SAA-C03 Design Secure Architectures Practice Test 14 — 15 Questions

Question 1

Based on the exhibit, users must access private PDF reports only through CloudFront. Direct requests to the S3 object URL must fail, and the bucket should not be publicly readable. Which solution is the best fit?

Accepted Answer

Enable CloudFront Origin Access Control for the distribution and update the bucket policy to allow only the CloudFront distribution principal with its SourceArn.. Option A is correct because CloudFront Origin Access Control (OAC) allows you to restrict access to an S3 bucket so that only the specific CloudFront distribution can retrieve objects. By updating the bucket policy to allow the CloudFront distribution principal with its SourceArn, you ensure that direct requests to the S3 object URL are denied, while CloudFront-signed URLs or cookies can still control user access. This meets the requirement of blocking direct S3 access while keeping the bucket private.

Answer

Keep the bucket public and require signed URLs at CloudFront, because signed URLs automatically block all direct S3 requests.

Answer

Add an S3 access point and allow the CloudFront distribution to use it without changing the bucket policy.

Answer

Attach AWS WAF to the distribution and block requests that do not include a signed cookie.

Question 2

Based on the exhibit, the security team needs to detect and alert on both successful and failed attempts to change S3 bucket policies and KMS key policies across the organization. Which solution best meets that requirement?

Accepted Answer

Enable an organization trail for management events in all regions and create an EventBridge rule that matches PutBucketPolicy and PutKeyPolicy, then send alerts to SNS.. Option A is correct because AWS CloudTrail management events capture all API calls that modify S3 bucket policies (PutBucketPolicy) and KMS key policies (PutKeyPolicy). By enabling an organization trail for all regions, you centralize these events across the entire AWS Organization. An Amazon EventBridge rule can then filter for these specific API calls and send alerts via Amazon SNS, meeting the requirement to detect both successful and failed attempts.

Answer

Enable AWS Config in all accounts and use only a periodic compliance evaluation to alert when bucket or key policies drift.

Answer

Use IAM Access Analyzer because it continuously blocks policy changes that would expose the resources publicly.

Answer

Turn on S3 server access logging and KMS key rotation, because both services will capture policy modifications automatically.

Question 3

Based on the exhibit, a public API is behind CloudFront and is experiencing bursts of requests from the same client IP, causing upstream saturation. The team wants AWS to automatically block that IP when the request rate becomes excessive while keeping enforcement as close to the client as possible. Which control should they add?

Accepted Answer

Add an AWS WAF rate-based rule to the CloudFront distribution and configure it to block the source IP after the threshold is exceeded.. AWS WAF rate-based rules are designed to automatically block IP addresses that exceed a specified request rate within a 5-minute evaluation window. By attaching this rule to a CloudFront distribution, enforcement occurs at the edge location closest to the client, preventing excessive requests from reaching the upstream API and mitigating saturation.

Answer

Add a network ACL rule that denies the source IP after five requests are observed.

Answer

Enable AWS Shield Advanced and create a custom protection group for the single IP address.

Answer

Place the API behind a security group rule that allows only the current client IP range.

Question 4

Based on the exhibit, a CI pipeline assumes a shared deployment role in Account A. The role can access several artifact prefixes, but this pipeline must only upload to teamA/prod/ and decrypt using a single KMS key for this execution. Changing the shared role would affect other pipelines. Which approach should the pipeline use?

Accepted Answer

Pass an inline session policy in the AssumeRole request that further restricts the temporary credentials to teamA/prod/ and the approved KMS key.. Option B is correct because an inline session policy passed in the AssumeRole request allows you to further restrict the temporary credentials' permissions without modifying the shared role itself. This ensures the pipeline can only upload to teamA/prod/ and decrypt using the specified KMS key, while other pipelines using the same role remain unaffected.

Answer

Attach a permission boundary to the pipeline's assumed session so the temporary credentials cannot exceed the shared role permissions.

Answer

Add an SCP to Account A that forces all roles to use the same S3 prefix and key whenever they are assumed.

Answer

Change the role trust policy to allow only the teamA/prod/ prefix and the key ARN because trust policies can scope S3 object paths directly.

Question 5

Based on the exhibit, a company wants EC2 instances in private subnets to access Amazon S3 without using a NAT gateway, and bucket access must be allowed only when requests come through the approved VPC endpoint. Which design is the most appropriate?

Accepted Answer

Use the S3 gateway VPC endpoint and keep the bucket policy that denies requests unless aws:SourceVpce matches the approved endpoint.. Option A is correct because an S3 gateway VPC endpoint allows EC2 instances in private subnets to access S3 without traversing the internet or requiring a NAT gateway. By adding a bucket policy condition that denies access unless `aws:SourceVpce` matches the approved VPC endpoint ID, you ensure that only requests originating from that specific endpoint are allowed, meeting the security requirement.

Answer

Use an interface VPC endpoint for S3 only, because gateway endpoints cannot be used with bucket policies.

Answer

Add a NAT gateway and remove the bucket policy condition because the NAT route will automatically secure the S3 traffic.

Answer

Move the bucket policy restriction to a security group attached to the S3 bucket so only the VPC endpoint can reach it.

Question 6

Based on the exhibit, a batch platform in Account B must assume a role in Account A. Only the specific role arn:aws:iam::222233334444:role/BatchRunner should be allowed to assume it, and the design must prevent any other role in Account B from reusing the same external ID. Which change best meets the requirement?

Accepted Answer

Change the trust policy principal from account root to arn:aws:iam::222233334444:role/BatchRunner and keep the ExternalId condition.. Option B is correct because the trust policy on the target role in Account A must restrict the principal to the exact BatchRunner role ARN (arn:aws:iam::222233334444:role/BatchRunner) rather than the entire Account B root. This ensures that only that specific role can assume the target role. Keeping the ExternalId condition adds an additional layer of security by requiring a unique identifier that only BatchRunner knows, preventing any other role in Account B from reusing the same external ID.

Answer

Add an identity-based policy to the BatchRunner role that allows sts:AssumeRole on the target role.

Answer

Replace the ExternalId condition with a role session name condition so only BatchRunner sessions are accepted.

Answer

Attach an SCP to Account B that denies sts:AssumeRole unless the request comes from BatchRunner.

Question 7

Based on the exhibit, an application in the same AWS account can upload and read objects in an S3 bucket encrypted with a customer managed KMS key, but GetObject fails with an AccessDenied error from AWS KMS. The IAM role already has s3:GetObject, s3:PutObject, kms:Decrypt, and kms:GenerateDataKey permissions. What change most directly fixes the issue while preserving least privilege?

Accepted Answer

Update the KMS key policy to allow the application role to use the key, ideally with a kms:ViaService condition for S3.. The error is an AccessDenied from AWS KMS, not from S3, which means the IAM role has the required S3 permissions (s3:GetObject) and KMS API permissions (kms:Decrypt), but the KMS key policy does not explicitly grant the role access to the key. Since customer managed KMS keys require a key policy to grant IAM principals permission to use the key (IAM policies alone are insufficient unless the key policy delegates such authority), updating the key policy to allow the role with a kms:ViaService condition for S3 directly resolves the KMS-side denial while preserving least privilege.

Answer

Add an S3 bucket ACL that grants the application role full control over objects.

Answer

Replace the customer managed key with the AWS managed S3 key so IAM permissions become sufficient.

Answer

Add an S3 bucket policy that grants s3:GetObject and s3:PutObject to the role for all objects.

Question 8

Based on the exhibit, an application runs in private subnets without a NAT gateway and must retrieve a secret from AWS Secrets Manager. Security requires the traffic to stay on the AWS network and not traverse the public internet. What is the best solution?

