SAA-C03 Practice Exam 55 — 20 Questions

Question 1

A healthcare company stores patient imaging studies in an Amazon S3 bucket encrypted with SSE-KMS using a customer managed key. A security audit reveals that a former employee's IAM user still has s3:GetObject permissions on the bucket. The company wants to ensure the former employee can no longer decrypt any objects, even if they somehow regain S3 access, without affecting other users or applications. What should a security engineer do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the KMS key policy to explicitly deny the former employee's IAM user the kms:Decrypt action.. With SSE-KMS, decryption requires both S3 read permission and kms:Decrypt on the customer managed key. Adding an explicit deny for the former employee in the KMS key policy ensures they cannot decrypt objects even if S3 access is accidentally restored, while leaving other principals unaffected. Bucket-level or access key actions do not remove the cryptographic capability, and disabling the key would break access for everyone.

Answer

Disable the customer managed KMS key used for the bucket encryption.

Answer

Add a bucket policy that denies s3:GetObject to the former employee's IAM user ARN.

Answer

Enable S3 Block Public Access on the bucket and rotate the IAM user's access keys.

Question 2

A financial services company runs a three-tier web application on AWS. The application servers in a private subnet must retrieve database credentials from AWS Secrets Manager at startup. The security team requires that the credentials never be stored on disk and that access be granted only to the specific IAM role attached to the instances. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Retrieve the secret from AWS Secrets Manager using the AWS SDK with the instance's IAM role, and configure automatic rotation for the secret.. AWS Secrets Manager is purpose-built for storing and rotating database credentials. Using the instance's IAM role to call GetSecretValue keeps credentials in memory, avoids disk storage, and supports least privilege through IAM policies scoped to the specific secret. Automatic rotation removes manual effort. The other options either require custom rotation logic, expose secrets in less secure locations, or add unnecessary components.

Answer

Use AWS Systems Manager Parameter Store SecureString parameters and retrieve them with the AWS CLI during instance bootstrap.

Answer

Embed the credentials in the AWS Lambda environment variables and have the application servers retrieve them through an API Gateway endpoint.

Answer

Store the credentials in an encrypted Amazon S3 object and have the application download and decrypt them at startup using the instance role.

Question 3

A global mobile game backend serves mostly static images and JavaScript files from an S3 origin. Users in distant countries report slow load times. What should improve performance most? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Amazon CloudFront distribution with the S3 bucket as origin. Amazon CloudFront is a global content delivery network (CDN) that caches static content (images, JavaScript) at edge locations close to users, drastically reducing latency. By using the S3 bucket as the origin, CloudFront offloads requests from S3 and serves cached objects from the nearest edge, which directly addresses slow load times for distant users. This is a managed AWS-native service that aligns with the architecture review board's preference.

Answer

RDS read replicas

Answer

A larger S3 bucket

Answer

An EC2 Auto Scaling group in one Region

Question 4

A healthcare company runs a three-tier web application on AWS. The application tier consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer. The security team must ensure that the application instances accept traffic only from the load balancer and that no instance can be reached directly from the internet. The instances are in private subnets and have a security group attached. What should a solutions architect do to meet these requirements?

Accepted Answer

Configure the instance security group to allow inbound traffic on the application port only from the load balancer's security group.. The most secure and operationally simple way to restrict instance access to the load balancer is to reference the load balancer's security group in the instance security group's inbound rule. This creates a logical relationship rather than an IP-based one, so it remains correct as the ALB scales and its node IPs change. It also prevents direct internet access because private instances have no public addresses.

Answer

Configure the instance security group to allow inbound traffic on the application port from the VPC CIDR range.

Answer

Create a network ACL that denies all inbound traffic except from the load balancer's subnet CIDR range.

Answer

Attach an Elastic IP address to each instance and allow inbound traffic only from the load balancer's public IP addresses.

Question 5

A company stores sensitive customer data in an Amazon S3 bucket. The security team wants to ensure that all data is encrypted at rest using keys that the company controls, including the ability to rotate keys and audit key usage. They also want to minimize operational overhead for key management. Which solution meets these requirements?

Accepted Answer

Use S3 server-side encryption with AWS KMS customer managed keys (SSE-KMS).. SSE-KMS with customer managed keys allows the company to control the KMS keys, configure automatic rotation, and audit key usage through CloudTrail. It is a native S3 feature, so no application changes are needed. SSE-S3 does not give key control, SSE-C requires the customer to manage keys per request, and client-side encryption adds significant operational burden.

