Amazon Web Services SAA-C03 Exam With Confidence Using Practice Dumps

AWS documentation states that the correct and least-privilege method for cross-account SNS-to-SQS integration is:

• Add specific SNS topic ARNs to the SQS queue policy.

• Allow only those topics to publish messages to the queue.

• Ensure SNS has permission to publish to the specific queue ARN.

This ensures strict scoping and adheres to least privilege.

Options A and D grant overly broad permissions. Option B allows publishing to any queue, which violates least privilege.

To handle increased loads effectively, it ' s essential to implement Auto Scaling for both frontend and backend tiers:

Frontend Auto Scaling Group: Scaling based on incoming network traffic ensures that the application can handle increased user requests.

Backend Auto Scaling Group: Scaling based on the Amazon SQS queue backlog ensures that the backend can process messages as they arrive, preventing delays.

This approach allows each tier to scale independently based on its specific load, ensuring optimal resource utilization and performance.

The correct answer isDbecause the company needs to authenticate users from anon-premises LDAP directoryto theAWS Management Console, but the directory isnot SAML-compatible. In this scenario, the AWS-recommended pattern is to use acustom identity brokerthat authenticates users against the existing LDAP directory and then requeststemporary AWS credentialsfromAWS Security Token Service (AWS STS). This enables federated access to AWS without creating long-term IAM user credentials for each person.

A custom identity broker serves as the intermediary between the non-SAML directory and AWS. After validating a user with LDAP, the broker can call AWS STS to issue short-lived credentials or console sign-in access. This approach preserves the use of the company’s existing identity source while meeting AWS security best practices for temporary credentials and centralized identity management.

Option A is incorrect becauseAWS IAM Identity Centertypically relies on supported identity sources and federation methods, and the question explicitly states that the LDAP directory is not SAML-compatible. Option B is incorrect because IAM policies do not integrate directly into LDAP as an authentication mechanism. Option C is incorrect because rotating IAM credentials tied to LDAP changes still relies on long-term credentials and does not provide a proper federated sign-in model.

AWS federation guidance supports the use of acustom identity brokerwhen an organization has a non-SAML-compatible identity system. Therefore, the best solution is to develop anon-premises custom identity brokerthat usesAWS STSto obtain short-lived credentials for AWS Management Console access.