SAA-C03 Design Secure Architectures Practice Test 10 — 15 Questions

Question 1

A platform team manages a multi-tenant SaaS application on Amazon EC2. Each tenant has a dedicated IAM role that the EC2 instances assume via instance profiles. The security team must ensure that a compromised tenant's instance cannot use its role credentials to read or write objects in any other tenant's S3 bucket, even if the role's identity-based policy contains a wildcard Resource. Which combination of controls should the team implement to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach an S3 bucket policy to each tenant bucket that grants access only to the corresponding tenant role, and use the aws:PrincipalArn condition key with a value of the tenant role ARN.. S3 authorization evaluates identity-based policies and resource-based policies together. A bucket policy that allows only a specific tenant role ARN, combined with the aws:PrincipalArn condition, explicitly limits access to that bucket. Even if a tenant role has a wildcard s3:* identity policy, the bucket policy for another tenant's bucket does not grant access to that role, so the request is denied. This provides strong cross-tenant isolation without disrupting legitimate tenant access.

Answer

Use AWS Organizations SCPs to deny s3:GetObject and s3:PutObject for all roles except a central administrator role, and have tenants request access through a ticketing system.

Answer

Enable S3 Block Public Access on all tenant buckets and require that all requests use HTTPS via a bucket policy condition aws:SecureTransport.

Answer

Configure each tenant bucket with a VPC endpoint policy that allows only the tenant's VPC endpoint, and associate the endpoint with the tenant's subnets.

Question 2

A security team wants to enforce that all Amazon EBS volumes created in an AWS account are encrypted at rest. They need a preventive control that blocks the creation of unencrypted volumes, including volumes created by any IAM principal. Which solution should they implement?

Accepted Answer

Create an AWS Organizations service control policy (SCP) that denies the ec2:CreateVolume action unless the request includes encryption.. A service control policy (SCP) in AWS Organizations can deny the ec2:CreateVolume action unless encryption is enabled, providing a preventive guardrail that applies to all accounts and principals in the organization. This ensures that no unencrypted EBS volumes can be created, meeting the security team's requirement for a preventive control.

Answer

Attach an IAM policy to all users that denies ec2:CreateVolume unless the aws:RequestTag/Encrypted condition key is present.

Answer

Use AWS Config to detect unencrypted EBS volumes and automatically delete them with a remediation action.

Answer

Enable EBS encryption by default for the account in each AWS Region.

Question 3

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits and allow only legitimate traffic. They have deployed AWS WAF with a web ACL associated with the ALB. Which two actions should they take to meet these requirements? (Choose two.)

Accepted Answer

Create AWS WAF rules that block requests based on known malicious IP addresses using an IP set.. To protect against common web exploits, AWS WAF managed rule groups such as AWSManagedRulesCommonRuleSet provide pre-configured rules for threats like SQL injection and XSS. Blocking known malicious IP addresses with an IP set further restricts traffic to legitimate sources. Together, these actions filter out malicious requests and help ensure only legitimate traffic reaches the application.

Answer

Enable AWS Shield Advanced on the ALB to automatically mitigate SQL injection attacks.

Answer

Implement rate-based rules in AWS WAF to limit requests from individual IP addresses.

Answer

Set up an Amazon CloudFront distribution in front of the ALB and enable AWS WAF on the distribution only.

Question 4

A company has a VPC with a CIDR block of 10.0.0.0/16. The company wants to allow instances in a private subnet to access an Amazon S3 bucket without traversing the internet. The security team requires that all traffic to S3 be encrypted in transit and that access be limited to a specific S3 bucket. Which solution should a solutions architect recommend?

Accepted Answer

Create a gateway VPC endpoint for Amazon S3 and attach a bucket policy that allows access only from the endpoint and requires TLS.. A gateway VPC endpoint for S3 provides private access from a VPC to S3 without requiring an internet gateway or NAT device. By attaching a bucket policy that allows access only from the endpoint and denies requests where aws:SecureTransport is false, you enforce TLS and restrict access to the specific bucket. This solution is cost-effective and meets all requirements.

Answer

Create a NAT gateway in a public subnet and route S3 traffic through it, then use an S3 bucket policy to enforce TLS.

Answer

Create an interface VPC endpoint for Amazon S3 and attach a bucket policy that allows access only from the endpoint and requires TLS.

Answer

Configure the private subnet's route table to point to an internet gateway and use an S3 bucket policy to restrict access by source IP.

Question 5

A security team wants to enforce that any Amazon EBS volume created in a production AWS account is encrypted with an AWS KMS customer managed key. They need a preventive control that blocks non-compliant CreateVolume calls, while still allowing developers to create volumes without an approval workflow. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Create an AWS Organizations service control policy that denies ec2:CreateVolume unless the request specifies encryption with an approved KMS key.. Preventive controls must stop the API call before the resource is created. An AWS Organizations service control policy is evaluated for every principal in the account and can deny ec2:CreateVolume when the request lacks the required encryption and key. This blocks non-compliant volumes account-wide without custom automation, unlike detective Config rules or per-role IAM policies.

Answer

Enable the account-level EBS encryption by default setting and specify an AWS KMS customer managed key as the default key.

Answer

Attach an IAM policy to each developer role that denies ec2:CreateVolume unless the request includes the encrypted condition key.

Answer

Create an AWS Config rule that checks ebsEncryptionByDefault and triggers an AWS Lambda function to delete unencrypted volumes.

Question 6

A financial services firm runs an internal API on Amazon EC2 instances behind an Application Load Balancer. Auditors require that all traffic between clients and the load balancer be encrypted with TLS 1.2 or higher, that the backend instances never receive unencrypted client traffic, and that client certificates be validated before requests reach the application. The firm wants to use AWS Certificate Manager for the public certificate on the load balancer. Which configuration meets these requirements?

Accepted Answer

Create an HTTPS listener with the ACM certificate and enable mutual TLS on the listener by referencing a trust store that contains the client CA certificates, then configure the target group for HTTPS to the instances.. Mutual TLS on an Application Load Balancer listener validates client certificates against a trust store, and an HTTPS target group ensures the connection from the load balancer to the instances is encrypted as well. Combining the ACM certificate for server authentication with a trust store for client authentication covers both directions and the TLS version floor.

Answer

Create a TCP listener on a Network Load Balancer with the ACM certificate attached, and keep the EC2 instances registered directly in the target group on port 80.

Answer

Create an HTTPS listener on the ALB using the ACM certificate, terminate TLS at the ALB, and configure the target group to use HTTP to the instances.

Answer

Create an HTTPS listener with the ACM certificate and attach a security group to the ALB that allows only port 443 from the internet, leaving the target group protocol as HTTP.

Question 7

A company stores sensitive logs in an Amazon S3 bucket. The security team requires that all data be encrypted at rest with a customer managed AWS KMS key, that the key be rotated annually, and that access to the key be logged for audit. A developer proposes using SSE-S3. Why does SSE-S3 fail to meet these requirements?

Accepted Answer

SSE-S3 uses an AWS managed key, so the customer cannot control rotation, key policy, or audit key usage in AWS CloudTrail.. The requirements demand a customer managed KMS key with configurable rotation, a key policy the customer controls, and CloudTrail visibility into key usage. SSE-S3 uses an AWS owned key that the customer cannot rotate on a chosen schedule, cannot attach a custom key policy to, and cannot audit per-use in CloudTrail. Only SSE-KMS with a customer managed key satisfies all three.

Answer

SSE-S3 cannot be used with bucket policies, so access cannot be restricted to specific IAM principals.

Answer

SSE-S3 requires the customer to store and manage the data key, which increases operational overhead and risk of key loss.

Answer

SSE-S3 does not encrypt objects at rest; it only encrypts data in transit using TLS.