Accepted Answer

Create an interface VPC endpoint for Secrets Manager and enable private DNS for the endpoint.. Option B is correct because an interface VPC endpoint for Secrets Manager allows the application in the private subnet to securely access Secrets Manager over the AWS network using private IP addresses, without needing a NAT gateway or internet gateway. Enabling private DNS ensures that the default Secrets Manager DNS name resolves to the endpoint's private IP addresses, keeping all traffic within the AWS backbone and satisfying the security requirement.

Answer

Add a NAT gateway to the private subnet route table and keep using the public Secrets Manager endpoint.

Answer

Create a gateway VPC endpoint for Secrets Manager and point the route table to it.

Answer

Use VPC peering to connect the application subnet to another VPC that already has internet access.

Question 9

Based on the exhibit, a company stores sensitive PDFs in S3 and serves them through CloudFront. Direct requests to the S3 object URL must fail, but CloudFront should still be able to fetch the files securely. Which solution best satisfies the requirement?

Accepted Answer

Configure CloudFront Origin Access Control for the S3 origin and update the bucket policy to allow only that distribution.. Option C is correct because CloudFront Origin Access Control (OAC) allows CloudFront to authenticate requests to an S3 origin using a specific identity, and the bucket policy can be configured to grant access only to that CloudFront distribution. This ensures that direct S3 object URL requests fail (since they lack the CloudFront signature), while CloudFront can still fetch the files securely using the OAC mechanism.

Answer

Leave the bucket public but require CloudFront signed cookies for all users.

Answer

Use an S3 access point and give it a public policy so CloudFront can reach the objects.

Answer

Use S3 object ACLs to grant read access only to users behind CloudFront.

Question 10

Based on the exhibit, the security team wants centralized detection and alerting for both successful and failed attempts to change S3 bucket policies and KMS key policies across multiple accounts. Which approach best meets the requirement?

Accepted Answer

Create an organization CloudTrail trail for management events and add EventBridge rules in the security account to alert on PutBucketPolicy and PutKeyPolicy events, including failed calls.. Option C is correct because an organization CloudTrail trail captures management events (including PutBucketPolicy and PutKeyPolicy) across all accounts in the organization, and EventBridge rules in the security account can filter for both successful and failed API calls (using the `errorCode` field) to trigger centralized alerts. This provides the required centralized detection and alerting for policy changes across multiple accounts.

Answer

Enable S3 server access logging on each bucket and archive the logs in the security account.

Answer

Use AWS Config rules only, because Config records every successful and failed API call automatically.

Answer

Enable GuardDuty in every account and use its findings as the main source for policy change notifications.

Question 11

Based on the exhibit, a development team in member accounts can create IAM roles, but one team created a role without the required permissions boundary. Security wants to ensure that no future role in the organization can exceed the approved boundary, even if a developer has broad IAM permissions. What is the best control to add?

Accepted Answer

Add an SCP that denies iam:CreateRole and iam:PutRolePermissionsBoundary unless the request specifies the ApprovedAppBoundary ARN.. Option B is correct because a Service Control Policy (SCP) at the organization root or in the member account's OU can deny IAM actions unless the required permissions boundary (ApprovedAppBoundary) is specified. This prevents any role creation or modification that would bypass the boundary, even if the developer has full IAM permissions in their account. SCPs are the only control that can enforce this across all principals in an account, including the account root user.

Answer

Add a permission boundary to the developer role that points to ApprovedAppBoundary.

Answer

Use an S3 bucket policy to block policy documents that grant AdministratorAccess.

Answer

Require team members to use STS session policies when they create new roles.

Question 12

Based on the exhibit, a public API is behind CloudFront. A single client IP is sending bursts of requests that are overwhelming the origin, and the team wants AWS to automatically mitigate the abuse at the edge without changing the application code. What should the team do?

Accepted Answer

Associate an AWS WAF web ACL with CloudFront and add a rate-based rule for the offending IP behavior.. AWS WAF rate-based rules automatically block or rate-limit requests from a client IP when the request rate exceeds a threshold you define. By associating the web ACL with CloudFront, the rule is enforced at the edge before traffic reaches the origin, mitigating abuse without modifying application code.

Answer

Increase the ALB idle timeout to allow the origin to absorb more concurrent requests.

Answer

Add an Amazon Route 53 health check to fail over traffic to another DNS name.

Answer

Enable AWS Shield Advanced and rely on automatic DDoS protection for all request bursts.

Question 13

Based on the exhibit, a central deployment role in Account A is assumed by several CI/CD pipelines from Account B. The role must remain reusable, but the team wants the TeamA pipeline to upload artifacts only to s3://artifact-bucket/teamA/prod/ without creating a separate IAM role. What is the best approach?

Accepted Answer

Pass an STS session policy when TeamA assumes the role to further restrict the temporary credentials to the teamA/prod prefix.. Option D is correct because when the TeamA pipeline assumes the central IAM role in Account A, it can pass an STS session policy that further restricts the temporary credentials to only allow actions on the s3://artifact-bucket/teamA/prod/ prefix. This approach keeps the role reusable for other pipelines while enforcing a narrower permission scope at the session level, without requiring a separate IAM role.

Answer

Use an IAM user in Account B and hard-code the narrower S3 path in its access key policy.

Answer

Add a bucket ACL that grants write access only to the TeamA pipeline session name.

Answer

Attach a permissions boundary to the central role so every pipeline session inherits the narrower prefix automatically.

Question 14

A microservice runs on an EC2 instance using an instance role. It must retrieve exactly one secret value from AWS Secrets Manager. The secret ARN is arn:aws:secretsmanager:us-east-1:111122223333:secret:prod/dbPassword-AbCdEf. The secret is encrypted with the default AWS-managed Secrets Manager KMS key (alias/aws/secretsmanager). Which IAM policy statement provides the best least-privilege access?

Accepted Answer

Allow secretsmanager:GetSecretValue only for the specific secret ARN: Resource "arn:aws:secretsmanager:us-east-1:111122223333:secret:prod/dbPassword-AbCdEf".. Option B is correct because it grants the least-privilege access by restricting the secretsmanager:GetSecretValue action to the exact secret ARN required. Since the secret is encrypted with the default AWS-managed KMS key (alias/aws/secretsmanager), no additional kms:Decrypt permission is needed because Secrets Manager automatically handles decryption with the default key when using GetSecretValue. This policy ensures the microservice can retrieve only the intended secret and no others.

Answer

Allow secretsmanager:GetSecretValue on all secrets: Resource "*".

Answer

Allow secretsmanager:DescribeSecret on the secret ARN, but not secretsmanager:GetSecretValue.

Answer

Allow secretsmanager:GetSecretValue on all secrets with the prefix: Resource "arn:aws:secretsmanager:us-east-1:111122223333:secret:prod/*".

Question 15

Company A must allow workloads in Company B to assume an IAM role in Company A (RoleInA). To mitigate confused-deputy attacks, a Security requirement is to use an External ID. Company A should restrict who can assume RoleInA. Which trust-policy configuration is the best choice?

Accepted Answer

In Company A role trust policy, allow sts:AssumeRole only for principal "arn:aws:iam:::role/" and require a condition where sts:ExternalId equals the expected External ID value.. Option B is correct because it restricts the trust policy to a specific IAM role in Company B (using the principal ARN) and requires the `sts:ExternalId` condition to match a predefined value. This ensures only the intended role in Company B can assume RoleInA, and the External ID prevents a confused-deputy attack by requiring the third party to provide a unique identifier that only the legitimate service knows.

Answer

In Company A role trust policy, allow sts:AssumeRole for principal "arn:aws:iam::<company-b-account-id>:root" with no sts:ExternalId condition.

Answer

In the trust policy, allow iam:PassRole for the Company B principal and include an sts:ExternalId condition.

Answer

In Company A, grant Company B access using an IAM permissions policy attached to RoleInA instead of using a trust policy.

SAA-C03 Design Secure Architectures Practice Test 14 — 15 Questions

Exhibit

SAA-C03 Design Secure Architectures Practice Test 14 — 15 Questions

Exhibit