SAA-C03 Design Secure Architectures Practice Test 2 — 15 Questions

Question 1

A web application is deployed on Amazon EC2 instances within a private subnet. The application must receive traffic from an Application Load Balancer (ALB) in a public subnet and connect to an Amazon RDS MySQL database in a different private subnet. Which TWO steps are required to secure this architecture using security groups?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the EC2 security group to allow inbound traffic on port 80/443 from the ALB security group.. Option A is correct because the EC2 instances must accept HTTP/HTTPS traffic from the ALB, and referencing the ALB's security group as the source on ports 80/443 restricts inbound access to only that load balancer rather than the whole internet. Option B is correct because the application tier must reach the RDS MySQL database on its listener port 3306, and using the EC2 security group as the source in the RDS security group's inbound rule limits database access to only those application instances. Option C is wrong because allowing 0.0.0.0/0 on port 80 would expose the instances directly to the internet, defeating the purpose of placing them in a private subnet behind an ALB. Option D is wrong because security groups are stateful, so return traffic for allowed inbound connections is automatically permitted and no outbound rule to the EC2 instances is needed; moreover, RDS does not initiate connections to the instances. Option E is wrong because it reverses the traffic direction: the ALB receives client traffic from the internet, not from the EC2 instances, so the ALB security group should allow inbound 80/443 from the internet (or appropriate clients), not from the EC2 security group.

Answer

Configure the EC2 security group to allow inbound traffic from 0.0.0.0/0 on port 80 to handle web traffic.

Answer

Configure the RDS security group to allow outbound traffic to the EC2 instances on all ports.

Answer

Configure the ALB security group to allow inbound traffic from the EC2 security group on port 80.

Question 2

Refer to the exhibit. A solutions architect reviews the following IAM policy applied to a user. What is the effect of this policy when the user attempts to access an object in the bucket from an IP address of 198.51.100.5?

Accepted Answer

Access is denied because the source IP address is not within the 203.0.113.0/24 range.. The policy includes a condition that restricts access to the IP range 203.0.113.0/24. Since the user's IP address (198.51.100.5) is outside this range, the condition evaluates to false, and the Allow statement does not apply. Therefore, the request is implicitly denied because there is no other Allow statement that grants access.

Answer

Access is allowed because the policy grants s3:GetObject permissions to the bucket.

Answer

Access is allowed because there is no explicit Deny statement in the policy.

Answer

Access is denied because the policy does not include permissions for the s3:ListBucket action.

Question 3

A company is concerned that its database credentials, currently stored as environment variables in AWS Lambda, are not being rotated regularly. Which AWS service should the company use to securely store and automatically rotate these credentials?

Accepted Answer

AWS Secrets Manager with its built-in rotation feature for Amazon RDS.. AWS Secrets Manager is purpose-built for storing secrets and provides native, automatic rotation using Lambda rotation functions, including built-in templates for Amazon RDS, Aurora, Redshift, and DocumentDB credentials. It integrates with RDS so the database password and the secret are rotated together without application downtime. This directly satisfies the requirement to store credentials securely and rotate them automatically.

Answer

AWS Systems Manager Parameter Store with SecureString parameters.

Answer

AWS Key Management Service (KMS) to encrypt the environment variables.

Answer

AWS Identity and Access Management (IAM) roles for the Lambda function.

Question 4

A company's public-facing application is experiencing a Distributed Denial of Service (DDoS) attack. The application is hosted on EC2 instances behind an Application Load Balancer (ALB). Which TWO AWS services or features can be used to mitigate this attack and protect the application?

Accepted Answer

AWS Shield Advanced for enhanced DDoS detection and mitigation.. Protecting against DDoS attacks requires a multi-layered approach. AWS Shield provides automatic protection for all AWS customers, while Shield Advanced offers enhanced detection and mitigation for sophisticated attacks. AWS WAF complements this by allowing administrators to create rules that block malicious traffic patterns, such as SQL injection or high-volume IP addresses.

Answer

Amazon GuardDuty to identify and block malicious traffic at the VPC level.

Answer

Amazon Inspector to scan EC2 instances for vulnerabilities during the attack.

Answer

AWS PrivateLink to hide the application from the public internet.

Question 5

A security team needs to identify and protect sensitive data, such as credit card numbers and passport IDs, that may be stored across hundreds of S3 buckets in multiple AWS accounts. Which service should they use to automate this discovery process?

Accepted Answer

Amazon Macie to scan S3 buckets for personally identifiable information (PII).. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in S3. It provides a centralized view of where sensitive data resides and how it is being accessed or moved, which is critical for compliance.

Answer

Amazon GuardDuty to monitor S3 data plane events for suspicious activity.

Answer

AWS Glue to crawl S3 buckets and catalog the data types found in the files.

