SAA-C03 Practice Exam 58 — 20 Questions

Question 1

A software vendor in Account B must assume a role in Account A to process support tickets. Security wants to prevent confused deputy attacks. Which two configurations are required for this access pattern to work safely? Select two.

Accepted Answer

Require a specific sts:ExternalId value in the role trust policy in Account A.. Option A is correct because requiring a specific sts:ExternalId value in the role trust policy in Account A is a standard AWS mechanism to prevent the confused deputy problem. The ExternalId acts as a unique secret that the vendor must provide when assuming the role, ensuring that the role is assumed only for the intended purpose and not by a malicious third party.

Answer

Share long-term access keys from Account A with the vendor.

Answer

Attach a permissions boundary to the role to satisfy the ExternalId requirement.

Answer

Allow sts:GetSessionToken instead of sts:AssumeRole in the trust policy.

Question 2

A warehouse integration service must use shared file storage across Linux EC2 instances in multiple Availability Zones. The storage must remain available during an AZ failure. Which service should be used?

Accepted Answer

Amazon EFS with mount targets in multiple Availability Zones. Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently on multiple Linux EC2 instances across different Availability Zones. By configuring mount targets in each AZ, the file system remains accessible even if one AZ fails, because the other mount targets continue to serve traffic. This meets the requirement for shared, highly available file storage across AZs.

Answer

S3 mounted as a POSIX file system without a file gateway

Answer

Instance store volumes

Answer

An EBS volume attached to all instances

Question 3

Based on the exhibit, which Route 53 configuration should be used so traffic automatically returns to the secondary Region only when the primary Region becomes unhealthy?

Accepted Answer

Use failover routing with a primary alias record, a secondary alias record, and a Route 53 health check on the primary target.. Failover routing in Amazon Route 53 is designed for active-passive configurations. By creating a primary alias record pointing to the ALB in the primary Region and a secondary alias record pointing to the ALB in the secondary Region, and attaching a Route 53 health check to the primary target, traffic automatically fails over to the secondary Region only when the health check detects the primary as unhealthy. This meets the requirement of returning traffic to the secondary Region only upon primary failure.

Answer

Use latency-based routing with both ALB records enabled.

Answer

Use geolocation routing so users are always sent to the closest Region.

Answer

Use a CNAME record that points to both ALBs so DNS can round-robin between Regions.

Question 4

Based on the exhibit, what is the best way to let private EC2 instances reach Amazon S3 and AWS Systems Manager without sending traffic through the internet or a NAT gateway?

Accepted Answer

Create a gateway endpoint for S3 and interface endpoints for Systems Manager, EC2Messages, and SSMMessages.. Gateway endpoints for S3 allow private EC2 instances to access S3 via AWS's private network without traversing the internet or a NAT gateway, using prefix lists and route table entries. Interface endpoints for Systems Manager, EC2Messages, and SSMMessages provide private connectivity to AWS Systems Manager via PrivateLink, enabling secure instance management without public IPs or NAT.

Answer

Add a more permissive security group rule allowing outbound 0.0.0.0/0 on all ports.

Answer

Replace the NAT gateway with a network ACL that allows ephemeral ports to the internet.

Answer

Move the instances to public subnets so they can reach AWS services directly.

Question 5

A SaaS vendor will access your AWS resources by assuming an IAM role in your account. You want to prevent confused-deputy attacks and ensure the vendor can only assume the role using an agreed external identifier.

Your role trust policy currently allows sts:AssumeRole from the vendor’s principal, but it does not include any external ID protection. Which change is the best next step?

Accepted Answer

Add a condition to the trust policy: Condition = {"StringEquals": {"sts:ExternalId": "vendor-agreed-id"}}.. Option A is correct because the `sts:ExternalId` condition key is specifically designed to prevent confused-deputy problems. By adding `{"StringEquals": {"sts:ExternalId": "vendor-agreed-id"}}` to the trust policy, you ensure that the vendor must provide the agreed external ID in the `AssumeRole` API call, which only the legitimate vendor knows. This prevents a malicious third party from tricking the vendor into assuming a role in your account on their behalf.

Answer

Add a condition to the trust policy: Condition = {"IpAddress": {"aws:SourceIp": "203.0.113.0/24"}}.

Answer

Remove sts:AssumeRole and replace it with sts:AssumeRoleWithWebIdentity to use the vendor’s browser-based tokens.

