SAA-C03 Design Secure Architectures Practice Test 11 — 15 Questions

Question 1

A server assumes an IAM role and must read export objects only from this prefix in an S3 bucket: s3://customer-data/exports/acme/ . The application also needs to list the objects under that exact prefix so it can discover which export folders exist. The application performs ListBucket requests with Prefix set to exactly "exports/acme/".

The current role policy allows s3:ListBucket on the bucket ARN without a prefix condition, and security reports the role can list other tenants’ export object keys.

Which IAM policy change best enforces least privilege for both ListBucket and GetObject?

Accepted Answer

Allow s3:ListBucket on arn:aws:s3:::customer-data only when s3:prefix equals "exports/acme/" (for example, using a StringEquals condition on s3:prefix). Also allow s3:GetObject only on arn:aws:s3:::customer-data/exports/acme/*.. It uses an s3:prefix condition with StringEquals on the ListBucket action to restrict listing to exactly 'exports/acme/', preventing the role from enumerating other tenants' objects. It also restricts GetObject to the same prefix using a resource ARN of arn:aws:s3:::customer-data/exports/acme/*, ensuring least privilege for both read operations. This combination enforces the principle of least privilege by scoping both actions to the specific tenant prefix.

Answer

Keep s3:ListBucket allowed on arn:aws:s3:::customer-data, but restrict s3:GetObject to arn:aws:s3:::customer-data/exports/acme/*.

Answer

Allow s3:ListBucket only on arn:aws:s3:::customer-data/exports/acme/* and allow s3:GetObject on arn:aws:s3:::customer-data/*.

Answer

Add a Deny statement for s3:GetObject outside arn:aws:s3:::customer-data/exports/acme/*, but keep s3:ListBucket unrestricted on arn:aws:s3:::customer-data.

Question 2

A company serves private images stored in S3 through Amazon CloudFront. Only authenticated users should be able to access each image, and access should expire after 1 hour. Which CloudFront feature best meets this requirement?

Accepted Answer

Signed URLs or signed cookies with an expiration time of 1 hour. Signed URLs or signed cookies allow CloudFront to grant temporary access to private content by embedding authentication information (policy, signature, key pair ID) directly in the request. By setting an expiration time of 1 hour in the policy statement, access automatically becomes invalid after that period, meeting both the authentication and expiry requirements without exposing the S3 bucket publicly.

Answer

A WAF rule that blocks requests without valid JWTs, without using signed URLs

Answer

Turning on S3 bucket public access block, without any CloudFront viewer authentication

Answer

Enabling CloudFront geo restriction to allow only one country

Question 3

A backend service uses an IAM role to read files from an S3 bucket. It must only read objects under s3://prod-reporting/incoming/ but currently receives AccessDenied (403) on GetObject for that prefix.

The role already has this statement:
- Action: s3:ListBucket
- Resource: arn:aws:s3:::prod-reporting

Which policy statement would most directly follow least privilege to allow only the required reads under the incoming prefix?

Accepted Answer

Allow reads with a prefix-scoped statement: Action = ["s3:GetObject"], Resource = ["arn:aws:s3:::prod-reporting/incoming/*"].. It grants only the s3:GetObject permission on the specific prefix path arn:aws:s3:::prod-reporting/incoming/*, which directly allows reading objects under that prefix while adhering to least privilege. The existing s3:ListBucket permission already enables listing the bucket, so only the missing read action needs to be added.

Answer

Allow only listing and reading with a single statement: Action = ["s3:*"], Resource = ["arn:aws:s3:::prod-reporting/incoming/*"].

Answer

Allow all S3 reads at the account level: Action = ["s3:GetObject"], Resource = ["arn:aws:s3:::*"].

Answer

Allow bucket listing with a condition that forces the prefix: Action = ["s3:ListBucket"], Resource = ["arn:aws:s3:::prod-reporting"], Condition = {"StringLike": {"s3:prefix": "incoming/*"}}.

Question 4

A third-party payroll vendor in another AWS account must assume a role in your account to write a daily settlement file to Amazon S3. You want to prevent confused-deputy attacks and make every assumed session traceable in CloudTrail back to an individual vendor user. Which three trust-policy or session controls should be used? Select three.

Accepted Answer

Specify the exact vendor role ARN as the trusted principal in the role trust policy.. Specifying the exact vendor role ARN as the trusted principal in the trust policy ensures that only that specific role in the vendor's account can assume the role, preventing any other entity from impersonating the vendor. This is a key control to limit the trust boundary and avoid confused-deputy attacks.

Answer

Use a wildcard principal and rely on the S3 bucket policy to narrow access later.

Answer

Give the vendor long-term IAM user credentials in your account for easier auditing.

Question 5

A SaaS vendor will access your AWS resources by assuming an IAM role in your account. You want to prevent confused-deputy attacks and ensure the vendor can only assume the role using an agreed external identifier.

Your role trust policy currently allows sts:AssumeRole from the vendor’s principal, but it does not include any external ID protection. Which change is the best next step?

Accepted Answer

Add a condition to the trust policy: Condition = {"StringEquals": {"sts:ExternalId": "vendor-agreed-id"}}.. The `sts:ExternalId` condition key is specifically designed to prevent confused-deputy problems. By adding `{"StringEquals": {"sts:ExternalId": "vendor-agreed-id"}}` to the trust policy, you ensure that the vendor must provide the agreed external ID in the `AssumeRole` API call, which only the legitimate vendor knows. This prevents a malicious third party from tricking the vendor into assuming a role in your account on their behalf.

Answer

Add a condition to the trust policy: Condition = {"IpAddress": {"aws:SourceIp": "203.0.113.0/24"}}.

Answer

Remove sts:AssumeRole and replace it with sts:AssumeRoleWithWebIdentity to use the vendor’s browser-based tokens.

Answer

Add a condition to the role permissions policy (not the trust policy) requiring aws:PrincipalTag/ExternalId to equal the external identifier.

Question 6

You use Amazon CloudFront in front of a private content S3 origin. To mitigate an OWASP Top 10 issue, you created a WAF web ACL and associated it to the CloudFront distribution, but attacks are still reaching the origin.

CloudWatch logs show the web ACL rules never match for the CloudFront requests.

What is the most likely configuration mistake?

Accepted Answer

The WAF web ACL intended for CloudFront must be created in the us-east-1 (N. Virginia) region (CloudFront scope), even if the rest of the stack is in another region.. When using AWS WAF with CloudFront, the web ACL must be created in the US East (N. Virginia) region (us-east-1) because CloudFront is a global service that only supports WAF web ACLs with a global scope, which are always defined in us-east-1. If the web ACL is created in any other region, it will be a regional web ACL and cannot be associated with a CloudFront distribution, causing the rules to never be evaluated against incoming requests. This explains why CloudWatch logs show no rule matches—the web ACL is effectively not attached to the CloudFront distribution.

Answer

WAF rules only evaluate requests after they reach the origin, so the absence of matches means the origin is blocking traffic first.

Answer

For CloudFront, you must use a regional WAF endpoint and cannot use a global web ACL.

Answer

WAF web ACL rules never apply to signed URLs or signed cookies, so the web ACL is bypassed by design.

Question 7

A team wants to delegate IAM management to developers, but must ensure developers can never grant themselves permissions beyond a specific limit. Which AWS mechanism best matches this requirement?

Accepted Answer

Use an IAM permission boundary on roles/users that developers create, so the developers’ effective permissions are capped by the boundary policy.. IAM permission boundaries are the correct mechanism because they allow a developer to create IAM roles or users, but explicitly cap the maximum permissions those entities can have. The boundary policy acts as a ceiling, so even if a developer attaches a permissive managed policy, the effective permissions are the intersection of the boundary and the attached policy. This directly enforces the requirement that developers cannot grant themselves permissions beyond a specific limit.

Answer

Rely only on their IAM managed policies and instruct developers to self-check against internal guidelines.

Answer

Use a service control policy (SCP) that applies only to the developers’ IAM users in the account.

Answer

Use a KMS key policy to restrict IAM actions, because IAM actions can be controlled with KMS.

Question 8

You want to protect an Application Load Balancer (ALB) from common web exploits using AWS WAF. The application is not using CloudFront. Which AWS WAF deployment scope should you choose so the WAF rules apply to the ALB?

