SAA-C03 Design Secure Architectures — 10 Questions

Question 1

Refer to the exhibit. An IAM user has the following policy attached. The user attempts to download a file named 'config.json' located in the 'secrets' folder of the 'app-logs' S3 bucket. What will be the result of this action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Access is denied because an explicit deny overrides any allow statement.. The prompt references an exhibit with an IAM user policy, but no exhibit or policy text is provided in the stem. Therefore, the question cannot be properly validated.

Answer

Access is allowed because the first statement grants GetObject permissions for the whole bucket.

Answer

Access is denied because the policy does not include the s3:PutObject permission.

Answer

Access is allowed because the ListBucket action permits viewing all objects in the bucket.

Question 2

A company is migrating a legacy application that uses a custom encryption library. They want to move to AWS KMS but must ensure that even the AWS account administrator cannot use the keys unless they are explicitly granted access in the key policy. How should the key policy be configured?

Accepted Answer

Modify the key policy to remove the default statement that grants the root user full access to the key.. By default, a KMS key policy includes a statement granting the AWS account root user full access to the key. Removing that statement ensures that even the account administrator cannot use the key unless explicitly granted access in the key policy. This is the only way to restrict root-level access because IAM policies alone cannot override the key policy's root grant.

Answer

Create an IAM policy for the administrator that explicitly denies all kms:Decrypt actions.

Answer

Grant the administrator 'kms:*' permissions in the key policy but use a condition to restrict access to their IP address.

Answer

Use a KMS key alias and only grant the application permission to access the alias.

Question 3

A financial institution stores highly sensitive customer records in Amazon S3 buckets. The Chief Information Security Officer mandates that all uploaded objects must be encrypted at rest using unique keys, and the key material must be fully managed and rotated automatically by AWS. Which TWO actions fulfill these security requirements? (Choose two.)

Accepted Answer

Configure Amazon S3 default encryption using AWS KMS keys (SSE-KMS) with AWS managed keys.. Option B is correct because SSE-KMS with AWS managed keys (aws/s3) encrypts each object with a unique data key derived from a KMS customer master key, and AWS fully manages and automatically rotates that key material, satisfying both the unique-key and automatic-rotation mandates. Option E is correct because a bucket policy that denies PUT requests lacking the x-amz-server-side-encryption header enforces that every uploaded object is encrypted at rest server-side, preventing unencrypted uploads and complementing the default encryption configuration. Option A is not correct because SSE-S3 uses a single AWS-owned master key with no customer-visible key management or configurable automatic rotation, so it does not meet the 'fully managed and rotated' requirement as specified. Option C is not correct because client-side encryption with locally stored custom keys places key management and rotation burden on the institution, not AWS, and risks key loss. Option D is not correct because versioning and MFA delete address data durability and deletion protection, not encryption at rest with unique, AWS-managed, auto-rotated keys.

Answer

Configure Amazon S3 default encryption using Amazon S3 managed encryption keys (SSE-S3).

Answer

Implement client-side encryption using custom keys stored locally on the user's workstation.

Answer

Enable S3 Bucket Versioning and enforce multi-factor authentication delete operations.

Question 4

Refer to the exhibit. A Solutions Architect implemented an Amazon S3 bucket policy to restrict access to corporate network ranges. However, users connecting from corporate laptops inside the approved CIDR block report that they cannot write objects using AWS Lambda functions configured in the same VPC. What is the cause of this access failure?

Accepted Answer

Lambda functions operating within a VPC communicate with S3 through VPC endpoints, causing the source IP to be evaluated as the VPC private IP rather than the corporate CIDR block.. When a Lambda function is configured inside a VPC, its outbound traffic to S3 does not originate from the function's public IP or the corporate CIDR — it originates from the private IP of the Lambda ENI in the VPC subnet. If the Lambda uses a VPC endpoint (Gateway or Interface) to reach S3, the source IP seen by S3 is the private IP of the ENI or the endpoint, not the corporate CIDR block. Therefore the bucket policy's IpAddress condition (aws:SourceIp) fails to match, and the write is denied.

Answer

The S3 bucket policy lacks explicit permission for the AWS Lambda service principal in the Principal element.

Answer

The Action element uses a wild-card s3:* which is prohibited by AWS security guardrails for production storage buckets.

Answer

Amazon S3 bucket policies do not support IP-based conditional evaluations for compute resources such as Lambda functions.

Question 5

A company is extending its on-premises data center to AWS and requires a secure, high-bandwidth connection that does not traverse the public internet. The connection must support consistent network performance. Which TWO components are needed to establish this connectivity? (Select TWO)

Accepted Answer

AWS Direct Connect. AWS Direct Connect (A) is correct because it provides a dedicated, private physical network connection from the on-premises data center to AWS that bypasses the public internet and delivers consistent, high-bandwidth performance. A Virtual Private Gateway (B) is correct because it is the AWS-side VPN gateway that attaches to the VPC and terminates the private virtual interface (VIF) used by the Direct Connect connection, enabling traffic to reach the VPC. Together, Direct Connect plus a Virtual Private Gateway form the standard architecture for private, high-bandwidth hybrid connectivity. An Internet Gateway (C) is not needed because it routes traffic over the public internet, which the scenario explicitly excludes. A NAT Gateway (D) only provides outbound internet access for private subnets and does not establish hybrid connectivity. AWS Client VPN (E) is a software-based remote-access VPN for individual users over the internet, not a dedicated high-bandwidth data center link.

Answer

Internet Gateway

Answer

NAT Gateway

Answer

AWS Client VPN

Question 6

An organization wants to centralize logging for all AWS accounts within an AWS Organization. Which service should be used to aggregate logs into a single, secure, and immutable location for security analysis?

Accepted Answer

AWS CloudTrail with an Organization Trail.. AWS CloudTrail with an Organization Trail is the correct service to centralize logging for all AWS accounts in an AWS Organization. An Organization Trail logs events for all accounts in the organization and delivers them to a single S3 bucket, providing a secure and immutable location for security analysis.

Answer

AWS CloudWatch Logs in each account.

Answer

AWS Config with local S3 buckets.

Answer

AWS GuardDuty configured per account.

Question 7

A company wants to secure its S3 data. The security policy requires that all objects be encrypted at rest and that the company retains full control over the rotation of the encryption keys. Which TWO of the following should the architect choose to satisfy these requirements?

Accepted Answer

Use AWS KMS with Customer Managed Keys (SSE-KMS).. Option B (SSE-KMS with Customer Managed Keys) is correct because customer managed keys in AWS KMS give the company control over key rotation, either through automatic annual rotation or manual rotation, while still encrypting all objects at rest with a KMS key. Option E (a Key Policy for the KMS CMK) is correct because the key policy is the primary access control mechanism for a customer managed key, defining which principals can use and manage the key, which is essential to retaining full control over the encryption keys. Option A (SSE-S3) is incorrect because Amazon S3 managed keys are rotated automatically by AWS and the customer has no control over rotation. Option C (aws:SecureTransport bucket policy) is incorrect because it only enforces encryption in transit via TLS, not encryption at rest or key rotation control. Option D (versioning) is incorrect because versioning preserves object versions for durability and recovery, not historical key state or key rotation control.

Answer

Enable Amazon S3 Managed Keys (SSE-S3).

Answer

Configure S3 Bucket Policies to enforce the 'aws:SecureTransport' condition.

Answer

Enable versioning on the S3 bucket to ensure historical key state preservation.

Question 8

A company is concerned about unauthorized access and potential data exfiltration within their AWS environment. They need a service that can continuously monitor VPC Flow Logs, AWS CloudTrail management events, and DNS logs to identify suspicious activities using machine learning. Which solution should the architect recommend for centralized threat detection?

Accepted Answer

Enable Amazon GuardDuty and integrate it with AWS Organizations for cross-account visibility.. Amazon GuardDuty is a threat detection service that continuously monitors VPC Flow Logs, AWS CloudTrail management events, and DNS logs using machine learning and threat intelligence to identify suspicious activities. Integrating it with AWS Organizations enables centralized threat detection across all accounts, matching the requirement for cross-account visibility.

Answer

Configure AWS Inspector to perform network reachability assessments on all EC2 instances.

Answer

Deploy AWS Shield Advanced to protect all public-facing endpoints from DDoS attacks.

Answer

Use AWS Config to monitor changes in security group rules and VPC configurations.

Question 9

An enterprise requires all data stored in Amazon S3 to be encrypted at rest. The security team must maintain full control over the encryption keys, including the ability to rotate them annually and define access policies for the keys themselves. Which encryption method meets these requirements with the least operational overhead?

Accepted Answer

Use Server-Side Encryption with AWS KMS Customer Managed Keys (SSE-KMS).. SSE-KMS with Customer Managed Keys (CMKs) allows the security team to create and manage their own KMS keys, including setting key policies, rotating keys annually, and auditing key usage via CloudTrail. It provides full control over the encryption keys while offloading the encryption/decryption process to S3, minimizing operational overhead.

Answer

Use Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3) for all buckets.

Answer

Implement client-side encryption using a third-party library before uploading objects.

Answer

Enable Server-Side Encryption with Customer-Provided Keys (SSE-C) for all uploads.

Question 10

A security architect is designing a multi-tier application in a VPC. The requirement is to block all traffic from a specific range of malicious IP addresses (CIDR 192.0.2.0/24) while allowing standard web traffic (HTTPS) from all other sources to the web tier. Which TWO actions should the architect take to implement this? (Select TWO.)

Accepted Answer

Create an inbound rule in the Network ACL to deny traffic from 192.0.2.0/24.. Option A is correct because Network ACLs are stateless, subnet-level firewalls that support explicit deny rules, so an inbound deny rule for 192.0.2.0/24 blocks that malicious CIDR before it can reach any resource in the subnet. Option D is correct because Security Groups are stateful, instance-level firewalls that only support allow rules, so permitting inbound TCP port 443 from 0.0.0.0/0 allows standard HTTPS web traffic from all other sources to the web tier. Together these satisfy both requirements: the NACL denies the malicious range while the Security Group allows HTTPS from everywhere else. Option B is wrong because Security Groups cannot contain deny rules; they are allow-only. Option C is wrong because AWS Shield Standard provides automatic protection against common DDoS attacks and does not let you block a specific CIDR like 192.0.2.0/24. Option E is wrong because route tables control routing, not inbound filtering, and blackholing a destination CIDR would not block inbound traffic from that source to the web tier.

Answer

Add a deny rule to the web tier Security Group for CIDR 192.0.2.0/24.

Answer

Configure AWS Shield Standard to automatically block the 192.0.2.0/24 subnet.

Answer

Update the VPC Route Table to blackhole all traffic destined for 192.0.2.0/24.