SAA-C03 Design Secure Architectures Practice Test 16 — 15 Questions

Question 1

Developers for a financial reporting platform need temporary elevated access to production resources for troubleshooting. The security team wants approvals, expiry, and audit logging. Which approach is best? The design must avoid adding custom operational scripts.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use IAM Identity Center permission sets with time-bound access processes and CloudTrail auditing. IAM Identity Center permission sets allow granting time-bound, least-privilege access to production resources. Combined with CloudTrail auditing, this provides full logging of all actions taken during the elevated access period. The solution meets the security team's requirements for approvals (via the permission set request workflow), expiry (via session duration or time-bound assignments), and audit logging (via CloudTrail), without requiring custom operational scripts.

Answer

Disable CloudTrail during troubleshooting

Answer

Create shared administrator access keys for the team

Answer

Attach AdministratorAccess permanently to every developer role

Question 2

A healthcare document service must ensure that only encrypted EBS volumes can be created in the account. What is the strongest preventive control? The design must avoid adding custom operational scripts.

Accepted Answer

Use an SCP that denies ec2:CreateVolume when the encrypted condition is false. AWS Organizations Service Control Policies (SCPs) provide a preventive guardrail that can deny the ec2:CreateVolume API call when the encryption condition is false, ensuring that no unencrypted EBS volumes can be created in the account. This is the strongest preventive control because it blocks the action at the API level before any resource is created, and it does not require custom scripts or post-creation remediation. The condition key ec2:Encrypted must be set to true in the SCP policy to enforce encryption at creation time.

Answer

Tag encrypted volumes after creation

Answer

Enable VPC Flow Logs

Answer

Run a daily Lambda function to encrypt unencrypted volumes

Question 3

A customer analytics portal uses CloudFront in front of an S3 origin. Which two settings help keep users from bypassing CloudFront and accessing the bucket directly? The design must avoid adding custom operational scripts.

Accepted Answer

Configure Origin Access Control for the S3 origin. Origin Access Control (OAC) is a CloudFront feature that restricts access to an S3 origin so that only the CloudFront distribution can retrieve objects. OAC uses a signed request mechanism that prevents direct S3 access, ensuring users cannot bypass CloudFront and hit the bucket directly without custom scripts.

Answer

Enable CloudFront standard logging

Answer

Enable S3 static website hosting

Question 4

A solutions architect is designing an S3 bucket for a IoT ingestion API. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure? The design must avoid adding custom operational scripts.

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. S3 Block Public Access provides a definitive override that prevents any public access to objects, regardless of bucket policies or object ACLs. This setting, when enabled at the account or bucket level, ensures that even if a developer later attaches an overly permissive bucket policy, the public access is blocked. It meets the requirement of avoiding custom operational scripts by being a native, configurable S3 feature.

Answer

Enable S3 Transfer Acceleration

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Answer

Enable server access logging on the bucket

Question 5

A company stores RDS database credentials in AWS Systems Manager Parameter Store as SecureString parameters. The security team requires that database passwords rotate automatically every 30 days. Which change should a solutions architect recommend?

Accepted Answer

Migrate the credentials to AWS Secrets Manager and enable automatic rotation with a 30-day schedule. AWS Secrets Manager provides native automatic rotation for RDS credentials using a managed Lambda function that rotates the secret on a defined schedule and updates the database password atomically.

Parameter Store SecureString does not support built-in automatic rotation — rotation must be implemented manually with custom automation. Secrets Manager is specifically designed for secrets requiring lifecycle management including rotation, auditing, and fine-grained access control.

Answer

Create a scheduled EventBridge rule to invoke a Lambda function that updates the Parameter Store SecureString value every 30 days

Answer

Enable Parameter Store SecureString automatic rotation in the AWS console

Answer

Configure AWS Config to detect password age and trigger an SNS notification after 30 days

Question 6

A company uses AWS Organizations and wants to prevent any account in the organization from launching resources in regions other than us-east-1 and eu-west-1. This restriction must apply even if an administrator in a member account grants full IAM permissions. Which approach should a solutions architect use?

Accepted Answer

Create an SCP with a Deny on all actions for regions outside us-east-1 and eu-west-1, attached to the Organization root. Service Control Policies (SCPs) in AWS Organizations provide a guardrail that applies to all principals in member accounts — including IAM users, roles, and even the account root. SCPs restrict the maximum permissions that can be granted within an account.

An SCP with Deny on all actions for all regions except us-east-1 and eu-west-1, attached to the organization root, prevents any account from launching resources in other regions regardless of account-level IAM permissions. IAM policies in member accounts cannot override SCPs.