Answer

Use S3 server-side encryption with customer-provided keys (SSE-C).

Answer

Use S3 server-side encryption with Amazon S3 managed keys (SSE-S3).

Answer

Encrypt the data client-side before uploading to S3 using an open-source library, and store the keys in AWS Secrets Manager.

Question 6

A healthcare analytics platform ingests records into an Amazon Aurora MySQL cluster. Compliance rules require that the cluster remain writable even if an entire Availability Zone is lost, and that recovery happen without operator action. The team also wants read traffic to scale independently of the writer. Which configuration should a solutions architect choose?

Accepted Answer

Create an Aurora MySQL cluster with one writer instance and two Aurora Replicas distributed across three Availability Zones, and connect the application to the cluster reader endpoint for read queries and the cluster endpoint for writes.. Aurora's storage layer replicates each data volume six ways across three Availability Zones, and placing the writer plus two Aurora Replicas in separate zones means a zone failure does not remove all compute endpoints. Aurora automatically promotes a surviving replica and repoints the cluster endpoint, so writes resume with no operator involvement, while the reader endpoint spreads read queries across the replicas for independent read scaling.

Answer

Create an Aurora MySQL cluster with one writer instance and enable Aurora Global Database with a secondary cluster in a different Region, directing all reads to the secondary Region's reader endpoint.

Answer

Create an Aurora MySQL cluster with one writer instance, and configure an Amazon Route 53 failover record that points to a standby cluster in the same Region when health checks fail.

Answer

Create an Aurora MySQL cluster with a single writer instance and one reader instance in the same Availability Zone, and enable automated backups with a 35-day retention period.

Question 7

A company is designing a secure architecture for an internal microservices application running on Amazon ECS with the Fargate launch type. The security team wants each microservice to have its own fine-grained permissions to access specific AWS resources, and wants to avoid storing long-term AWS credentials in the container images or task definitions. The company also wants to encrypt data in transit between services. (Choose two.)

Accepted Answer

Implement mutual TLS between microservices using AWS App Mesh with certificate management through AWS Certificate Manager Private CA.. ECS task IAM roles provide each microservice with temporary, scoped credentials without storing secrets in images or task definitions, meeting the fine-grained permission and credential-hygiene requirements. AWS App Mesh with mutual TLS encrypts and authenticates service-to-service traffic using certificates from ACM Private CA, satisfying the in-transit encryption requirement. Together they form a least-privilege, encrypted microservices architecture.

Answer

Enable AWS PrivateLink for communication between microservices and use TLS termination at the Network Load Balancer.

Answer

Attach an IAM user access key to each container through a mounted Amazon EFS volume.

Answer

Store AWS credentials in AWS Secrets Manager and inject them as environment variables in the task definition.

Question 8

A media company hosts a public-facing web application on Amazon EC2 instances behind an Application Load Balancer. The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting, and also wants to rate-limit requests from individual IP addresses to mitigate scraping. Which AWS service should a solutions architect associate with the load balancer to meet both requirements?

Accepted Answer

AWS WAF with a web ACL attached to the Application Load Balancer, using managed rule groups for SQL injection and XSS plus a rate-based rule.. AWS WAF is the service designed to filter HTTP requests at the application layer and integrates natively with Application Load Balancers. Managed rule groups cover SQL injection and cross-site scripting signatures, and rate-based rules track request counts per originating IP. Attaching a web ACL to the ALB inspects traffic before it reaches the EC2 instances, meeting both protection goals with one service.

Answer

AWS Shield Advanced with automatic application layer DDoS mitigation enabled on the load balancer.

Answer

Amazon GuardDuty with the S3 protection and EKS protection features enabled for the account.

Answer

AWS Network Firewall deployed in a subnet and referenced by the load balancer's target group.

Question 9

A media company runs a video-transcoding fleet on Amazon EC2 instances that read source files from an Amazon S3 bucket and write output to a second bucket. The fleet is spread across three Availability Zones in one Region, and instances are launched by an Auto Scaling group. The company needs the architecture to survive the loss of an entire Availability Zone without losing in-flight transcoding work or requiring manual intervention. Which combination of design elements should a solutions architect implement to meet these requirements?

