SAA-C03 Practice Test 47 — 15 Questions

Question 1

A security team stores sensitive documents in an Amazon S3 bucket that is encrypted with SSE-KMS using a customer managed key. An auditor requires that every object upload be traceable to the IAM principal that performed it and that the key's usage be independently auditable. The team also wants to prevent any principal, including account administrators, from reading objects without a corresponding key grant. Which configuration combination meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable AWS CloudTrail data events for the S3 bucket, enable CloudTrail management events for KMS, and ensure the key policy delegates usage only to explicitly named roles.. Object-level traceability requires CloudTrail data events on the bucket, and independent key auditing requires CloudTrail management events on KMS so that Encrypt and Decrypt calls appear in the log. Limiting the key policy to named roles creates a second authorization boundary, so possession of S3 permissions alone is insufficient to read the encrypted objects.

Answer

Enable AWS CloudTrail data events for the S3 bucket, enable KMS key rotation, and apply a bucket policy that requires the aws:SecureTransport condition.

Answer

Enable S3 server access logging to a separate bucket, enable S3 default encryption with SSE-S3, and attach a bucket policy that denies unencrypted uploads.

Answer

Enable S3 Object Lock in compliance mode, enable CloudTrail management events for S3, and use a key policy that grants kms:Decrypt to the account root user.

Question 2

A security team must ensure that all data written to a new Amazon S3 bucket is encrypted with a specific customer-managed AWS KMS key, and that any PUT request that does not specify that key is rejected. The team also needs to detect and react if someone attempts to change the bucket policy to remove the restriction. Which combination of actions meets these requirements with the LEAST operational effort?

Accepted Answer

Attach a bucket policy that denies s3:PutObject when the request lacks the required KMS key condition, enable AWS CloudTrail data events, and create an Amazon EventBridge rule that matches PutBucketPolicy API calls and invokes an AWS Lambda function.. A bucket policy with a Deny effect and the KMS key condition rejects any PUT that does not use the required key, which is the only option that enforces encryption at write time. Pairing CloudTrail data events with an EventBridge rule on the PutBucketPolicy API call provides automated detection and response to policy tampering without managing infrastructure.

Answer

Configure an S3 Lifecycle rule to re-encrypt objects with the required KMS key and use AWS Config with the s3-bucket-server-side-encryption-enabled managed rule.

Answer

Use an S3 access point with a custom policy that allows only the required key, and enable AWS Shield Advanced on the bucket.

Answer

Enable default bucket encryption with the required KMS key and turn on S3 Block Public Access at the account level.

Question 3

A financial services company runs a critical application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application must be able to survive the failure of an entire AWS Region. The company wants a cost-effective solution that minimizes operational overhead. Which approach should the architect recommend?

Accepted Answer

Deploy the application in two Regions with an Auto Scaling group in each, and use Amazon Route 53 failover routing with health checks.. To survive a regional failure, the application must be deployed in at least two Regions with independent compute capacity. Route 53 failover routing with health checks automatically directs traffic to the healthy Region, providing resilience with minimal manual intervention and operational overhead.

Answer

Deploy the application in one Region and take regular Amazon EBS snapshots copied to another Region.

Answer

Deploy the application in one Region and use AWS Global Accelerator to route traffic to the nearest edge location.

Answer

Deploy the application in two Regions and use an Amazon S3 cross-Region replication bucket to store application logs.

Question 4

A SaaS company hosts a REST API on Amazon API Gateway with AWS Lambda proxy integration. The API serves tenants in North America and Europe. European users report high latency, but the Lambda function and its Amazon RDS database must remain in the us-east-1 Region for data residency and cost reasons. The team wants to reduce latency for European users without moving the backend. Which solution meets these requirements?

Accepted Answer

Create an Amazon CloudFront distribution with the API Gateway Regional endpoint as the origin and enable caching for cacheable responses.. CloudFront places edge caches near European users and forwards only cache misses to the API Gateway endpoint in us-east-1. For cacheable API responses, this removes most transatlantic round trips while keeping the Lambda function and RDS database in the required Region. Regional endpoints, stage caching, and Lambda tuning all leave the request path crossing the Atlantic or fail to address the geographic latency.

Answer

Enable API Gateway caching on the stage and set a TTL of 300 seconds.

Answer

Increase the Lambda function's memory and provisioned concurrency to reduce execution time.

Answer

Create a second API Gateway Regional endpoint in eu-west-1 and use a Lambda authorizer to route requests.

Question 5

A startup runs a static marketing website on Amazon S3 and wants to serve it to users worldwide with low latency. The site consists of HTML, CSS, JavaScript, and images stored in a single S3 bucket in the us-east-1 Region. The team wants to minimize cost while improving global performance. Which solution should the team implement?

Accepted Answer

Create an Amazon CloudFront distribution with the S3 bucket as the origin and use the default cache behavior.. CloudFront is the standard AWS service for delivering static content globally with low latency. It caches objects at edge locations, reducing the number of requests that reach the S3 origin and improving performance for users everywhere. Cross-Region Replication, EC2-hosted content, and Transfer Acceleration either add cost and complexity or do not provide edge caching, making them less suitable for this scenario.

Answer

Enable S3 Transfer Acceleration on the bucket and update the website URLs to use the accelerated endpoint.

Answer

Enable S3 Cross-Region Replication to replicate the bucket to multiple Regions and direct users to the closest bucket using latency-based routing.

Answer

Move the website content to an Amazon EBS volume attached to an EC2 instance in each Region and serve it with a web server.

Question 6

A startup runs a two-tier web application on Amazon EC2 instances behind an Application Load Balancer. The instances are in private subnets and must reach the internet only to download operating system patches. Security policy forbids any inbound internet traffic to the instances. Which configuration meets these requirements with the least operational overhead?

Accepted Answer

Deploy a NAT gateway in a public subnet and route the private subnets' outbound traffic through it.. Instances in private subnets need outbound internet access for patching but must not accept inbound connections. A NAT gateway placed in a public subnet provides that one-way connectivity and is a fully managed, highly available service, minimizing operational effort. Alternatives either expose the instances publicly or require extra cross-VPC routing, both of which conflict with the policy or the simplicity requirement.

Answer

Assign each EC2 instance an Elastic IP address and open the security group to inbound HTTPS.

Answer

Create a VPC peering connection to a shared services VPC that has an internet gateway.

Answer

Place the instances in public subnets and attach a security group that allows only outbound traffic.

Question 7

A company has a critical application running on Amazon EC2 instances that must access an Amazon RDS for MySQL database. The security team requires that the database credentials are never stored on the EC2 instances and that access to the database is auditable. The database is in a private subnet and only accepts connections from the application's security group. The company wants to implement a solution that automatically rotates the database password every 90 days. Which solution meets these requirements?

Accepted Answer

Store the database credentials in AWS Secrets Manager with automatic rotation enabled. Configure the EC2 instance role to allow secretsmanager:GetSecretValue, and have the application retrieve the secret at runtime.. AWS Secrets Manager is the managed service designed for storing and rotating database credentials. It provides automatic rotation for Amazon RDS for MySQL, integrates with IAM for access control, and logs access via CloudTrail. The EC2 instances retrieve the secret at runtime, so credentials are never stored locally. This meets the no-hardcoded-credentials, automatic rotation, and auditability requirements.

Answer

Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter. Use a custom Lambda function to rotate the password every 90 days and update the parameter.

Answer

Use IAM database authentication for Amazon RDS for MySQL. Configure the EC2 instance role with rds-db:connect permission, and have the application generate an authentication token.

Answer

Store the database credentials in an encrypted Amazon S3 bucket. Use an AWS Lambda function triggered by Amazon EventBridge to rotate the password every 90 days and update the S3 object.

