SAA-C03 Design Secure Architectures Practice Test 15 — 15 Questions

Question 1

A cross-account IAM role in Account B reads encrypted S3 objects from Account A. The objects use SSE-KMS with a customer-managed KMS key in Account A. Account B can successfully call s3:GetObject, but decryption fails with an AccessDeniedException from KMS. What change most directly fixes the issue?

Accepted Answer

Update the customer-managed KMS key policy in Account A to allow kms:Decrypt for the specific Account B role principal.. SSE-KMS with a customer-managed KMS key requires explicit permission to use the key for decryption. The S3 GetObject call succeeds because the bucket policy allows it, but KMS decryption fails because the KMS key policy in Account A does not grant kms:Decrypt to the IAM role principal in Account B. Updating the KMS key policy to allow the Account B role principal to call kms:Decrypt directly resolves the AccessDeniedException.

Answer

Add kms:Decrypt only to the Account B role’s IAM policy, without changing the customer-managed KMS key policy in Account A.

Answer

Update the Account A S3 bucket policy to grant kms:Decrypt to Account B.

Answer

Enable KMS key rotation, which automatically allows cross-account decrypt permissions.

Question 2

You have EC2 instances in private subnets with no NAT gateway. They must retrieve secrets from AWS Secrets Manager without sending traffic to the public internet. Which VPC endpoint type is the correct choice for connecting to AWS Secrets Manager?

Accepted Answer

Create an Interface VPC endpoint (AWS PrivateLink) for Secrets Manager and associate security groups for the endpoint.. AWS Secrets Manager is accessed via an API endpoint that uses HTTPS. Interface VPC endpoints (AWS PrivateLink) are the correct choice for connecting to services like Secrets Manager because they use elastic network interfaces (ENIs) with private IPs in your VPC, allowing traffic to stay within the AWS network. Gateway endpoints only support S3 and DynamoDB, not Secrets Manager.

Answer

Create a Gateway VPC endpoint for Secrets Manager.

Answer

Use a Transit Gateway attachment to route traffic to the public internet for Secrets Manager.

Answer

Deploy a NAT gateway and allow outbound HTTPS traffic to Secrets Manager.

Question 3

An internal web application is exposed through an Application Load Balancer (ALB). The ALB currently has only an HTTP listener on port 80. Security requires that all client traffic be encrypted in transit. What is the best next step?

Accepted Answer

Configure an ALB HTTPS listener on port 443 using an ACM certificate, and redirect HTTP (80) to HTTPS (443).. Option B is correct because the requirement to encrypt all client traffic in transit is met by adding an HTTPS listener on port 443 using an ACM certificate, which enables TLS encryption. Additionally, configuring a redirect from HTTP (port 80) to HTTPS (port 443) ensures that any client attempting to connect over unencrypted HTTP is automatically upgraded to HTTPS, enforcing encryption for all traffic.

Answer

Enable S3 bucket encryption for application files, since it ensures encryption in transit.

Answer

Turn on default encryption for CloudFront origin access, which automatically encrypts all ALB traffic.

Answer

Add KMS permissions to the ALB role so TLS is enabled automatically.

Question 4

A company serves a public API through a CloudFront distribution. They want to automatically block common web exploits (for example, OWASP Top 10–style threats) without building custom detection logic. Which AWS service configuration best meets the goal?

Accepted Answer

Enable AWS WAF with AWS Managed Rules and associate the web ACL with the CloudFront distribution.. AWS WAF with AWS Managed Rules provides pre-configured rule sets specifically designed to block common web exploits, including OWASP Top 10 threats, without requiring custom detection logic. By associating the web ACL with a CloudFront distribution, the filtering occurs at the edge, protecting the origin from malicious traffic before it reaches the application.

Answer

Enable AWS Shield Advanced only; it fully replaces the need for WAF rule evaluation.

Answer

Attach a security group rule to the ALB to block malicious patterns based on HTTP request bodies.

Answer

Use Security Hub to block requests automatically when it detects suspicious activity.

Question 5

A company stores sensitive PDFs in Amazon S3 and serves them through CloudFront. Users must access PDFs only through CloudFront, and direct S3 URL requests must fail. Which three changes should be implemented? Select three.

