SAA-C03 Design Secure Architectures Practice Test 18 — 15 Questions

Question 1

A company uses IAM permission boundaries to prevent developers from escalating privileges. The security team created a permission boundary that allows only read-only actions on most AWS services, but teams can still manage their own resources. A developer can create an IAM role with broad permissions, and the boundary does not appear to be restricting it. Which corrective action best aligns with how permission boundaries work?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure the role creation process sets the permission boundary on the new role, using the boundary’s ARN in the CreateRole call or role template.. Permission boundaries must be explicitly applied to a role during its creation (via the `CreateRole` API call or an infrastructure-as-code template). Without setting the boundary ARN, the role inherits no restriction, allowing the developer to create a role with broad permissions that bypasses the intended boundary. Option B correctly identifies that the role creation process must include the boundary ARN to enforce the limitation.

Answer

Rely on an AWS-managed policy attached to the developer’s IAM user; permission boundaries only apply to users.

Answer

Attach the permission boundary policy as an SCP in AWS Organizations so it automatically applies to all roles.

Answer

Grant the developer IAM permissions to add a “deny” statement to the boundary policy so the boundary blocks escalation.

Question 2

A team wants to remove a bastion host used for administrative access to EC2 instances in private subnets. The instances should be reachable only for occasional troubleshooting by engineers who authenticate with AWS SSO. What is the best secure alternative within AWS, assuming the instances already have an instance profile attached?

Accepted Answer

Use AWS Systems Manager Session Manager, enabling the required SSM permissions in the instance profile and restricting access to engineers via IAM.. AWS Systems Manager Session Manager provides secure, auditable, agent-based access to EC2 instances without requiring a bastion host, open inbound ports, or SSH keys. By enabling the required SSM permissions (e.g., AmazonSSMManagedInstanceCore) in the instance profile and using IAM policies to restrict access to authenticated engineers via AWS SSO, you achieve a fully managed, secure, and compliant solution. This eliminates the need for a bastion host while maintaining the ability to troubleshoot instances in private subnets.

Answer

Keep the bastion host but move it into a private subnet; engineers can connect by using a corporate VPN into the VPC.

Answer

Attach a public IP to each private instance so engineers can SSH directly and use security groups to restrict access.

Answer

Create a security group rule that allows engineers’ source IP addresses to reach instances over RDP on port 3389.

Question 3

A team stores important documents in Amazon S3. They want to recover earlier versions if someone overwrites or deletes a file by mistake. What should they enable?

Accepted Answer

Amazon S3 Versioning. Amazon S3 Versioning is the correct choice because it allows you to preserve, retrieve, and restore every version of every object stored in an S3 bucket. When enabled, S3 automatically maintains a unique version ID for each object, so if a file is overwritten or deleted, the previous version remains accessible. This directly addresses the requirement to recover earlier versions after accidental modification or deletion.

Answer

Amazon EBS snapshots

Answer

Amazon CloudWatch logs

Answer

VPC flow logs

Question 4

A mobile app reads the same product catalog items repeatedly throughout the day. The DynamoDB table is already properly keyed, but read latency is still a problem during sales events. The team can tolerate eventually consistent reads and wants the least disruptive change. What should they add?

Accepted Answer

Enable DynamoDB Accelerator to cache frequently accessed items in memory.. DynamoDB Accelerator (DAX) is a fully managed, in-memory cache that reduces read latency for frequently accessed items by orders of magnitude, from single-digit milliseconds to microseconds. Since the team can tolerate eventually consistent reads, DAX is ideal because it caches read results and serves them without additional DynamoDB read capacity consumption, making it the least disruptive change — no schema changes or application rewrites are required.

Answer

Add a global secondary index for every frequently viewed product attribute.

Answer

Switch the table to on-demand capacity mode to reduce latency.

Answer

Move the catalog to Aurora and use a read replica for every region.

Question 5

Match each database availability event to the AWS failover behavior that best describes it.

Accepted Answer

Multi-AZ RDS primary failure: Fails over automatically to standby. Multi-AZ RDS automatically fails over to standby; read replicas require manual redirect; Aurora uses replicas for failover; without replicas, Aurora recovers in-place.

Answer

Multi-AZ RDS primary failure: Requires manual promotion of a read replica

Answer

RDS primary failure with read replicas: Automatically fails over to an Aurora replica

Question 6

A high-frequency trading analytics service runs on several EC2 instances in the same Availability Zone. The application exchanges small messages between nodes and is sensitive to microsecond-level network latency. Which design best meets the requirement?

Accepted Answer

Place the instances in a cluster placement group in one Availability Zone.. A cluster placement group is designed for low-latency, high-throughput scenarios by placing instances in a single Availability Zone with non-blocking, fully bisectioned bandwidth and microsecond-level latency. This meets the requirement for microsecond-sensitive inter-node communication in high-frequency trading.

Answer

Place the instances in a spread placement group across multiple Availability Zones.

Answer

Place the instances in a partition placement group within one Availability Zone.

Answer

Deploy the instances behind an Application Load Balancer in multiple Availability Zones.

Question 7

A legacy market-data service runs on EC2 and exposes a custom TCP protocol. Clients must connect over TCP with very low latency, and the team wants static IP addresses at the load-balancing layer. Which AWS service is the best fit?

Accepted Answer

Network Load Balancer, because it supports TCP, static IPs, and very low latency.. The Network Load Balancer (NLB) operates at Layer 4, supports TCP traffic natively, provides static IP addresses per Availability Zone, and delivers very low latency by processing packets without inspecting application-layer headers. This makes it the ideal choice for a legacy market-data service that requires a custom TCP protocol and fixed IPs at the load-balancing layer.

Answer

Application Load Balancer, because it provides advanced routing for all protocols.

Answer

Amazon API Gateway, because it can front any network protocol with throttling.

Answer

Amazon CloudFront, because it can route traffic to EC2 instances at the edge.

Question 8

A media company has users around the world uploading 1 to 5 GB files directly to a single Amazon S3 bucket. Upload times are slow from distant regions, but the app must keep using S3 as the destination. What should the architects enable to improve upload performance?

Accepted Answer

Amazon S3 Transfer Acceleration on the bucket.. Amazon S3 Transfer Acceleration (B) uses AWS edge locations to accelerate uploads over the public internet. When a user uploads a file, the data is sent to the nearest edge location via optimized network paths, then forwarded over AWS's private backbone to the S3 bucket. This reduces latency and improves throughput for large files (1–5 GB) from distant regions, directly addressing the slow upload times while keeping S3 as the destination.

Answer

Amazon CloudFront for origin caching of uploaded files.

Answer

Provisioned IOPS EBS volumes attached to a transfer server.

Answer

Amazon EFS with a mount target in each Region.

Question 9

A backup process restores a 2 TB production database from an EBS snapshot onto a new volume. During the first hours after restore, the application sees slow reads whenever previously unused blocks are accessed. What is the best way to avoid this performance issue in future restores?

Accepted Answer

Enable Fast Snapshot Restore on the snapshots used for recovery.. When an EBS volume is restored from a snapshot, it is lazily loaded from Amazon S3 in the background. Accessing data blocks that have not yet been loaded triggers a read penalty because the volume must fetch them from S3 before serving the I/O. Enabling Fast Snapshot Restore (FSR) pre-warms the snapshot data so that restored volumes have full performance immediately, eliminating the slow reads on first access.

Answer

Increase the volume size to give the database more free space.

Answer

Move the database files to Amazon EFS after the restore completes.

Answer

Use magnetic standard volumes because they avoid snapshot hydration delays.

Question 10

An order-quote Lambda function is invoked directly by API Gateway. Traffic is predictable during the business day, and the first request after scaling from zero causes unacceptable latency. The team wants to keep the current architecture and reduce cold-start impact. Which configuration should they use?

Accepted Answer

Enable provisioned concurrency for the Lambda function.. Provisioned concurrency initializes a specified number of execution environments in advance, so when the first request arrives after scaling from zero, it is served by a pre-warmed instance instead of incurring a cold start. This directly addresses the unacceptable latency without changing the architecture or requiring code modifications.

Answer

Increase the function timeout so the first invocation has more time to finish.

Answer

Set reserved concurrency to a fixed number and leave the rest unchanged.

Answer

Increase the memory size only to eliminate cold starts.

Question 11

A website serves mostly cacheable images, CSS, and JavaScript from an ALB. Users in Europe and Asia report slower page loads, and the ALB receives far more requests than expected. The team also wants text assets compressed automatically. Which change is the best first step?

Accepted Answer

Place Amazon CloudFront in front of the ALB and enable compression and caching.. CloudFront is the correct first step because it acts as a CDN that caches cacheable content (images, CSS, JS) at edge locations close to users in Europe and Asia, reducing load on the ALB and improving page load times. It also supports automatic compression of text assets (e.g., via gzip or Brotli) without requiring backend changes, directly addressing the team's requirement for compressed text assets. By offloading requests from the ALB, CloudFront reduces the number of requests hitting the origin, solving the 'far more requests than expected' issue.

Answer

Increase the ALB size and add more target instances behind it.

Answer

Use Route 53 latency-based routing to send users to the nearest ALB.

Answer

Replace the ALB with an NLB to reduce latency for web requests.