Accepted Answer

Deploy the Auto Scaling group across three Availability Zones, make transcoding jobs idempotent and store progress in Amazon DynamoDB, and have instances poll an Amazon SQS queue for work so that unfinished jobs are retried by healthy instances.. Resilience across an Availability Zone failure requires both compute capacity in the surviving zones and durable, externalized job state. Distributing the Auto Scaling group across three zones keeps instances running, while an SQS queue with visibility timeouts and DynamoDB progress tracking lets interrupted jobs be reclaimed and retried automatically. This removes any dependency on the failed zone's instances or storage.

Answer

Deploy the Auto Scaling group in a single Availability Zone with a spot fleet, use an Amazon EBS volume attached to each instance to persist transcoding progress, and enable EBS snapshots every five minutes to another zone.

Answer

Deploy the Auto Scaling group across three Availability Zones, place a Network Load Balancer in front of the instances, and configure the load balancer to retry failed transcoding requests against the same instance until the zone recovers.

Answer

Deploy the Auto Scaling group across three Availability Zones, store transcoding state in an Amazon S3 bucket configured with S3 Cross-Region Replication, and rely on the S3 Standard storage class for automatic recovery.

Question 10

A media company runs a two-tier web application in a VPC. The web tier is in public subnets behind an internet-facing Application Load Balancer, and the database tier is in private subnets running Amazon RDS. A security review found that the RDS security group allows traffic from 0.0.0.0/0 on port 3306. What is the MOST secure way to restrict database access to only the web tier?

Accepted Answer

Change the RDS security group inbound rule to allow port 3306 from the web tier's security group ID.. Security group referencing lets the database accept connections only from instances that belong to the web tier's security group, which is the tightest and most maintainable control. It removes the 0.0.0.0/0 exposure and automatically adapts as the web tier scales. VPC-wide CIDRs, public subnets, and network ACL CIDR rules are all broader or more fragile than a security group reference.

Answer

Create a network ACL on the database subnet that denies all traffic except port 3306 from the web subnet CIDR.

Answer

Change the RDS security group inbound rule to allow port 3306 from the VPC CIDR range.

Answer

Move the RDS instance into a public subnet and attach an Elastic IP, then restrict access by IP allowlist.

Question 11

A fintech company runs a containerized payment API on Amazon ECS with AWS Fargate. The security team requires that the API access a stored database credential without hardcoding it in the task definition or environment variables. The credential must be encrypted at rest and automatically rotated every 90 days. The API also needs to retrieve the credential at container startup with minimal latency. Which solution meets these requirements?

Accepted Answer

Store the credential in AWS Secrets Manager, enable automatic rotation, and grant the ECS task role permission to call secretsmanager:GetSecretValue.. AWS Secrets Manager is designed for storing, encrypting, and automatically rotating secrets such as database credentials. By using the ECS task role to call GetSecretValue, the container retrieves the credential at startup without embedding it in the task definition. Native rotation every 90 days satisfies the compliance requirement, and KMS encryption at rest plus IAM policies enforce least privilege.

Answer

Store the credential in an encrypted Amazon S3 object and grant the ECS task role s3:GetObject. Configure a Lambda function to rotate the credential every 90 days.

Answer

Store the credential in AWS Systems Manager Parameter Store as a SecureString, and grant the ECS task role ssm:GetParameter. Enable automatic rotation through Parameter Store.

Answer

Store the credential in an encrypted Amazon EBS volume attached to the Fargate task, and grant the task role permission to mount the volume.

Question 12

A company is deploying a web application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer. The company wants to protect the application from common web exploits such as SQL injection and cross-site scripting, and also wants to restrict access to specific geographic regions. Which combination of AWS services should a solutions architect use to meet these requirements?

Accepted Answer

AWS WAF with managed rule groups and geographic match conditions.. AWS WAF is the appropriate service for protecting web applications behind an Application Load Balancer from application-layer attacks. Its managed rule groups cover common threats like SQL injection and cross-site scripting, and geographic match conditions can allow or block traffic by country. The other services either operate at different layers or provide detection rather than inline prevention.

Answer

AWS Network Firewall with stateful rule groups and domain lists.

Answer

AWS Shield Advanced with a web ACL and IP set rules.