Accepted Answer

Enable CloudFront Origin Access Control (OAC) for the S3 origin.. Option A is correct because CloudFront Origin Access Control (OAC) is the modern, recommended method to restrict S3 bucket access exclusively to a CloudFront distribution. OAC uses a signed request mechanism that verifies the request originates from CloudFront, ensuring direct S3 URL requests are denied. This replaces the older Origin Access Identity (OAI) and provides stronger security with support for features like cross-region buckets and server-side encryption with KMS.

Answer

Enable S3 static website hosting on the bucket.

Answer

Make the object ACLs public so CloudFront can retrieve them.

Question 6

An application in Account B reads objects from an Amazon S3 bucket in Account A. The bucket uses SSE-KMS with a customer managed key in Account A. The role in Account B already has s3:GetObject, but downloads fail with AccessDenied on decrypt. Which two changes are required for the role to read the object successfully? Select two.

Accepted Answer

Add kms:Decrypt permission in the role's IAM policy for the KMS key.. Option B is correct because the role in Account B needs explicit kms:Decrypt permission in its IAM policy to use the KMS key for decrypting the S3 objects. Option C is correct because the KMS key policy in Account A must grant the role from Account B permission to call kms:Decrypt, as the key is customer managed and cross-account access requires both the key policy and the IAM policy to allow the action.

Answer

Add an SCP that grants the role additional permissions for KMS usage.

Answer

Grant the role read access with an S3 bucket ACL.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 7

A workload in private subnets must upload logs to Amazon S3 and retrieve one secret from AWS Secrets Manager. The security team forbids internet egress and wants the lowest operational overhead. Which two VPC endpoints should be created? Select two.

Accepted Answer

An Amazon S3 gateway endpoint for private S3 access.. Amazon S3 gateway endpoints allow private subnet resources to access S3 without traversing the internet, using prefix lists and route table entries to direct traffic through AWS's internal network. This satisfies the security team's no-egress requirement and incurs no hourly cost, offering the lowest operational overhead for S3 access.

Answer

A NAT Gateway in the public subnet.

Answer

An Internet Gateway attached to the VPC.

Answer

A DynamoDB gateway endpoint for the log upload path.

Question 8

A software vendor in Account B must assume a role in Account A to process support tickets. Security wants to prevent confused deputy attacks. Which two configurations are required for this access pattern to work safely? Select two.

Accepted Answer

Require a specific sts:ExternalId value in the role trust policy in Account A.. Option A is correct because requiring a specific sts:ExternalId value in the role trust policy in Account A is a standard AWS mechanism to prevent the confused deputy problem. The ExternalId acts as a unique secret that the vendor must provide when assuming the role, ensuring that the role is assumed only for the intended purpose and not by a malicious third party.

Answer

Share long-term access keys from Account A with the vendor.

Answer

Attach a permissions boundary to the role to satisfy the ExternalId requirement.

Answer

Allow sts:GetSessionToken instead of sts:AssumeRole in the trust policy.

Question 9

An organization lets application teams create IAM roles in member accounts. Security wants every newly created role to stay within an approved permission ceiling, and teams must not be able to remove that ceiling later. Which two controls best meet the requirement? Select two.

Accepted Answer

Attach the approved permissions boundary to every role created by the teams.. Option A is correct because a permissions boundary is an IAM feature that sets the maximum permissions a role can have. By attaching an approved permissions boundary to every newly created role, the organization enforces a permission ceiling that cannot be exceeded, even if the role has additional policies attached. This directly meets the requirement of keeping roles within an approved ceiling.

Answer

Use an S3 bucket policy to prevent the roles from gaining extra privileges.

Answer

Rely on a role trust policy to limit the permissions the role can have.

Answer

Use a session policy attached to one assumed-role session to enforce the ceiling permanently.

Question 10

A public API is delivered through CloudFront and an Application Load Balancer. The security team wants AWS to automatically block repetitive bursts from the same client IP and also reduce exposure to common web exploits without custom code. Which two AWS WAF features should be enabled? Select two.

Accepted Answer

A rate-based rule that blocks clients exceeding a request threshold from the same source IP.. A rate-based rule in AWS WAF automatically tracks request rates per source IP and blocks clients that exceed a configured threshold within a 5-minute evaluation window. This directly addresses the security team's requirement to block repetitive bursts from the same client IP without custom code.