Answer

Create IAM policies with Deny for disallowed regions and attach them to all IAM users and roles in each account

Answer

Enable AWS Config rules to detect resources launched in disallowed regions and trigger auto-remediation to delete them

Answer

Use AWS Control Tower guardrails to enforce region restriction for all accounts

Question 7

A company is designing a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), an Amazon EC2 Auto Scaling group for the web tier, and an Amazon RDS for MySQL database. The security team requires that the web tier instances have no public IP addresses and that all outbound traffic to the internet is blocked, except for specific software updates from a trusted vendor. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Use a security group on the web tier instances that denies all outbound traffic except to the trusted vendor's IP range.. Placing the web tier instances in a private subnet ensures they have no public IP addresses, meeting the security requirement. Using a security group on the web tier instances to deny all outbound traffic except to the trusted vendor's IP range provides a stateful, instance-level control that blocks all other outbound internet traffic. Additionally, a network ACL on the private subnet must allow outbound traffic to the trusted vendor's IP range and to the NAT gateway, because the NAT gateway itself needs to send traffic to the vendor, and the network ACL acts as a stateless subnet-level filter that must explicitly permit this return traffic.

Answer

Configure a VPC endpoint for the trusted vendor's software update service.

Answer

Deploy the web tier instances in a public subnet and use a network ACL to block all inbound traffic from the internet.

Answer

Configure the ALB to be internet-facing and place the web tier instances in a public subnet.

Question 8

A financial services company is migrating sensitive customer data to Amazon S3. The data must be encrypted at rest using a customer-managed key stored in AWS KMS, with automatic rotation every 90 days. The company also needs to prevent any access to the data from outside the corporate network, except for approved AWS services. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Attach an S3 VPC endpoint policy that only allows access from the corporate VPC.. Enable default encryption on the S3 bucket with SSE-KMS using the customer-managed key ensures data is encrypted at rest with a key the customer controls and can rotate automatically every 90 days. Configure an S3 bucket policy that denies access unless the request is made from the corporate IP range restricts access to the corporate network. Attach an S3 VPC endpoint policy that only allows access from the corporate VPC ensures that traffic to S3 stays within the AWS network and is subject to VPC controls, preventing exposure to the public internet.

Answer

Use an S3 bucket policy to require that all requests use HTTPS.

Answer

Use an S3 bucket policy that grants access only to the root user of the account.

Answer

Enable S3 Block Public Access at the account level.

Question 9

A company is deploying a serverless application using AWS Lambda functions that process credit card transactions. The application stores data in Amazon DynamoDB and sends notifications through Amazon SNS. Compliance requirements mandate that all data in transit and at rest is encrypted, and that no AWS Lambda function can access resources in other AWS accounts. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Attach an IAM policy to the Lambda execution role that denies access to resources outside the account using a condition on aws:SourceAccount.. To meet the requirements, three steps are needed. First, configure DynamoDB to use AWS owned keys for encryption at rest (Option A). This ensures data at rest is encrypted. Second, enable encryption in transit for the Lambda function by using an ENI in a private subnet with a VPC endpoint for DynamoDB and SNS (Option E). Third, use a VPC endpoint for DynamoDB and SNS and ensure the Lambda function is configured to use the VPC (Option D). This combination enforces encryption in transit and prevents cross-account access by ensuring traffic stays within the VPC. Option B is incorrect because it uses the aws:SourceAccount condition key; the correct condition key to prevent a principal from accessing resources in other accounts is aws:ResourceAccount.

Answer

Configure DynamoDB to use AWS owned keys for encryption at rest.

Answer

Configure the Lambda function to use an IAM role that allows access to all accounts.

Answer

Use a security group to block all outbound traffic from the Lambda function to the internet.

Question 10

A company is designing a secure CI/CD pipeline on AWS. Developers push code to AWS CodeCommit, which triggers AWS CodePipeline to build and deploy applications to Amazon EC2 instances running in a VPC. The security team requires that all code is scanned for secrets and vulnerabilities before deployment, and that deployment artifacts are encrypted at rest in Amazon S3. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Add a CodeBuild step in the pipeline that runs a static code analysis tool to scan for secrets and vulnerabilities.. Adding a CodeBuild step that runs static code analysis directly addresses the requirement to scan for secrets and vulnerabilities before deployment. Using AWS Secrets Manager to store secrets and retrieve them via IAM roles ensures that sensitive credentials are not hardcoded and are securely accessed during the build. For the encryption at rest requirement, configuring the S3 bucket with default SSE-S3 encryption ensures that all objects stored in the bucket are encrypted at rest. The option to enforce HTTPS only provides encryption in transit, not at rest, and thus does not meet the requirement. CloudTrail logging addresses auditing, not encryption. Public access is insecure.

Answer

Configure the S3 bucket used for deployment artifacts to have default encryption with SSE-S3.

Answer

Enable AWS CloudTrail to log all access to the S3 bucket and CodeCommit repository.

Answer

Use an S3 bucket policy that grants full public access to the deployment artifacts for faster downloads.

Question 11

A company is hosting a web application on Amazon ECS Fargate behind an Application Load Balancer. The application needs to authenticate users using Amazon Cognito and store session data in Amazon ElastiCache for Redis. The security team mandates that all traffic between the ALB and ECS tasks must not traverse the public internet, and that session data in ElastiCache is encrypted at rest. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Use a security group on the ECS tasks that allows inbound traffic only from the ALB's security group.. Deploying ECS tasks in private subnets with an internal ALB ensures traffic between the ALB and tasks does not traverse the public internet, as internal load balancers have only private IP addresses. Enabling encryption at rest on ElastiCache for Redis with a customer-managed KMS key meets the security mandate for encrypted session data. Using a security group on ECS tasks that allows inbound traffic only from the ALB's security group provides a precise, stateful firewall rule that enforces the traffic flow restriction.