Answer

Add a condition to the role permissions policy (not the trust policy) requiring aws:PrincipalTag/ExternalId to equal the external identifier.

Question 6

A service consumes messages from an SQS queue. Recently, a new message format started failing validation in the consumer. The consumer catches the exception but cannot successfully process those messages without code changes. The team wants failed messages to be isolated for later investigation instead of being retried indefinitely. What should they configure?

Accepted Answer

Configure a dead-letter queue (DLQ) with a redrive policy and set maxReceiveCount so messages move after repeated failed receives.. A dead-letter queue (DLQ) with a redrive policy is the correct solution because it allows messages that repeatedly fail processing to be moved to a separate queue after exceeding the maxReceiveCount. This isolates problematic messages for later investigation without blocking the main queue or causing infinite retries. The consumer catches the exception, so the message is not deleted and is returned to the queue for redelivery; the DLQ ensures that after a configurable number of attempts, the message is redirected instead of being retried indefinitely.

Answer

Set the queue’s retention period to 1 minute and rely on messages expiring naturally.

Answer

Increase the visibility timeout to 7 days so failed messages cannot be retried.

Answer

Publish the same message again to SNS on every failure so a different subscriber might succeed.

Question 7

Based on the exhibit, which storage design best supports the application servers' shared working directory requirement?

Accepted Answer

Mount Amazon EFS on every EC2 instance and use it as the shared workspace.. Amazon EFS provides a fully managed, NFS-based shared file system that can be mounted concurrently on multiple EC2 instances across multiple Availability Zones. This directly satisfies the requirement for a shared working directory where all application servers can read and write files simultaneously without additional synchronization overhead.

Answer

Attach one gp3 EBS volume to each instance and synchronize the files with cron jobs.

Answer

Store the artifacts in S3 and have each node read them directly from S3 as a filesystem.

Answer

Use instance store on each instance because it provides the fastest local file access.

Question 8

A web application for a order processing API is behind an Application Load Balancer. The application must be protected from common SQL injection and cross-site scripting attacks with minimum operational overhead. What should the architect deploy?

Accepted Answer

AWS WAF associated with the Application Load Balancer. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS) attacks. By associating an AWS WAF web ACL with the Application Load Balancer, you can filter and monitor HTTP/HTTPS requests based on customizable rules, providing application-layer protection with minimal operational overhead since AWS manages the underlying infrastructure and rule updates.

Answer

Security groups on the application instances

Answer

Network ACLs on the public subnets

Answer

AWS Shield Advanced only

Question 9

In an AWS Organizations environment, developers create IAM roles using an automation tool. The security team wants to guarantee that even if a developer attaches an overly permissive inline policy, the role cannot exceed a fixed set of allowed actions. The team already uses permission boundaries on each role. The tool’s role-creation API call succeeds, but one developer’s new role can still delete production S3 buckets. What is the most likely reason, and what should be corrected?

Accepted Answer

The boundary policy was not actually attached during role creation, or the automation tool attached the wrong boundary ARN; correct the role-creation request to set the intended PermissionBoundary.. Option B is correct because permission boundaries must be explicitly attached to an IAM role during creation via the `PermissionBoundary` parameter. If the automation tool fails to attach the intended boundary policy or attaches the wrong ARN, the role will have no effective boundary, allowing any inline policy to grant full access. The developer's role could then delete production S3 buckets because the boundary was not enforced.

Answer

Permission boundaries do not affect permissions for resources created with role chaining; enable role chaining instead to apply the boundary.

Answer

KMS key policies override permission boundaries for S3, so deletion permission comes from the KMS policy; restrict the KMS key policy instead.

Answer

Permission boundaries apply only to managed policies, not to inline policies; move the overly permissive permissions to a managed policy type to keep it bounded.

Question 10

A startup runs an API on Amazon EC2. The instance must read items from one DynamoDB table and upload logs to one S3 bucket. Platform engineers also need a way to create new application roles, but those roles must never exceed a predefined set of permissions. Which three actions should the architect take? Select three.

Accepted Answer

Attach an IAM role to the EC2 instance profile and remove long-lived access keys from the server.. Option A is correct because attaching an IAM role to the EC2 instance profile allows the instance to obtain temporary credentials via the instance metadata service (IMDS), eliminating the need to store long-lived access keys on the server. This follows the AWS security best practice of using roles for EC2 to securely access DynamoDB and S3 without managing static credentials.

Answer

Give the EC2 instance an IAM user with administrator access for simplicity.

