SAA-C03 (SAA-C03) — Questions 1–75

The issue is that the Web ACL is not evaluating requests at all, which indicates a missing association between the Web ACL and the ALB. Adding a security group rule to drop traffic from attacker IPs does not address the root cause—the Web ACL is not in the evaluation path—and security groups operate at the instance level, not at the ALB level for WAF inspection.

Stickiness (session affinity) ensures requests from the same client are sent to the same target, but it does not cause WAF to evaluate requests. The issue is that the Web ACL is not associated with the ALB, so WAF never inspects traffic regardless of stickiness.

AWS Shield Advanced does not automatically apply rate limiting; it provides DDoS protection but does not replace the need to associate a Web ACL for WAF rate-based rules. The Web ACL must be explicitly associated with a resource like an ALB to evaluate requests.

This option would be correct in a scenario where the Web ACL is already properly associated and evaluating traffic, but attackers are still reaching the backend because the WAF rate-based rule is not effectively blocking them. In that case, adding a security group rule to drop traffic from known attacker IPs at the instance ENIs would provide an additional layer of defense.

A question where clients report intermittent failures or inconsistent behavior from a backend that maintains state, and the solution must ensure all requests from a client go to the same target. For example: 'Users are randomly logged out when using a stateful web application behind an ALB. Which configuration ensures session persistence?'

If the question described a scenario where the goal is to protect against large-scale DDoS attacks that overwhelm infrastructure, and the requirement is to get enhanced DDoS mitigation and cost protection, then enabling AWS Shield Advanced would be correct, even without a Web ACL for rate limiting.

Candidates may think that blocking attacker IPs at the instance level is a quick fix to stop abusive traffic, overlooking that the primary issue is the Web ACL not being associated with the ALB. They might also confuse the roles of security groups and WAF in traffic filtering.

Candidates may confuse rate-based rules (which count requests per IP) with stickiness, thinking that binding a client to one target helps WAF count requests accurately. However, WAF counts at the ALB level, not per target.

Candidates may think Shield Advanced includes all WAF capabilities automatically, or that it can substitute for a Web ACL, due to its name implying comprehensive protection.

Backup and restore with scheduled snapshots cannot meet the RPO of 15 minutes (snapshots are typically less frequent) and the RTO of about 1 hour (manual restores are slow and unpredictable).

Pilot light requires starting full services after failover, which typically takes more than 1 hour (RTO) due to provisioning and scaling, and may not meet the 15-minute RPO if data replication is not continuous.

Active/active requires full duplicate capacity in both Regions at all times, which contradicts the requirement that the business cannot afford full duplicate capacity in both Regions all the time.

A company with a non-critical application that can tolerate an RPO of several hours and an RTO of 24+ hours, and where cost is the primary concern, would choose backup and restore.

A scenario with a longer RTO (e.g., 4-6 hours) and a moderate RPO (e.g., 1 hour), where cost savings from minimal standby infrastructure are prioritized over rapid failover, and the team can tolerate manual scaling steps.

An application requiring zero RPO and near-zero RTO with a budget that supports full-time dual-region capacity, such as a global real-time trading platform that cannot tolerate any data loss or downtime.

Candidates may think backup and restore is the simplest and cheapest DR strategy, overlooking the strict RPO and RTO requirements in the question.

Candidates may confuse pilot light with warm standby, assuming minimal infrastructure can be quickly scaled, but underestimate the time needed to provision and configure full production capacity from a minimal base.

Candidates may think active/active provides the best availability and failover speed, overlooking the cost constraint and the specific requirement to avoid full duplicate capacity.

Increasing the deregistration delay only keeps existing connections alive longer; it does not speed up the bootstrapping of new instances, so it does not reduce the time until additional capacity is available.

Reducing the minimum size to one instance does not address the bootstrapping delay; it only lowers the baseline capacity, potentially worsening performance during traffic spikes.

Replacing the ALB with a Network Load Balancer does not address the bootstrapping delay of EC2 instances; NLB operates at layer 4 and does not affect instance initialization time.

This option would be correct in a scenario where the question asks how to prevent in-flight requests from being dropped during a scale-in event, such as when instances are being terminated and you need to ensure graceful connection draining.

If the question were about minimizing costs for a predictable, low-traffic application where over-provisioning is unnecessary, reducing the minimum size to one instance would be correct.

In a scenario where the application requires ultra-low latency and high throughput for TCP/UDP traffic, and the bootstrapping delay is not a concern, replacing an ALB with an NLB would be correct to reduce latency and handle millions of requests per second.

Candidates may confuse the deregistration delay with a mechanism that helps new instances become ready faster, or they might think it gives more time for bootstrapping to complete before traffic is sent.

Candidates may think that a smaller minimum size forces faster scaling, but it actually reduces the buffer of running instances, increasing the impact of bootstrapping delays.

Candidates may think that a faster load balancer (NLB) will reduce the time until new instances can receive traffic, overlooking that the bottleneck is instance bootstrapping, not load balancer performance.

CloudWatch Logs metric filters on application logs cannot capture the full API request parameters (e.g., which principal made the change and the exact parameters used) because application logs are not authoritative for IAM changes and lack the detailed API call context required for immutable audit records.

AWS Config stores resource configuration changes but does not capture the full API request parameters (e.g., which principal made the change or the exact parameters used), so it cannot provide the immutable audit record of API calls required for forensic investigation.

A SOC analyst needs to monitor application-level errors or specific patterns (e.g., failed login attempts) across multiple accounts and trigger alarms. In that scenario, CloudWatch Logs metric filters on centralized application logs would be appropriate for real-time alerting, not for immutable audit trails of API changes.

A question that asks for a solution to track resource configuration changes over time and detect drift, without needing to capture API caller identity or request parameters, would make AWS Config the correct answer.

Candidates may think CloudWatch Logs can serve as a centralized audit tool because it aggregates logs, but they overlook that application logs do not capture the full API request/response details needed for IAM policy changes, and they are not immutable.

Candidates may confuse AWS Config's configuration history with API audit logging, assuming it captures who made changes, when it only records the resulting state of resources.

The error indicates that the KMS key policy in Account A does not grant the Account B role permission to decrypt. Adding kms:Decrypt to the key policy is necessary, but removing it from the role policy in Account B is incorrect because the role still needs the permission for the request to proceed; both the key policy and the role policy must allow the action.

The error includes 'kms:Decrypt', indicating the KMS key policy is missing cross-account decrypt permission. Simply using s3:GetObject does not bypass KMS authorization; S3 cannot automatically authorize KMS decrypt across accounts without proper key policy.

Switching to SSE-S3 removes KMS involvement, but the question states that the bucket uses SSE-KMS with a customer-managed key. Changing encryption type is an indirect workaround that does not address the root cause (missing KMS key policy permissions) and may violate compliance or security requirements.

This option would be correct if the question stated that the role in Account B had kms:Decrypt permissions but the key policy in Account A was overly permissive, and the goal was to restrict access by removing the permission from the role and relying solely on the key policy to grant cross-account access.

In a scenario where the S3 bucket uses SSE-S3 (not SSE-KMS) and the IAM role in Account B has s3:GetObject permission, then no KMS permissions are needed, and S3 handles decryption automatically.

This option would be correct if the question described a scenario where the application does not require KMS-based encryption, the bucket's encryption can be changed without affecting other dependencies, and the goal is to eliminate KMS-related permissions entirely to simplify access.

Candidates may think that removing the permission from the role simplifies the configuration or that the key policy alone is sufficient, misunderstanding that both the key policy and the IAM policy must grant the permission for cross-account access.

Candidates may think S3 handles all authorization automatically, overlooking that cross-account KMS access requires explicit key policy grants, not just IAM permissions.

Candidates may think that switching to SSE-S3 removes the KMS dependency and thus the error, without considering that the bucket is already configured with SSE-KMS and changing encryption type is a significant change that may not be allowed or desired.

Asynchronous Lambda invocation from EventBridge has limited retry (0-2 attempts) and no DLQ support, so events lost after transient failures cannot be inspected or reprocessed, failing the requirement for bounded retries and inspectability.

