SAA-C03 Design Secure Architectures — Timed 20 Questions

Question 1

Refer to the exhibit. An IAM user has the following policy attached. The user attempts to download a file named 'config.json' located in the 'secrets' folder of the 'app-logs' S3 bucket. What will be the result of this action?

20 minute time limit — choose an answer to begin.

Accepted Answer

Access is denied because an explicit deny overrides any allow statement.. The prompt references an exhibit with an IAM user policy, but no exhibit or policy text is provided in the stem. Therefore, the question cannot be properly validated.

Answer

Access is allowed because the first statement grants GetObject permissions for the whole bucket.

Answer

Access is denied because the policy does not include the s3:PutObject permission.

Answer

Access is allowed because the ListBucket action permits viewing all objects in the bucket.

Question 2

A company is migrating a legacy application that uses a custom encryption library. They want to move to AWS KMS but must ensure that even the AWS account administrator cannot use the keys unless they are explicitly granted access in the key policy. How should the key policy be configured?

Accepted Answer

Modify the key policy to remove the default statement that grants the root user full access to the key.. By default, a KMS key policy includes a statement granting the AWS account root user full access to the key. Removing that statement ensures that even the account administrator cannot use the key unless explicitly granted access in the key policy. This is the only way to restrict root-level access because IAM policies alone cannot override the key policy's root grant.

Answer

Create an IAM policy for the administrator that explicitly denies all kms:Decrypt actions.

Answer

Grant the administrator 'kms:*' permissions in the key policy but use a condition to restrict access to their IP address.

Answer

Use a KMS key alias and only grant the application permission to access the alias.

Question 3

A financial institution stores highly sensitive customer records in Amazon S3 buckets. The Chief Information Security Officer mandates that all uploaded objects must be encrypted at rest using unique keys, and the key material must be fully managed and rotated automatically by AWS. Which TWO actions fulfill these security requirements? (Choose two.)

Accepted Answer

Configure Amazon S3 default encryption using AWS KMS keys (SSE-KMS) with AWS managed keys.. Option B is correct because SSE-KMS with AWS managed keys (aws/s3) encrypts each object with a unique data key derived from a KMS customer master key, and AWS fully manages and automatically rotates that key material, satisfying both the unique-key and automatic-rotation mandates. Option E is correct because a bucket policy that denies PUT requests lacking the x-amz-server-side-encryption header enforces that every uploaded object is encrypted at rest server-side, preventing unencrypted uploads and complementing the default encryption configuration. Option A is not correct because SSE-S3 uses a single AWS-owned master key with no customer-visible key management or configurable automatic rotation, so it does not meet the 'fully managed and rotated' requirement as specified. Option C is not correct because client-side encryption with locally stored custom keys places key management and rotation burden on the institution, not AWS, and risks key loss. Option D is not correct because versioning and MFA delete address data durability and deletion protection, not encryption at rest with unique, AWS-managed, auto-rotated keys.

Answer

Configure Amazon S3 default encryption using Amazon S3 managed encryption keys (SSE-S3).

Answer

Implement client-side encryption using custom keys stored locally on the user's workstation.

Answer

Enable S3 Bucket Versioning and enforce multi-factor authentication delete operations.

Question 4

Refer to the exhibit. A Solutions Architect implemented an Amazon S3 bucket policy to restrict access to corporate network ranges. However, users connecting from corporate laptops inside the approved CIDR block report that they cannot write objects using AWS Lambda functions configured in the same VPC. What is the cause of this access failure?

Accepted Answer

Lambda functions operating within a VPC communicate with S3 through VPC endpoints, causing the source IP to be evaluated as the VPC private IP rather than the corporate CIDR block.. When a Lambda function is configured inside a VPC, its outbound traffic to S3 does not originate from the function's public IP or the corporate CIDR — it originates from the private IP of the Lambda ENI in the VPC subnet. If the Lambda uses a VPC endpoint (Gateway or Interface) to reach S3, the source IP seen by S3 is the private IP of the ENI or the endpoint, not the corporate CIDR block. Therefore the bucket policy's IpAddress condition (aws:SourceIp) fails to match, and the write is denied.

Answer

The S3 bucket policy lacks explicit permission for the AWS Lambda service principal in the Principal element.

