Amazon AWS Certified Solutions Architect Associate SAA-C03 VPC Isolation and Secure Hybrid Connectivity Practice Test

 

Topic 03 covers VPC isolation and secure hybrid connectivity for the AWS Certified Solutions Architect – Associate certification. These original SAA-C03 questions apply routing, filtering, endpoint and encryption requirements to architecture and diagnosis. Select one answer unless a fixed number is requested. For broader preparation, visit the AWS Certified Solutions Architect Associate SAA-C03 Exam Dumps page. Each alternative explains its effect under the stated constraints.

Question 1

An internet-facing Application Load Balancer forwards HTTPS requests to EC2 targets on port 8080 in private subnets. The ALB’s security group is attached only to its interfaces, and the targets have no other inbound grants. Routes, ACLs and ALB outbound access are correct. Other VPC instances must not connect directly to port 8080. Which target security-group rule enforces the intended entry path?

1. Allow TCP 8080 from the entire VPC CIDR because the targets have no public IPs.
2. Allow TCP 8080 from 0.0.0.0/0 and rely only on the ALB listener.
3. Allow TCP 8080 with the ALB’s security group as the source.
4. Allow TCP 443 from the ALB security group and omit TCP 8080.

Correct Answer: C

 

Correct Answer

Answer C is correct because the rule identifies the load balancer’s network interfaces as the permitted source. Other VPC instances do not become permitted simply because they share the VPC address space.

Incorrect Answers

Answer A is incorrect because private addressing prevents a direct public address path but does not exclude other VPC resources. The broader CIDR would permit the direct access the design forbids.

Answer B is incorrect because a listener controls traffic arriving at the ALB, not every separate path to the target. The target’s security group would still authorize undesired sources.

Answer D is incorrect because the backend connection uses the stated target port 8080. Permitting only the frontend listener port does not authorize the actual ALB-to-target flow.

 

Question 2

A database tier should accept PostgreSQL traffic only from the application tier and should have no route for initiating connections to the internet. The VPC’s local routes provide application-to-database connectivity. Which TWO controls implement these requirements without removing that local connectivity? Choose TWO.

1. Associate the database subnets with a default route to a public NAT gateway.
2. Allow TCP 5432 to the database security group only from the application security group.
3. Allow TCP 5432 to the database security group from the entire VPC CIDR.
4. Remove all inbound rules from the database security group.
5. Associate the database subnets with route tables that have no internet or NAT default route.

Correct Answers: B, E

 

Correct Answers

Answer B is correct because the source group and port restrict who may initiate database connections. A route alone cannot enforce that application-tier identity boundary.

Answer E is correct because the isolated route tables remove an internet egress path while preserving local VPC routing. The database does not need a default route for the stated local application traffic.

Incorrect Answers

Answer A is incorrect because a NAT gateway permits client-initiated outbound traffic while preventing unsolicited inbound connections. It does not satisfy the separate requirement that databases have no internet egress route.

Answer C is incorrect because the CIDR includes other VPC resources as well as the application tier. Local reachability must be narrowed with the specified source-group boundary.

Answer D is incorrect because that blocks the required application connections as well as unwanted ones. The design must preserve the authorized application-to-database flow.

 

Question 3

IPv4-only workers without public IP addresses must download updates from a public vendor. The vendor accepts connections from one allow-listed public IPv4 address. The design must use a managed egress service and must not expose workers to unsolicited internet connections. Which design fits?

1. Use an EC2 NAT instance with an Elastic IP and appropriate forwarding routes.
2. Use a private NAT gateway and route its traffic directly to an internet gateway.
3. Use a public NAT gateway with an Elastic IP and the required private-subnet and internet-gateway routes.
4. Route workers directly to an internet gateway while leaving them without public IPv4 addresses.

Correct Answer: C

 

Correct Answer

Answer C is correct because the managed gateway supplies an outbound translation path and a stable public source address. Internet peers cannot use it to initiate unsolicited connections to the private workers.

Incorrect Answers

Answer A is incorrect because a NAT instance can provide this translation with suitable configuration, but the team would operate the instance. The requirement explicitly calls for a managed egress service.

Answer B is incorrect because a private NAT gateway is not the public-internet egress design. It does not provide the required Elastic-IP-backed public source path through an internet gateway.

Answer D is incorrect because an IPv4 internet-gateway route alone does not give a private-only instance the public address mapping needed for this path. The vendor also requires a stable permitted source.

 

Question 4

A private workload has IPv6 addresses and needs to initiate connections to an IPv6 internet service. The gateway design must prevent the internet from initiating new connections to the workload while permitting response traffic. Which route target matches that requirement?

1. An ordinary internet gateway, relying on its route alone to reject inbound initiation.
2. A gateway VPC endpoint for the external vendor’s arbitrary IPv6 address.
3. A public NAT gateway for traffic to the service’s native IPv6 address.
4. An egress-only internet gateway for the ::/0 route.

Correct Answer: D

 

Correct Answer

Answer D is correct because the gateway supports outbound-initiated IPv6 connectivity and corresponding responses while preventing internet-initiated connections through that gateway. Security groups remain additional controls.

Incorrect Answers

Answer A is incorrect because an ordinary internet gateway is not inherently egress-only. The route itself does not enforce the gateway behavior explicitly requested in this design.

Answer B is incorrect because gateway endpoints support particular AWS services rather than arbitrary internet destinations. They do not provide the requested external IPv6 path.

Answer C is incorrect because NAT64 through a NAT gateway addresses IPv6 clients reaching IPv4 destinations. It is not a substitute for native IPv6 outbound-only routing to the IPv6 service described here.

 

Question 5

An EC2 managed node must support Systems Manager Session Manager without inbound SSH or internet egress. The agent, instance permissions, operator permissions and endpoint DNS are already correct. Interface endpoints exist for the required services, but security groups currently permit no HTTPS between the node and endpoint interfaces. Which TWO changes establish the required network channel? Choose TWO.

1. Permit the node to initiate outbound TCP 443 to the required endpoint interfaces.
2. Allow inbound TCP 443 on the node from the endpoint security group.
3. Allow inbound ephemeral TCP ports on the node while retaining its blocked outbound HTTPS.
4. Allow inbound TCP 443 on the endpoint security group from the node’s permitted source.
5. Allow outbound TCP 443 on the endpoint security group while retaining its empty inbound rules.

Correct Answers: A, D

 

Correct Answers

Answer A is correct because the agent establishes an outbound secure connection to the service endpoints. It does not require an inbound SSH connection for Session Manager.

Answer D is correct because the endpoint interfaces must accept the agent’s HTTPS connection. An outbound rule at the node alone does not authorize ingress at the destination endpoint.

Incorrect Answers

Answer B is incorrect because the agent initiates the connection toward the endpoint. Opening a new inbound listener path on the node does not permit the required outbound initiation or destination ingress.

Answer C is incorrect because security groups allow responses to permitted connections through state tracking. An inbound ephemeral-port rule cannot authorize the initial outbound connection that is currently blocked.

Answer E is incorrect because the endpoint is receiving the agent’s HTTPS connection. An outbound permission does not authorize a new inbound connection to the endpoint interface.

 

Question 6

An EC2 worker’s security group permits outbound HTTPS and has no inbound rules. A deployment must let the worker call an external API while rejecting new internet-initiated connections. Routes and network ACLs permit both directions. Which security-group change is required for the API’s responses to the worker’s established HTTPS connections?

1. Add inbound TCP 443 from the API’s address to authorize replies.
2. Add inbound TCP ephemeral ports from the API’s address for every reply.
3. Keep the existing rules; stateful response handling permits these replies.
4. Remove outbound restrictions after the first successful request to preserve the connection.

Correct Answer: C

 

Correct Answer

Answer C is correct because security groups track permitted connections and allow their responses without a separate inbound grant. This does not authorize an unrelated new inbound connection.

Incorrect Answers

Answer A is incorrect because the API’s reply returns to the worker’s client port rather than creating a new connection to a worker HTTPS listener. Stateful response handling already permits the reply.

Answer B is incorrect because this applies a stateless-filter approach to a stateful security group. No separate inbound rule is needed for replies, and such a grant could permit new inbound initiations.

Answer D is incorrect because stateful response handling does not require broadening the initiating worker’s egress policy. The existing outbound HTTPS rule already permits the request and its associated reply.

 

Question 7

A client in a subnet opens HTTPS to a remote server using local TCP port 50000. The subnet’s custom network ACL permits the outbound request to destination port 443, but permits inbound TCP only to destination port 443. Security groups and routing are correct. What narrowly fixes the return path for this specified test connection?

50000. Add an outbound ACL allow to destination port 50000.
50001. Change the client’s subnet route to an internet gateway without changing the ACL.
50002. Add only an inbound security-group rule for destination port 50000.
50003. Allow inbound TCP to destination port 50000 from the server’s address.

Correct Answer: D

 

Correct Answer

Answer D is correct because the response returns to the client’s chosen port, not the server’s listening port. A stateless network ACL needs a rule permitting that return packet separately. A production rule must account for the client’s actual ephemeral-port range, not assume every connection uses 50000.

Incorrect Answers

Answer A is incorrect because the response arrives inbound at the client’s port 50000. An outbound rule for that port is in the wrong direction and does not permit the returning packet.

Answer B is incorrect because routing is already correct. A different next hop cannot make a packet permitted by a stateless filter that still denies its destination port.

Answer C is incorrect because security groups are not the stated blocker, and their allow does not override the custom ACL. The response still encounters the missing ACL allowance.

 

Question 8

A custom network ACL has inbound rule 100 allowing TCP 443 from 0.0.0.0/0. Security now requires blocking 198.51.100.0/24 on that port while retaining all other current HTTPS access. Which change gives the intended result?

110. Add the same deny with rule number 110.
111. Remove rule 100 without adding any replacement allows.
112. Add a security-group deny rule for that CIDR while leaving the ACL unchanged.
113. Add an inbound deny for that CIDR and TCP 443 with rule number 90.

Correct Answer: D

 

Correct Answer

Answer D is correct because network ACL rules are evaluated in ascending rule-number order. The specific deny must be encountered before the broader matching allow for the blocked source.

Incorrect Answers

Answer A is incorrect because the existing broad allow at 100 would match first. A later matching deny is not evaluated after the earlier rule has already allowed the packet.

Answer B is incorrect because that would remove permitted HTTPS access for other sources as well. The requirement is a narrow block while preserving the remaining accepted traffic.

Answer C is incorrect because security groups provide allow rules rather than explicit deny entries. The requested deny cannot be implemented as the proposed security-group rule.

 

Question 9

A database security group permits its database port only from application security group AppSG. AppSG permits HTTPS from an office CIDR. An office host has a routed path to the database but no interface associated with AppSG. The team expects AppSG’s office rule to authorize direct database access. Which interpretation should guide the design?

1. Add the database port to AppSG’s office-CIDR rule so the database inherits that allowance.
2. Referencing AppSG authorizes its associated interfaces, not every source allowed by AppSG’s own rules.
3. Have the office host establish HTTPS to the application before opening a direct database connection.
4. Opening the database’s outbound port will authorize the office host’s initial inbound connection.

Correct Answer: B

 

Correct Answer

Answer B is correct because the reference does not import another group’s inbound rules. The office host does not acquire AppSG membership by being allowed to connect to the application.

Incorrect Answers

Answer A is incorrect because security-group references do not import the referenced group’s inbound rules. Changing AppSG’s listener permissions does not make the office host a member of AppSG.

Answer C is incorrect because a successful connection to the application does not associate the remote office host with AppSG. Direct database access still uses the office source, not the application’s interface.

Answer D is incorrect because outbound permissions do not grant an unrelated inbound initiation. The direct office request still lacks the intended source authorization.

 

Question 10

A VPC uses AWS Network Firewall to require stateful inspection of a defined set of TCP flows. Firewall endpoints and stateful rules already exist. Some routes bypass the endpoints, return traffic can use a different endpoint, and matching stateless rules use Pass. Which THREE changes are needed for the specified inspection path? Choose THREE.

1. Route the in-scope forward flows through the intended firewall endpoint.
2. Replace the inspection path with a network ACL that allows the required TCP port.
3. Keep stateless Pass actions and rely on the presence of stateful rules to inspect all passed traffic.
4. Route each flow’s return traffic through the same firewall endpoint.
5. Forward the in-scope traffic from the stateless engine to the stateful rule groups.
6. Send every return flow to a different healthy endpoint to distribute inspection load.

Correct Answers: A, D, E

 

Correct Answers

Answer A is correct because a firewall cannot inspect flows that are routed around it. Endpoint creation alone does not put the endpoint in the workload’s packet path.

Answer D is correct because stateful inspection requires the request and response path to reach the same endpoint. Different endpoints can create asymmetric routing and incomplete flow context.

Answer E is correct because a stateless Pass action can bypass stateful inspection. The policy must deliver the relevant traffic to the stateful engine instead of terminating processing with Pass.

Incorrect Answers

Answer B is incorrect because a port-level ACL is not the configured stateful inspection policy. It cannot substitute for delivery of the flows to the firewall’s stateful engine.

Answer C is incorrect because stateful rules are only evaluated when traffic is forwarded to that engine. Merely configuring those rules does not override the stateless action.

Answer F is incorrect because this creates the asymmetric path the stateful design must avoid. Endpoint health alone does not provide the same connection context at two endpoints.

 

Question 11

Two private subnets use different route tables and have no NAT or internet-gateway route. Both must reach S3 in the same Region. An S3 gateway endpoint is associated only with the first subnet’s route table; that subnet works, while the second cannot reach S3. IAM, bucket policy, security groups and ACLs are correct. What is the targeted fix?

1. Associate the second subnet’s route table with the S3 gateway endpoint.
2. Add inbound TCP 443 to a security group on the gateway endpoint.
3. Replace the second subnet’s route table with a new table containing only local VPC routes.
4. Grant AdministratorAccess to the second subnet’s instance role.

Correct Answer: A

 

Correct Answer

Answer A is correct because the endpoint route must be present in the route table used by the workload. The first subnet’s association does not automatically modify a distinct table.

Incorrect Answers

Answer B is incorrect because a gateway endpoint is reached through its route-table integration, not through an interface-endpoint security group. This does not repair the missing route association.

Answer C is incorrect because a new table without the S3 endpoint route still lacks a service path. Recreating a table is insufficient unless the endpoint is associated with the table the workload actually uses.

Answer D is incorrect because the scenario already establishes correct authorization. Broader identity permissions do not install the route needed to reach the service.

 

Question 12

A workload must access Secrets Manager through its private interface endpoint. The service name resolves to the endpoint’s private IP addresses, but TCP 443 connections time out. The IAM role allows the operation, the workload allows outbound HTTPS, and routing and ACLs are correct. The endpoint security group has no inbound rule. Which change fixes the verified missing control?

1. Allow outbound TCP 443 on the endpoint security group while leaving inbound rules empty.
2. Permit inbound TCP 443 on the endpoint security group from the workload’s source.
3. Add secretsmanager:GetSecretValue to the workload’s already sufficient IAM role.
4. Remove private DNS so the hostname resolves to a public endpoint.

Correct Answer: B

 

Correct Answer

Answer B is correct because the private endpoint interface is the connection destination and must accept the workload’s HTTPS traffic. DNS resolution alone does not authorize packet delivery to that interface.

Incorrect Answers

Answer A is incorrect because the workload initiates a connection to the endpoint’s port 443. An outbound rule does not authorize that incoming connection, so the missing destination ingress remains.

Answer C is incorrect because IAM authorization is evaluated after a request reaches the service. It does not repair the stated TCP timeout caused by the endpoint network filter.

Answer D is incorrect because the required private path would be abandoned rather than fixed. It also does not add a public egress path or meet the endpoint security requirement.

 

Question 13

The same IAM role can read approved buckets A and B when used from an authorized administration path. From a private subnet, reads of A succeed through an S3 gateway endpoint, but B returns AccessDenied. That endpoint policy allows only A. All other permissions are identical, and the workload must continue using the private endpoint path. What should be changed?

1. Attach another identical S3 read policy to the IAM role.
2. Route B’s traffic through a public NAT gateway while leaving the endpoint policy unchanged.
3. Extend the endpoint policy to permit the approved reads of B.
4. Add another bucket-policy allow for the same role on B while leaving the endpoint policy unchanged.

Correct Answer: C

 

Correct Answer

Answer C is correct because the path-specific policy restricts which requests may traverse this endpoint. The same principal’s success elsewhere and A’s success here identify the missing endpoint allowance.

Incorrect Answers

Answer A is incorrect because the role already has the required read grants. Repeating them does not change the endpoint policy that filters requests on this network path.

Answer B is incorrect because a different route could avoid that endpoint policy, but it violates the requirement to keep using the private endpoint path. It is not the authorized correction.

Answer D is incorrect because target-side authorization is already sufficient, as shown by the role’s successful administration-path request. Another bucket grant does not change the endpoint’s separate resource filter.

 

Question 14

A private workload can call Secrets Manager using an interface endpoint’s endpoint-specific hostname. Calls to the normal regional service hostname resolve to public addresses and fail because the subnet has no internet egress. VPC DNS resolution and DNS hostnames are enabled, and no custom DNS override exists. How can the workload keep using the normal service hostname over the existing private path?

1. Expand the endpoint policy from the required secret to all secrets.
2. Add the service’s public IP addresses as inbound security-group sources on the workload.
3. Enable private DNS on the Secrets Manager interface endpoint.
4. Add an internet-gateway default route without giving the workload a public address.

Correct Answer: C

 

Correct Answer

Answer C is correct because private DNS maps the normal service name to the endpoint’s private addresses under the stated DNS prerequisites. Successful calls using the endpoint-specific name already verify the basic endpoint path.

Incorrect Answers

Answer A is incorrect because the endpoint-specific call already confirms sufficient authorization for the secret. A policy expansion cannot change DNS answers for the normal service name.

Answer B is incorrect because the workload initiates the connection, and the observed issue is selection of the public destination. An inbound source rule cannot redirect that connection to the existing endpoint.

Answer D is incorrect because this does not make the normal hostname resolve to the private interface endpoint and does not satisfy the private-path requirement. It also does not by itself establish public IPv4 egress.

 

Question 15

An on-premises application must reach S3 through a private Direct Connect path to a VPC. That VPC currently has only an S3 gateway endpoint. The application may use an endpoint-specific S3 hostname; its DNS resolver can resolve those names. Routing to the planned interface-endpoint subnet and HTTPS security rules are already prepared. Which TWO changes enable the intended S3 path? Choose TWO.

1. Add a second gateway endpoint to the same VPC and leave the application unchanged.
2. Route the application through an internet NAT service because Direct Connect automatically privatizes any destination.
3. Configure the application to use the S3 interface endpoint’s appropriate endpoint-specific hostname.
4. Advertise the S3 gateway endpoint route to the office as if it were a reachable router.
5. Create an S3 interface endpoint in the reachable VPC subnet.

Correct Answers: C, E

 

Correct Answers

Answer C is correct because the hostname directs application requests to the new private endpoint addresses. This method is supported without needing to replace the standard corporate DNS resolver.

Answer E is correct because an interface endpoint supplies private endpoint addresses that the on-premises application can reach over the existing connection. A gateway endpoint cannot be extended to this on-premises path.

Incorrect Answers

Answer A is incorrect because duplicating the same endpoint type does not remove its on-premises limitation. The application still needs a reachable interface-endpoint destination.

Answer B is incorrect because a public egress route does not become the specified private VPC endpoint path merely because Direct Connect exists. The requirement excludes this substitute path.

Answer D is incorrect because gateway endpoints are not a transitive on-premises access mechanism. Advertising an address or route does not convert one into an interface endpoint.

 

Question 16

A branch must connect its private network to a VPC over its existing internet connection. It has a compatible customer gateway with a public IP address. The connection must encrypt routed IP traffic between the site and AWS; no private carrier circuit is available. Which architecture meets the requirements?

