SAA-C03 Design Secure Architectures — 100 Questions

Question 1

A platform team lets project administrators create IAM roles for workloads in their own AWS accounts, but every role must stay inside a fixed security baseline. The organization also wants to block all member accounts from using AWS Regions outside us-east-1 and us-west-2. Which three controls should be used? Select three.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach a permissions boundary to each role created through the delegation process.. Attaching a permissions boundary to each role created through delegation ensures that even if a project administrator grants excessive permissions, the effective permissions are limited by the boundary. This enforces the fixed security baseline without preventing administrators from creating roles within those constraints.

Answer

Grant AdministratorAccess to the project administrators and rely on later audits for enforcement.

Answer

Use an AWS Config rule alone to stop role creation if the permissions are too broad.

Question 2

A batch job runs on EC2 instances in isolated private subnets with no NAT Gateway. The job uses STS AssumeRole to access an operations account and then retrieves a secret from AWS Secrets Manager. After a network hardening change, both calls fail. Which two interface VPC endpoints should be created? Select two.

Accepted Answer

An interface VPC endpoint for AWS STS so the job can call AssumeRole without internet access.. The batch job uses STS AssumeRole, which requires calling the AWS STS API. Without a NAT Gateway or Internet Gateway, private subnets cannot reach public endpoints. An interface VPC endpoint for STS allows the EC2 instances to call AssumeRole privately using AWS PrivateLink, without needing internet access.

Answer

A gateway VPC endpoint for Amazon S3 so the job can reach the secret store indirectly.

Answer

A NAT Gateway in each Availability Zone so the job can use the public service endpoints.

Answer

An internet gateway attached to the VPC so private subnets can reach AWS APIs.

Question 3

A CI system runs on EC2 instances in private subnets and uploads build artifacts to an S3 bucket. The security team wants to eliminate NAT Gateway costs, force all uploads to use TLS, and require SSE-KMS with an approved customer managed key. Which three changes should be made? Select three.

Accepted Answer

Create an S3 gateway VPC endpoint and associate it with the private subnets' route tables.. Creating an S3 gateway VPC endpoint allows EC2 instances in private subnets to access S3 without traversing the internet, eliminating the need for a NAT Gateway and its associated costs. The endpoint uses AWS’s internal network, and associating it with the private subnets' route tables ensures traffic to S3 is routed through the endpoint.

Answer

Deploy a NAT Gateway in each Availability Zone and route artifact traffic through it.

Answer

Use the S3 static website endpoint because it automatically enforces HTTPS.

Question 4

Security responders suspect exfiltration from an Amazon S3 bucket that stores sensitive reports encrypted with a customer managed KMS key. They need to identify which IAM principal downloaded each object and whether any principals called KMS Decrypt on the key during the same time window. Which two detective controls should be enabled? Select two.

Accepted Answer

Enable CloudTrail data events for the S3 bucket.. Enabling CloudTrail data events for the S3 bucket captures detailed logs of object-level operations, including GetObject (download) requests. This allows you to identify which IAM principal downloaded each object, including the source IP, user agent, and request time. Without data events, CloudTrail only logs management-level actions (e.g., bucket creation) and misses object-level access.

Answer

Enable S3 Object Lock in compliance mode.

Answer

Turn on default bucket encryption with SSE-KMS.

Answer

Enable MFA Delete on the bucket.

Question 5

Your company requires that all requests to an S3 bucket use HTTPS and that all objects uploaded to the bucket are encrypted at rest. You manage the S3 bucket policy and want enforcement that does not rely on application code compliance.

Which bucket policy change best enforces both requirements?

Accepted Answer

Add a Deny statement for all S3 actions on the bucket and its objects when aws:SecureTransport is false, and add a Deny statement for s3:PutObject when the request does not specify server-side encryption with AES256 (s3:x-amz-server-side-encryption = "AES256").. It uses a Deny statement with the `aws:SecureTransport` condition to block any request that does not use HTTPS, enforcing encryption in transit. It also adds a Deny statement for `s3:PutObject` when the request does not include the `x-amz-server-side-encryption` header set to `AES256`, ensuring that all uploaded objects are encrypted at rest with SSE-S3. This policy-based enforcement works regardless of application code, meeting the requirement for non-reliance on client-side compliance.

Answer

Use S3 website hosting to redirect users to HTTPS and rely on bucket default encryption for all uploads.

Answer

Add a Deny statement for s3:GetObject when aws:SecureTransport is false, and enable default encryption on the bucket.

Answer

Allow only IAM principals from your account to access the bucket and require clients to configure HTTPS in their applications.