Answer

Amazon GuardDuty with threat intelligence and custom findings.

Question 13

A company is migrating a legacy application to AWS. The application uses a fixed set of credentials stored in a configuration file to access an Amazon RDS database. The security team wants to eliminate hardcoded credentials and automatically rotate them every 30 days. The application runs on Amazon EC2 instances and can be modified to retrieve credentials at startup. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Store the credentials in AWS Secrets Manager and configure automatic rotation every 30 days. Modify the application to retrieve the secret using the AWS SDK.. AWS Secrets Manager is designed for this use case: it stores and automatically rotates database credentials using a Lambda rotation function, with minimal setup. The application retrieves the secret via the AWS SDK, eliminating hardcoded credentials. Other options lack built-in rotation or require custom development, increasing operational overhead.

Answer

Store the credentials in an encrypted Amazon S3 object and use S3 Object Lambda to decrypt them at runtime. Configure a lifecycle policy to delete and recreate the object every 30 days.

Answer

Use AWS KMS to encrypt the credentials and store them in an EC2 instance's user data. Use an AWS Lambda function to rotate the credentials and update the user data every 30 days.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString parameter and write a custom Lambda function to rotate them every 30 days.

Question 14

A company is designing a secure architecture for a three-tier web application on AWS. The web tier runs on Amazon EC2 instances in public subnets, the application tier runs on EC2 instances in private subnets, and the database tier runs on Amazon RDS in private subnets. The security team requires that the application tier instances can access the internet for software updates without being directly reachable from the internet, and that the database tier is not accessible from the internet. Which two actions should a solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

Configure the RDS database security group to allow inbound traffic only from the application tier security group.. A NAT gateway in a public subnet allows private application instances to initiate outbound internet traffic for updates without being reachable inbound. Referencing the application security group in the RDS security group restricts database access to only those instances. Together, these actions provide secure outbound access and database isolation.

Answer

Place the RDS database in a public subnet and rely on a security group that allows only the application tier's IP range.

Answer

Create a VPC peering connection between the application tier VPC and the database tier VPC, and route all database traffic over the peering connection.

Answer

Attach an Elastic IP address to each application tier instance and configure security groups to allow only outbound traffic.

Question 15

A media company uses an Amazon CloudFront distribution to serve content from a private S3 bucket. The security team wants to ensure that users cannot bypass CloudFront and access the S3 bucket directly, and that only the distribution can read objects. Which configuration should be implemented?

Accepted Answer

Create an origin access control (OAC) for the distribution, update the bucket policy to allow the OAC, and block public access on the bucket.. Origin access control (OAC) is the modern, recommended way to secure S3 origins for CloudFront. It allows the distribution to sign requests to S3, and the bucket policy can be scoped to the OAC. Blocking public access ensures users cannot bypass CloudFront. This satisfies both requirements.

Answer

Configure the S3 bucket as a website endpoint and use a bucket policy that allows only the CloudFront distribution's IP addresses.

Answer

Set the S3 bucket ACL to private and enable CloudFront signed URLs for all objects.

Answer

Create an origin access identity (OAI) for the distribution, update the bucket policy to allow the OAI, and block public access on the bucket.

Question 16

A media company runs a transcoding fleet on Amazon EC2 instances behind an Application Load Balancer in a single Availability Zone. The business requires the workload to survive the loss of that Availability Zone with no manual intervention and minimal downtime. The instances store intermediate files on instance store volumes and the fleet is managed by an Auto Scaling group. Which change should a solutions architect make to meet the requirement?

Accepted Answer

Add a second Availability Zone to the Auto Scaling group and configure the Application Load Balancer with subnets in both Availability Zones.. Resilience to an Availability Zone failure requires spreading compute across multiple zones and giving the load balancer subnets in each of those zones. The Auto Scaling group then replaces failed instances in the surviving zone while the load balancer routes only to healthy targets, delivering continuous service without human action.

Answer

Increase the desired capacity of the Auto Scaling group so that more instances run in the existing Availability Zone.

Answer

Convert the instances to Spot Instances and configure a placement group to keep them close together.

Answer

Enable detailed CloudWatch monitoring and create an alarm that notifies operators when an instance becomes unhealthy.