Answer

Store the access keys in the application configuration file and rotate them later.

Question 11

Several EC2 instances in different Availability Zones need to read and write the same shared file system. The file storage should stay available if one AZ has a problem. Which service should the team choose?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones. It is designed for high availability and durability by storing data redundantly across multiple AZs within a region, ensuring continued access even if one AZ fails.

Answer

Amazon EBS

Answer

Amazon S3 only

Answer

Instance store

Question 12

A service reads encrypted data from Amazon S3. The S3 objects use a customer-managed CMK. The IAM role used by the service has kms:Decrypt in its identity policy, but decryption fails with a KMS error stating the role is not authorized to perform kms:CreateGrant. The CMK’s key policy allows kms:Decrypt for the role but does not include kms:CreateGrant. What is the most appropriate change to resolve the failure while preserving least privilege?

Accepted Answer

Add kms:CreateGrant permission to the CMK key policy for the role (scoped to the necessary CMK), keeping other KMS permissions minimal.. The error indicates that the service requires a grant to allow the KMS key to be used in a cryptographic operation that involves a grant-based workflow (e.g., using the S3 bucket key or cross-account access). The IAM role has kms:Decrypt, but the key policy does not grant kms:CreateGrant, which is necessary for the service to create a grant on the CMK. Adding kms:CreateGrant to the key policy scoped to the role resolves the failure while adhering to least privilege by only granting the minimum additional permission needed.

Answer

Enable key rotation because it makes grant creation unnecessary.

Answer

Add kms:DescribeKey to the key policy and remove kms:Decrypt to reduce permissions.

Answer

Update the IAM role to use kms:ScheduleKeyDeletion so future decrypt attempts succeed.

Question 13

A static web application uses CloudFront with an S3 origin for assets (JavaScript, CSS, images). After deploying a new frontend build, the CloudFront cache hit ratio dropped significantly because the S3 origin receives many repeated requests for the same assets. The team notices that requests now include the Authorization header in asset requests. Which change is most likely to restore cache efficiency and reduce origin request costs?

Accepted Answer

Update the CloudFront cache policy so that Authorization is excluded from the cache key for static asset paths.. The drop in cache hit ratio is caused by the Authorization header being included in asset requests, which makes each request unique from CloudFront's perspective, preventing cache reuse. By updating the CloudFront cache policy to exclude the Authorization header from the cache key for static asset paths, CloudFront can treat identical asset requests as cache hits, restoring cache efficiency and reducing origin load.

Answer

Keep the Authorization header but increase the cache TTL to 1 year to reduce revalidation frequency.

Answer

Remove CloudFront and serve assets directly from the S3 website endpoint to reduce CloudFront charges.

Answer

Switch the S3 origin from private access to public access so CloudFront can cache assets more effectively.

Question 14

Your application uses ElastiCache Redis as a cache for user profiles stored in DynamoDB. You must ensure that when a profile is updated, subsequent reads see the latest value quickly. Which cache strategy is generally the best fit for this requirement?

Accepted Answer

Use a cache-aside approach with TTL plus explicit invalidation after writes.. Option B is correct because a cache-aside (lazy loading) strategy with TTL and explicit invalidation ensures that after a write to DynamoDB, the stale Redis entry is removed, forcing the next read to fetch the fresh profile from DynamoDB and repopulate the cache. This combination minimizes the window of stale reads while maintaining high read performance, which is critical for user profile caches where consistency matters.

Answer

Write to DynamoDB only, and never update or invalidate the Redis cache.

Answer

Cache only for reads, and do not fetch from DynamoDB when a key is missing.

Answer

Rely on eventual consistency of Redis replication to propagate updates to all nodes.

Question 15

Based on the exhibit, which change will most improve the CloudFront cache hit ratio for the static assets while still serving the same files to all users?

Accepted Answer

Create a custom cache policy that includes only the v query string and excludes cookies.. Option A is correct because static assets (e.g., images, CSS, JS) are typically served identically to all users, so forwarding a unique query string like 'v' for versioning still allows CloudFront to cache a single object per version. By excluding cookies and other query strings, you prevent cache fragmentation caused by irrelevant variations, directly improving the cache hit ratio. This custom cache policy ensures that requests for the same 'v' value are served from the edge cache rather than forwarded to the origin.

Answer

Enable Origin Shield and keep the current cache behavior unchanged.

Answer

Move the static assets to individual presigned URLs for each viewer.

Answer

Increase the CloudFront default TTL to 24 hours while continuing to forward all cookies and query strings.