Answer

Amazon Inspector to perform deep packet inspection on data uploaded to S3.

Question 6

An organization is using AWS Control Tower to manage multiple AWS accounts. They need to implement a set of guardrails to ensure that all accounts remain compliant with security best practices. Which THREE components or features are part of a standard AWS Control Tower landing zone implementation?

Accepted Answer

Preventive guardrails implemented using Service Control Policies (SCPs).. Option A is correct because AWS Control Tower preventive guardrails are enforced through Service Control Policies (SCPs) attached to OUs, which restrict what actions member accounts can perform. Option B is correct because detective guardrails in Control Tower are implemented as AWS Config rules (often deployed via conformance packs) that detect and flag noncompliant resources. Option C is correct because a standard Control Tower landing zone provisions a dedicated log archive account for centralized logging and an audit (security tooling) account for security and compliance tooling. Option D is incorrect because Amazon Macie is not enabled by default on all S3 buckets as part of the landing zone; it is an optional data-security service. Option E is incorrect because GuardDuty is not automatically enabled across all accounts by Control Tower itself; it can be integrated via services like AWS Security Hub or delegated administration, but it is not a built-in landing zone component.

Answer

Amazon Macie enabled by default on all S3 buckets in member accounts.

Answer

Amazon GuardDuty for automated threat detection across all accounts.

Question 7

A company wants to improve the security of its Amazon RDS for PostgreSQL database. They want to eliminate the need for storing database passwords in application code and simplify the management of database access for their EC2-based applications. Which solution should they implement?

Accepted Answer

Configure the RDS instance to use IAM Database Authentication and assign a role to the EC2 instances.. IAM Database Authentication for RDS for PostgreSQL lets EC2 instances (or other AWS principals) authenticate to the database using short-lived authentication tokens generated from their IAM role credentials, so no static database password is ever stored in application code. The EC2 instance assumes an IAM role, and the RDS instance is configured to allow IAM authentication; the application then calls generate-db-auth-token (or the SDK equivalent) to obtain a 15-minute token used as the password. This eliminates password storage and centralizes access management through IAM policies, satisfying both the security and simplification goals.

Answer

Use AWS Secrets Manager to store the RDS credentials and retrieve them at runtime.

Answer

Enable SSL/TLS encryption for all database connections to protect the password in transit.

Answer

Store the database password in a private S3 bucket and allow the EC2 instances to read the file.

Question 8

Refer to the exhibit. A security audit identifies that data is being transmitted to an S3 bucket named 'corporate-data' without encryption in transit. Which behavior does this bucket policy enforce to address this concern?

Accepted Answer

It denies any S3 action if the request does not use an encrypted connection (HTTPS).. The bucket policy denies any S3 action if the request does not use an encrypted connection (HTTPS). This is enforced by a condition like aws:SecureTransport: false, which blocks HTTP requests. This directly addresses the concern of data in transit being unencrypted.

Answer

It ensures that all objects stored in the bucket are encrypted using AES-256 server-side encryption.

Answer

It logs all access attempts to the bucket to identify users who are not using SSL.

Answer

It automatically redirects all HTTP requests to HTTPS for the specified S3 bucket.

Question 9

An organization needs to perform continuous security assessments of its Amazon EC2 instances to identify software vulnerabilities and unintended network exposure. Which service should they use to automate these assessments and provide a centralized view of the findings?

Accepted Answer

Amazon Inspector to automatically discover and scan EC2 instances for vulnerabilities.. Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads for software vulnerabilities and unintended network exposure. It is particularly effective for EC2 instances as it can scan both the operating system and the installed applications, providing detailed findings and remediation advice to improve the security posture.

Answer

AWS Trusted Advisor to check for security groups that allow unrestricted access.

Answer

AWS CloudTrail to monitor and log all API calls made to the EC2 instances.

Answer

VPC Flow Logs to analyze traffic patterns and identify potential security threats.

Question 10

A company is building a mobile application that needs to authenticate users and allow them to upload photos directly to an Amazon S3 bucket. Which TWO Amazon Cognito components should be used to provide a secure and scalable solution?

Accepted Answer

Amazon Cognito User Pools to manage user registration and sign-in.. Option A is correct because Amazon Cognito User Pools provide a scalable, managed user directory that handles registration, sign-in, and token issuance (ID, access, and refresh tokens) for the mobile app's authentication layer. Option B is correct because Cognito Identity Pools exchange the User Pool token for temporary, scoped AWS credentials via AWS STS, allowing the app to upload photos directly to S3 without embedding long-term keys. Together they implement the standard authentication-plus-authorization pattern for mobile apps accessing AWS services. Option C (Cognito Sync) is a legacy data-synchronization service, not an authentication or credential-vending mechanism, and is not needed here. Option D (IAM Users per app user) is an anti-pattern for mobile apps because it requires distributing long-term credentials and does not scale. Option E (AWS Directory Service) is for integrating existing AD/ LDAP directories and does not provide the mobile-native sign-up/sign-in or temporary credential flow required.