Question 8

A company's EC2 instances in a private subnet must access an Amazon DynamoDB table. Security policy prohibits internet gateways and NAT devices, and requires that credentials never be stored on the instances. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create an interface VPC endpoint for DynamoDB, attach an IAM role to the instances with the required DynamoDB permissions, and allow the endpoint's security group from the instance security group.. A private path to DynamoDB without internet or NAT is provided by an interface VPC endpoint, and temporary credentials come from an IAM role attached to the instances. Combining the endpoint with the instance role satisfies both the network restriction and the no-stored-credentials rule, and it avoids the management overhead of distributing and rotating static keys.

Answer

Deploy a NAT gateway in a public subnet and attach an IAM role to the instances with the required DynamoDB permissions.

Answer

Create an interface VPC endpoint for DynamoDB, generate an IAM user access key pair, and distribute it to the instances through EC2 user data.

Answer

Create a gateway VPC endpoint for DynamoDB, store IAM user access keys in AWS Systems Manager Parameter Store, and retrieve them at boot.

Question 9

A company is designing a multi-account structure with AWS Organizations. Compliance requires that no member account be able to disable AWS CloudTrail, delete its trail, or turn off Amazon GuardDuty, even by an account administrator. The security team manages a dedicated log archive account. Which approach enforces these guardrails?

Accepted Answer

Create a service control policy in AWS Organizations that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and guardduty:DeleteDetector, and attach it to the organizational units containing the member accounts.. Service control policies are the only mechanism that constrains every principal in a member account, including the account root user, because they define the permission ceiling for the account. An explicit deny on the CloudTrail and GuardDuty destructive actions therefore blocks anyone in the affected organizational units from turning off detection or logging, regardless of their in-account permissions.

Answer

Use AWS IAM Identity Center to assign permission sets that omit the CloudTrail and GuardDuty destructive actions to all workforce users.

Answer

Enable AWS CloudTrail organization trails in all accounts and configure Amazon EventBridge rules that invoke an AWS Lambda function to re-enable logging when it is stopped.

Answer

Attach an IAM permissions boundary to every IAM role in each member account that excludes the CloudTrail and GuardDuty destructive actions.

Question 10

A company is designing a multi-account AWS environment. The security team wants centralized control so that a new restrictive guardrail applies automatically to every existing and future account, and they want to prevent member accounts from leaving the organization's management. Which two actions should a solutions architect take? (Choose two.)

Accepted Answer

Create the accounts with AWS Organizations and apply a service control policy that denies the unwanted actions, attaching it at the root so it inherits to all accounts.. Centralized preventive control across all current and future accounts comes from service control policies attached at the organization root, which requires enabling that policy type. Member accounts have no ability to leave the organization on their own, so protecting the management account credentials and enforcing the guardrail from the root covers the containment requirement.

Answer

Enable all features in AWS Organizations and use the management account to apply the guardrail, so member accounts inherit it by default.

Answer

Configure an organization trail in AWS CloudTrail and an AWS Config conformance pack to detect accounts that violate the guardrail.

Answer

Apply IAM permission boundaries to every role in each member account so the guardrail is enforced uniformly across the organization.

Question 11

A startup stores application logs in an Amazon S3 bucket. The security team requires that all objects be encrypted at rest using keys managed by AWS, with automatic key rotation and no additional cost. The team does not want to manage key policies or permissions. Which encryption option should a solutions architect recommend?

Accepted Answer

SSE-S3 with default bucket encryption enabled.. SSE-S3 provides encryption at rest with S3-managed keys, automatic rotation, and no additional cost. Enabling default bucket encryption ensures all objects are encrypted by default. This meets the requirements for AWS-managed keys, no key policy management, and no extra charges. SSE-KMS options introduce cost or management overhead, and client-side encryption requires application changes.

Answer

SSE-KMS with an AWS managed key (aws/s3).

Answer

SSE-KMS with a customer managed key.

Answer

Client-side encryption using the AWS Encryption SDK.

Question 12

A company has an Amazon S3 bucket that must be accessible only from a specific Amazon VPC endpoint. The bucket contains sensitive data, and the security team wants to ensure that requests to the bucket are denied unless they originate from the VPC endpoint. The company uses an interface VPC endpoint for S3. Which configuration should a solutions architect implement to meet this requirement?