Accepted Answer

Use AWS WAF regional scope (associate the web ACL with the ALB resource). AWS WAF offers two deployment scopes: regional and CloudFront (global). Since the application is using an Application Load Balancer (ALB) without CloudFront, you must choose the regional scope. This allows you to associate the web ACL directly with the ALB resource, enabling AWS WAF to inspect HTTP/HTTPS requests for common web exploits like SQL injection and cross-site scripting (XSS) at the regional endpoint.

Answer

Use AWS WAF CloudFront (global) scope and associate the web ACL with the ALB

Answer

Use AWS Shield Advanced and rely on it to inspect payloads for SQL injection and XSS

Answer

Use security groups only, because they can detect SQL injection patterns in HTTP requests

Question 9

You use a customer managed AWS KMS key (CMK) to encrypt objects in an S3 bucket using SSE-KMS. A specific IAM role must be able to decrypt objects. Where should you grant kms:Decrypt permissions so that the role can decrypt data encrypted with that CMK?

Accepted Answer

In the KMS key policy, allowing kms:Decrypt (and any other required KMS permissions) for the role’s principal ARN.. When using a customer managed KMS key (CMK) with SSE-KMS, the KMS key policy is the primary access control mechanism. To allow a specific IAM role to decrypt objects, you must grant kms:Decrypt (and typically kms:DescribeKey) in the key policy for that role's principal ARN. Without this explicit permission in the key policy, the role will be denied decryption even if it has s3:GetObject permissions, because KMS enforces its own authorization.

Answer

Only in the S3 bucket policy by granting s3:GetObject, because S3 bucket policy controls decryption.

Answer

Only in the IAM role identity policy; the KMS key policy does not need changes for SSE-KMS.

Answer

By enabling S3 default encryption; KMS permissions are automatically granted to all IAM roles in the account.

Question 10

A team wants detective controls to investigate suspected exfiltration from an S3 bucket. They need to know when objects are accessed (GetObject) and also when new encrypted objects are written.

They already enabled AWS CloudTrail for management events, but their investigation shows no visibility into object-level reads/writes in the logs they review.

Which CloudTrail configuration change most directly provides the missing object-level visibility?

Accepted Answer

Enable CloudTrail data events for the specific S3 bucket so that GetObject and PutObject operations are logged at the object level.. CloudTrail management events do not include object-level operations like GetObject or PutObject. By enabling CloudTrail data events for the specific S3 bucket, you capture object-level read (GetObject) and write (PutObject) API calls, including those for encrypted objects, providing the missing visibility for detective controls.

Answer

Enable AWS Config delivery to a separate bucket and create a rule to detect noncompliant S3 policies; this will automatically generate GetObject logs.

Answer

Turn on VPC Flow Logs for the VPC hosting the S3 gateway endpoint, because network logs show S3 object read and write details.

Answer

Add an S3 bucket policy that denies all GetObject requests unless the caller uses TLS; the denial events will create investigation logs automatically.

Question 11

You manage multiple AWS accounts under AWS Organizations. A compliance requirement states: no account is allowed to create new IAM access keys for IAM users. Local administrators may attempt to override permissions. Which mechanism should you use to enforce this guardrail across all accounts?

Accepted Answer

An Organizations service control policy (SCP) that explicitly denies CreateAccessKey. An SCP is the correct mechanism because it operates at the AWS Organizations root, OU, or account level to define a central guardrail that cannot be overridden by any IAM principal, including account administrators. By explicitly denying the `iam:CreateAccessKey` action, the SCP ensures that no IAM user in any account can create new access keys, fulfilling the compliance requirement across all accounts.

Answer

An IAM permissions policy attached to a role that only your security team uses

Answer

A KMS key policy that blocks key creation and reuse

Answer

A permission boundary on a single IAM role

Question 12

A CI pipeline needs to upload build artifacts only to s3://ci-artifacts/uploads/*. You also want the pipeline to list only objects under uploads/ to verify that the upload succeeded. Which IAM policy approach is the best fit for least privilege?