Answer

Amazon Cognito Sync to synchronize user data across multiple devices.

Answer

IAM Users for each mobile application user to control S3 access.

Answer

AWS Directory Service to integrate with an on-premises Active Directory.

Question 11

A company wants to ensure that its internal applications can access Amazon S3 without the traffic ever leaving the AWS network or passing through the public internet. What should they implement to achieve this securely?

Accepted Answer

Create a VPC Gateway Endpoint for Amazon S3 and update the route tables.. A VPC Gateway Endpoint for Amazon S3 provides a private, logical connection between a VPC and S3 that keeps traffic on the AWS backbone and never traverses the public internet. Updating route tables to direct S3-bound traffic to the gateway endpoint ensures instances in private subnets reach S3 privately.

Answer

Configure a NAT Gateway in a public subnet to route S3 traffic.

Answer

Use an AWS Direct Connect connection between the VPC and S3.

Answer

Set up a VPN connection between the private subnet and the S3 service.

Question 12

An organization needs to issue and manage SSL/TLS certificates for its internal microservices, which are not accessible from the public internet. They want to avoid the overhead of managing their own PKI infrastructure. Which service should they use?

Accepted Answer

AWS Certificate Manager (ACM) Private Certificate Authority (PCA).. AWS Certificate Manager (ACM) Private Certificate Authority (PCA) is a managed private CA service that helps you easily and securely manage the lifecycle of your private certificates. It eliminates the need for organizations to maintain their own complex and costly internal PKI while still providing the security of private certificates.

Answer

AWS Certificate Manager (ACM) to request public certificates for the services.

Answer

AWS CloudHSM to store and manage the private keys for the certificates.

Answer

Amazon Inspector to audit the certificates used by the microservices.

Question 13

A company is hosting a multi-tier web application on AWS using Amazon EC2 instances in a private subnet behind an Application Load Balancer (ALB). The security team requires that all incoming web traffic is encrypted in transit from the client to the ALB and from the ALB to the backend EC2 instances. Which combination of configurations meets these requirements?

Accepted Answer

Configure an HTTPS listener on the ALB using an ACM certificate and configure the backend instances to accept HTTPS traffic.. To encrypt traffic from client to ALB, an HTTPS listener with an ACM certificate is required. To encrypt traffic from ALB to backend EC2 instances, the backend must accept HTTPS (TLS) traffic, which means the ALB target group protocol must be HTTPS and the instances must have certificates installed and be listening on the HTTPS port. Option C is the only one that satisfies both requirements.

Answer

Configure an HTTP listener on the ALB and configure the backend instances to accept HTTP traffic on port 80.

Answer

Configure an HTTPS listener on the ALB and route traffic to the backend instances using HTTP on port 80.

Answer

Configure a TCP listener on the ALB and install self-signed certificates directly on the target EC2 instances.

Question 14

A company is hosting a sensitive web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The compliance team requires that all data at rest must be encrypted using keys that are rotated annually, and all access to these keys must be logged for auditing purposes. Which solution meets these requirements with the least administrative effort?

Accepted Answer

Encrypt the EC2 EBS volumes using AWS KMS with automatic key rotation enabled.. AWS KMS with automatic key rotation enabled on the EBS encryption key satisfies annual rotation, and KMS logs every key operation to CloudTrail for auditing. EBS encryption at rest is configured at the volume level using a KMS CMK, and enabling rotation is a single checkbox or API call — the least administrative effort. CloudHSM and third-party tools require manual rotation and more operational overhead.

Answer

Use AWS CloudHSM to manage encryption keys and manually rotate them every year.

Answer

Implement a third-party encryption tool on the EC2 instances and store keys in an S3 bucket.

Answer

Use Amazon S3 SSE-S3 to encrypt the EBS volumes and monitor access via VPC Flow Logs.

Question 15

A security engineer needs to block a specific range of malicious IP addresses from accessing an entire subnet within a VPC. The solution must ensure that the traffic is rejected before it reaches any EC2 instances. Which AWS feature should be used to implement this restriction?

Accepted Answer

Network Access Control Lists (NACLs). Network ACLs are stateless, subnet-level firewalls that evaluate traffic before it reaches any EC2 instance, making them the correct tool to block a malicious IP range at the subnet boundary. Because NACLs support explicit deny rules with CIDR ranges, they can reject the traffic before it hits the instances.

Answer

Security Groups

Answer

AWS WAF

Answer

AWS Shield Standard