SOA-C03 — Frequently Asked Questions

Standard health checks only verify basic connectivity and response codes. They do not detect application-level logic errors or statefulness issues that cause random failures.

No. If session affinity is enabled, the ALB routes requests to the same instance regardless of the algorithm. Changing the algorithm does not resolve errors from a single broken instance holding a session.

Route 53 only evaluates health automatically for Alias records with 'Evaluate Target Health' set to Yes. Standard records require explicit health check association.

No. Reducing TTL only affects how quickly clients refresh cached DNS records. It does not make Route 53 aware of endpoint failures or exclude them from responses.

No, ALBs only support HTTP/HTTPS traffic. SMB uses different ports and protocols not supported by standard load balancers.

Storage Gateway primarily caches data locally and stores it in S3; it does not offer native Multi-AZ redundancy for the gateway instance itself.

While presigned URLs are secure, managing an EC2 instance to generate them adds administrative overhead. CloudFront OAC is a managed service that handles delivery and caching automatically.

No. OAC ensures that only CloudFront can access the private S3 bucket. End-users download from CloudFront, but the underlying S3 bucket remains completely private and protected by the account-level block.

Yes, you can replicate SSE-S3 encrypted objects across accounts as long as you grant the s3:ObjectOwnerOverrideToBucketOwner permission.

No, SSE-KMS is not required. You can use SSE-S3, but you must configure the ownership override permission in both the IAM role and bucket policy.

IAM roles define what the Lambda function can do internally. Resource policies define who can invoke the function. S3 needs explicit permission via the resource policy.

Yes, if any existing destination fails validation, S3 rejects the entire update. However, missing permissions on the new target is the primary architectural check.

An Internet Gateway allows instances to reach the internet but does not support inbound SSH initiation to private subnets securely.

No, NAT Gateways only support outbound internet traffic from private subnets, not inbound connections.

CloudWatch alarms are event-driven and trigger when a metric crosses a threshold. They cannot be scheduled to fire at a specific time every day.

No. StartInstances starts an instance that is in a stopped state. To reboot a running instance, you must use StopInstances followed by StartInstances, or use the Restart action in SSM.

Adding a policy scopes permissions but still requires permanent Access Keys, violating the requirement to avoid them.

Use AssumeRoleWithSAML when integrating with an external Identity Provider (like AD FS or Okta) that issues SAML assertions, not for direct SaaS SDK usage.