SAP-C02 Q603 · Security

Question

IoT sensors are manufactured with certificates from a private CA. They must only connect to AWS after physical installation. What should the architect do?

Accepted Answer

**Option A: Use Lambda as a pre-provisioning hook to validate serial number before registration.**

Let's break down the requirements:

1. **Sensors have certificates from a private CA** — The devices already possess identity credentials from manufacturing.
2. **Must only connect to AWS after physical installation** — There must be a validation gate that prevents premature or unauthorized registration.

How Option A satisfies both:

- **AWS IoT Fleet Provisioning** supports a **pre-provisioning hook**, which is a Lambda function invoked *before* a device is fully registered in AWS IoT Core.
- When a device attempts to provision itself (e.g., after physical installation), the Lambda function is triggered and can **validate the device's serial number** against an approved list (e.g., a Dynam

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips