ExamNova

Design Secure Architectures

This domain carries 30% of the SAA-C03 exam. Practise it with original questions that explain every answer option.

Practise this domain free

Certification
SAA-C03
Exam weight
30%
Subdomains
3
Objectives
22

What this domain covers

Design Secure Access to AWS Resources8 topics
Design Secure Workloads and Applications9 topics
Determine Appropriate Data Security Controls5 topics

Example question from this domain

An Amazon EKS cluster in private subnets pulls images from Amazon ECR in the same Region. The Region supports Amazon ECR FIPS endpoint services. Policy requires the ECR API and registry connections to use the supported FIPS endpoints, and no image-pull traffic can use a NAT gateway or public path. Which VPC endpoint design meets these requirements?

  • Create the `ecr-fips.api` and `ecr-fips.dkr` interface endpoints with private DNS, and create an Amazon S3 gateway endpoint for image layers.
  • Create the standard `ecr.api` and `ecr.dkr` interface endpoints with private DNS, and create an Amazon S3 gateway endpoint for image layers.
  • Create the `ecr-fips.api` and `ecr-fips.dkr` interface endpoints with private DNS, and route Amazon S3 image-layer traffic through a NAT gateway.
  • Create the `ecr-fips.api` interface endpoint with private DNS and an Amazon S3 gateway endpoint, but do not create a Docker registry endpoint.

Create the `ecr-fips.api` and `ecr-fips.dkr` interface endpoints with private DNS, and create an Amazon S3 gateway endpoint for image layers. — The ECR API and Docker registry use separate interface endpoint services. Amazon ECR stores image layers in Amazon S3, so the S3 gateway endpoint completes the private pull path. The FIPS service names satisfy the stated ECR connection requirement in a supported Region.

Create the standard `ecr.api` and `ecr.dkr` interface endpoints with private DNS, and create an Amazon S3 gateway endpoint for image layers. — This is the usual private ECR endpoint design when FIPS endpoints are not required. The stem specifically requires the supported FIPS API and registry endpoint services.

Create the `ecr-fips.api` and `ecr-fips.dkr` interface endpoints with private DNS, and route Amazon S3 image-layer traffic through a NAT gateway. — Amazon S3 supplies the image layers. Sending that traffic through a NAT gateway conflicts with the requirement that no part of the image pull use a public or NAT path.

Create the `ecr-fips.api` interface endpoint with private DNS and an Amazon S3 gateway endpoint, but do not create a Docker registry endpoint. — The API endpoint supports ECR API operations, while Docker push and pull operations use the separate registry endpoint. Omitting `ecr-fips.dkr` leaves the registry portion of the pull path incomplete.

Continue with SAA-C03

All SAA-C03 practiceAll certifications

Domain names and weightings follow the vendor's published exam guide. ExamNova questions are written in-house and are not exam dumps.