SAA-C03 Design Secure Architectures Practice Test 3 — 15 Questions

Question 1

A solutions architect is designing a storage solution for a financial firm. The firm requires that data stored in Amazon S3 must be protected against accidental deletion and all changes to the data must be versioned. Which TWO features should the architect implement to meet these requirements? (Select TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable S3 Versioning on the bucket.. Option A is correct because enabling S3 Versioning on the bucket preserves every prior version of an object, so overwrites and deletes create new versions rather than destroying data, directly satisfying the requirement that all changes to the data be versioned. Option B is correct because MFA Delete adds a second authentication factor requiring the bucket owner's MFA token plus a valid request to permanently delete an object version or to suspend versioning, which protects the versioned data against accidental or malicious deletion. Together, Versioning provides the version history and MFA Delete guards the deletion of those versions, which is exactly the combination the financial firm needs. Option C is not appropriate because Lifecycle policies only transition or expire objects and do not provide versioning or deletion protection. Option D is not appropriate because S3 Object Lock in Governance mode enforces a retention period (WORM) rather than versioning all changes, and Governance mode can be bypassed by users with special permissions. Option E is not appropriate because Block Public Access only restricts public exposure of the bucket and has nothing to do with versioning or protecting against deletion.

Answer

Implement S3 Lifecycle policies to move data to Glacier.

Answer

Configure a Default Retention Period using S3 Object Lock in Governance mode.

Answer

Use S3 Block Public Access at the account level.

Question 2

Refer to the exhibit. A company has applied the following bucket policy to an S3 bucket named 'finance-reports'. A user is attempting to download a file from this bucket from the IP address 203.0.113.15 using an authenticated session without MFA. What will be the result of this request?

Accepted Answer

The request will be denied because both conditions must be true for the policy to grant access.. S3 bucket policy conditions are evaluated with AND logic by default — all conditions in a single Condition block must be true for the statement to apply. Since the request comes from an allowed IP but lacks MFA authentication, the Bool condition (aws:MultiFactorAuthPresent = true) fails, so the policy does not grant access and the request is denied.

Answer

The request will be allowed because the IP address is within the allowed range.

Answer

The request will be allowed because the 'Bool' condition is only evaluated if MFA is configured.

Answer

The request will be denied because S3 bucket policies require an explicit 'Deny' statement to block traffic.

Question 3

A company's security team identifies that its public-facing web application is being targeted by SQL injection and cross-site scripting (XSS) attacks. The application is running on EC2 instances behind an Application Load Balancer (ALB). Which service should the solutions architect implement to protect the application from these specific web-based attacks?

Accepted Answer

AWS WAF. AWS WAF is purpose-built to inspect HTTP/HTTPS requests at Layer 7 and block application-layer exploits such as SQL injection and cross-site scripting. It integrates natively with ALB, CloudFront, and API Gateway, and provides managed rule groups (e.g., AWSManagedRulesSQLiRuleSet, AWSManagedRulesCommonRuleSet) that detect these exact attack patterns. Because the workload sits behind an ALB, WAF can be attached directly to the load balancer to filter malicious requests before they reach the EC2 instances.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 4

A company needs to store database credentials for an application running on Amazon ECS. The credentials must be encrypted and automatically rotated every 30 days without requiring an application restart. Which TWO AWS services should be used together to achieve this? (Select TWO)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager (A) is correct because it is purpose-built to store and encrypt database credentials and natively supports automatic rotation on a schedule such as every 30 days, so the ECS application can retrieve the latest secret without a restart. AWS Lambda (B) is correct because Secrets Manager rotation is implemented by a Lambda rotation function that performs the four-step rotation (createSecret, setSecret, testSecret, finishSecret) against the database. AWS Systems Manager Parameter Store (C) can hold encrypted parameters but does not provide built-in automatic rotation, so it does not meet the 30-day rotation requirement. AWS Key Management Service (D) provides the encryption keys used by Secrets Manager but is not itself a secret store or rotation scheduler, so it is not one of the two services to use together. Amazon DynamoDB (E) is a NoSQL database service and has no role in storing or rotating application credentials.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

Amazon DynamoDB

Question 5

A company wants to implement a service that continuously monitors for malicious activity and unauthorized behavior across its AWS accounts, such as cryptocurrency mining or unusual API calls. Which AWS service should they use?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that continuously monitors AWS accounts for malicious activity and unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence. It specifically detects findings like cryptocurrency mining, unusual API calls, and compromised instances, which matches the requirement exactly.

