SAA-C03 Design Secure Architectures Practice Test 17 — 15 Questions

Question 1

An EC2 instance in a private subnet must access an S3 bucket that contains regulated exports for a customer analytics portal. The security team requires access to be allowed only when traffic comes through a specific VPC endpoint. What should the architect add to the bucket policy?

Accepted Answer

A condition that matches aws:sourceVpce to the endpoint ID. Option D is correct because the bucket policy can use the `aws:sourceVpce` condition key to restrict access exclusively to traffic originating from a specific VPC endpoint (interface or Gateway Load Balancer endpoint). This ensures that only requests sent through that VPC endpoint are allowed, meeting the security team's requirement for regulated exports.

Answer

A security group rule that allows HTTPS to S3

Answer

A condition that matches aws:RequestedRegion to the bucket Region

Answer

A deny statement for all IAM users except the EC2 role

Question 2

A web application for a IoT ingestion API is behind an Application Load Balancer. The application must be protected from common SQL injection and cross-site scripting attacks with minimum operational overhead. What should the architect deploy?

Accepted Answer

AWS WAF associated with the Application Load Balancer. AWS WAF is a web application firewall that integrates directly with an Application Load Balancer to filter and monitor HTTP/HTTPS requests. It provides managed rules specifically designed to block common attack patterns like SQL injection and cross-site scripting (XSS) with minimal operational overhead, as AWS manages the rule updates and scaling. This makes it the ideal choice for protecting the IoT ingestion API without requiring custom code or manual configuration.

Answer

Network ACLs on the public subnets

Answer

Security groups on the application instances

Answer

AWS Shield Advanced only

Question 3

A partner company needs read-only access to reports in an S3 bucket for a e-learning platform. The partner has its own AWS account. What is the most secure scalable access pattern?

Accepted Answer

Create a bucket policy that grants the partner role least-privilege access to the required prefix. Option C is correct because it uses a resource-based bucket policy that grants the partner's AWS account (via its root user or an IAM role) least-privilege read-only access to a specific prefix. This approach avoids sharing long-term credentials, leverages AWS's cross-account trust mechanism, and scales securely without managing additional IAM users.

Answer

Copy the objects to a public website bucket

Answer

Create an IAM user in the company account and share the access keys

Answer

Make the objects public and rely on difficult-to-guess object names

Question 4

A claims portal uses Amazon RDS for PostgreSQL. Application credentials must not be stored on the EC2 instances, and authentication should use short-lived credentials. What should the architect recommend?

Accepted Answer

IAM database authentication for RDS with an EC2 instance role. IAM database authentication for RDS with an EC2 instance role allows the application to obtain a short-lived authentication token (valid for 15 minutes) using the AWS CLI or SDK, without storing any credentials on the instance. The EC2 instance role provides the necessary permissions to generate the token, which is then used instead of a static password, meeting both security requirements.

Answer

Store the database password in user data

Answer

Embed the database password in the AMI

Answer

Use a security group rule that allows only application instances

Question 5

A public API for a image sharing application is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used?

Accepted Answer

JWT authorizer configured for the OpenID Connect issuer. Option C is correct because API Gateway's JWT authorizer natively validates JSON Web Tokens (JWTs) issued by an external OpenID Connect (OIDC) provider. It verifies the token's signature, expiry, and issuer against the OIDC provider's JWKS endpoint, enabling standards-based authentication without custom Lambda code.

Answer

A VPC endpoint policy

Answer

API keys only

Answer

IAM authorization for all internet users

Question 6

A company is encrypting sensitive S3 data for a order processing API with AWS KMS. Which two controls help prevent accidental use of the KMS key by unauthorized principals?

Accepted Answer

A key policy that limits key administrators and key users. Option B is correct because a KMS key policy explicitly defines which principals (IAM users, roles, or AWS accounts) are allowed to administer or use the key. By limiting key administrators and key users in the key policy, you prevent unauthorized principals from accidentally invoking KMS operations on the key, even if they have broad IAM permissions. This is a fundamental resource-based control that overrides any IAM policy that would otherwise grant access.

Answer

A larger KMS key rotation period

Answer

S3 Transfer Acceleration

Question 7

Developers for a financial reporting platform need temporary elevated access to production resources for troubleshooting. The security team wants approvals, expiry, and audit logging. Which approach is best?

Accepted Answer

Use IAM Identity Center permission sets with time-bound access processes and CloudTrail auditing. IAM Identity Center (formerly AWS SSO) allows you to define permission sets with time-bound access, ensuring that developers receive temporary elevated permissions that automatically expire. Combined with AWS CloudTrail, all API calls made during the troubleshooting session are logged for audit, meeting the security team's requirements for approvals, expiry, and audit logging.

Answer

Disable CloudTrail during troubleshooting

Answer

Create shared administrator access keys for the team

Answer

Attach AdministratorAccess permanently to every developer role

Question 8

A healthcare document service must ensure that only encrypted EBS volumes can be created in the account. What is the strongest preventive control?

