one-minute visibility timeout.
- Switch the SQS queue from standard to FIFO but keep visibility at one minute for six-minute processing jobs.
Explanation
Correct Answer
A:An insufficient visibility timeout makes an in-flight message available again; appropriate visibility plus idempotency reduces duplicate effects.
Incorrect Answers
B:Messages whose processing exceeds the timeout become visible to another worker; robust configuration must cover actual processing time or extend it.
C:Retention controls how long unprocessed messages are stored, not when in-flight messages become visible for duplicate processing.
D:FIFO ordering/deduplication does not prevent in-flight redelivery when visibility expires before the worker completes.
Question 288
A public web tier uses an EC2 Auto Scaling group behind an ALB. All instances currently launch in one Availability Zone, so an AZ failure disrupts service. The application is stateless and another AZ has adequate subnets. What is the smallest resilience improvement?
- Increase the existing Auto Scaling group minimum capacity only in its current AZ and rely on the extra instances during that AZ outage.
- Enable cross-zone ALB load balancing while leaving the Auto Scaling group with instances in only one AZ.
- Deploy additional instances in a second AZ but leave that AZ disabled for the ALB and omit health checks.
- Configure Auto Scaling subnets in multiple AZs and verify the ALB target health and minimum capacity distribution.
Explanation
Correct Answer
D:Multi-AZ placement lets replacement capacity survive an AZ failure while ALB target health routes to functioning instances.
Incorrect Answers
A:Additional instances in the same failed AZ share the failure domain; diversify subnets/healthy targets across Availability Zones.
B:Cross-zone routing cannot send traffic to healthy compute in an AZ where no targets are deployed.
C:Raw capacity alone is insufficient if the load balancer cannot route to validated healthy targets in the alternate AZ.
Question 289
A Lambda function reads from SQS, but a faulty downstream API causes thousands of retries and the account experiences concurrency spikes that starve unrelated Lambda applications. Which configuration most directly bounds this function’s capacity impact?
- Increase the function memory allocation to make each retry execute faster, keeping unbounded concurrency against the failing API.
- Set only the SQS maximum receive count to one and leave the Lambda function unbounded during incoming spikes.
- Set reserved concurrency for the Lambda function and tune event-source scaling controls and retry/DLQ behavior to protect other workloads.
- Set the SQS visibility timeout to the Lambda maximum duration without setting any per-function concurrency cap.
Explanation
Correct Answer
C:Reserved concurrency isolates capacity consumption, while source throttling and failure handling prevent repeated work from overwhelming downstream services.
Incorrect Answers
A:Memory tuning can affect execution time but does not isolate account-wide concurrency consumption from an uncontrolled retry backlog.
B:Early DLQ redrive may change failure handling but does not directly protect unrelated functions from a flood of concurrent invocations.
D:Visibility controls redelivery timing rather than the number of Lambda executions that can consume the shared account concurrency pool.
Question 290
A service uses DynamoDB to allocate each unique invoice number. During bursts, concurrent writers sometimes both believe they have reserved the same number because each first performs a read. What DynamoDB mechanism prevents the race?
- Use a strongly consistent GetItem before an unconditional PutItem to reserve each invoice number.
- Add a GSI keyed by invoice number, then perform an unconditional base-table write because indexed uniqueness is enforced automatically.
- Use DynamoDB Streams to detect duplicate invoice numbers after both concurrent writers commit.
- Use a conditional PutItem or transactional conditional write that succeeds only when the invoice key is not already present.
Explanation
Correct Answer
D:Server-side conditional writes enforce atomic reservation semantics instead of trusting an unsafe read-then-write sequence.
Incorrect Answers
A:A strongly consistent read gives the latest state at read time but does not make the later write atomic against competing writers.
B:A GSI does not enforce a unique constraint across independent concurrent writes. Use an atomic conditional operation on the item key.
C:Detection after committing does not prevent dual reservations. Conditional writes or transactions must reject the second write atomically.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests