Amazon AWS Certified Solutions Architect Associate SAA-C03 Application Authentication and Threat Protection Practice Test

 

Topic 04 covers application authentication and threat protection for the AWS Certified Solutions Architect – Associate certification. These original SAA-C03 questions separate customer identity, secret lifecycle, web-layer prevention, security evidence, and layered controls. Select one answer unless a fixed number is requested. Each alternative explains the governing behavior. For broader preparation, visit the AWS Certified Solutions Architect Associate SAA-C03 Exam Dumps page.

Question 1

A consumer web application needs a managed sign-in directory, password reset, MFA support, and JWT tokens for its API. The users are customers, not employees with AWS accounts. Which service should own the application sign-in?

1. AWS IAM Identity Center
2. IAM users
3. Amazon Cognito identity pools
4. Amazon Cognito user pools

Correct Answer: D

 

Correct Answer

Answer D is correct because User pools provide a managed customer user directory and authentication flows that issue tokens to applications. They fit application sign-in without creating IAM users.

Incorrect Answers

Answer A is incorrect because IAM Identity Center is designed for workforce access to AWS accounts and business applications, not as the primary customer identity store for a public application.

Answer B is incorrect because Creating IAM users for customers gives human application users AWS identities and long-term credential-management concerns that the managed customer-authentication requirement avoids.

Answer C is incorrect because Identity pools exchange identities for temporary AWS credentials. They do not replace the customer user-directory and sign-in function requested here.

 

Question 2

A mobile application authenticates users with an existing Cognito user pool. After sign-in, each user must receive short-lived AWS credentials that allow direct upload only to that user’s S3 prefix. Which addition best meets the requirement?

1. Store one shared access key in the mobile application and rely on S3 object ACLs.
2. Use only the user pool token as an S3 API credential.
3. Add a Cognito identity pool that maps authenticated users to a scoped IAM role.
4. Create an IAM user for every mobile user and return access keys after sign-in.

Correct Answer: C

 

Correct Answer

Answer C is correct because An identity pool can accept the authenticated token and issue temporary AWS credentials through an IAM role. The role policy can constrain S3 access to the user-specific prefix.

Incorrect Answers

Answer A is incorrect because A shared embedded key can be extracted and cannot provide per-user temporary credential isolation. Object ACLs do not fix the credential-distribution problem.

Answer B is incorrect because User pool tokens authenticate the application user, but S3 API requests that need AWS authorization require AWS credentials or another mediated application path.

Answer D is incorrect because IAM user keys are long-lived AWS credentials and create a credential lifecycle for every application user instead of issuing temporary role credentials.

 

Question 3

A public photo application permits anonymous visitors to upload one image to a quarantine prefix before registration. The client must not contain an AWS access key, and anonymous access must use temporary credentials with a narrowly scoped role. Which design is appropriate?

1. Create a public S3 bucket and let anonymous users call PutObject without AWS credentials.
2. Embed a single IAM user key in the client and rotate it daily.
3. Require an IAM Identity Center permission set before any upload.
4. Enable Cognito identity-pool guest access with a tightly scoped unauthenticated role.

Correct Answer: D

 

Correct Answer

Answer D is correct because Identity pools can issue temporary credentials to guest identities when guest access is enabled. The unauthenticated role can be restricted to the quarantine prefix.

Incorrect Answers

Answer A is incorrect because A public write bucket removes the requested role-based temporary authorization boundary and exposes the bucket to broader unauthenticated writes.

Answer B is incorrect because Rotation frequency does not prevent extraction of a shared long-term credential from a public client.

Answer C is incorrect because Identity Center is a workforce access mechanism and does not satisfy the anonymous consumer-upload requirement.

 

Question 4

A SaaS API uses Cognito user-pool tokens. A premium endpoint must accept only authenticated users whose token contains the application’s premium group claim. Which control should the architect apply closest to the API?

1. Give every premium customer an IAM access key.
2. Use an S3 bucket policy with the premium group name.
3. Validate the user-pool token and require the premium claim.
4. Create a security group for the premium users.

Correct Answer: C

 

Correct Answer

Answer C is correct because The token establishes the customer identity and its claims can drive application/API authorization. The premium decision remains tied to authenticated identity context.

Incorrect Answers

Answer A is incorrect because Long-term IAM keys are unnecessary for a customer API and move identity management away from the existing token-based application model.

Answer B is incorrect because An S3 resource policy does not authorize access to an unrelated application API or interpret Cognito group membership for that endpoint.

Answer D is incorrect because Security groups filter network traffic to resources; they do not understand individual customer identities or JWT group claims.

 

Question 5

A browser application signs users in with a Cognito user pool and also lets signed-in users upload directly to S3. Which TWO components have distinct required roles in this design? Choose TWO.

1. AWS Organizations must place every customer in a separate account.
2. The identity pool can exchange the authenticated identity for temporary AWS credentials.
3. A per-user IAM user must be created so S3 can identify each customer.
4. The user pool authenticates the customer and issues application tokens.
5. A public-write S3 bucket is required because browser users cannot receive temporary AWS credentials.

Correct Answers: B, D

 

Correct Answers

Answer B is correct because The identity pool bridges an authenticated application identity to temporary AWS credentials that can authorize the direct S3 request.

Answer D is correct because The user pool is the managed sign-in directory and token issuer for the customer application.

Incorrect Answers

Answer A is incorrect because Organizations governs AWS accounts, not customer identities inside a web application. It therefore does not satisfy the scenario’s decisive requirement: No long-term customer AWS credentials.

Answer C is incorrect because Temporary role credentials from an identity pool avoid creating IAM users for application customers.

Answer E is incorrect because Browsers can receive scoped temporary credentials through an identity pool, so public write access is not required.

 

Question 6

An ECS service connects to an RDS database with a password that must rotate automatically. The application should retrieve the current value at runtime instead of baking it into an image. Which design best fits?

1. Use an S3 object with public-read disabled and poll it from the application.
2. Store the credential in Secrets Manager, enable rotation, and let the task role read it.
3. Store the password in a container image layer and rebuild the image monthly.
4. Place the password in an unencrypted environment variable in the task definition.

Correct Answer: B

 

Correct Answer

Answer B is correct because Secrets Manager is designed to store secrets and can rotate supported database credentials while the workload retrieves the current value using its role.

Incorrect Answers

Answer A is incorrect because S3 can protect an object, but it does not provide the database-secret rotation workflow requested and adds custom secret lifecycle logic.

Answer C is incorrect because The secret remains copied into immutable image history and rotation depends on redeployment rather than managed secret lifecycle.

Answer D is incorrect because This still distributes the secret as configuration and does not provide the requested automatic credential rotation.

 

Question 7

A Lambda function needs a non-secret feature flag that operators change frequently. No password, token, or private key is involved. The team wants centralized configuration without treating the value as a rotating credential. Which choice is most appropriate?

1. Store the value in Systems Manager Parameter Store.
2. Create an IAM access key whose ID encodes the flag value.
3. Hard-code the flag in the Lambda deployment package.
4. Store the flag in Secrets Manager and configure password rotation.

Correct Answer: A

 

Correct Answer

Answer A is correct because Parameter Store is appropriate for centralized configuration values and avoids imposing a credential-rotation workflow where there is no secret.

Incorrect Answers

Answer B is incorrect because Access keys are credentials, not configuration storage, and would create a security problem unrelated to the requested flag.

Answer C is incorrect because Hard-coding requires deployment to change an operational setting and defeats the centralized configuration requirement.

Answer D is incorrect because Secrets Manager can hold arbitrary values, but automatic credential rotation is unnecessary for a non-secret feature flag and adds the wrong lifecycle model.

 

Question 8

An application retrieves a database password from Secrets Manager, but its IAM role currently has broad permission to read every secret in the account. The application needs only one production secret. What is the best change?

1. Copy the secret into the application configuration and remove Secrets Manager access.
2. Make the secret readable by all authenticated IAM principals and rely on CloudTrail for detection.
3. Restrict the role to GetSecretValue for the specific secret it requires.
4. Grant the role SecretsManager:* so future deployments do not need policy changes.

Correct Answer: C

 

Correct Answer

Answer C is correct because Narrowing the action and resource implements least privilege while preserving runtime retrieval. This applies directly to the scenario’s decisive requirement: Least privilege.

Incorrect Answers

Answer A is incorrect because This removes centralized secret handling and creates a distributed copy that still needs protection and rotation.

Answer B is incorrect because Audit evidence does not replace preventive access control; the secret should not be broadly readable.

Answer D is incorrect because A wildcard increases authority beyond the application requirement and directly conflicts with the stated least-privilege goal.

 

Question 9

A database password stored in Secrets Manager was accidentally printed to an application log. The log entry has been removed, but the password might have been copied before deletion. Which action addresses the credential risk most directly?

1. Encrypt future log groups with KMS and keep the same database password.
2. Rename the secret in Secrets Manager and keep its current value.
3. Rotate the database secret so the exposed value is no longer valid.
4. Increase CloudWatch Logs retention so investigators have more time.

Correct Answer: C

 

Correct Answer

Answer C is correct because Removing the log limits further exposure but cannot revoke copies already obtained. Rotation changes the underlying credential and invalidates the exposed value.

Incorrect Answers

Answer A is incorrect because Log encryption protects stored log data but does not invalidate a credential that may already have been copied.

Answer B is incorrect because Changing the secret name does not change the credential accepted by the database, so the exposed password remains valid.

Answer D is incorrect because Longer retention can support investigation but leaves the exposed database credential usable. It therefore does not satisfy the scenario’s decisive requirement: Database credential must be invalidated.

 

Question 10

A custom database runs on EC2. Secrets Manager rotation uses a Lambda function, but rotations fail whenever the database is placed in private subnets. Which TWO conditions must the design satisfy for Lambda-based rotation to work? Choose TWO.

1. The secret must be copied into the Lambda deployment package before rotation begins.
2. The rotation function must be able to reach the database or service whose credential it changes.
3. The function must use the root user so it can always change the password.
4. The database must be publicly reachable from the internet.
5. The rotation function must have permission to access the relevant secret in Secrets Manager.

Correct Answers: B, E

 

Correct Answers

Answer B is correct because The function has to update and test the underlying credential, so network reachability to the target service is required.

Answer E is correct because Rotation steps read and write secret versions, so the function role needs the required Secrets Manager permissions.

Incorrect Answers

Answer A is incorrect because Embedding the secret in code defeats managed retrieval and is not part of the rotation workflow.

Answer C is incorrect because Root credentials are unnecessary and inappropriate; least-privilege function permissions are sufficient. It therefore does not satisfy the scenario’s decisive requirement: Lambda rotation.

Answer D is incorrect because Public exposure is not required; the function can use VPC networking to reach a private database.

 

Question 11

A public API behind an Application Load Balancer receives repeated SQL-injection patterns in query strings. The team wants a managed web-layer control that can inspect HTTP requests before they reach the targets. Which service is the best fit?

1. A security group on the database.
2. AWS KMS on the load balancer.
3. Amazon GuardDuty only.
4. Associate AWS WAF with the Application Load Balancer.

Correct Answer: D

 

Correct Answer

Answer D is correct because AWS WAF can inspect HTTP request characteristics and apply managed or custom rules at supported application-layer resources such as an ALB.

Incorrect Answers

Answer A is incorrect because Security groups can filter network flows but do not inspect HTTP query content for SQL-injection patterns.

Answer B is incorrect because KMS manages cryptographic keys; it does not inspect application-layer requests. It therefore does not satisfy the scenario’s decisive requirement: Inline request filtering.

Answer C is incorrect because GuardDuty is a threat-detection service that produces findings; it is not the inline HTTP filtering control requested.

 

Question 12

A login endpoint normally receives fewer than 50 requests per minute from any one client. During abuse, a small number of source IPs send thousands of requests. The architect wants an AWS-native control that can limit requests when an aggregation exceeds a configured threshold. What should be added?

1. Add a scoped AWS WAF rate-based rule for the login path.
2. A KMS key policy that denies repeated decrypt calls.
3. A longer ALB idle timeout.
4. An S3 lifecycle rule.

Correct Answer: A

 

Correct Answer

Answer A is correct because A rate-based rule counts matching requests by the configured aggregation criteria and can apply a limiting action when the rate exceeds the threshold.

Incorrect Answers

Answer B is incorrect because KMS policies do not inspect or count HTTP requests arriving at the login endpoint.

Answer C is incorrect because The idle timeout changes connection behavior but does not rate-limit abusive HTTP request volumes.

Answer D is incorrect because S3 lifecycle policies manage object storage transitions and expiration, not API request rates. It therefore does not satisfy the scenario’s decisive requirement: Application-layer control.

 

Question 13

A company uses CloudFront in front of an ALB and wants enhanced DDoS assistance plus application-layer protections. Which combination most directly addresses Layer 7 request floods at the edge?

1. Increase the Auto Scaling maximum capacity without filtering requests.
2. Move the ALB to a private subnet while leaving CloudFront unable to reach it.
3. Use AWS WAF rate controls with Shield Advanced for enhanced DDoS protection.
4. Encrypt the ALB listener with a KMS customer managed key.

Correct Answer: C

 

Correct Answer

Answer C is correct because WAF provides Layer 7 request controls, while Shield Advanced can add enhanced DDoS protection and mitigation workflows for supported resources.

Incorrect Answers

Answer A is incorrect because More capacity can absorb some load but does not provide the requested application-layer DDoS control or distinguish abusive traffic.

Answer B is incorrect because Breaking origin reachability prevents legitimate traffic as well as attacks and is not a valid DDoS protection design.

Answer D is incorrect because Listener TLS protects transport confidentiality; it does not rate-limit or mitigate abusive HTTP request floods.

 

Question 14

A CloudFront distribution uses a public ALB origin. The security team wants users to reach the application through CloudFront rather than sending ordinary internet traffic directly to the ALB. Which design direction best supports this?

1. Allow 0.0.0.0/0 to the ALB and rely only on its DNS name being unpublished.
2. Restrict the ALB origin path to CloudFront-facing traffic.
3. Remove CloudFront and expose the ALB publicly so there is only one endpoint.
4. Add a second public ALB listener on another port and document that clients should not use it.

Correct Answer: B

 

Correct Answer

Answer B is correct because Constraining origin reachability reduces direct bypass while retaining CloudFront as the intended public entry point.

Incorrect Answers

Answer A is incorrect because An unadvertised hostname is not an access control; a public ALB can still be reached directly if its address is discovered.

Answer C is incorrect because This eliminates the required edge path rather than preventing origin bypass. It therefore does not satisfy the scenario’s decisive requirement: Prevent ordinary direct origin access.

Answer D is incorrect because A second public path increases bypass surface and documentation does not enforce the requested restriction.

 

Question 15

An application uses both CloudFront and an ALB. The team needs two protections: block known malicious HTTP patterns before they reach the application, and limit abusive request rates to one sensitive path. Which TWO AWS WAF capabilities address these needs? Choose TWO.

1. Use S3 Object Lock for the origin logs.
2. Use KMS automatic key rotation for the CloudFront cache.
3. Use a rate-based rule with a scope-down condition for the sensitive path.
4. Use web ACL rules or managed rule groups to inspect and block matching web requests.
5. Use an IAM permissions boundary on the ALB target group.

Correct Answers: C, D

 

Correct Answers

Answer C is correct because A scoped rate-based rule can count only matching requests and act when the configured rate is exceeded.

Answer D is correct because WAF rules can inspect HTTP request components and apply blocking actions for malicious patterns.

Incorrect Answers

Answer A is incorrect because Object Lock can protect stored log objects but does not block malicious requests or rate-limit the endpoint.

Answer B is incorrect because KMS rotation concerns cryptographic key material, not web request inspection or rate limiting. It therefore does not satisfy the scenario’s decisive requirement: Inline web-layer enforcement.

Answer E is incorrect because Permissions boundaries limit IAM identity permissions; they do not inspect HTTP traffic. It therefore does not satisfy the scenario’s decisive requirement: Inline web-layer enforcement.

 

Question 16

Several EC2 instances suddenly contact known command-and-control infrastructure and one IAM role begins making unusual API calls from an unexpected location. Which AWS service is designed to produce threat-detection findings from this kind of activity?

1. Amazon Macie
2. Use Amazon GuardDuty.
3. AWS Config
4. AWS Artifact

Correct Answer: B

 

Correct Answer

Answer B is correct because GuardDuty analyzes AWS data sources and threat intelligence to identify suspicious activity and produce security findings.

Incorrect Answers

Answer A is incorrect because Macie focuses on discovering and evaluating sensitive data in S3 rather than detecting command-and-control behavior.

Answer C is incorrect because Config records resource configuration and evaluates configuration rules; it is not the primary managed threat-detection service for this behavior.

Answer D is incorrect because Artifact provides AWS compliance reports and agreements, not runtime threat findings. It therefore does not satisfy the scenario’s decisive requirement: Threat findings.

 

Question 17

A security team needs an inventory of software vulnerabilities affecting supported EC2 instances, container images in ECR, and Lambda functions. Which service best matches that requirement?