Removing retry and DLQ configuration prevents at-least-once processing and makes it impossible to inspect unprocessable events, directly contradicting the requirements.

Storing failed events only in CloudWatch logs and manually reprocessing them does not provide automated retries, bounded retries, or a systematic way to inspect and reprocess unprocessable events, violating the requirements for at-least-once processing and automated reprocessing.

This option would be correct if the question required minimal cost and complexity for a non-critical system where occasional event loss is acceptable, and there was no need for DLQ or reprocessing.

In a scenario where the requirement is exactly-once processing with no duplicates and no need for retries or inspection of failed events, and the system can tolerate event loss on failure.

This option would be correct in a scenario where the requirement is to have a simple, low-cost solution for debugging and manual intervention, with no need for automated retries or DLQ, and where the volume of failures is very low and acceptable to handle manually.

Candidates may think asynchronous invocation automatically handles retries and durability, overlooking that EventBridge async targets have no DLQ and limited retry, and that increasing timeout doesn't prevent loss from other transient failures.

Candidates may think SNS with Lambda is simpler and that removing retries reduces duplicates, but they overlook the need for reliability and failure inspection.

Candidates may think that logging failures is sufficient for auditing and that manual reprocessing is acceptable, underestimating the need for automated retry and DLQ mechanisms to ensure reliability and reduce operational overhead.

Option A uses long-term IAM users with static keys, violating requirement (1) for temporary credentials. Rotating keys every 90 days does not prevent leaks between rotations and still allows permanent access, failing to meet the security goal.

This option relies on developers self-policing their policies, which does not prevent them from accidentally or intentionally adding IAM permissions, violating the requirement that IAM changes be impossible.

Option D grants full administrator permissions, violating the requirement that developers must never be able to modify IAM. It also uses a single shared role with permanent credentials, contradicting the need for temporary credentials and least privilege.

This option would be correct if the requirements were: (1) developers need programmatic access with long-term credentials, (2) key rotation is acceptable, and (3) there is no requirement to prevent IAM modifications or use temporary credentials.

In a scenario where developers are trusted to follow security guidelines and the requirement is only to provide least-privilege access without enforcing IAM restrictions, this self-review approach could be acceptable.

This option would be correct in a scenario where developers need unrestricted access for emergency troubleshooting in a sandbox environment, and the requirement for temporary credentials and IAM restriction is not present.

Candidates may think key rotation is sufficient for security and overlook the requirement for temporary credentials, or they may be accustomed to using IAM users for developer access.

Candidates may think that granting only ECS and Auto Scaling permissions is sufficient, overlooking the need for a permission boundary to block IAM modifications, and assume developers will not escalate privileges.

Candidates may think full admin access simplifies troubleshooting and deployment, overlooking the security requirements for temporary credentials and IAM restrictions.

Amazon EBS snapshots are used for backing up Amazon Elastic Block Store volumes attached to EC2 instances, not for S3 object versioning. They do not provide the ability to recover earlier versions of S3 objects.

Amazon CloudWatch logs capture log data from AWS resources, not file versions. They cannot recover overwritten or deleted S3 objects.

VPC flow logs capture IP traffic information for network interfaces in a VPC, not file version history in S3. They cannot recover overwritten or deleted S3 objects.

When a question asks for a backup solution for EC2 instance volumes (e.g., to recover from accidental data loss or corruption), enabling EBS snapshots would be the correct answer.

A question asks: 'A company needs to monitor API calls to an S3 bucket for security analysis. What should they enable?' CloudWatch Logs would be correct if the question specified logging API activity via CloudTrail and storing logs in CloudWatch.

A question asks: 'A company needs to analyze network traffic patterns and troubleshoot connectivity issues between EC2 instances in a VPC. What should they enable?' VPC flow logs would be the correct answer.

Candidates may confuse EBS snapshots with versioning because both involve creating point-in-time backups, but they apply to different AWS services (EBS vs. S3).

Candidates may confuse logging (CloudWatch) with versioning, thinking logs can track changes and enable recovery, but logs only record events, not object versions.

Candidates may confuse 'logs' with version tracking, or think that any logging feature can help recover data, not understanding that VPC flow logs are for network metadata only.

Increasing EC2 instance size and keeping all servers in one subnet does not provide fault tolerance across Availability Zones; a single AZ failure would still take down all application servers.

A Network Load Balancer (NLB) in a single AZ cannot provide cross-AZ failover; the question requires serving traffic during a single-AZ failure, which demands multi-AZ architecture. An NLB alone does not address the lack of application server redundancy.

A read replica does not provide automatic failover; the application would need to manually switch to the replica endpoint, which does not address the single-AZ failure of the primary database. The question requires continued serving traffic during a single-AZ failure, which Multi-AZ provides by automatic failover.

If the question described a performance bottleneck (e.g., CPU or memory saturation) and the goal was to improve throughput for a single-AZ workload, increasing instance size would be correct.

When the requirement is to handle extremely high throughput with low latency for TCP/UDP traffic, and the application is already deployed across multiple AZs with its own failover logic. An NLB in a single AZ could be correct if the question explicitly states that only one AZ is used and the goal is to maximize performance within that AZ.

A read replica would be correct if the question asked for offloading read traffic from the primary database to improve read performance, or if the requirement was to have a standby for disaster recovery in a different region (cross-region read replica) without automatic failover.

Candidates may think bigger instances alone can handle failures, confusing vertical scaling with high availability.

Candidates may confuse load balancer types, thinking an NLB provides better availability than an ALB, or they may overlook that the NLB is still confined to a single AZ, which does not solve the multi-AZ failure requirement.

Candidates may confuse read replicas with Multi-AZ deployments, thinking that a read replica provides high availability, but it does not offer automatic failover and is primarily for read scaling.

Glacier Instant Retrieval has a higher storage cost than Glacier Flexible Retrieval and does not provide significant cost savings for backups that are rarely restored, making it less cost-optimized for this scenario.

Glacier Deep Archive has a retrieval time of 12-48 hours, which exceeds the 24-hour RTO, making it unsuitable for this requirement.

S3 One Zone-IA does not meet the 90-day retention requirement because the rule deletes objects after 7 days. Additionally, One Zone-IA is not resilient to AZ failures, which could risk backup availability within the 24-hour RTO.

If the RTO were reduced to minutes (e.g., 5 minutes) and backups needed immediate retrieval for frequent restores, Glacier Instant Retrieval would be the correct choice to meet the low-latency requirement while still being cheaper than S3 Standard.

A question where the RTO is greater than 48 hours (e.g., 72 hours) and the retention period is long (e.g., 1 year), and cost optimization is the primary goal, would make Glacier Deep Archive the correct choice.

This option would be correct if the compliance policy required retention for only 7 days and the RTO was less than 1 hour, allowing quick retrieval from One Zone-IA at lower cost than Standard, and if the data was non-critical and could tolerate AZ-level failures.

Candidates may confuse 'Instant Retrieval' with 'Flexible Retrieval' and assume that 'Instant' is always better, overlooking the cost implications and the fact that the RTO of 24 hours allows for slower retrieval.

Candidates may choose this because Glacier Deep Archive is the cheapest storage class, and they overlook the RTO constraint, assuming any glacier class meets the requirement.

Candidates may choose this option because S3 One Zone-IA offers lower storage cost than Standard, and they overlook the 90-day retention requirement or mistakenly think the 7-day deletion can be adjusted, or they underestimate the importance of durability for backups.

Option A only requires MFA at login, but does not enforce MFA for API calls made with temporary credentials, allowing actions without MFA if session credentials are obtained.

This option does not use a condition key in IAM policies to require MFA for API calls, so temporary session credentials obtained without MFA could still perform actions. It only enforces MFA at login, not for subsequent API operations.

Enforcing MFA only at the application level (via OTP prompt) does not prevent actions taken through other means like AWS CLI or SDK, and does not use IAM condition keys to enforce MFA for all API calls, leaving a security gap.

This option would be correct if the requirement was simply to require MFA for console access and the administrator uses long-lived access keys for programmatic access without needing MFA enforcement for API calls.

