SAA-C03 Practice Test 15 — 15 Questions

Question 1

A SaaS vendor needs temporary access to an S3 bucket in your AWS account to read customer exports. The vendor will assume an IAM role you created. During integration testing, the vendor reports that their AssumeRole requests succeed, but your security team is concerned about the possibility of confused-deputy attacks. Which trust policy approach most directly mitigates this risk?

Accepted Answer

Add an sts:ExternalId condition to the role trust policy that must match the unique external ID you provide to the vendor.. Option A is correct because the `sts:ExternalId` condition in the trust policy forces the vendor to include a unique external ID in their `AssumeRole` API call. This prevents a confused-deputy attack by ensuring that the role can only be assumed when the caller provides the exact external ID you have pre-shared, thereby verifying the intended purpose of the cross-account access.

Answer

Require the vendor to use the same MFA device serial number as your internal administrators in the trust policy.

Answer

Remove the role’s permissions policy and rely only on the S3 bucket policy to validate the caller.

Answer

Allow sts:AssumeRole from the vendor account root principal without restricting to the vendor’s specific IAM role.

Question 2

A security team needs an audit trail to investigate suspicious API activity across multiple AWS accounts. Which AWS approach best provides centralized visibility into who did what, when, for service API calls?

Accepted Answer

Create an AWS CloudTrail organization trail that delivers logs to a centralized, access-controlled S3 bucket.. AWS CloudTrail organization trail is the correct approach because it captures all management and data events across multiple AWS accounts within an AWS Organizations structure, delivering them to a single, centralized S3 bucket. This provides a unified, immutable audit trail of who performed which API call, when, and from which source IP, enabling the security team to investigate suspicious activity with full visibility. The centralized bucket can be access-controlled with S3 bucket policies and IAM to ensure only authorized personnel can view the logs.

Answer

Enable AWS Config only for EC2 security groups and rely on it for API call auditing.

Answer

Turn on S3 server access logging for every bucket and assume it covers all AWS services.

Answer

Use only Amazon CloudWatch alarms with no logging destination to reduce storage costs.

Question 3

A SaaS vendor has a steady 24/7 control plane on ECS and several small event-driven tasks that currently run on a separate always-on service. Management wants the billing discount that applies across both ECS and Lambda usage without committing to a specific instance family. Which two actions are best? Select two.

Accepted Answer

Buy a Compute Savings Plan for the predictable baseline usage.. A Compute Savings Plan offers the largest discount (up to 66%) across both ECS and Lambda usage without committing to a specific instance family, which matches the requirement to cover both services flexibly. It applies to any EC2 instance, including those used by ECS, and to AWS Lambda compute, making it ideal for a mixed workload with a predictable baseline.

Answer

Buy an EC2 Instance Savings Plan tied to one instance family for all workloads.

Answer

Use Spot Instances for the control plane because it is the largest bill.

Answer

Increase the ECS desired count so Lambda can be removed.

Question 4

A solutions architect is designing an S3 bucket for a mobile banking backend. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure?

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. Option C is correct because S3 Block Public Access provides a definitive override that prevents any public access to objects, regardless of bucket policies or ACLs. This setting can be applied at the account or bucket level and ensures that even if a developer later adds an overly broad bucket policy, the objects remain inaccessible to anonymous users. It is the only mechanism that enforces a hard block on public access at the S3 service level.

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Answer

Enable S3 Transfer Acceleration

Answer

Enable server access logging on the bucket

Question 5

A SaaS application is deployed in us-east-1 and us-west-2 behind separate ALBs. The business wants DNS to send new clients to the primary Region when it is healthy and automatically fail over to the secondary Region when the primary endpoint is unhealthy. Which two Route 53 settings are required? Select two.

Accepted Answer

Use a failover routing policy with a primary and secondary record.. A failover routing policy is correct because it allows you to designate one record as primary and another as secondary. Route 53 will route traffic to the primary record as long as it is healthy, and automatically fail over to the secondary record when the primary is unhealthy. This directly meets the requirement to send new clients to the primary region when healthy and fail over to the secondary region.

Answer

Use weighted routing with a 50/50 traffic split between both Regions.

Answer

Use latency-based routing so clients always choose the fastest Region.

Answer

Use a geolocation policy without health checks.

Question 6

A security operations team wants continuous compliance checks for AWS resources. They need to know when an EBS volume becomes unencrypted or when a security group starts allowing SSH from 0.0.0.0/0. Which AWS service should they use?

Accepted Answer

AWS Config, because it evaluates resource configuration against compliance rules.. AWS Config is the correct service because it continuously monitors and evaluates the configuration of AWS resources against desired compliance rules. It can detect when an EBS volume is unencrypted or when a security group rule allows SSH (port 22) from 0.0.0.0/0, and trigger notifications or remediation actions via AWS Config rules.

Answer

AWS CloudTrail, because it records every API call made in the account.

Answer

Amazon GuardDuty, because it automatically encrypts noncompliant resources.

Answer

Amazon Macie, because it manages encryption settings for all AWS resources.

Question 7

A read-heavy media archive repeatedly queries the same product catalogue data from DynamoDB with millisecond latency requirements. Which service can reduce read latency and table load?

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is a fully managed, in-memory cache for DynamoDB that delivers up to 10x read performance improvement by reducing response times from single-digit milliseconds to microseconds. For a read-heavy workload repeatedly querying the same product catalogue data, DAX caches the hot items, offloading read requests from the DynamoDB table and significantly reducing table read capacity consumption.

Answer

Amazon Kinesis Data Firehose

Answer

AWS Glue Data Catalog

Answer

S3 Transfer Acceleration

Question 8

A stateless web API runs on EC2 instances behind an Application Load Balancer (ALB). The Auto Scaling group (ASG) currently uses subnets from only one Availability Zone, even though the ALB spans two Availability Zones. During maintenance of that single AZ, the ALB remains up but clients see timeouts because there are no healthy targets. Which change most directly improves resilience against an AZ failure?

Accepted Answer

Update the ASG to launch instances across subnets in at least two Availability Zones and ensure ALB health checks target an application-ready path.. The most direct fix for AZ failure resilience is to distribute the ASG across multiple Availability Zones. With the ALB already spanning two AZs, if the ASG only launches instances in one AZ, a failure of that AZ leaves the ALB with zero healthy targets, causing timeouts. By configuring the ASG to launch instances in at least two AZs and setting ALB health checks to an application-ready path, the ALB can route traffic to healthy instances in the surviving AZ, maintaining availability.

Answer

Keep the ASG in one subnet/AZ, but enable ALB stickiness to reduce session interruption.

Answer

Add a NAT gateway in the public subnets so instances can reach the internet during maintenance events.

Answer

Create a second ALB in the same Availability Zone and route traffic using DNS failover.

Question 9

A photo studio stores original project archives in Amazon S3. Objects are read heavily for 14 days after upload, occasionally during the next 11 months, and almost never after one year. The team wants the lowest storage cost while keeping retrieval within minutes during the first year. Which three actions are best? Select three.

Accepted Answer

Keep new objects in S3 Standard for the first 14 days.. A is correct because S3 Standard is designed for frequently accessed data with low latency and high throughput, making it ideal for the first 14 days when objects are read heavily. This storage class provides immediate retrieval and no retrieval costs, aligning with the requirement for minutes-level access during the first year.

Answer

Transition objects to S3 Glacier Flexible Retrieval after 14 days.

Answer

Disable versioning to make the lifecycle rules work correctly.

Question 10

A retail platform needs disaster recovery across AWS Regions. The business requirement is: RTO up to 6 hours, RPO up to 1 hour, and they want the ability to start serving quickly during a Region outage but do not want to run full production capacity continuously. Which DR strategy best fits these requirements?

Accepted Answer

Warm standby, keeping a reduced but ready-to-scale environment in the secondary Region.. Warm standby is the best fit because it maintains a scaled-down but fully functional copy of the production environment in the secondary Region, allowing the RTO of 6 hours and RPO of 1 hour to be met without running full production capacity continuously. During a disaster, the standby environment can be scaled up quickly to serve traffic, balancing cost and recovery speed.

Answer

Backup and restore only, with no continuously running infrastructure in the secondary Region.

Answer

Pilot light, keeping only the minimum resources needed to bootstrap the environment.

Answer

Multi-site active-active, serving production traffic from both Regions at all times.

Question 11

A security team requires that every object uploaded to s3://secure-bucket/uploads/ must be encrypted using SSE-KMS with a specific customer-managed KMS key. Which S3 bucket policy condition approach best enforces this requirement for PutObject requests?

Accepted Answer

Deny PutObject unless s3:x-amz-server-side-encryption equals "aws:kms" and s3:x-amz-server-side-encryption-aws-kms-key-id equals the required CMK ARN. Option A is correct because it uses a Deny effect with the s3:x-amz-server-side-encryption condition key set to 'aws:kms' and the s3:x-amz-server-side-encryption-aws-kms-key-id condition key set to the specific customer-managed KMS key ARN. This ensures that any PutObject request that does not include both the required encryption header and the exact KMS key identifier is denied, enforcing the encryption requirement at the bucket policy level.