Question 17

A company runs a stateless web application on a fleet of six On-Demand EC2 instances behind an Application Load Balancer. The instances are spread across three Availability Zones in a single AWS Region and run 24/7. The workload is steady and predictable, and the company wants to reduce compute costs without changing the application architecture or reducing availability. The company is willing to commit to a one-year term. Which two actions will reduce the EC2 compute cost for this workload? (Choose two.)

Accepted Answer

Purchase a one-year Standard Reserved Instance for each of the six running instances in the same instance family and Region.. For steady, predictable, always-on compute, commitment-based discounts are the correct lever. Compute Savings Plans and Standard Reserved Instances both convert On-Demand hourly pricing into a lower committed rate for a one-year term, satisfying the cost goal while preserving the multi-AZ, always-available design. Spot capacity and monitoring changes do not meet the availability requirement or do not change the compute rate.

Answer

Enable detailed monitoring on all instances and configure an Auto Scaling target tracking policy at 40% CPU.

Answer

Replace the On-Demand instances with Spot Instances and let the Auto Scaling group replace any interrupted capacity.

Answer

Move the instances into a placement group and enable cluster networking between them.

Question 18

A media company runs a stateless transcoding fleet on Amazon EC2 instances spread across three Availability Zones behind a Network Load Balancer. The fleet must keep processing jobs even if an entire Availability Zone becomes unavailable, and the architect wants to minimize manual intervention. Which combination of actions should the architect take to meet these requirements?

Accepted Answer

Create an Auto Scaling group that spans the three Availability Zones, enable ELB health checks, and configure the group to replace unhealthy instances automatically.. The requirement is automatic recovery from the loss of a whole Availability Zone. An Auto Scaling group distributed across three zones, combined with ELB health checks, continuously replaces unhealthy instances and rebalances capacity into surviving zones. That removes the need for manual intervention. The other configurations either concentrate risk in one zone, rely on interruptible capacity, or alter load balancing behavior without providing replacement capacity.

Answer

Launch the instances as a Spot Fleet with a capacity-optimized allocation strategy and attach an Application Load Balancer in front of the fleet.

Answer

Configure the Network Load Balancer with cross-zone load balancing disabled and register all instances in a single target group.

Answer

Place all instances in a single Availability Zone and create an Amazon Route 53 latency routing policy pointing at the Network Load Balancer.

Question 19

A logistics firm runs an order-processing service that reads from an Amazon SQS queue and writes results to an Amazon DynamoDB table. During a marketing event, the consumer fleet scaled out aggressively and DynamoDB began returning ProvisionedThroughputExceededException errors, causing messages to be retried and some orders to be processed twice. The architects want to absorb traffic spikes without overprovisioning capacity and without duplicate processing. Which combination of changes should they make?

Accepted Answer

Switch the DynamoDB table to on-demand capacity mode and have the consumer use a conditional write with an idempotency key derived from the message ID.. The symptom set has two distinct causes: a capacity model that cannot absorb spikes and a consumer that is not idempotent. On-demand capacity mode lets the table follow the workload without manual provisioning, while a conditional write on a stable idempotency key makes repeated delivery harmless. Addressing both together is what stops the throttling and the duplicate orders.

Answer

Add a global secondary index on the message ID and query it before each write to check whether the order has already been stored.

Answer

Increase the table's provisioned write capacity units substantially and enable DynamoDB Streams so that duplicate items can be detected after the fact.

Answer

Move the table to a different AWS Region and enable DynamoDB Accelerator (DAX) in front of it to cache the writes during the spike.

Question 20

A company stores nightly database backup files in an Amazon S3 bucket. Each backup is about 50 GB, and the files are written once and never modified. Regulatory policy requires that every backup be retained for exactly seven years, after which it may be deleted. Retrieval of a backup for an audit is extremely rare and the company can tolerate a retrieval time of up to 12 hours. Which S3 storage class is the MOST cost-effective choice for these backups?

Accepted Answer

S3 Glacier Deep Archive. The backups are immutable, retained for a fixed multi-year period, and almost never retrieved, with a retrieval tolerance of up to 12 hours. S3 Glacier Deep Archive is purpose-built for exactly this pattern and offers the lowest storage cost among S3 classes, so it satisfies both the compliance retention requirement and the cost-optimization goal without needing frequent access.

Answer

S3 One Zone-IA

Answer

S3 Intelligent-Tiering

Answer

S3 Standard