Answer

Configure the ElastiCache cluster to use in-transit encryption only.

Answer

Configure the ALB to be internal-facing and place the ECS tasks in public subnets.

Answer

Place the ECS tasks in a public subnet and use network ACLs to block inbound traffic from the internet.

Question 12

A company has a workload running on Amazon EC2 instances that need to securely communicate with an Amazon SQS queue and an Amazon DynamoDB table. The EC2 instances are in a private subnet without internet access. The security team wants to ensure that no traffic leaves the AWS network. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Create a VPC endpoint for Amazon DynamoDB and attach a policy that allows access from the EC2 instance's IAM role.. Creating VPC endpoints for Amazon SQS and DynamoDB allows EC2 instances in a private subnet to communicate with these services privately, without traversing the internet or requiring a NAT gateway. Attaching a policy that restricts access to the EC2 instance's IAM role ensures that only authorized traffic is allowed, meeting the security team's requirement that no traffic leaves the AWS network. Configuring the security group to allow outbound traffic to the VPC endpoints is necessary because security groups are stateful and control outbound connections, but the endpoints themselves are accessed via their specific prefix list IDs, not public IPs.

Answer

Configure a NAT gateway in a public subnet to route traffic to SQS and DynamoDB.

Answer

Add a route in the private subnet's route table pointing to a NAT gateway for all traffic.

Answer

Enable VPC flow logs to monitor traffic to SQS and DynamoDB.

Question 13

A company is designing a secure multi-tier web application on AWS. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in private subnets, and the EC2 instances need to access an Amazon RDS database in a separate private subnet. The company must ensure that all traffic is encrypted in transit and that only necessary access is allowed. Which of the following steps should the company take to meet these requirements? (Choose four.)

Accepted Answer

Configure the ALB with an HTTPS listener and install a TLS certificate from AWS Certificate Manager (ACM).. To meet the requirements, the company should: 1) Configure the ALB with an HTTPS listener and install a TLS certificate from ACM to encrypt client-to-ALB traffic. 2) Configure the RDS security group to allow inbound traffic on the database port only from the EC2 security group, ensuring least privilege. 3) Enable SSL/TLS for connections between EC2 instances and RDS to encrypt database traffic. The option to use an NLB with a TLS listener is unnecessary; the ALB can be configured with an HTTPS target group to encrypt traffic between the ALB and EC2 instances. Thus, the correct answers are A, C, and D.

Answer

Place the EC2 instances in a public subnet to allow direct access to the internet for security updates.

Answer

Assign a public IP address to the RDS database instance to simplify connectivity from the EC2 instances.

Question 14

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must meet strict security and compliance requirements. The company needs to ensure that all data stored in DynamoDB is encrypted at rest using a customer-managed key, that the Lambda function can only access the specific DynamoDB table it needs, and that API requests are authenticated and authorized. Which of the following actions should the company take? (Choose four.)

Accepted Answer

Create an AWS KMS customer managed key and configure DynamoDB to use it for encryption at rest.. Creating an AWS KMS customer managed key and configuring DynamoDB to use it for encryption at rest ensures that the data is encrypted using a key that the company controls, meeting strict compliance requirements. Attaching an IAM role to the Lambda function with a policy that grants only the necessary DynamoDB actions on the specific table ARN follows the principle of least privilege. Configuring API Gateway to use an IAM authorizer ensures that only authenticated AWS users or roles can invoke the API, providing authentication and authorization. Using AWS KMS grants in the Lambda function's IAM policy allows the function to use the customer managed key for encryption operations, which is necessary for encrypting and decrypting data in DynamoDB when using client-side encryption or when the key is used for other cryptographic operations.

Answer

Store the customer managed key directly in the Lambda function's environment variables for easy access.

Answer

Enable DynamoDB Streams and configure the Lambda function to process stream records without any additional security configuration.

Question 15

Arrange the steps to create an encrypted Amazon EBS volume from scratch in the correct order.

Accepted Answer

Step 1: Create a KMS key; Step 2: Create an encrypted EBS volume; Step 3: Attach the volume to an instance; Step 4: Format and mount the volume; Step 5: Verify encryption.. Encryption requires a KMS key first, then volume creation with encryption, attach, format/mount, and verification.

Answer

Step 1: Create an encrypted EBS volume; Step 2: Attach the volume; Step 3: Create a KMS key; Step 4: Format and mount; Step 5: Verify encryption.

Answer

Step 1: Create a KMS key; Step 2: Create an encrypted EBS volume; Step 3: Format and mount; Step 4: Attach the volume; Step 5: Verify encryption.

Answer

Step 1: Attach the volume; Step 2: Create a KMS key; Step 3: Create an encrypted EBS volume; Step 4: Format and mount; Step 5: Verify encryption.