1. Use Amazon Inspector.
2. AWS CloudTrail
3. Amazon Macie
4. Amazon GuardDuty

Correct Answer: A

 

Correct Answer

Answer A is correct because Inspector provides vulnerability management for supported compute and container/serverless workloads, producing findings that can be prioritized and aggregated.

Incorrect Answers

Answer B is incorrect because CloudTrail records API activity; it does not scan workload software for vulnerabilities. It therefore does not satisfy the scenario’s decisive requirement: Lambda vulnerability coverage.

Answer C is incorrect because Macie identifies sensitive data exposure in S3, not CVEs in compute software. It therefore does not satisfy the scenario’s decisive requirement: Lambda vulnerability coverage.

Answer D is incorrect because GuardDuty detects suspicious behavior and threats rather than acting as the software vulnerability inventory requested.

 

Question 18

A data lake contains thousands of S3 buckets and the security team wants managed discovery of personally identifiable information and other sensitive data so exposure can be prioritized. Which service should be used?

1. AWS Shield Advanced
2. Amazon Macie
3. AWS CloudFormation
4. Amazon Inspector

Correct Answer: B

 

Correct Answer

Answer B is correct because Macie is designed to discover and classify sensitive data in S3 and can generate findings about data exposure.

Incorrect Answers

Answer A is incorrect because Shield Advanced focuses on DDoS protection and does not classify sensitive S3 data. It therefore does not satisfy the scenario’s decisive requirement: Prioritize exposure.

Answer C is incorrect because CloudFormation manages infrastructure definitions and does not discover sensitive content in stored objects. It therefore does not satisfy the scenario’s decisive requirement: Prioritize exposure.

Answer D is incorrect because Inspector assesses workload vulnerabilities rather than classifying sensitive object content in S3. It therefore does not satisfy the scenario’s decisive requirement: Prioritize exposure.

 

Question 19

An engineer needs to determine which principal changed a production security group yesterday and the API parameters used in the change. Which data source should be queried first?

1. AWS CloudTrail events
2. AWS WAF sampled requests
3. Amazon Macie findings
4. Amazon CloudFront access logs

Correct Answer: A

 

Correct Answer

Answer A is correct because CloudTrail records AWS API activity and identifies the caller and request details needed to attribute the security-group change.

Incorrect Answers

Answer B is incorrect because WAF samples web requests evaluated by web ACLs and does not provide the AWS control-plane change record.

Answer C is incorrect because Macie focuses on sensitive data in S3, not API change history for security groups.

Answer D is incorrect because CloudFront logs viewer requests to a distribution; they do not record EC2 security-group API modifications.

 

Question 20

A central security team receives findings from GuardDuty, Inspector, Macie, and configuration security controls across many accounts. It wants one service to aggregate and correlate the findings for prioritization. Which service is the best fit?

1. AWS Security Hub
2. Amazon SQS
3. AWS KMS
4. AWS CloudTrail Lake

Correct Answer: A

 

Correct Answer

Answer A is correct because Security Hub aggregates security findings from multiple AWS security services and can correlate signals for centralized prioritization.

Incorrect Answers

Answer B is incorrect because SQS can transport messages, but it does not provide the security posture aggregation and finding model requested.

Answer C is incorrect because KMS manages cryptographic keys and cannot aggregate threat, vulnerability, or sensitive-data findings. It therefore does not satisfy the scenario’s decisive requirement: Central prioritization.

Answer D is incorrect because CloudTrail Lake can analyze event data, but it is not the native multi-service security-finding aggregation service described.

 

Question 21

A consumer application must authenticate users and then allow only signed-in users to upload directly to a private S3 bucket with temporary AWS credentials. Which TWO controls should be combined? Choose TWO.

1. Use a Cognito user pool for sign-in.
2. A Cognito identity pool that exchanges the authenticated identity for a scoped IAM role.
3. AWS Organizations SCPs for each customer identity.
4. A public-write bucket policy so the browser does not need AWS authorization.
5. A permanent IAM access key embedded in the application.

Correct Answers: A, B

 

Correct Answers

Answer A is correct because The user pool owns the customer authentication flow. This applies directly to the scenario’s decisive requirement: Temporary direct AWS credentials.

Answer B is correct because The identity pool supplies temporary AWS credentials for the direct S3 operation. This applies directly to the scenario’s decisive requirement: Temporary direct AWS credentials.