If the requirement were only to enforce MFA for console login (not for programmatic access or API calls), and long-lived access keys were acceptable, then attaching policies to an IAM user with MFA enabled at the account level would suffice.

If the requirement was to enforce MFA only for application-level API calls (e.g., a custom web app) and not for other AWS access methods, and the application already handles MFA separately, then this design could be acceptable.

Candidates may think that enabling MFA on the IAM user account globally protects all actions, not realizing that MFA at login does not extend to API calls made with access keys or temporary credentials.

Candidates may think that enabling MFA on the account or user automatically protects all actions, not realizing that IAM condition keys are needed to enforce MFA for API calls made with temporary credentials.

Candidates may think that application-level MFA enforcement is sufficient and simpler to implement, overlooking that IAM policies must enforce MFA at the API level to cover all access methods.

NAT gateways route traffic through the public internet, violating the requirement to avoid public internet and incurring additional cost, which the question explicitly wants to avoid.

Using public subnets without security groups exposes instances to inbound internet traffic, violating the requirement to avoid public internet and the security rule that only required VPC traffic should be allowed to reach AWS services.

Option D is wrong because enabling public access to Secrets Manager via the default service endpoint would expose the service to the internet, violating the requirement to avoid routing through the public internet and the security requirement to allow only required VPC traffic.

If the question required internet access for other purposes (e.g., software updates) and cost was not a constraint, using NAT gateways in private subnets would be appropriate for outbound traffic to AWS services.

If the question required a simple, low-security setup for a non-production environment where instances need unrestricted outbound internet access and cost is the only concern, public subnets with no security groups might be acceptable.

This option would be correct in a scenario where the application instances have public IPs and the requirement is to restrict access to S3 and Secrets Manager based on source IP addresses, while allowing internet access for other purposes. For example, a company using public subnets with security groups that restrict inbound traffic and needing to allow access to S3 and Secrets Manager from specific private IPs via bucket policies and resource-based policies.

Candidates may default to using NAT gateways for private subnet outbound traffic without considering VPC endpoints, or overlook the cost and internet routing constraints.

Candidates may think public subnets are simpler and cheaper, and mistakenly believe that AWS services inherently reject unauthorized traffic, ignoring the need for security groups and the requirement to avoid public internet.

Candidates may think that using S3 bucket policies with IP restrictions and enabling public access to Secrets Manager is a simple way to allow access without additional VPC endpoints, overlooking the security and routing requirements that mandate private connectivity.

Increasing Auto Scaling desired capacity adds more instances, which increases cost without addressing the existing over-provisioning. The question states CPU utilization is low and stable, so adding instances would waste resources.

Switching to Spot Instances immediately would risk interruptions that impact users, which is unacceptable for a production application requiring stable performance. The question states the application does not require additional headroom, but it does not indicate tolerance for interruptions.

Disabling detailed monitoring does not reduce CPU usage from the monitoring agent; it only reduces the frequency of metric data sent to CloudWatch, which has negligible impact on CPU. The question focuses on cost optimization, and detailed monitoring costs extra, but the primary issue is that the instances are over-provisioned, not that monitoring costs are significant.

This option would be correct if the application is experiencing high CPU utilization and performance degradation, and the goal is to improve performance or ensure high availability by distributing load across more instances.

A question where the application is fault-tolerant, can handle interruptions gracefully (e.g., using Spot Instance best practices like checkpointing), and cost reduction is the primary goal, with no requirement for stable performance or minimal user impact.

A scenario where the question asks: 'Your EC2 instances are running a batch job that is not performance-sensitive, and you want to reduce CloudWatch costs without affecting application performance. What should you do?' In that case, disabling detailed monitoring (switching to basic monitoring) would be correct to save on monitoring fees.

Candidates may think adding instances is always good for performance or cost optimization, or they confuse Auto Scaling with right-sizing, not realizing that adding instances increases cost when existing instances are underutilized.

Candidates know Spot Instances are cheaper and may assume any cost-saving measure is good, overlooking the critical requirement of stable performance and user impact from interruptions.