Question 6

A public web application sits behind Amazon CloudFront with an Application Load Balancer as the origin. The security team wants all edge traffic inspected by AWS WAF and also wants to prevent anyone on the internet from reaching the ALB directly. Which two changes should be made? Select two.

Accepted Answer

Associate an AWS WAF web ACL with the CloudFront distribution.. AWS WAF can be associated directly with a CloudFront distribution to inspect all edge traffic before it reaches the origin. This allows the security team to filter malicious requests at the AWS edge locations, reducing the attack surface and offloading processing from the Application Load Balancer.

Answer

Place the ALB in private subnets and keep the CloudFront distribution unchanged.

Answer

Use an S3 Origin Access Control instead of a security group change.

Answer

Open the ALB to 0.0.0.0/0 and rely on WAF alone for protection.

Question 7

A marketing portal serves private PDF files stored in Amazon S3 through CloudFront. Users authenticate to the portal first, and each download link must expire after one hour. The S3 origin must never be directly reachable from the internet. Which three actions should be used? Select three.

Accepted Answer

Use CloudFront signed URLs or signed cookies with a one-hour expiration window.. CloudFront signed URLs or signed cookies allow you to restrict access to content for a specific time window. By setting the expiration to one hour, you ensure that each download link becomes invalid after that period, meeting the requirement for expiring links. This approach also keeps the S3 bucket private, as users must authenticate through CloudFront rather than accessing S3 directly.

Answer

Expose the S3 bucket through the static website endpoint and secure it with security group rules.

Answer

Use an AWS WAF web ACL attached to the S3 bucket instead of CloudFront.

Question 8

An application runs on EC2 instances in private subnets in a VPC. There is no NAT gateway. The instances need to download objects from S3 over HTTPS and also call DynamoDB. The security group outbound rules allow TCP 443 to the VPC endpoint addresses. After deployment, the app times out when connecting to S3, but it can reach DynamoDB. Which single change is most likely to restore S3 connectivity?

Accepted Answer

Create a Gateway VPC endpoint for S3 and associate it with the private subnet route tables that contain the instances.. The application is in private subnets without a NAT Gateway, so it cannot reach the internet. A Gateway VPC Endpoint for S3 allows private subnet instances to access S3 over the AWS network without internet connectivity. The security group already allows TCP 443 to the VPC endpoint addresses, so the missing piece is the route table association that directs S3 traffic to the endpoint.

Answer

Replace the security group egress rule to allow all outbound traffic to 0.0.0.0/0 on TCP 443.

Answer

Add an Internet Gateway to the VPC and route the private subnet’s 0.0.0.0/0 to the IGW.

Answer

Switch from network ACLs to security groups by removing the existing NACL allow rules for ephemeral ports.

Question 9

A company hosts an internal HTTP API on an internal Network Load Balancer (NLB) in VPC A. A partner team in a separate AWS account needs access, but their VPC CIDR overlaps with VPC A, so VPC peering is not feasible.

Security requirements state the API must remain non-public (no internet-facing ALB/NLB) and access must use AWS private networking.

Which architecture best meets these requirements?

Accepted Answer

Use AWS PrivateLink by creating a VPC endpoint service backed by the NLB in VPC A, then create an interface VPC endpoint in the partner VPC with appropriate endpoint access controls.. AWS PrivateLink allows you to expose an internal NLB in VPC A as a VPC endpoint service, and the partner team can create an interface VPC endpoint in their own VPC to connect privately. This solution avoids overlapping CIDR issues because traffic flows through PrivateLink’s network interfaces using private IPs, not through VPC peering or internet routing. It also satisfies the non-public requirement since the API remains accessible only via private networking within AWS.

Answer

Expose the NLB to the internet with an Elastic IP and restrict access using the NLB’s security group only.

Answer

Use VPC peering between VPC A and the partner VPC and update route tables to resolve the overlap.

Answer

Deploy a NAT gateway in VPC A and route the partner’s traffic to the NLB through the NAT gateway.

Question 10

Your CI system assumes an IAM role RoleForDeploy using STS AssumeRole and includes a session tag called Project=blue. The role’s permissions policy uses an ABAC condition like aws:PrincipalTag/Project to allow access only to resources tagged with the same project.

AssumeRole succeeds, but deployments fail with AccessDenied. CloudTrail shows the role was assumed, yet the effective session does not contain the Project tag.

Which change most directly fixes this issue?