Question 12

An e-commerce application uses Aurora MySQL. Writes are modest, but the product-detail page generates many read-only queries and the writer instance CPU is high. The application can tolerate a small amount of replication lag on those reads. What should the team do?

Accepted Answer

Add Aurora read replicas and send read-only traffic to the reader endpoint.. Adding Aurora read replicas and directing read-only traffic to the reader endpoint offloads SELECT queries from the writer instance, reducing its CPU load. Aurora replicas share the same underlying storage volume, so replication lag is minimal (typically <100ms) and acceptable for the product-detail page. This scales read throughput without increasing writer instance size or cost.

Answer

Increase the writer instance size and keep all traffic on the primary.

Answer

Replace Aurora with DynamoDB to eliminate replication lag.

Answer

Enable Multi-AZ failover only, because it increases read throughput automatically.

Question 13

A retail company lets developers deploy ECS services but they must never be able to modify IAM. The team currently uses an IAM user per developer with an admin-like policy, and several access keys have been leaked. You are asked to redesign access so that: (1) developers authenticate with temporary credentials, (2) they can create/update ECS services and related autoscaling resources, and (3) IAM changes are impossible even if a developer tries to attach new policies.

Which design best meets all requirements?

Accepted Answer

Use an IAM role that developers assume for deployments; attach least-privilege policies for ECS and Auto Scaling; and attach a permission boundary that does not allow iam:* actions, so additional inline or managed policies cannot grant IAM permissions.. It uses an IAM role with temporary credentials (via AWS STS AssumeRole), satisfying the requirement that developers never have long-term access keys. The least-privilege policies restrict actions to ECS and Auto Scaling only, and the permission boundary explicitly denies iam:* actions, preventing developers from escalating privileges by attaching new policies to their role. This combination ensures developers can deploy ECS services but cannot modify IAM in any way.

Answer

Create an IAM user for each developer and keep the existing broad permissions, rotating keys every 90 days.

Answer

Attach a policy that allows ecs:* and autoscaling:* and rely on developers to self-review that no IAM statements are added to their roles.

Answer

Create a single shared IAM role with full administrator permissions so developers can troubleshoot faster when deployments fail.

Question 14

An administrator needs the ability to read and update infrastructure for a specific AWS account, but only when using MFA. The security team wants to eliminate long-lived administrator access keys and ensure that even if someone obtains temporary session credentials, actions are only allowed with MFA present.

Which IAM design best meets these requirements?

Accepted Answer

Create an IAM role for administration and use a permissions policy that allows only the required read/write actions. Add a condition to deny all allowed actions unless aws:MultiFactorAuthPresent is true.. It uses an IAM role with a condition key `aws:MultiFactorAuthPresent` set to `true` to enforce MFA for all API calls made with temporary credentials. This eliminates long-lived access keys and ensures that even if temporary session credentials are compromised, actions are denied unless MFA was used during the session. The policy explicitly denies all allowed actions when MFA is not present, meeting the security team's requirement for MFA on every administrative action.

Answer

Create an IAM user for administrators with AdministratorAccess and require MFA only at the IAM user login.

Answer

Attach policies to an IAM user that allow read/write actions and enable MFA in the account, but do not use condition keys in IAM policies.

Answer

Use a role with the correct actions but enforce MFA only in the application by prompting users for an OTP before every API call.

Question 15

A company runs an application in private subnets (no inbound internet). The application must access Amazon S3 and AWS Secrets Manager endpoints without routing through the public internet and without exposing the instances to NAT gateways due to cost. Security requirements also state that only the required VPC traffic should be allowed to reach AWS services.

Which architecture best satisfies these requirements?

Accepted Answer

Add a VPC gateway endpoint for S3 and an interface VPC endpoint for Secrets Manager; keep instances in private subnets and configure security group rules attached to the endpoints to allow inbound traffic only from the application subnets.. It uses a VPC gateway endpoint for S3 and an interface VPC endpoint for Secrets Manager, both of which allow private subnet instances to access these AWS services without traversing the public internet or requiring a NAT gateway. The security group rules attached to the interface endpoint restrict inbound traffic to only the application subnets, satisfying the security requirement of allowing only required VPC traffic. This architecture avoids NAT gateway costs and keeps instances isolated from inbound internet traffic.

Answer

Place instances in private subnets but use NAT gateways so traffic to S3 and Secrets Manager goes through the internet; restrict security groups to instance-to-instance only.

Answer

Use public subnets with instances that have no security group rules; rely on AWS services to reject unauthorized traffic.

Answer

Create an S3 bucket policy that allows requests from the application instances’ private IP addresses and enable public access to Secrets Manager via the default service endpoint.