Answer

ALB sticky sessions for all requests.

Answer

A security group rule that blocks requests based on HTTP path.

Answer

CloudFront origin access control for the API endpoint.

Question 11

A SaaS vendor’s automation account in Account B needs to assume a role in a customer account in Account A to read a specific S3 bucket and publish a deployment status file. The customer is worried about confused deputy attacks because multiple customers use the same vendor software. Which trust-policy design best meets the requirement?

Accepted Answer

Allow only the vendor’s specific IAM principal to assume the role and require a unique sts:ExternalId condition.. Option B is correct because the `sts:ExternalId` condition is specifically designed to prevent the confused deputy problem in cross-account role assumptions. By requiring a unique external ID that only the customer knows, the customer ensures that the vendor's automation can only assume the role when acting on behalf of that specific customer, even if multiple customers use the same vendor software.

Answer

Allow the Account B root principal to assume the role if the caller knows the role ARN.

Answer

Attach a permissions boundary to the role so that the vendor cannot exceed the approved permissions.

Answer

Require MFA for the role assumption because it ensures only the vendor’s production automation can use the role.

Question 12

A platform team lets application teams create IAM roles in member accounts through Infrastructure as Code. Security says every new role must stay within a centrally approved permission ceiling, even if someone later attaches broader managed policies or inline policies. Which control should be used to enforce that maximum permission set?

Accepted Answer

Attach a permissions boundary to each role so the role can never exceed the approved ceiling.. A permissions boundary is an AWS IAM feature that sets the maximum permissions an IAM role can have. When attached to a role, any policy that grants permissions beyond the boundary is effectively ignored, ensuring the role cannot exceed the approved permission ceiling even if broader managed or inline policies are later attached. This directly enforces the security requirement without restricting the application teams' ability to create roles via Infrastructure as Code.

Answer

Use an AWS Organizations service control policy to grant the role all needed permissions directly.

Answer

Use a resource-based policy on Amazon S3 to restrict the permissions that IAM roles can receive.

Answer

Require temporary STS session policies whenever the role is assumed.

Question 13

An application runs in private subnets and must download objects from Amazon S3 and read one secret from AWS Secrets Manager. NAT gateways are prohibited, and traffic must not traverse the public internet. The secret uses a customer managed KMS key. Which design is best?

Accepted Answer

Create a gateway VPC endpoint for S3 and an interface VPC endpoint for Secrets Manager with private DNS enabled.. Option C is correct because it uses a gateway VPC endpoint for S3, which provides private connectivity to S3 without traversing the internet, and an interface VPC endpoint for Secrets Manager, which allows private access via AWS PrivateLink. Enabling private DNS ensures that the standard DNS names for both services resolve to the endpoint IPs, keeping all traffic within the AWS network and meeting the requirement to avoid NAT gateways and public internet.

Answer

Use a NAT gateway for outbound access and rely on security groups to block internet destinations.

Answer

Create interface VPC endpoints for both S3 and Secrets Manager and enable private DNS.

Answer

Use VPC peering to a public subnet that hosts a proxy for S3 and Secrets Manager access.

Question 14

A solutions architect is designing an S3 bucket for a claims portal. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure?

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. S3 Block Public Access provides a definitive override that prevents any public access to objects, regardless of bucket policies or object ACLs. By enabling this setting at the account or bucket level, the architect ensures that even if a developer later adds an overly broad bucket policy, the S3 service will block all public access. This is the only option that directly and permanently prevents public exposure.

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Answer

Enable server access logging on the bucket

Answer

Enable S3 Transfer Acceleration

Question 15

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use?

Accepted Answer

Interface VPC endpoint for Systems Manager. Interface VPC endpoints (AWS PrivateLink) enable private connectivity to Systems Manager Parameter Store by creating an elastic network interface in the subnet with a private IP, allowing the application to read parameters without traversing the internet. Gateway VPC endpoints for S3 provide private access to S3 objects via route table entries, using the S3 public IP space but staying within the AWS network, avoiding the need for an internet gateway or NAT gateway.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone