A parks department streams fire-hydrant pressure readings into AWS and must keep the ingestion path off the public internet. The architecture should use a private streaming or API endpoint secured with IAM—not an out-of-scope IoT specialty service. Which design best meets that requirement?
Select an answer to reveal the explanation.
Short Explanation
Picture the hydrant feed like a private city radio channel, not a bullhorn on Main Street. You want readings to land on a locked private pipe—Kinesis or a private API—with IAM checking badges, not IoT Core (out of scope) and not a wide-open public PUT bucket.
Full Explanation
For parks hydrant telemetry, SAA-C03 secure-architecture design favors an in-scope ingestion plane that stays off the public internet and authenticates producers with IAM. Amazon Kinesis Data Streams or a private API Gateway integration, reached over VPC private networking (interface endpoints, private APIs, or equivalent private paths), gives the department a controlled pipe: readings land on a service the city owns, identity is evaluated with least-privilege roles, and there is no requirement to advertise a public PUT target. That pattern maps cleanly to Task-style guidance on securing workload ingress without inventing specialty IoT platforms.
A public S3 website endpoint with anonymous PUT fails on confidentiality and integrity: anyone who learns the URL can write or overwrite objects, and website hosting is not a hardened telemetry bus. An unauthenticated API Gateway HTTP API open to 0.0.0.0/0 fails for the same conceptual reason—security through obscurity is not IAM—and leaves the city unable to prove who published each reading. Selecting AWS IoT Core as the only acceptable answer fails exam-scope discipline: even when devices "feel like" IoT sensors, Associate-level designs must stay within services and patterns the exam covers rather than forcing a specialty control plane.
Exam caveat: private does not mean "no authentication." Pair private networking with IAM (and encryption in transit) so compromised bastions or misrouted clients still cannot publish without credentials. Operational check: confirm producers resolve private endpoints, deny public API stages, verify IAM policies allow only PutRecord/Invoke on the intended stream or API, and sample CloudTrail or stream metrics after a controlled hydrant simulator publish to prove traffic never required a public internet path.