Answer

The Action element uses a wild-card s3:* which is prohibited by AWS security guardrails for production storage buckets.

Answer

Amazon S3 bucket policies do not support IP-based conditional evaluations for compute resources such as Lambda functions.

Question 5

A company is extending its on-premises data center to AWS and requires a secure, high-bandwidth connection that does not traverse the public internet. The connection must support consistent network performance. Which TWO components are needed to establish this connectivity? (Select TWO)

Accepted Answer

AWS Direct Connect. AWS Direct Connect (A) is correct because it provides a dedicated, private physical network connection from the on-premises data center to AWS that bypasses the public internet and delivers consistent, high-bandwidth performance. A Virtual Private Gateway (B) is correct because it is the AWS-side VPN gateway that attaches to the VPC and terminates the private virtual interface (VIF) used by the Direct Connect connection, enabling traffic to reach the VPC. Together, Direct Connect plus a Virtual Private Gateway form the standard architecture for private, high-bandwidth hybrid connectivity. An Internet Gateway (C) is not needed because it routes traffic over the public internet, which the scenario explicitly excludes. A NAT Gateway (D) only provides outbound internet access for private subnets and does not establish hybrid connectivity. AWS Client VPN (E) is a software-based remote-access VPN for individual users over the internet, not a dedicated high-bandwidth data center link.

Answer

Internet Gateway

Answer

NAT Gateway

Answer

AWS Client VPN

Question 6

An organization wants to centralize logging for all AWS accounts within an AWS Organization. Which service should be used to aggregate logs into a single, secure, and immutable location for security analysis?

Accepted Answer

AWS CloudTrail with an Organization Trail.. AWS CloudTrail with an Organization Trail is the correct service to centralize logging for all AWS accounts in an AWS Organization. An Organization Trail logs events for all accounts in the organization and delivers them to a single S3 bucket, providing a secure and immutable location for security analysis.

Answer

AWS CloudWatch Logs in each account.

Answer

AWS Config with local S3 buckets.

Answer

AWS GuardDuty configured per account.

Question 7

A company wants to secure its S3 data. The security policy requires that all objects be encrypted at rest and that the company retains full control over the rotation of the encryption keys. Which TWO of the following should the architect choose to satisfy these requirements?

Accepted Answer

Use AWS KMS with Customer Managed Keys (SSE-KMS).. Option B (SSE-KMS with Customer Managed Keys) is correct because customer managed keys in AWS KMS give the company control over key rotation, either through automatic annual rotation or manual rotation, while still encrypting all objects at rest with a KMS key. Option E (a Key Policy for the KMS CMK) is correct because the key policy is the primary access control mechanism for a customer managed key, defining which principals can use and manage the key, which is essential to retaining full control over the encryption keys. Option A (SSE-S3) is incorrect because Amazon S3 managed keys are rotated automatically by AWS and the customer has no control over rotation. Option C (aws:SecureTransport bucket policy) is incorrect because it only enforces encryption in transit via TLS, not encryption at rest or key rotation control. Option D (versioning) is incorrect because versioning preserves object versions for durability and recovery, not historical key state or key rotation control.

Answer

Enable Amazon S3 Managed Keys (SSE-S3).

Answer

Configure S3 Bucket Policies to enforce the 'aws:SecureTransport' condition.

Answer

Enable versioning on the S3 bucket to ensure historical key state preservation.

Question 8

A company is concerned about unauthorized access and potential data exfiltration within their AWS environment. They need a service that can continuously monitor VPC Flow Logs, AWS CloudTrail management events, and DNS logs to identify suspicious activities using machine learning. Which solution should the architect recommend for centralized threat detection?

Accepted Answer

Enable Amazon GuardDuty and integrate it with AWS Organizations for cross-account visibility.. Amazon GuardDuty is a threat detection service that continuously monitors VPC Flow Logs, AWS CloudTrail management events, and DNS logs using machine learning and threat intelligence to identify suspicious activities. Integrating it with AWS Organizations enables centralized threat detection across all accounts, matching the requirement for cross-account visibility.

Answer

Configure AWS Inspector to perform network reachability assessments on all EC2 instances.

Answer

Deploy AWS Shield Advanced to protect all public-facing endpoints from DDoS attacks.

Answer

Use AWS Config to monitor changes in security group rules and VPC configurations.