Candidates may think that disabling detailed monitoring reduces CPU overhead from the CloudWatch agent, thereby lowering utilization and costs. They might also confuse the cost of monitoring with compute costs, or believe that any reduction in monitoring activity directly saves significant money.

Backup and restore typically has a Recovery Time Objective (RTO) of hours to days, which may not meet the 'within a few hours' requirement, and it often involves rebuilding infrastructure from backups, which the question explicitly wants to avoid.

Multi-site active-active requires fully active resources in two regions simultaneously, which incurs higher ongoing costs than a fully active second Region, contradicting the requirement for lower cost.

Single-AZ deployment does not provide any cross-region recovery capability; a regional outage would cause complete downtime, contradicting the requirement to recover within hours.

A question where the RTO is measured in days (e.g., 24-48 hours) and the business can tolerate rebuilding the entire environment from scratch using backups, with minimal ongoing cost as the primary driver.

An application requires near-zero RTO and RPO with automatic failover, and the business has budget for continuous dual-region operation, such as a global e-commerce platform that cannot tolerate any downtime.

For a non-critical application with low cost priority and tolerance for downtime during an AZ failure, where the question specifies 'single Availability Zone' and does not mention regional outage recovery.

Candidates may think backup and restore is the cheapest DR option and assume it can meet a 'few hours' RTO if backups are restored quickly, underestimating the time needed to provision infrastructure and validate the environment.

Candidates may assume that active-active provides the best recovery time and mistakenly think it can be cost-effective if traffic is balanced, overlooking the higher infrastructure and data replication costs.

Candidates may confuse high availability within a single region with disaster recovery across regions, or think that a single AZ is sufficient for 'low cost' without considering regional failure.

Increasing write capacity does not reduce read latency; read latency is affected by read capacity and throttling, not write capacity. The problem is high read demand on the same items, which write capacity cannot address.

Creating a GSI does not reduce read latency for repeated requests to the same items; it only provides an alternate query pattern. The hot partition issue is caused by high read frequency on specific items, which a GSI does not alleviate.

This option would be correct if the question described high write latency or write throttling during peak periods, and the solution required increasing write capacity to handle the write load without changing the partitioning model.

A DynamoDB table has a suboptimal partition key leading to hot partitions, and you need to improve read performance by distributing reads across partitions. Creating a GSI with a different partition key can spread the read load and reduce latency.

Candidates may mistakenly think that writes and reads are coupled in DynamoDB, or that increasing any capacity will improve overall performance, not realizing that read and write capacities are independent.

Candidates may think that indexes always speed up reads, not realizing that GSIs don't cache data or reduce the load on the base table's partitions for repeated identical queries.

DynamoDB is a NoSQL database that does not support complex joins and aggregations natively, and using a single partition key without indexes would severely limit query flexibility and performance for the required relational queries.

S3 is an object store, not a relational database; it cannot support complex joins, aggregations, or relational queries, making it unsuitable for the application's relational data model and frequent complex queries.

DynamoDB is a NoSQL database that does not support relational SQL queries or joins. Attempting to use relational queries on DynamoDB would fail or require significant application-level workarounds, defeating the purpose of keeping relational features.

For a serverless application with a simple key-value access pattern, high write throughput, and no need for complex queries or joins, DynamoDB with a single partition key and no indexes would be optimal to maximize write performance and minimize costs.

In a scenario where the application stores static or semi-static data (e.g., log files, images, or large datasets) that is accessed infrequently and does not require complex queries, and the goal is to reduce costs by offloading storage from a database, using S3 with direct querying (e.g., via Athena) could be correct.

This option would be correct if the question described a non-relational workload with simple key-value access patterns, high scalability needs, and no requirement for complex joins or aggregations. For example: 'A social media app needs to store user profiles with low-latency reads and writes, and does not require joins.'

Candidates may mistakenly believe that DynamoDB can handle relational queries efficiently or that simplifying the data model always improves performance, overlooking the specific need for complex joins and aggregations.

Candidates may think S3 is a cheap, scalable storage option that can handle any data, overlooking that it lacks relational query capabilities and is not designed for transactional or complex query workloads.