Answer

Allow PutObject only when aws:SecureTransport is true; encryption is then guaranteed automatically

Answer

Deny PutObject if the request includes Content-Type other than "application/octet-stream"

Answer

Deny PutObject when the caller’s role is not allowed to kms:Decrypt in their IAM policy

Question 12

A startup has three sandbox accounts and one production account. The CTO wants lower cost and operational overhead while keeping central purchasing and spend visibility. Which two actions are best? Select two.

Accepted Answer

Enable consolidated billing under AWS Organizations so discounts and shared purchasing apply across accounts.. Option A is correct because enabling consolidated billing under AWS Organizations aggregates usage across all accounts, allowing the startup to benefit from volume discounts and Reserved Instance sharing, which lowers overall costs. This also provides a single payer account for central purchasing and spend visibility through the consolidated billing console.

Answer

Move each sandbox to its own payer account to isolate spend from the rest.

Answer

Buy Dedicated Hosts for sandbox workloads to get a lower blended rate.

Answer

Disable AWS Budgets because consolidated billing already solves visibility.

Question 13

A service role has an IAM policy granting kms:Decrypt for a specific AWS KMS key. The application still fails to decrypt with an AccessDenied error. What change most directly fixes this when the KMS key policy is missing the role’s permissions?

Accepted Answer

Update the KMS key policy to allow kms:Decrypt for the service role principal (or the assumed-role principal identity that the KMS key evaluates).. The AccessDenied error occurs because the KMS key policy does not grant the service role (or its assumed-role principal) permission to call kms:Decrypt. Even if the IAM policy attached to the role allows kms:Decrypt, KMS requires that the key policy explicitly authorize the principal (or the role’s assumed-role session) when the key policy is the sole authorization mechanism. Updating the key policy to include the service role principal (or the assumed-role ARN) with kms:Decrypt directly resolves the missing permission.

Answer

Add an IAM policy statement allowing s3:GetObject for the bucket that stores the encrypted data.

Answer

Enable a CloudFront distribution for the KMS key alias.

Answer

Create a VPC gateway endpoint for KMS to route decryption requests privately.

Question 14

A stateless web application runs on Amazon EC2 instances across two Availability Zones. The team wants unhealthy instances to be removed automatically and replaced without manual action. What is the best solution?

Accepted Answer

Use an Application Load Balancer with an Auto Scaling group and configure health checks.. Option B is correct because an Application Load Balancer (ALB) with an Auto Scaling group provides automated health checks and instance replacement. The ALB performs HTTP/HTTPS health checks against the instances, and when an instance fails the health check, the Auto Scaling group automatically terminates the unhealthy instance and launches a new one to maintain the desired capacity. This ensures the stateless web application remains available across both Availability Zones without manual intervention.

Answer

Place the instances in a single subnet and increase the instance size.

Answer

Use a network ACL to detect failed instances and restart them.

Answer

Store the web servers on EBS volumes so the data survives failures.

Question 15

A server assumes an IAM role and must read export objects only from this prefix in an S3 bucket: s3://customer-data/exports/acme/ . The application also needs to list the objects under that exact prefix so it can discover which export folders exist. The application performs ListBucket requests with Prefix set to exactly "exports/acme/".

The current role policy allows s3:ListBucket on the bucket ARN without a prefix condition, and security reports the role can list other tenants’ export object keys.

Which IAM policy change best enforces least privilege for both ListBucket and GetObject?

Accepted Answer

Allow s3:ListBucket on arn:aws:s3:::customer-data only when s3:prefix equals "exports/acme/" (for example, using a StringEquals condition on s3:prefix). Also allow s3:GetObject only on arn:aws:s3:::customer-data/exports/acme/*.. Option B is correct because it uses an s3:prefix condition with StringEquals on the ListBucket action to restrict listing to exactly 'exports/acme/', preventing the role from enumerating other tenants' objects. It also restricts GetObject to the same prefix using a resource ARN of arn:aws:s3:::customer-data/exports/acme/*, ensuring least privilege for both read operations. This combination enforces the principle of least privilege by scoping both actions to the specific tenant prefix.

Answer

Keep s3:ListBucket allowed on arn:aws:s3:::customer-data, but restrict s3:GetObject to arn:aws:s3:::customer-data/exports/acme/*.

Answer

Allow s3:ListBucket only on arn:aws:s3:::customer-data/exports/acme/* and allow s3:GetObject on arn:aws:s3:::customer-data/*.

Answer

Add a Deny statement for s3:GetObject outside arn:aws:s3:::customer-data/exports/acme/*, but keep s3:ListBucket unrestricted on arn:aws:s3:::customer-data.