1. Publish the application through a public ALB and treat HTTPS as a VPN for all branch traffic.
2. Configure a Direct Connect private virtual interface without ordering or providing a circuit.
3. Create VPC peering between the VPC and the branch’s public router address.
4. Establish AWS Site-to-Site VPN with the branch’s customer gateway.

Correct Answer: D

 

Correct Answer

Answer D is correct because the IPsec tunnels protect site-to-site traffic over the available internet transport. The stated gateway capability and public address satisfy the proposed connection model.

Incorrect Answers

Answer A is incorrect because application HTTPS protects those application connections, not the required routed private IP network path. The requested scope is broader than one public web entry point.

Answer B is incorrect because a virtual interface depends on Direct Connect connectivity. The scenario explicitly has no private circuit, so this does not use the available transport.

Answer C is incorrect because VPC peering connects VPCs, not a VPC to an arbitrary on-premises router. It does not supply the required branch-to-AWS IPsec tunnel.

 

Question 17

A company has Direct Connect through a transit VIF, Direct Connect gateway and transit gateway. The connection does not support MACsec. Its policy requires IPsec protection for selected on-premises-to-VPC traffic without public VPN endpoint addresses. The supported private-IP VPN prerequisites can be configured. Which design fits?

1. Retain the unencrypted Direct Connect routes because a dedicated circuit supplies IPsec automatically.
2. Enable MACsec on the existing Direct Connect connection.
3. Terminate a public-IP Site-to-Site VPN connection at the transit gateway.
4. Use private IP Site-to-Site VPN over Direct Connect and route the protected traffic through it.

Correct Answer: D

 

Correct Answer

Answer D is correct because private IP VPN provides IPsec over the stated Direct Connect and transit-gateway architecture. Explicit routing is needed so the selected traffic uses the encrypted attachment.

Incorrect Answers

Answer A is incorrect because Direct Connect does not encrypt traffic by default. Dedicated transport is not equivalent to the specific cryptographic protection required here.

Answer B is incorrect because MACsec cannot be configured on the stated unsupported connection. It is also a different encryption mechanism from the explicitly required IPsec tunnel.

Answer C is incorrect because that provides IPsec under different endpoint requirements but conflicts with the prohibition on public tunnel addresses. Private IP VPN addresses both conditions.

 

Question 18

A branch has configured only one of the two tunnels in its AWS Site-to-Site VPN connection. A planned AWS tunnel maintenance event must not force traffic onto an unencrypted backup path. The branch router supports both supplied tunnel configurations and routing failover. Which TWO changes create a supported encrypted alternate path? Choose TWO.

1. Use a direct carrier route as the backup without adding IPsec to that path.
2. Copy the first tunnel’s outside endpoint address into both local tunnel definitions.
3. Increase the first tunnel’s negotiated key lifetime and leave the second tunnel unconfigured.
4. Configure and validate the second IPsec tunnel using its supplied tunnel parameters.
5. Configure and test routing so protected traffic can select a working VPN tunnel when the primary path changes.

Correct Answers: D, E

 

Correct Answers

Answer D is correct because the second tunnel must actually be usable before it can carry traffic. Its existence in the AWS configuration alone does not configure the branch device.

Answer E is correct because encryption on an unused tunnel is insufficient if routing never selects it. Testing the alternate path verifies the intended failover behavior without promising zero interruption.

Incorrect Answers

Answer A is incorrect because a carrier path could preserve connectivity in a different design, but it does not meet this requirement for an encrypted alternate. Private transport alone is not IPsec protection.

Answer B is incorrect because the provided tunnels have distinct endpoint configurations. Reusing one endpoint does not create an independently usable second path.

Answer C is incorrect because a longer key lifetime does not keep an endpoint available during maintenance or provide another path. The second tunnel and routing must be configured for an actual encrypted alternate.

 

Question 19

A new VPC has not yet been populated. Its proposed CIDR exactly matches the existing on-premises CIDR. Both sites must retain access to their local hosts and reach remote hosts using original addresses without NAT or application proxies. On-premises addresses cannot change. What should the architect do before deployment?