Candidates may think DynamoDB is a universal performance solution for any read-heavy workload, overlooking that it sacrifices relational capabilities. They might also assume that SQL-like queries are possible with DynamoDB's PartiQL, but that does not support complex joins.

Moving assets to EC2 behind an ALB increases cost and complexity without addressing the root cause of excessive origin fetches; CloudFront already caches from S3, and the issue is cache hit ratio, not origin type.

Disabling CloudFront caching would force every request to go to the S3 origin, increasing origin load and costs, which is the opposite of the goal to reduce origin fetches.

Adding more viewer-facing headers to the cache key increases cache fragmentation, reducing cache hit ratio and causing more origin fetches, which is the opposite of the desired outcome.

A question where the static assets require dynamic server-side processing (e.g., personalized CSS/JS) or where the origin must support custom headers/authentication that S3 cannot provide, and the goal is to reduce latency or add compute before serving.

If the question required real-time content updates where stale data is unacceptable (e.g., live stock prices or breaking news), and the origin can handle the load, disabling caching would ensure viewers always get the latest version.

A question where the application serves different content based on browser type (e.g., mobile vs desktop) and the goal is to ensure each browser variation gets the correct cached version, even if it increases origin fetches.

Candidates may think EC2+ALB is more 'powerful' or 'flexible' than S3, or assume that moving off S3 will somehow reduce costs, without realizing that CloudFront caching is the key to reducing origin fetches.

Candidates may think disabling caching eliminates stale content issues, but they overlook that the problem is about reducing origin fetches, not about freshness.

Candidates may think that customizing cached content per browser variation improves performance, but they overlook that versioned assets are immutable and don't need such differentiation.

A gateway VPC endpoint only supports S3 and DynamoDB; it cannot route STS traffic, which requires an interface endpoint. STS uses HTTPS traffic that must be directed through an interface endpoint, not a gateway endpoint.

Opening an inbound rule for outbound HTTPS to the internet CIDR does not provide a route to the internet; the instances are in a private subnet with no NAT gateway, so outbound traffic cannot reach the internet.

Attaching an Internet Gateway to the private subnet route table would make the subnet public, violating the requirement to keep instances private. The instances would have direct internet access, which is not allowed.

This option would be correct in a scenario where EC2 instances in a private subnet need to access S3 buckets without a NAT gateway or internet gateway, and the question asks for a solution to access S3 specifically.

This would be correct if the instances were in a public subnet with an internet gateway, and the security group needed to allow outbound HTTPS traffic to the internet for STS calls.

This option would be correct if the question required instances in a private subnet to access the internet (e.g., for software updates) and explicitly allowed making the subnet public, or if the subnet was already public and needed internet access for STS.

Candidates may confuse gateway endpoints with interface endpoints, assuming all AWS services can be accessed via a gateway endpoint, or they may think routing STS traffic through an S3 endpoint is possible due to similar naming.

Candidates may think that allowing outbound HTTPS in the security group is sufficient to reach the STS endpoint, overlooking the missing route to the internet from a private subnet.

Candidates may think that an Internet Gateway is necessary for any outbound internet access, not realizing that private subnets should not have direct internet routes, and that VPC endpoints can provide private connectivity.

A read replica in the same Availability Zone does not provide automatic failover if the primary AZ goes down; it is designed for read scaling, not high availability.

Increasing the backup retention period to 35 days does not provide automatic failover; it only extends the point-in-time recovery window. The question requires automatic failover when the primary Availability Zone fails, which Multi-AZ RDS provides.

Moving the database to an EC2 instance with an attached EBS volume does not provide automatic failover; you would need to manually manage failover or implement custom scripting, which does not meet the requirement for automatic failover when the primary Availability Zone goes down.

This option would be correct if the requirement was to offload read traffic from the primary database to improve performance, with no need for automatic failover.

This option would be correct if the question asked for a solution to meet a compliance requirement for longer backup retention (e.g., 35 days) or to enable point-in-time recovery for a longer period, without any mention of automatic failover or high availability.

This option would be correct in a scenario where the application requires full control over the database environment, such as needing to install custom software or configure specific OS-level settings that are not supported by RDS, and where automatic failover is not a requirement.

