SAA-C03 Exam Dumps : AWS Certified Solutions Architect - Associate (SAA-C03)

Explanation (AWS Docs):

A: Use Direct Connect with a private VIF to ensure private connectivity from on-premises to AWS.

E: Peer the networking VPC with VPCs in the accounts hosting S3 buckets to allow private routing.

“A private virtual interface enables private connectivity to your VPC.”

— Direct Connect Private VIF

AWS WAF Bot Control is the best fit because the problem is abusive automated traffic submitting unnecessary requests and consuming compute resources. AWS documents that the Bot Control managed rule group is specifically designed to identify and manage bot traffic, including high-confidence bot signatures and common bot categories. This is more targeted than maintaining custom IP blocks and more directly aligned to the behavior described than general IP reputation controls. AWS Shield focuses on DDoS protection, not detailed application-layer bot categorization. Therefore, associating a WAF web ACL with the ALB and enabling Bot Control is the most appropriate solution.

============

A: Amazon Macie can scan S3 buckets for sensitive data and identify PII.

C: S3 Object Lock legal hold prevents object deletion until a review is complete, meeting compliance requirements.

E: EventBridge can trigger the Lambda function automatically when Macie detects sensitive data, creating an automated workflow.

AWS Documentation Extract:

" Amazon Macie automatically discovers, classifies, and protects sensitive data in AWS. You can use EventBridge to invoke a Lambda function for post-processing, such as applying Object Lock legal hold to flagged objects. "

(Source: AWS Macie and S3 Object Lock documentation)

B, D: Moving to Glacier Deep Archive or applying retention in governance mode is not specific to deletion prevention pending review.

F: MFA Delete adds a security layer but does not automate object retention for flagged PII.