Accepted Answer

Attach a bucket policy that denies requests unless aws:sourceVpce matches the VPC endpoint ID.. To restrict S3 bucket access to a specific VPC endpoint, use a bucket policy with a Deny statement that checks the aws:sourceVpce condition key against the endpoint ID. This ensures requests not originating from that endpoint are denied. Security groups, Block Public Access, and access points do not provide the same endpoint-specific enforcement at the bucket level.

Answer

Use an S3 access point with a policy that allows only the VPC endpoint's IAM role.

Answer

Enable S3 Block Public Access at the bucket level and account level.

Answer

Configure a security group on the VPC endpoint that allows inbound traffic only from the VPC CIDR range.

Question 13

A Lambda function needs to read the current value of exactly one AWS Secrets Manager secret at startup. Which least-privilege IAM permission (action and resource scope) should you grant to the Lambda execution role?

Accepted Answer

secretsmanager:GetSecretValue on only the secret’s full ARN. The Lambda function needs to read the current value of exactly one secret at startup. The least-privilege permission is `secretsmanager:GetSecretValue` scoped to that secret's full ARN. This action retrieves the secret value, and restricting the resource to the specific ARN ensures the function cannot access any other secrets.

Answer

secretsmanager:ListSecrets on all secrets (resource set to "*")

Answer

secretsmanager:UpdateSecret on the specific secret ARN

Answer

secretsmanager:DescribeSecret on all secrets (resource set to "*")

Question 14

A security team requires that every object uploaded to s3://secure-bucket/uploads/ must be encrypted using SSE-KMS with a specific customer-managed KMS key. Which S3 bucket policy condition approach best enforces this requirement for PutObject requests?

Accepted Answer

Deny PutObject unless s3:x-amz-server-side-encryption equals "aws:kms" and s3:x-amz-server-side-encryption-aws-kms-key-id equals the required CMK ARN. It uses a Deny effect with the s3:x-amz-server-side-encryption condition key set to 'aws:kms' and the s3:x-amz-server-side-encryption-aws-kms-key-id condition key set to the specific customer-managed KMS key ARN. This ensures that any PutObject request that does not include both the required encryption header and the exact KMS key identifier is denied, enforcing the encryption requirement at the bucket policy level.

Answer

Allow PutObject only when aws:SecureTransport is true; encryption is then guaranteed automatically

Answer

Deny PutObject if the request includes Content-Type other than "application/octet-stream"

Answer

Deny PutObject when the caller’s role is not allowed to kms:Decrypt in their IAM policy

Question 15

An application in Account B (IAM role arn:aws:iam::account-b:role/app-read) reads objects from an S3 bucket in Account A. The bucket uses SSE-KMS with a customer-managed KMS key in Account A. Object reads consistently fail with an error that includes "AccessDenied" and "kms:Decrypt".

The IAM permissions in Account B for kms:Decrypt are correct, but the requests still fail.

Which change will most directly fix the failure?

Accepted Answer

Modify the KMS key policy in Account A to allow kms:Decrypt for the Account B role arn:aws:iam::account-b:role/app-read, using the appropriate cross-account conditions (for example, allowing the use via S3 and the expected encryption context for the bucket).. When using SSE-KMS with a customer-managed KMS key in a cross-account scenario, the KMS key policy must explicitly grant the external IAM role (arn:aws:iam::account-b:role/app-read) permission to perform kms:Decrypt. Even if the IAM role in Account B has the correct kms:Decrypt permission, the KMS key policy in Account A acts as a resource-based policy that must also allow the cross-account principal. Without this, the KMS service denies the decrypt request, resulting in the 'AccessDenied' error.

Answer

Add kms:Decrypt to the KMS key policy in Account A for the Account B role arn:aws:iam::account-b:role/app-read, and remove kms:Decrypt from the role policy in Account B.

Answer

Update the IAM role in Account B to use the s3:GetObject permission only, and rely on S3 to authorize KMS decrypt automatically.

Answer

Switch the S3 bucket encryption from SSE-KMS to SSE-S3, keeping all existing IAM and KMS configuration unchanged.