Answer

Amazon Macie

Answer

AWS Config

Answer

AWS CloudTrail

Question 6

Refer to the exhibit. A security administrator is reviewing a CloudTrail log entry for an 'Access Denied' error. The user 'Alice' is trying to upload a file to an S3 bucket. Alice has an IAM policy that allows 's3:PutObject' on all resources. What is the most likely cause of this error?

Accepted Answer

The S3 bucket has a bucket policy with an explicit Deny for Alice or the action.. In AWS, access is determined by the intersection of all applicable policies. Even if Alice has an IAM policy allowing the action, an 'Access Denied' error can occur if there is an explicit 'Deny' in a Service Control Policy (SCP), a bucket policy, or if there is a Permissions Boundary restricting her actions.

Answer

Alice is not using an encrypted connection (HTTPS) to upload the file.

Answer

The S3 bucket is located in a different region than the IAM user.

Answer

Alice's IAM user is missing the 's3:ListBucket' permission.

Question 7

A large enterprise uses AWS Organizations to manage multiple accounts. The Chief Information Security Officer (CISO) wants to ensure that no account within the organization can create any resources in regions other than 'us-east-1' and 'us-west-2'. What is the most efficient way to enforce this across the entire organization?

Accepted Answer

Apply a Service Control Policy (SCP) to the organization root that denies all actions if the region is not 'us-east-1' or 'us-west-2'.. SCPs are the only AWS Organizations mechanism that centrally enforce permission guardrails across every account in the OU/root, and they apply to all principals including the root user. A deny statement conditioned on aws:RequestedRegion outside us-east-1/us-west-2 blocks resource creation in unauthorized regions before the API call succeeds. Attaching it at the organization root propagates the restriction to every member account with a single policy, which is the most efficient approach.

Answer

Create an IAM Group in the management account with a region-restrictive policy and add all users to it.

Answer

Use AWS Config rules in each account to monitor resource creation and delete any resource found in unauthorized regions.

Answer

Configure a VPC Endpoint for all services and restrict access to specific regions using VPC Endpoint policies.

Question 8

A healthcare company must store patient records in Amazon S3 for a minimum of 7 years to meet regulatory requirements. During this period, the records must not be deleted or modified by any user, including the root user. Which S3 feature should be used to enforce this?

Accepted Answer

S3 Object Lock in Compliance mode. S3 Object Lock provides Write-Once-Read-Many (WORM) protection. When configured in Compliance mode, an object version cannot be deleted or overwritten by any user, including the root user, for the duration of the retention period. This is the only way to satisfy strict regulatory requirements for data immutability.

Answer

S3 Versioning with MFA Delete

Answer

S3 Object Lock in Governance mode

Answer

S3 Lifecycle policy with an expiration of 7 years

Question 9

A company is building a zero-trust architecture for its internal microservices running on Amazon EKS. Which THREE steps should the solutions architect take to ensure secure, least-privilege communication between services? (Select THREE)

Accepted Answer

Assign IAM Roles to individual Kubernetes Service Accounts (IRSA).. Option A is correct because IAM Roles for Service Accounts (IRSA) lets each Kubernetes Service Account assume a distinct IAM role via the EKS OIDC provider, so individual microservices receive only the AWS permissions they need, which is a core least-privilege control in a zero-trust model. Option B is correct because AWS App Mesh enforces mutual TLS (mTLS) between microservices, providing cryptographic identity verification and encrypted service-to-service traffic so that no service is trusted merely by network location. Option C is correct because Security Groups for Pods (using the VPC CNI and ENI trunking) applies EC2 security group rules directly to pod ENIs, enabling fine-grained, least-privilege network segmentation between specific services. Option D is not appropriate because placing all microservices in a single public subnet exposes them to the internet and removes the network segmentation that zero-trust requires. Option E is not appropriate because disabling VPC Flow Logs reduces visibility and auditability of traffic, which is essential for detecting and investigating lateral movement in a zero-trust architecture.

Answer

Place all microservices in a single public subnet to simplify routing.

Answer

Disable VPC Flow Logs to reduce latency between microservices.

Question 10

A data analytics company stores massive amounts of data in Amazon S3. They need a way to automatically identify and flag sensitive data, such as Personally Identifiable Information (PII) or financial records, to ensure it is not being mishandled. Which AWS service is designed for this task?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service. It uses machine learning and pattern matching to automatically discover and protect sensitive data in Amazon S3. Macie provides a dashboard and findings that alert the security team to PII, helping them maintain data privacy compliance.