Question 8

A financial analytics company runs a nightly batch job that reads 4 TB of compressed log data from an Amazon S3 bucket and writes aggregated results to another S3 bucket. The job runs on a fleet of 8 Amazon EC2 instances in a single AWS Region, and the team wants the highest possible aggregate read throughput while minimizing request costs. The data is already stored in S3 Standard, and the team does not want to change the storage class. Which solution best meets these requirements?

Accepted Answer

Have the EC2 instances issue ranged GET requests against many distinct prefixes in parallel to spread the load across S3 partitions.. S3 scales read throughput by partitioning data across multiple internal partitions, each with its own request rate limit. Spreading parallel ranged GET requests across many prefixes lets the fleet hit multiple partitions simultaneously, maximizing aggregate throughput. Transfer Acceleration, S3 File Gateway, and Cross-Region Replication all add cost or complexity without addressing the per-prefix request limit for in-Region batch reads.

Answer

Enable S3 Cross-Region Replication to a second bucket and have half the instances read from the replica.

Answer

Use S3 Transfer Acceleration on the source bucket and have the EC2 instances read through the accelerated endpoint.

Answer

Mount the source bucket as a file system on each EC2 instance using an S3 File Gateway and read the objects through the mounted share.

Question 9

A logistics company stores shipment events in an Amazon S3 bucket. An analytics team must be able to recover any object version that is accidentally overwritten or deleted for at least 90 days, and objects must be protected from permanent deletion by any user, including the root user, during that window. Which combination of S3 features meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable S3 Versioning and apply an S3 Object Lock retention period of 90 days in compliance mode on the bucket.. S3 Object Lock requires versioning and enforces a retention period during which object versions cannot be deleted or overwritten by anyone, including the root user. Compliance mode cannot be shortened or bypassed, so it uniquely satisfies the requirement to prevent permanent deletion for at least 90 days while still allowing recovery of prior versions.

Answer

Enable S3 Versioning and configure S3 Cross-Region Replication to a second bucket in another Region with a 90-day lifecycle expiration.

Answer

Enable S3 Versioning and configure an S3 Lifecycle rule to transition noncurrent versions to S3 Glacier Deep Archive after 90 days.

Answer

Enable S3 Versioning and add a bucket policy that denies s3:DeleteObject for all principals for 90 days.

Question 10

A company needs to give an external auditing firm read-only access to specific objects in an Amazon S3 bucket for 30 days. The firm has its own AWS account and should not receive long-term credentials. The company wants to minimize the blast radius if the firm's account is compromised. Which two steps should the company take? (Choose two.)

Accepted Answer

Create an IAM role in the company account with a trust policy that allows the auditing firm's AWS account to assume it, and attach a policy granting s3:GetObject on the specific object prefix.. Cross-account temporary access is best implemented with an IAM role in the resource account that the external account assumes. Scoping the role policy to the specific prefix and requiring sts:AssumeRole with a maximum session duration and an external ID limits what a compromised external account can do and prevents the confused deputy problem. Long-term IAM users and public buckets fail the security goals.

Answer

Create an IAM user in the company account for the auditing firm and email the access key and secret key to the firm's security contact.

Answer

Attach an S3 bucket policy that grants s3:GetObject to the auditing firm's IAM user ARN, and disable S3 Block Public Access to allow the cross-account policy to work.

Answer

Make the S3 bucket public and share the object URLs with the auditing firm so no AWS credentials are needed.

Question 11

A company uses AWS Organizations with multiple accounts. A security engineer must ensure that no IAM user in any member account can create an access key for the root user or perform any action as the root user, even if an administrator in that account tries to allow it. What should the security engineer do?

Accepted Answer

Attach a service control policy to the organization root or OUs that denies all actions when the principal is the root user, and denies iam:CreateAccessKey for the root user.. A service control policy attached to the organization root or the relevant OUs is evaluated for all member account principals, including the root user. Denying root user actions and iam:CreateAccessKey for the root user enforces the restriction regardless of local administrator intent. Detective tools like IAM Access Analyzer and AWS Config, and authentication controls like MFA, do not block the action.