Candidates may mistakenly believe that a read replica can serve as a standby for failover, confusing read replicas with Multi-AZ deployments.

Candidates may confuse backup retention with disaster recovery or high availability, thinking that longer backups improve availability, but backups do not provide automatic failover.

Candidates may think that running the database on EC2 with EBS provides flexibility and control, and they might assume that EBS snapshots or replication can be used for failover, but they overlook the complexity and lack of built-in automatic failover.

Using a wildcard principal in the trust policy would allow any AWS principal to assume the role, violating the principle of least privilege and failing to prevent confused-deputy attacks. The S3 bucket policy cannot restrict who assumes the role, only what the assumed role can access.

Option E suggests giving the vendor long-term IAM user credentials in your account, which violates the principle of least privilege and makes auditing harder because actions are tied to a shared credential rather than individual vendor users. It also does not prevent confused-deputy attacks or ensure traceability to individual vendor users.

In a scenario where you want to allow multiple accounts or services to assume a role without specifying each ARN individually, and you have additional controls like an external ID and source identity to prevent confused-deputy attacks, a wildcard principal might be acceptable if combined with strong condition keys.

A question where a trusted third party needs direct access to your AWS resources without assuming a role, and you have full control over their access policies. For example, a contractor who needs to upload files to S3 and you want to manage their permissions directly within your account, with CloudTrail logging tied to that IAM user.

Candidates may think that a bucket policy can compensate for a permissive trust policy, not realizing that the trust policy controls who can assume the role, while the bucket policy only controls actions after the role is assumed.

Candidates may think that giving the vendor their own IAM user in the account simplifies auditing because the user is directly visible in CloudTrail, but they overlook the security risks of sharing long-term credentials and the inability to trace actions back to individual vendor employees.

The question requires protection against confused-deputy attacks using an external ID, not IP-based restrictions. The vendor's IP addresses may change or be shared, and IP conditions do not prevent a different vendor from using the same role.

This option is wrong because the question is about preventing confused-deputy attacks when a vendor assumes an IAM role, which requires sts:AssumeRole with an external ID condition, not sts:AssumeRoleWithWebIdentity, which is used for federated users with web identity tokens (e.g., from Amazon Cognito, Google, or Facebook).

The permissions policy controls what actions the role can perform, not who can assume it. The external ID check must be in the trust policy to prevent confused-deputy attacks during role assumption.

This would be correct if the question asked to restrict role assumption to requests originating from a specific, static IP range owned by the vendor, such as when the vendor has a fixed corporate network and the goal is to limit access by network location.

This option would be correct in a scenario where a web application allows users to sign in via a third-party identity provider (e.g., Google or Facebook) and then accesses AWS resources using temporary credentials obtained through web identity federation. The trust policy would then use sts:AssumeRoleWithWebIdentity with conditions on the token's claims.

If the question asked how to restrict the role's actions based on a specific external identifier after assumption (e.g., logging or resource tagging), then a condition in the permissions policy using aws:PrincipalTag/ExternalId would be appropriate.

Candidates may think IP restriction is a general security best practice and assume it also prevents confused-deputy attacks, not realizing that external ID is the specific mechanism for that threat.

Candidates might confuse the need for an external identifier with web identity federation, thinking that using a web identity token provides a similar security mechanism, or they may not fully understand the difference between sts:AssumeRole and sts:AssumeRoleWithWebIdentity.

Candidates may confuse the purpose of trust policies vs. permissions policies, thinking that any condition related to the external ID can be placed in the permissions policy.

Versioning does not affect lifecycle rules; lifecycle rules work independently of versioning status. Disabling versioning is unnecessary and does not help achieve the lowest storage cost.

If the question asks for a way to reduce storage costs by preventing accumulation of old versions, disabling versioning could be correct. For example, when objects are frequently updated and old versions are not needed, disabling versioning avoids storing multiple versions.

Candidates may mistakenly think that lifecycle rules require versioning to be disabled, or that versioning interferes with transitions, due to confusion about how S3 lifecycle policies interact with versioned buckets.