Amazon SAA-C03 Dumps - Pass AWS Certified Solutions Architect - Associate Exam in 2026

The correct answer isBbecause the company wants to view bothAmazon EKS clustersandon-premises Kubernetes clustersfrom acentral locationwith theleast operational overhead.Amazon EKS Connectoris designed for this purpose. It allows externally managed Kubernetes clusters, including on-premises clusters, to be registered to AWS so they can be viewed in theAmazon EKS consolealongside native EKS clusters. This creates a centralized management experience without requiring the company to migrate or rebuild the existing on-premises clusters.

EKS Connector is a low-overhead solution because it extends visibility into Kubernetes environments that are not running directly on Amazon EKS. It provides centralized cluster registration and observability at the AWS management layer while preserving the existing cluster deployments. This is especially useful for hybrid Kubernetes environments where organizations want a single control point for inventory and visibility.

Option A is incorrect becauseAmazon CloudWatch Container Insightsis primarily for metrics, logs, and performance monitoring. Although it provides observability, it is not the primary service for centrally registering and viewing clusters themselves in a unified cluster-management context. Option C is incorrect becauseAWS Systems Manageris not the main service for centralized Kubernetes cluster management. Option D is incorrect becauseAmazon EKS Anywhereis used to run Kubernetes on-premises, but it is not the simplest way to centrally view existing clusters with the least operational effort.

AWS guidance for hybrid Kubernetes visibility recommendsAmazon EKS Connectorfor connecting external Kubernetes clusters to AWS. Therefore, it is the most appropriate solution.

AWS WAF allows web applications to protect themselves from common web exploits and vulnerabilities. Using AWS managed rule groups ensures protection against known attack patterns, such as SQL injection and cross-site scripting. Associating AWS WAF with the ALB provides application-layer security and real-time threat mitigation.

CloudFront Signed URLs: These URLs allow you to provide limited access to content that is being served through an Amazon CloudFront distribution. Signed URLs can be generated to grant time-limited access to premium customers.

Content Restriction:

By using CloudFront signed URLs, you can control access to your media streams and file content stored in S3.

These URLs can be customized with an expiration time, ensuring that access is only available for a specific period, which is useful for scenarios like movie rentals or music downloads.

Security and Flexibility:

Signed URLs ensure that only authenticated users (premium customers) can access the restricted content.

This approach integrates seamlessly with CloudFront and S3, providing an efficient way to manage access controls without additional overhead.

Operational Efficiency: Using CloudFront signed URLs leverages AWS managed services to handle the complexity of access control, reducing the need for custom implementation and maintenance.

Serving Private Content with Signed URLs and Signed Cookies

Amazon EFS requires a mount target in each Availability Zone where EC2 instances access the file system. This is because each mount target provides an elastic network interface in the subnet and AZ, reducing network latency by allowing EC2 instances to communicate locally with the EFS mount target. Creating a mount target in each AZ optimizes file system access performance and availability. Instances mount the EFS file system via the mount target in their respective AZ, which provides the lowest possible latency and avoids cross-AZ traffic.

Option A, with only a single mount target in the VPC, will cause cross-AZ traffic for instances in other AZs, increasing latency and potentially incurring data transfer costs. Option B is incomplete and introduces complexity with sharing directories across instances. Option C is invalid because mount targets are per AZ and per subnet, not per instance.

Amazon EFS Overview (https://docs.aws.amazon.com/efs/latest/ug/whatisefs.html)

Creating Mount Targets (https://docs.aws.amazon.com/efs/latest/ug/manage-fs-access.html#creating-mount-targets)

AWS Well-Architected Framework --- Performance Efficiency Pillar (https://d1.awsstatic.com/whitepapers/architecture/AWS_Well-Architected_Framework.pdf)

The IAM policy includes two statements:

1 Allow ec2:TerminateInstances on all resources

2 Deny ec2:TerminateInstances if the request does NOT come from:

192.0.2.0/24

203.0.113.0/24

AWS IAM policy evaluation rules state:

Explicit Deny always overrides Allow.

A request must meet all applicable conditions in the policy to be granted.

aws:SourceIp condition applies when IAM actions are invoked via the public AWS APIs.

In this scenario, the administrator is not originating the request from one of the allowed CIDR blocks, so the Deny condition is triggered, overriding the Allow statement.

Therefore, the operation is blocked with:

403 AccessDenied: explicit deny

This matches the behavior described in the AWS IAM Policy Evaluation Logic used in the Security Pillar of the Well-Architected Framework:

Explicit Deny > Allow > Default Deny

IP-based Conditions restrict API calls originating outside approved network ranges

Options A/B/C do not accurately reflect this explicit Deny condition behavior.