Question 9

An enterprise requires all data stored in Amazon S3 to be encrypted at rest. The security team must maintain full control over the encryption keys, including the ability to rotate them annually and define access policies for the keys themselves. Which encryption method meets these requirements with the least operational overhead?

Accepted Answer

Use Server-Side Encryption with AWS KMS Customer Managed Keys (SSE-KMS).. SSE-KMS with Customer Managed Keys (CMKs) allows the security team to create and manage their own KMS keys, including setting key policies, rotating keys annually, and auditing key usage via CloudTrail. It provides full control over the encryption keys while offloading the encryption/decryption process to S3, minimizing operational overhead.

Answer

Use Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3) for all buckets.

Answer

Implement client-side encryption using a third-party library before uploading objects.

Answer

Enable Server-Side Encryption with Customer-Provided Keys (SSE-C) for all uploads.

Question 10

A security architect is designing a multi-tier application in a VPC. The requirement is to block all traffic from a specific range of malicious IP addresses (CIDR 192.0.2.0/24) while allowing standard web traffic (HTTPS) from all other sources to the web tier. Which TWO actions should the architect take to implement this? (Select TWO.)

Accepted Answer

Create an inbound rule in the Network ACL to deny traffic from 192.0.2.0/24.. Option A is correct because Network ACLs are stateless, subnet-level firewalls that support explicit deny rules, so an inbound deny rule for 192.0.2.0/24 blocks that malicious CIDR before it can reach any resource in the subnet. Option D is correct because Security Groups are stateful, instance-level firewalls that only support allow rules, so permitting inbound TCP port 443 from 0.0.0.0/0 allows standard HTTPS web traffic from all other sources to the web tier. Together these satisfy both requirements: the NACL denies the malicious range while the Security Group allows HTTPS from everywhere else. Option B is wrong because Security Groups cannot contain deny rules; they are allow-only. Option C is wrong because AWS Shield Standard provides automatic protection against common DDoS attacks and does not let you block a specific CIDR like 192.0.2.0/24. Option E is wrong because route tables control routing, not inbound filtering, and blackholing a destination CIDR would not block inbound traffic from that source to the web tier.

Answer

Add a deny rule to the web tier Security Group for CIDR 192.0.2.0/24.

Answer

Configure AWS Shield Standard to automatically block the 192.0.2.0/24 subnet.

Answer

Update the VPC Route Table to blackhole all traffic destined for 192.0.2.0/24.

Question 11

An application running on an Amazon EC2 instance needs to securely access data in an Amazon DynamoDB table. What is the most secure way to provide the application with the necessary permissions?

Accepted Answer

Create an IAM role with the required permissions and attach it to the EC2 instance profile.. IAM roles attached to an EC2 instance profile provide temporary, automatically rotated credentials to the instance via the Instance Metadata Service (IMDS). The application (or AWS SDK) retrieves these credentials without any hardcoded secrets, and permissions are managed centrally through IAM policies. This eliminates the risk of long-term credential leakage and follows AWS best practices for least privilege.

Answer

Store IAM user credentials in a configuration file on the EC2 instance.

Answer

Pass the Access Key and Secret Key as environment variables when starting the application.

Answer

Embed the credentials directly into the application source code.

Question 12

A large corporation uses AWS Organizations to manage hundreds of accounts. The security team wants to ensure that no account can provision resources in unauthorized regions and that only approved AWS services can be used. Which TWO features should be used to enforce these constraints across the entire organization? (Select TWO.)

Accepted Answer

Service Control Policies (SCPs) applied to the root of the Organization.. Option B is correct because Service Control Policies (SCPs) applied at the organization root set the maximum available permissions for all accounts in the organization, so they can centrally deny access to unapproved AWS services across every member account. Option E is correct because an SCP with a Condition element using the aws:RequestedRegion global condition key can explicitly deny API calls made to regions outside the approved list, enforcing the region restriction organization-wide. Together, SCPs at the root and region-based conditions satisfy both requirements: restricting services and restricting regions for all accounts. Option A is not appropriate because IAM policies in each member account are decentralized, must be maintained per account, and do not act as a guardrail against account administrators granting themselves broader permissions. Option C is incorrect because AWS Resource Access Manager (RAM) shares resources such as subnets or Transit Gateways between accounts; it does not restrict which services or regions can be used. Option D is incorrect because AWS Config rules detect and can remediate noncompliant resources after creation, but they do not prevent provisioning in unauthorized regions the way an SCP deny does.