Answer

Amazon GuardDuty

Answer

AWS Glue

Answer

Amazon Inspector

Question 11

A company is launching a high-profile marketing campaign and expects a significant increase in traffic. They are concerned about potential Distributed Denial of Service (DDoS) attacks targeting their Application Load Balancer. Which AWS service provides advanced protection and includes 24/7 access to the AWS Shield Response Team (SRT)?

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced provides expanded DDoS protection for web applications. Unlike the free Standard tier, it includes additional mitigation capabilities, 24/7 access to the Shield Response Team, and financial protection against bill spikes caused by DDoS attacks, making it ideal for high-profile applications.

Answer

AWS Shield Standard

Answer

AWS WAF

Answer

AWS Global Accelerator

Question 12

A company is developing a mobile application that allows users to sign in using their social media accounts (e.g., Google or Facebook). After signing in, the application needs to obtain temporary AWS credentials to upload photos directly to an Amazon S3 bucket. Which service should the architect use?

Accepted Answer

Amazon Cognito. Amazon Cognito provides identity pools that directly support social identity providers (Google, Facebook, Amazon, Apple) and exchange the resulting tokens for temporary, scoped AWS credentials via STS. This is the managed, recommended way to implement web identity federation for mobile apps without building the token-exchange flow yourself. Cognito user pools handle authentication, and identity pools handle AWS credential vending.

Answer

AWS IAM User with static access keys

Answer

AWS Directory Service

Answer

AWS Security Token Service (STS) with a manual web identity federation implementation

Question 13

A company is migrating a web application to AWS and needs to ensure that all data stored in Amazon S3 is encrypted at rest using keys managed by the company. The company must be able to rotate these keys annually and maintain full control over key access policies. Which solution meets these requirements?

Accepted Answer

Use AWS KMS with Customer Managed Keys.. AWS KMS Customer Managed Keys (CMKs) give the company full control over the key policy, allow annual rotation to be enabled, and support auditing via CloudTrail. SSE-S3 uses AWS-owned keys the customer cannot manage or rotate, and AWS Managed Keys have rotation controlled by AWS (every three years) with policies the customer cannot edit. Uploading a raw master key to S3 is not a supported KMS pattern.

Answer

Enable S3 Managed Keys (SSE-S3) for all buckets.

Answer

Use AWS KMS with AWS Managed Keys.

Answer

Upload a master key to AWS via the S3 console.

Question 14

A developer needs to access an Amazon RDS database from an EC2 instance within a private subnet. The database must only accept traffic from the instance. Which security configuration is most appropriate?

Accepted Answer

Configure the RDS security group to allow inbound traffic from the EC2 instance security group ID.. Configuring the RDS Security Group to allow inbound traffic on the database port exclusively from the security group ID associated with the EC2 instance follows the principle of least privilege. This stateful configuration ensures that only authorized resources can communicate with the database, significantly reducing the attack surface. By referencing the security group ID instead of an IP address, the architecture remains resilient to dynamic IP changes.

Answer

Configure the RDS security group to allow inbound traffic from 0.0.0.0/0 on the database port.

Answer

Configure the RDS security group to allow inbound traffic from the database's own IP address.

Answer

Configure the RDS security group to allow inbound traffic from the private IP of the EC2 instance.

Question 15

A company is designing a multi-tier application. The web tier is public, and the database tier is private. Which TWO actions should the architect take to ensure the database tier is secure? (Select TWO.)

Accepted Answer

Place the database instances in a private subnet.. Option B is correct because placing the database instances in a private subnet removes them from direct internet reachability, since private subnets have no route to an Internet Gateway, which is the foundational control for protecting a database tier. Option C is correct because referencing the web tier's security group as the source in the database security group's inbound rule enforces least-privilege, instance-level access so only the web tier can reach the database on the required port (for example, 3306 for MySQL or 5432 for PostgreSQL). Option A is wrong because a public subnet is routable to the internet, so even with a restrictive Network ACL the database would still be exposed at the subnet level. Option D is wrong because attaching an Internet Gateway to the private subnet's route table would make that subnet public and expose the database to inbound internet traffic. Option E is wrong because allowing all internet traffic to the database via a Network ACL directly violates the requirement to keep the database tier private and secure.

Answer

Place the database instances in a public subnet with a restrictive Network ACL.

Answer

Attach an Internet Gateway to the private subnet route table.

Answer

Use a Network ACL to allow all traffic from the internet to the database.