Question 16

Company A runs an internal app in account A. The app needs to upload objects to an S3 bucket in account B. When the app calls S3, it receives AccessDenied for s3:PutObject. The team already created an IAM role in account B named UploadRole with a policy allowing s3:PutObject. They did not yet set up any trust relationship. Which change most directly fixes the access problem with least privilege?

Accepted Answer

Update the trust policy on UploadRole (account B) to allow sts:AssumeRole from the app’s IAM role or principal in account A.. The app in account A needs to assume the UploadRole in account B to gain s3:PutObject permissions. Without a trust policy on UploadRole that allows sts:AssumeRole from the app's IAM principal in account A, the role cannot be assumed, and the S3 PutObject call fails with AccessDenied. Updating the trust policy is the most direct fix and follows least privilege by granting only the necessary cross-account role assumption.

Answer

Create IAM user access keys in account A and attach the UploadRole policy directly to those keys.

Answer

Add s3:PutObject permissions to the bucket policy in account B for all principals in account A.

Answer

Attach an SCP (service control policy) in AWS Organizations to deny sts:AssumeRole unless the caller uses an MFA device.

Question 17

You manage multiple AWS accounts under AWS Organizations. A compliance requirement states: no account is allowed to create new IAM access keys for IAM users. Local administrators may attempt to override permissions. Which mechanism should you use to enforce this guardrail across all accounts?

Accepted Answer

An Organizations service control policy (SCP) that explicitly denies CreateAccessKey. An SCP is the correct mechanism because it operates at the AWS Organizations root, OU, or account level to define a central guardrail that cannot be overridden by any IAM principal, including account administrators. By explicitly denying the `iam:CreateAccessKey` action, the SCP ensures that no IAM user in any account can create new access keys, fulfilling the compliance requirement across all accounts.

Answer

An IAM permissions policy attached to a role that only your security team uses

Answer

A KMS key policy that blocks key creation and reuse

Answer

A permission boundary on a single IAM role

Question 18

You store application logs in an S3 bucket. After 30 days, the logs are rarely accessed, but you must retain them for 1 year for compliance. Which S3 feature is the best way to reduce storage cost while meeting the retention requirement?

Accepted Answer

Create an S3 lifecycle rule to transition older objects to a colder storage class after 30 days, then expire after 1 year. Option A is correct because an S3 Lifecycle rule can automatically transition objects from S3 Standard to a colder storage class (e.g., S3 Glacier Instant Retrieval or S3 Glacier Deep Archive) after 30 days, reducing storage costs for rarely accessed logs. After 1 year, the rule can expire the objects, which permanently deletes them, meeting the compliance retention requirement without manual intervention.

Answer

Keep all logs in S3 Standard and rely on lower request rates to reduce cost

Answer

Copy logs to EBS snapshots each week and delete the original files

Answer

Use S3 replication to a second bucket in another region to reduce costs

Question 19

Your AWS Organizations environment has an SCP that explicitly denies kms:Decrypt for principals in the Production OU. A member account IAM policy for a user grants kms:Decrypt on the required KMS key. If that user attempts kms:Decrypt, what happens?

Accepted Answer

The request is denied because the SCP explicit deny overrides IAM allows. In AWS Organizations, Service Control Policies (SCPs) act as a guardrail that sets the maximum available permissions for all accounts in an OU. An explicit deny in an SCP overrides any allow in an IAM policy, even if the IAM policy explicitly grants the action. Therefore, the user's kms:Decrypt request is denied because the SCP's explicit deny takes precedence over the IAM allow.

Answer

The request succeeds because the IAM policy explicitly allows kms:Decrypt

Answer

The request succeeds, but only when using the KMS key policy to allow the user

Answer

The request succeeds for read-only actions and fails only for writes

Question 20

Multiple EC2 instances need a shared filesystem so they can concurrently read and write the same files (for example, user uploads and rendered assets). The instances are in different Availability Zones and must mount the filesystem using NFS. Which AWS storage service best fits?

Accepted Answer

Amazon EFS. Amazon EFS is a fully managed NFS file system that supports concurrent read/write access from multiple EC2 instances across different Availability Zones. It uses the NFSv4.1 protocol, making it the only AWS storage service that provides a shared POSIX-compliant filesystem mountable via NFS for multi-AZ workloads.

Answer

Amazon S3

Answer

Amazon EBS gp3 volumes

Answer

Instance store on EC2