Answer

IAM Policies attached to each administrative user in every member account.

Answer

AWS Resource Access Manager (RAM) to share authorized services across accounts.

Answer

AWS Config rules to automatically terminate resources in unauthorized regions.

Question 13

An enterprise organization is planning a centralized logging architecture across hundreds of AWS accounts using AWS CloudTrail and Amazon S3. Security mandates state that all log files delivered to the centralized S3 bucket must be cryptographically verified to ensure they have not been modified or tampered with after delivery. Which TWO actions must a Solutions Architect implement to achieve this mandate? (Choose two.)

Accepted Answer

Enable CloudTrail log file integrity validation on each trail.. Option A is correct because CloudTrail log file integrity validation is the feature that produces a digest file for each delivered log file, containing a digital signature (SHA-256 hash signed with a private key) that allows detection of any modification, deletion, or tampering after delivery. Option E is correct because enabling validation alone only generates the digests; the architect must actually validate them by running AWS CLI commands such as 'aws cloudtrail validate-logs' (or SDK equivalents) against the S3 bucket to cryptographically confirm the log files match their digests. Option B is not correct because S3 Object Lock prevents deletion or overwrite of objects going forward but does not cryptographically prove that a delivered log file's contents are unmodified. Option C is not correct because KMS encryption with key rotation protects data confidentiality and key hygiene, not post-delivery tamper detection. Option D is not correct because S3 Versioning preserves prior object versions but does not itself verify the integrity or authenticity of log file contents.

Answer

Configure S3 Object Lock in compliance mode on the centralized logging bucket.

Answer

Use AWS KMS customer managed keys with automatic key rotation enabled for S3 bucket encryption.

Answer

Enable Amazon S3 Versioning on the centralized logging bucket to preserve previous object iterations.

Question 14

A company wants to ensure that no developer can create an Amazon S3 bucket in any AWS region except for us-east-1 and us-west-2 across their entire AWS Organization. Which solution provides the most efficient and centralized way to enforce this across all member accounts?

Accepted Answer

Attach a Service Control Policy (SCP) to the organization root that denies s3:CreateBucket if the region is not us-east-1 or us-west-2.. A Service Control Policy (SCP) attached to the organization root applies to all member accounts and can deny s3:CreateBucket when the requested region is not us-east-1 or us-west-2. SCPs are the centralized, efficient way to enforce guardrails across an AWS Organization, affecting all principals without per-account changes.

Answer

Apply an IAM policy to every developer user in each account that denies s3:CreateBucket in restricted regions.

Answer

Configure an S3 bucket policy on all existing buckets to prevent the creation of new buckets in other regions.

Answer

Enable AWS Config in all accounts and create a custom rule to delete any bucket created in a restricted region.

Question 15

A financial services firm must store transaction logs in Amazon S3 for seven years to meet regulatory requirements. The logs must be protected against any modification or deletion by any user, including the root user, during this period. Which S3 feature should be implemented?

Accepted Answer

Enable S3 Object Lock in compliance mode with a retention period of seven years.. S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting an object version for a specified retention period. This meets the requirement of protecting logs from modification or deletion for seven years. Compliance mode is the strictest mode and cannot be overridden, ensuring regulatory compliance.

Answer

Enable S3 Versioning on the bucket to keep a history of all changes made to the logs.

Answer

Use S3 Glacier Deep Archive as the storage class for the logs with a vault lock policy.

Answer

Configure AWS Backup to take daily snapshots of the S3 bucket and store them in a secure vault.

Question 16

A web application is deployed on Amazon EC2 instances within a private subnet. The application must receive traffic from an Application Load Balancer (ALB) in a public subnet and connect to an Amazon RDS MySQL database in a different private subnet. Which TWO steps are required to secure this architecture using security groups?