Accepted Answer

Use an SCP that denies ec2:CreateVolume when the encrypted condition is false. Option A is correct because an SCP (Service Control Policy) is a preventive control that can deny the ec2:CreateVolume action when the encryption condition (ec2:Encrypted) is false. This ensures that no unencrypted EBS volumes can be created in the account, providing a strong, proactive guardrail that cannot be overridden by IAM policies within the account.

Answer

Tag encrypted volumes after creation

Answer

Enable VPC Flow Logs

Answer

Run a daily Lambda function to encrypt unencrypted volumes

Question 9

A company hosts a B2B file exchange site on EC2. Administrators must connect without opening SSH or RDP ports to the internet. What should the architect use?

Accepted Answer

AWS Systems Manager Session Manager with the required instance role. AWS Systems Manager Session Manager allows secure shell access to EC2 instances without opening inbound ports (SSH 22 or RDP 3389) to the internet. It uses the AWS Systems Manager agent and an IAM instance role to establish a bidirectional connection via the AWS cloud, eliminating the need for a bastion host or public IP. This meets the requirement for administrators to connect without exposing any network ports.

Answer

A bastion host with SSH open to 0.0.0.0/0

Answer

A public Elastic IP address on each instance

Answer

An internet gateway attached to the private subnet

Question 10

A mobile banking backend stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured?

Accepted Answer

S3 Object Lock in compliance mode with an appropriate retention period. S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects until the retention period expires. This meets the compliance requirement of immutable audit logs for seven years, as compliance mode enforces a legal hold that cannot be removed by any party.

Answer

S3 server access logging

Answer

S3 lifecycle expiration after seven years

Answer

S3 versioning only

Question 11

A customer analytics portal uses CloudFront in front of an S3 origin. Which two settings help keep users from bypassing CloudFront and accessing the bucket directly?

Accepted Answer

Configure Origin Access Control for the S3 origin. Option B is correct because Origin Access Control (OAC) is a CloudFront feature that restricts access to an S3 origin so that only the CloudFront distribution can fetch objects. When OAC is configured, CloudFront signs requests using a trusted identity, and the S3 bucket policy can then deny any request that does not come from that identity, effectively blocking direct S3 access.

Answer

Enable CloudFront standard logging

Answer

Enable S3 static website hosting

Question 12

A solutions architect is designing an S3 bucket for a IoT ingestion API. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure?

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. Option C is correct because S3 Block Public Access provides a definitive override that prevents any public access to objects regardless of other policies. When enabled at the account or bucket level, it blocks all public access settings, including those from bucket policies, access control lists (ACLs), or object ACLs, ensuring that even if a developer later adds an overly broad bucket policy, the objects remain private. This is the only mechanism that cannot be overridden by a bucket policy, making it the appropriate choice for a strict no-public-access requirement.

Answer

Enable S3 Transfer Acceleration

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Answer

Enable server access logging on the bucket

Question 13

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Interface VPC endpoint for Systems Manager. Interface VPC endpoints (AWS PrivateLink) for Systems Manager allow EC2 instances in private subnets to access Parameter Store without traversing the internet. Gateway VPC endpoints for S3 provide a highly available, managed route to S3 via the VPC route table, requiring no NAT or internet gateway. Both are AWS-native, managed services that meet the architecture review board's preference.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone

Question 14

A Lambda function for a claims portal needs to read a database password. The password must rotate automatically every 30 days and should not be stored in environment variables. Which service should be used?

Accepted Answer

AWS Secrets Manager with rotation enabled. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, automatically rotating, and managing secrets like database passwords. It supports automatic rotation every 30 days via a built-in Lambda rotation function, and it avoids storing the password in environment variables, which are visible in the Lambda console and logs.

Answer

AWS Systems Manager Parameter Store SecureString without automation

Answer

An encrypted object in Amazon S3

Answer

A KMS-encrypted Lambda environment variable

Question 15

An EC2 instance in a private subnet must access an S3 bucket that contains regulated exports for a image sharing application. The security team requires access to be allowed only when traffic comes through a specific VPC endpoint. What should the architect add to the bucket policy?

Accepted Answer

A condition that matches aws:sourceVpce to the endpoint ID. Option A is correct because the `aws:sourceVpce` condition key in an S3 bucket policy allows you to restrict access so that only traffic originating from a specific VPC endpoint (VPCe) is permitted. This enforces the security team's requirement that all S3 access must come through that endpoint, ensuring that requests from other paths (e.g., NAT gateway, internet gateway) are denied. The condition is evaluated at the S3 service side, not at the instance level, making it a direct and secure way to enforce the policy.

Answer

A deny statement for all IAM users except the EC2 role

Answer

A security group rule that allows HTTPS to S3

Answer

A condition that matches aws:RequestedRegion to the bucket Region