Accepted Answer

Allow s3:PutObject on arn:aws:s3:::ci-artifacts/uploads/* and allow s3:ListBucket on arn:aws:s3:::ci-artifacts with a condition that restricts s3:prefix to uploads/.. It grants the minimum required permissions: s3:PutObject on the specific uploads/ path for uploading artifacts, and s3:ListBucket on the bucket with a condition restricting the s3:prefix to uploads/ to list only objects under that prefix. This follows the least privilege principle by scoping both actions to the exact resources needed.

Answer

Allow s3:PutObject on arn:aws:s3:::ci-artifacts/* and allow s3:ListBucket on arn:aws:s3:::ci-artifacts without any prefix condition.

Answer

Allow s3:GetObject on arn:aws:s3:::ci-artifacts/uploads/* so the pipeline can confirm artifacts exist.

Answer

Allow s3:PutObject on arn:aws:s3:::ci-artifacts/uploads/* and also allow s3:DeleteObject on arn:aws:s3:::ci-artifacts/uploads/*.

Question 13

A reporting application in Account B must read files from an S3 bucket in Account A. The bucket contains objects encrypted with a customer managed KMS key in Account A. The application role in Account B already has an identity policy allowing s3:GetObject on the bucket prefix, but requests still fail with AccessDenied. Which two changes are required for the application to read the objects? Select two.

Accepted Answer

Add a bucket policy in Account A that allows the Account B role to perform s3:GetObject on the required prefix.. Cross-account S3 access requires the destination account (Account A) to explicitly grant access via a bucket policy that allows the source account's role (Account B) to perform s3:GetObject on the specified prefix. Without this bucket policy, the S3 service in Account A will deny the request, even if the IAM identity policy in Account B permits the action. Option B is correct because the objects are encrypted with a customer managed KMS key in Account A; the application role in Account B must be added to the KMS key policy with kms:Decrypt permission to decrypt the objects during retrieval. Both the S3 bucket policy and the KMS key policy are required for cross-account encrypted access.

Answer

Attach an IAM policy in Account B that grants s3:* on the bucket and its objects.

Answer

Create an S3 gateway endpoint in Account B so the application can reach the bucket privately.

Answer

Add an SCP in Account A that allows the Account B role to bypass KMS encryption checks.

Question 14

Your company allows application teams to create IAM roles. Each team must be prevented from granting permissions beyond a defined per-role baseline, even if they attach overly permissive identity-based policies to the role. Which AWS feature best enforces this ceiling at the IAM role level?

Accepted Answer

Attach a permission boundary to every role that teams create so the boundary limits the role’s maximum effective permissions. Permission boundaries are an AWS IAM feature that sets the maximum permissions that an identity-based policy can grant to an IAM role. When a permission boundary is attached to a role, the effective permissions are the intersection of the boundary and the role's identity-based policy, ensuring that even if a team attaches an overly permissive policy, the role cannot exceed the boundary's defined limits. This directly enforces a per-role ceiling on permissions, making option B the correct choice.

Answer

Use an Organizations service control policy (SCP) to cap the maximum permissions for role creation in each account

Answer

Rely on KMS key policies to restrict permissions because IAM policies cannot override KMS restrictions

Answer

Require multi-factor authentication (MFA) for all role creation requests and deny any request without MFA

Question 15

Account A hosts an IAM role that Account B developers must assume for a limited task. You want to require MFA for anyone assuming the role. Which trust policy condition most directly enforces that requirement for sts:AssumeRole?

Accepted Answer

Add a statement condition requiring "Bool": {"aws:MultiFactorAuthPresent": "true"} in the role trust policy.. The `aws:MultiFactorAuthPresent` condition key in the role trust policy directly checks whether the caller authenticated with a valid MFA device before calling `sts:AssumeRole`. When set to "true" with a Bool condition, it enforces that the session must have been established after MFA verification, which is the most direct and standard way to require MFA for role assumption.

Answer

Add a condition requiring "StringEquals": {"aws:PrincipalOrgID": "o-example"} without any MFA condition.

Answer

Add a statement that denies sts:AssumeRole when the requested role session name contains the text "dev".

Answer

Require HTTPS by setting a condition on "aws:SecureTransport": "true" in the trust policy.