Accepted Answer

Configure the EC2 security group to allow inbound traffic on port 80/443 from the ALB security group.. Option A is correct because the EC2 instances must accept HTTP/HTTPS traffic from the ALB, and referencing the ALB's security group as the source on ports 80/443 restricts inbound access to only that load balancer rather than the whole internet. Option B is correct because the application tier must reach the RDS MySQL database on its listener port 3306, and using the EC2 security group as the source in the RDS security group's inbound rule limits database access to only those application instances. Option C is wrong because allowing 0.0.0.0/0 on port 80 would expose the instances directly to the internet, defeating the purpose of placing them in a private subnet behind an ALB. Option D is wrong because security groups are stateful, so return traffic for allowed inbound connections is automatically permitted and no outbound rule to the EC2 instances is needed; moreover, RDS does not initiate connections to the instances. Option E is wrong because it reverses the traffic direction: the ALB receives client traffic from the internet, not from the EC2 instances, so the ALB security group should allow inbound 80/443 from the internet (or appropriate clients), not from the EC2 security group.

Answer

Configure the EC2 security group to allow inbound traffic from 0.0.0.0/0 on port 80 to handle web traffic.

Answer

Configure the RDS security group to allow outbound traffic to the EC2 instances on all ports.

Answer

Configure the ALB security group to allow inbound traffic from the EC2 security group on port 80.

Question 17

Refer to the exhibit. A solutions architect reviews the following IAM policy applied to a user. What is the effect of this policy when the user attempts to access an object in the bucket from an IP address of 198.51.100.5?

Accepted Answer

Access is denied because the source IP address is not within the 203.0.113.0/24 range.. The policy includes a condition that restricts access to the IP range 203.0.113.0/24. Since the user's IP address (198.51.100.5) is outside this range, the condition evaluates to false, and the Allow statement does not apply. Therefore, the request is implicitly denied because there is no other Allow statement that grants access.

Answer

Access is allowed because the policy grants s3:GetObject permissions to the bucket.

Answer

Access is allowed because there is no explicit Deny statement in the policy.

Answer

Access is denied because the policy does not include permissions for the s3:ListBucket action.

Question 18

A company is concerned that its database credentials, currently stored as environment variables in AWS Lambda, are not being rotated regularly. Which AWS service should the company use to securely store and automatically rotate these credentials?

Accepted Answer

AWS Secrets Manager with its built-in rotation feature for Amazon RDS.. AWS Secrets Manager is purpose-built for storing secrets and provides native, automatic rotation using Lambda rotation functions, including built-in templates for Amazon RDS, Aurora, Redshift, and DocumentDB credentials. It integrates with RDS so the database password and the secret are rotated together without application downtime. This directly satisfies the requirement to store credentials securely and rotate them automatically.

Answer

AWS Systems Manager Parameter Store with SecureString parameters.

Answer

AWS Key Management Service (KMS) to encrypt the environment variables.

Answer

AWS Identity and Access Management (IAM) roles for the Lambda function.

Question 19

A company's public-facing application is experiencing a Distributed Denial of Service (DDoS) attack. The application is hosted on EC2 instances behind an Application Load Balancer (ALB). Which TWO AWS services or features can be used to mitigate this attack and protect the application?

Accepted Answer

AWS Shield Advanced for enhanced DDoS detection and mitigation.. Protecting against DDoS attacks requires a multi-layered approach. AWS Shield provides automatic protection for all AWS customers, while Shield Advanced offers enhanced detection and mitigation for sophisticated attacks. AWS WAF complements this by allowing administrators to create rules that block malicious traffic patterns, such as SQL injection or high-volume IP addresses.

Answer

Amazon GuardDuty to identify and block malicious traffic at the VPC level.

Answer

Amazon Inspector to scan EC2 instances for vulnerabilities during the attack.

Answer

AWS PrivateLink to hide the application from the public internet.

Question 20

A security team needs to identify and protect sensitive data, such as credit card numbers and passport IDs, that may be stored across hundreds of S3 buckets in multiple AWS accounts. Which service should they use to automate this discovery process?

Accepted Answer

Amazon Macie to scan S3 buckets for personally identifiable information (PII).. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in S3. It provides a centralized view of where sensitive data resides and how it is being accessed or moved, which is critical for compliance.

Answer

Amazon GuardDuty to monitor S3 data plane events for suspicious activity.

Answer

AWS Glue to crawl S3 buckets and catalog the data types found in the files.

Answer

Amazon Inspector to perform deep packet inspection on data uploaded to S3.