Accepted Answer

Add permissions for sts:TagSession to the IAM role so the CI pipeline is allowed to pass the Project session tag during AssumeRole.. When using AWS Security Token Service (STS) AssumeRole with session tags, the calling entity must have explicit permission to pass those tags via the `sts:TagSession` action. Without this permission, the AssumeRole call succeeds but the session tags are silently dropped, causing the ABAC condition `aws:PrincipalTag/Project` to evaluate to false and deny access to resources. Adding `sts:TagSession` to the role's permissions policy allows the CI pipeline to include the `Project=blue` tag in the assumed role session.

Answer

Remove the ABAC condition using aws:PrincipalTag/Project so the policy ignores session tags.

Answer

Move the aws:PrincipalTag/Project condition into the trust policy so it applies during the AssumeRole call.

Answer

Add kms:Decrypt permission to the CI role because missing tags are typically caused by KMS authorization failures.

Question 11

A team wants to remove a bastion host used for administrative access to EC2 instances in private subnets. The instances should be reachable only for occasional troubleshooting by engineers who authenticate with AWS SSO. What is the best secure alternative within AWS, assuming the instances already have an instance profile attached?

Accepted Answer

Use AWS Systems Manager Session Manager, enabling the required SSM permissions in the instance profile and restricting access to engineers via IAM.. AWS Systems Manager Session Manager provides secure, auditable, agent-based access to EC2 instances without requiring a bastion host, open inbound ports, or SSH keys. By enabling the required SSM permissions (e.g., AmazonSSMManagedInstanceCore) in the instance profile and using IAM policies to restrict access to authenticated engineers via AWS SSO, you achieve a fully managed, secure, and compliant solution. This eliminates the need for a bastion host while maintaining the ability to troubleshoot instances in private subnets.

Answer

Keep the bastion host but move it into a private subnet; engineers can connect by using a corporate VPN into the VPC.

Answer

Attach a public IP to each private instance so engineers can SSH directly and use security groups to restrict access.

Answer

Create a security group rule that allows engineers’ source IP addresses to reach instances over RDP on port 3389.

Question 12

A platform team wants application developers to create IAM roles for their ECS tasks, but security must guarantee that no role created by those developers can ever exceed a predefined permission set. The developers also should not be able to attach broader permissions to themselves later. What should the team implement?

Accepted Answer

Use an IAM permission boundary on the developer principals and require created roles to include the boundary.. IAM permission boundaries allow the platform team to define a maximum set of permissions that any role created by the developers can have. By attaching a permission boundary to the developers' IAM user or role, and requiring that any new role they create includes that boundary, the developers cannot grant permissions beyond the boundary—even if they attach a broader policy. This ensures that no role can ever exceed the predefined permission set, and developers cannot escalate their own privileges later.

Answer

Attach a customer-managed IAM policy to the developers and let them create roles freely.

Answer

Create a service-linked role for ECS and let developers reuse it for all workloads.

Answer

Add an S3 bucket policy that only allows tagged roles to be created.

Question 13

A startup has an HTTP API with highly unpredictable traffic from mobile devices. Each request performs lightweight validation, writes an event record, and triggers downstream notifications. The current EC2 fleet stays mostly idle, and the team wants to reduce infrastructure management and pay only for usage. Which two changes best fit the requirement? Select two.

Accepted Answer

Place Amazon API Gateway in front of AWS Lambda functions for request handling.. Amazon API Gateway can directly invoke AWS Lambda functions, eliminating the need to manage EC2 instances. This serverless architecture scales automatically with unpredictable traffic, and you pay only for the requests and compute time consumed, which aligns with the startup's goal of reducing idle costs and infrastructure management.

Answer

Keep the EC2 fleet and add more instances so the idle cost is less noticeable.

Answer

Move the API to an Application Load Balancer only, without changing compute.

Answer

Store runtime secrets in user data on each instance.

Question 14

A company runs a customer portal in us-east-1 and a warm standby in us-west-2. The DNS name must send users to us-east-1 while it is healthy and automatically switch to us-west-2 if the primary application endpoint stops responding. Which two actions should the architect take? Select two.

Accepted Answer

Create Route 53 failover records for the same DNS name with primary and secondary targets.. Route 53 failover routing allows you to configure active-passive failover by associating a primary and secondary record with the same DNS name. When the primary endpoint fails, Route 53 automatically returns the secondary record's IP address, directing traffic to the warm standby in us-west-2. This directly meets the requirement for automatic failover based on endpoint health.

Answer

Use latency-based routing so Route 53 always returns the lowest-latency Region.

Answer

Use weighted records with a 50/50 split to balance traffic across both Regions.

Answer

Place the standby application in a private hosted zone so only internal systems can resolve it.

Question 15

A web application uses Amazon RDS for MySQL in a Multi-AZ deployment. During a planned maintenance event, the team wants to understand which two statements about failover are accurate so they can design connection handling correctly. Which two statements are accurate? Select two.

Accepted Answer

RDS automatically promotes the synchronous standby in the same Region if the primary instance becomes unavailable.. In a Multi-AZ RDS for MySQL deployment, Amazon RDS automatically maintains a synchronous standby replica in a different Availability Zone. If the primary instance becomes unavailable due to a planned maintenance event or failure, RDS automatically fails over to the standby, promoting it to become the new primary. This failover is transparent to the application when using the same DNS endpoint, as RDS updates the DNS record to point to the new primary.

Answer

The standby instance can serve production read traffic to improve read scaling in standard RDS Multi-AZ.

Answer

The application must permanently change its connection string to a new host after failover completes.

Answer

Multi-AZ provides protection against a full Region outage without any additional design changes.

Question 16

A studio keeps 4 PB of completed video projects in Amazon S3. Editors work on active projects for about 60 days, auditors occasionally review the same objects for several months, and legal policy requires retention for 7 years. Retrieval of very old files can take hours. Which three actions should the architect recommend? Select three.

Accepted Answer

Transition objects to S3 Standard-IA after 60 days.. After 60 days of active editing, objects can be transitioned to S3 Standard-IA, which offers lower storage costs than S3 Standard while still providing low-latency retrieval for occasional access by auditors. This lifecycle policy optimizes cost without sacrificing availability for the review period.

Answer

Keep the files in S3 Standard indefinitely so retrieval is always fast.

Answer

Copy the files to a single EBS volume for lower per-GB cost.

Question 17

A single EC2 instance hosts a database that needs low-latency block storage and a persistent volume that remains attached to the instance. Which AWS storage service is the best fit?

Accepted Answer

Amazon EBS. Amazon EBS provides persistent block-level storage volumes that can be attached to a single EC2 instance, offering low-latency performance suitable for database workloads. Unlike ephemeral instance store volumes, EBS volumes persist independently of the instance's lifecycle, ensuring data durability even when the instance is stopped or terminated.

Answer

Amazon S3

Answer

Amazon EFS

Answer

AWS Storage Gateway

Question 18

A company runs a steady inventory API on AWS Fargate and AWS Lambda during the day, plus a nightly batch render farm on EC2 that can be interrupted and retried. The finance team wants the lowest predictable discount for the always-on compute and the lowest possible cost for the batch jobs. Which two purchasing choices should the architect recommend? Select two.

Accepted Answer

Purchase a Compute Savings Plan for the steady Fargate and Lambda usage.. A Compute Savings Plan offers the lowest predictable discount (up to 66% compared to On-Demand) and automatically applies to Fargate and Lambda usage, covering the always-on inventory API without requiring instance family or region commitments. This provides flexibility while still delivering significant savings over On-Demand pricing.

Answer

Purchase Standard Reserved Instances for the steady Fargate and Lambda usage.

Answer

Use On-Demand Instances for the batch render farm to avoid interruptions.

Answer

Move the render farm to Dedicated Hosts to improve price predictability.

Question 19

A company operates 40 AWS accounts and wants chargeback by application, environment, and business unit. Finance needs detailed line items, and engineering wants consistent monthly reports without manual spreadsheet work. The current tagging scheme is inconsistent, and many resources are missing billing metadata. Which three actions should the architect recommend? Select three.

Accepted Answer

Standardize cost allocation tags such as Application, Environment, and BusinessUnit.. Standardizing cost allocation tags like Application, Environment, and BusinessUnit ensures consistent metadata across all 40 accounts. This is a prerequisite for accurate chargeback, as AWS Cost Allocation Tags allow you to group resources by these dimensions for detailed billing reports.

Answer

Use AWS Budgets alone because it provides the most detailed line-item attribution.

Answer

Rely only on the Cost Explorer console for chargeback accuracy.

Question 20

A company has three workloads. First, a stable EC2 application will remain on the same instance family for at least one year. Second, an ECS service on Fargate may shift between launch types but has steady baseline usage. Third, a fault-tolerant nightly batch job can be interrupted and restarted. Which three pricing choices should the architect recommend? Select three.

Accepted Answer

Standard Reserved Instances for the EC2 application.. Standard Reserved Instances (A) are ideal for the stable EC2 application because the workload has a predictable, steady-state usage and will remain on the same instance family for at least one year. By committing to a 1-year or 3-year term, the company receives a significant discount (up to 72%) compared to On-Demand pricing, making it the most cost-effective choice for this stable, long-running workload.

Answer

On-Demand Instances for all three workloads.

Answer

Dedicated Hosts for the batch job.