Answer

Enable AWS IAM Access Analyzer in each member account and review findings for root user access keys.

Answer

Enable multi-factor authentication for the root user in every member account and require it for all IAM users through a password policy.

Answer

Configure an AWS Config managed rule in each account that checks for root user access keys and sends an Amazon SNS notification to the security team.

Question 12

A healthcare company stores patient records in an Amazon S3 bucket. Compliance requires that every object be encrypted at rest with a key that the company fully controls, including the ability to rotate and immediately revoke access. The security team also needs a record of every time the key is used to decrypt an object. Which encryption configuration should the company implement?

Accepted Answer

Use SSE-KMS with a customer managed key in AWS KMS.. The requirement is customer-controlled encryption with the ability to rotate and revoke keys and to audit every decryption. A customer managed key in AWS KMS provides editable key policies, scheduled or on-demand rotation, the ability to disable the key to cut off access, and CloudTrail logging of cryptographic operations. Other S3 encryption options either lack customer key control or lack a per-use audit trail.

Answer

Use SSE-C where the customer provides the encryption key on each request.

Answer

Use SSE-S3 with the default AWS managed key for the bucket.

Answer

Use client-side encryption with an AWS managed key before uploading objects.

Question 13

A startup runs a static website hosted on Amazon S3. The website is accessed globally, and users in Europe report slow load times. The company wants to improve performance for these users without changing the website's code. Which AWS service should the company use?

Accepted Answer

Amazon CloudFront with an S3 origin.. CloudFront caches static content at edge locations worldwide, bringing it closer to users. For a static website on S3, creating a CloudFront distribution with the S3 bucket as the origin is the standard solution to reduce latency for global users. It requires no changes to the website code, only configuration of the distribution and updating DNS to point to CloudFront.

Answer

AWS Global Accelerator with an S3 endpoint.

Answer

AWS Direct Connect.

Answer

Amazon S3 Transfer Acceleration.

Question 14

A company stores 500 TB of archival data in Amazon S3. The data is accessed only for compliance audits, which occur once every two years. Retrieval times of up to 12 hours are acceptable. The company wants the lowest storage cost. Which S3 storage class should be used?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is specifically designed for long-term retention of data that is rarely accessed, offering the lowest storage cost among S3 classes. It supports retrieval within 12 hours, which matches the acceptable retrieval time. For compliance data accessed every two years, it provides the most economical solution without unnecessary retrieval speed or monitoring overhead.

Answer

S3 One Zone-Infrequent Access (S3 One Zone-IA)

Answer

S3 Intelligent-Tiering

Answer

S3 Standard-Infrequent Access (S3 Standard-IA)

Question 15

A company runs an internal API on Amazon EC2 instances in a private subnet. Clients in an on-premises data center must reach the API over a private connection, and the security team wants to inspect and filter the traffic using AWS managed security appliances before it reaches the application. The company has already established an AWS Site-to-Site VPN to a transit gateway. Which two actions should the security engineer take to route and inspect the traffic? (Choose two.)

Accepted Answer

Create a VPC attachment on the transit gateway for the VPC that hosts the API and the inspection appliances.. Traffic from the VPN reaches the transit gateway, which needs a VPC attachment to hand packets into the VPC. Once inside, route tables must send the flows through the subnet that hosts the inspection appliances and then on to the API subnet, with a symmetric return path, so that every packet is evaluated by the security layer before delivery.

Answer

Attach an internet gateway to the VPC and advertise the VPC CIDR to on-premises over the VPN so that return traffic uses the public path.

Answer

Enable VPC flow logs on the API subnet and use Amazon GuardDuty findings to block malicious sources at the network layer.

Answer

Replace the Site-to-Site VPN with an AWS Direct Connect connection because a transit gateway cannot route traffic from a VPN attachment into a VPC.