Incorrect Answers

Answer C is incorrect because SCPs govern permissions in AWS accounts and are not customer application authorization controls. It therefore does not satisfy the scenario’s decisive requirement: Temporary direct AWS credentials.

Answer D is incorrect because Public write access removes the authenticated-user boundary and is unnecessary when temporary credentials are available.

Answer E is incorrect because A shared long-term key can be extracted and does not provide per-user temporary authorization.

 

Question 22

A public application is protected by a security group that allows HTTPS only from the internet, but malicious SQL-injection requests still reach the ALB. What additional control should be added without removing the network restriction?

1. Remove the security group because AWS WAF automatically controls all network ports.
2. Add S3 Object Lock to the application logs.
3. Keep the security group and add AWS WAF for HTTP inspection.
4. Replace the security group with AWS KMS.

Correct Answer: C

 

Correct Answer

Answer C is correct because The two controls operate at different layers: the security group restricts network reachability while WAF can inspect HTTP content.

Incorrect Answers

Answer A is incorrect because WAF evaluates supported web requests and does not replace security-group controls for network reachability.

Answer B is incorrect because Protecting log retention does not prevent malicious HTTP requests from reaching the load balancer.

Answer D is incorrect because KMS does not provide network filtering or HTTP inspection. It therefore does not satisfy the scenario’s decisive requirement: Need application-layer filtering.

 

Question 23

A GuardDuty finding reports credential misuse. The team wants the next similar API request to be denied, not merely detected. Which statement best describes the required design change?

1. Store the GuardDuty finding in an Object Lock bucket and rely on immutability to stop the principal.
2. Increase the GuardDuty finding severity because high-severity findings automatically deny future API calls.
3. Disable CloudTrail so the attacker cannot see the API history.
4. Keep GuardDuty for detection and add preventive IAM or resource controls.

Correct Answer: D

 

Correct Answer

Answer D is correct because GuardDuty produces findings; preventing the API operation requires authorization or resource controls that reject it.

Incorrect Answers

Answer A is incorrect because Immutable evidence can protect records but has no effect on whether the principal is authorized to call the API.

Answer B is incorrect because Finding severity affects prioritization, not IAM authorization; GuardDuty does not become an inline API deny control.

Answer C is incorrect because CloudTrail records activity for defenders and disabling it would reduce evidence without preventing misuse.

 

Question 24

A company wants one consistent AWS WAF policy on several supported public applications in multiple accounts, while application teams continue to own their individual stacks. Which service can centrally apply and manage the web ACL policy at scale?

1. AWS Artifact
2. Use AWS Firewall Manager.
3. AWS Secrets Manager
4. Amazon Cognito

Correct Answer: B

 

Correct Answer

Answer B is correct because Firewall Manager can centrally manage security policies such as AWS WAF across accounts in an AWS Organization.

Incorrect Answers

Answer A is incorrect because Artifact provides compliance documentation and agreements, not enforcement of web request rules. It therefore does not satisfy the scenario’s decisive requirement: Application teams retain stack ownership.

Answer C is incorrect because Secrets Manager manages secret values and rotation, not centralized web ACL deployment. It therefore does not satisfy the scenario’s decisive requirement: Application teams retain stack ownership.

Answer D is incorrect because Cognito manages application identities and temporary credentials, not organization-wide WAF policy. It therefore does not satisfy the scenario’s decisive requirement: Application teams retain stack ownership.

 

Question 25

A Security Hub finding indicates that a public application is exposed because a web ACL rule was removed. The company wants a repeatable workflow that can react to selected findings and invoke approved remediation automation, while Security Hub remains the central findings view. Which design direction is most appropriate?

1. Store the finding in Secrets Manager and rotate it after remediation.
2. Replace Security Hub with CloudFront so findings become edge-cache events.
3. Give Security Hub permission to rewrite every application configuration automatically without an explicit workflow.
4. Route selected Security Hub findings to approved event-driven remediation.

Correct Answer: D

 

Correct Answer

Answer D is correct because This preserves Security Hub as the findings aggregator and uses event-driven automation for controlled remediation.

Incorrect Answers

Answer A is incorrect because A finding is not a credential; secret rotation has no role in applying configuration remediation.

Answer B is incorrect because CloudFront delivers content and does not replace a security findings aggregation and remediation workflow.

Answer C is incorrect because Security Hub centralizes findings; broad implicit configuration authority is neither required nor a controlled remediation design.