1. Force all traffic for the shared CIDR into the VPN instead of using local destinations.
2. Keep the overlapping CIDRs and implement address translation at the network boundary.
3. Allocate a non-overlapping VPC CIDR and update the routing plan.
4. Advertise the identical CIDR from both sides and rely on encryption to distinguish destinations.

Correct Answer: C

 

Correct Answer

Answer C is correct because distinct original address spaces allow routes to distinguish local from remote destinations. The empty VPC makes address selection the available correction while preserving the no-translation requirement.

Incorrect Answers

Answer A is incorrect because redirecting the shared prefix does not distinguish local hosts from remote hosts with the same addresses. It sacrifices required local reachability rather than resolving the ambiguity.

Answer B is incorrect because translation can be part of a different overlap design, but it violates the explicit requirement to preserve original addresses without NAT. Selecting a different CIDR for the unpopulated VPC avoids that conflict.

Answer D is incorrect because IPsec protects packets but does not make overlapping private destinations unambiguous. Encryption does not replace the need for a workable addressing and routing model.

 

Question 20

An employee authenticates successfully to an AWS Client VPN endpoint using directory integration. Only members of the finance group may access the finance subnet. The endpoint route, target security groups and ACLs are correct, but no Client VPN authorization rule grants that group access. Which change meets the requirement without authorizing other users?

1. A longer lifetime for the employee’s authentication session.
2. An authorization rule granting that group access to the finance subnet’s destination CIDR.
3. A second identical route to the finance subnet.
4. An allow-all authorization rule for every user and every destination.

Correct Answer: B

 

Correct Answer

Answer B is correct because Client VPN authentication establishes identity, while authorization rules grant access to particular destination networks. A route does not replace the missing group-to-network authorization.

Incorrect Answers

Answer A is incorrect because the employee is already authenticated. Session duration does not turn successful authentication into permission for every reachable network.

Answer C is incorrect because the route already exists and does not confer client authorization. Adding the same network path cannot grant the missing permission to the group.

Answer D is incorrect because this could broaden reachability but exceeds the stated group-specific finance access requirement. The targeted authorization rule satisfies the need without that expansion.

 

Question 21

A deliberately public IPv4 web server has a security group allowing HTTPS, a permissive network ACL, and a subnet route to an attached internet gateway. The instance was launched without a public IPv4 address. Direct internet clients must reach the server itself; no load balancer is part of the design. Which change supplies the missing component?

1. Route the subnet through a NAT gateway and wait for clients to initiate connections through it.
2. Associate a public IPv4 address, such as an Elastic IP, with the instance.
3. Add another default route to the same internet gateway.
4. Open a wider inbound source range on the existing HTTPS security-group rule.

Correct Answer: B

 

Correct Answer

Answer B is correct because direct IPv4 internet-gateway access requires the instance’s public address mapping as well as the route and filters. Those other prerequisites are already verified.

Incorrect Answers

Answer A is incorrect because NAT gateways support outbound-initiated connectivity rather than unsolicited inbound connections to private instances. That does not supply this direct public-server path.

Answer C is incorrect because the subnet already has the required route. A duplicate next-hop configuration does not provide the instance with a public IPv4 address.

Answer D is incorrect because the current group already permits the traffic. Expanding it does not repair the missing public addressing component and can increase exposure.

 

Question 22

An administrator creates an isolated route table containing only the intended local VPC routes. A subnet that should become isolated still initiates new internet connections. DescribeRouteTables confirms that it uses the main route table, whose default route leads to an internet gateway. Other public subnets must retain their main-table internet access. Which correction addresses the verified cause?

1. Explicitly associate the subnet with the intended isolated route table.
2. Delete the internet-gateway default route from the main route table.
3. Detach the internet gateway from the VPC while keeping all route-table associations.
4. Associate the prepared table with a different private subnet that is already isolated.

Correct Answer: A

 

Correct Answer

Answer A is correct because creating a route table does not automatically apply it to the subnet. The observed association explains why the old internet route continues to be used.

Incorrect Answers

Answer B is incorrect because this changes the affected subnet’s internet path, but also removes required internet routing for the other public subnets. Applying the prepared isolated table confines the change to its intended subnet.

Answer C is incorrect because this removes the shared gateway needed by the other public subnets. The defect is which table the isolated subnet uses, not the presence of a gateway for the VPC’s public tier.

Answer D is incorrect because a route-table association affects the subnet named in that association. Changing another subnet leaves the identified subnet using the main table and its internet route.

 

Question 23

Workers use a correctly configured public NAT gateway to contact a partner HTTPS service. After a planned egress change, the partner’s firewall logs show requests arriving from the new NAT gateway’s Elastic IP, which is absent from its allow-list. AWS routes, ACLs and security groups permit the flow. Which targeted change restores the approved partner access?

1. Update the partner allow-list to include the approved new NAT Elastic IP.
2. Add the workers’ private subnet CIDR to the partner’s public-source allow-list.
3. Assign different private IPv4 addresses to the workers while retaining the new public NAT gateway.
4. Add inbound port 443 from the partner to every worker security group.

Correct Answer: A

 

Correct Answer

Answer A is correct because the partner’s evidence identifies the translated public source being rejected. The existing private-worker addresses are not the source addresses the partner sees on this internet path.

Incorrect Answers

Answer B is incorrect because public NAT translates the workers’ source addresses. Allowing their private addresses does not match the public source recorded by the partner’s firewall.

Answer C is incorrect because the partner sees the NAT gateway’s translated Elastic IP, not the workers’ original private addresses. Changing those private sources does not change the source rejected by the partner.

Answer D is incorrect because the connection is initiated by the workers and the partner rejection occurs after source translation. Wider inbound worker access does not change the rejected source IP.

 

Question 24

All workload DNS queries in a VPC use the Amazon-provided Route 53 Resolver. A team adds network ACL denies for port 53, but queries through that resolver still resolve a domain that its policy forbids. It needs domain-based filtering for this resolver path. Which control addresses the specific requirement?

1. Add a lower-numbered ACL deny for the same resolver port and domain name.
2. Associate a Route 53 Resolver DNS Firewall rule group that blocks the prohibited domain.
3. Replace the ACL rule with a security-group deny for the domain.
4. Enable Resolver query logging and alert when the prohibited domain is queried.

Correct Answer: B

 

Correct Answer

Answer B is correct because network ACLs do not filter the Amazon-provided resolver path. DNS Firewall applies domain-based policy to the stated resolver queries rather than relying on a port-level block.

Incorrect Answers

Answer A is incorrect because changing ACL priority does not remove this resolver-path exception, and ACL rules do not implement domain-name matching. The proposed rule uses the wrong control layer.

Answer C is incorrect because security groups do not support that explicit domain deny and do not filter this Amazon-provided DNS path. They cannot express the requested resolver policy.

Answer D is incorrect because logging can reveal policy violations but does not block a DNS answer. The stated requirement is preventive domain filtering on the resolver path.

 

Question 25

An instance has two security groups. RestrictedSG allows SSH only from the approved office CIDR, while LegacySG allows SSH from 0.0.0.0/0. The team expected RestrictedSG to override LegacySG, but an outside test host can connect. Which security-group change enforces the intended office-only SSH access?

1. Remove the broad SSH allowance or detach LegacySG while retaining the required office rule.
2. Attach a third group with another office-only SSH allow.
3. Reorder the two security-group attachments so RestrictedSG is listed first.
4. Remove RestrictedSG’s office rule while keeping LegacySG attached.

Correct Answer: A

 

Correct Answer

Answer A is correct because rules from associated security groups are combined as allows. The broad grant remains effective until it is removed; a narrower grant in another group does not act as a deny.

Incorrect Answers

Answer B is incorrect because adding an allow does not subtract an existing broader allow. The union still includes LegacySG’s access from any IPv4 source.

Answer C is incorrect because group attachment order is not a first-match deny/allow list. Unlike network ACL rule priority, it does not make the narrower group override the broader one.

Answer D is incorrect because removing a narrower grant does not remove the separate broad grant from LegacySG. Rules are combined, so the outside source remains authorized by LegacySG.