SAA-C03 Design Secure Architectures Practice Test 18 — 15 Questions

Question 1

A CI/CD system creates an IAM role (CICDRole) used for deployments. Your organization uses IAM permission boundaries to prevent developers from granting themselves higher privileges. After an incident, you discover that CICDRole can perform unintended IAM actions because the role’s identity policy includes broad permissions. Which change most directly ensures permission boundaries continue to restrict CICDRole regardless of what is later added to the role’s identity policies?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure CICDRole is created with the required permissions boundary ARN, and verify that the boundary policy does not allow the unintended IAM actions.. IAM permission boundaries define the maximum permissions that an IAM role can have, regardless of what is later added to its identity-based policies. By ensuring CICDRole is created with a permission boundary that explicitly denies the unintended IAM actions, even if broad permissions are added to the role's identity policy, the boundary will override and restrict those actions. This directly addresses the requirement to prevent privilege escalation through policy modifications.

Answer

Remove the permission boundary from CICDRole so that only the identity policy controls access.

Answer

Add an identity-policy deny for iam:CreatePolicy and iam:UpdateRole on all resources.

Answer

Rely on CloudTrail alerts to stop deployments from performing IAM changes after the fact.

Question 2

Account 3000 owns a customer-managed KMS key (key-K). A data processing team in account 4000 needs to decrypt data encrypted with key-K. The role in account 4000 already has an identity policy allowing kms:Decrypt on key-K. Despite this, decrypt requests fail with an AccessDenied error referencing KMS. What is the most likely missing authorization step?

Accepted Answer

Update key-K’s key policy in account 3000 to allow kms:Decrypt for the specific role principal in account 4000.. KMS key policies are resource-based policies that must explicitly grant cross-account access. Even though the role in account 4000 has an identity-based policy allowing kms:Decrypt, the key policy in account 3000 (the key owner) must also include a statement that permits the specific role principal from account 4000 to perform kms:Decrypt on key-K. Without this, the KMS service will deny the request due to the lack of a valid authorization path.

Answer

Update the S3 bucket policy to allow kms:Decrypt for account 4000 principals on key-K.

Answer

Enable AWS managed key rotation on key-K and remove the existing key policy.

Answer

Switch the access from a role to an IAM user because KMS only supports user principals.

Question 3

A microservice runs in private subnets with no NAT gateway. It must retrieve a secret from AWS Secrets Manager. Security requires that traffic to Secrets Manager stays within AWS’s private network (no public internet egress). The IAM role already grants secretsmanager:GetSecretValue for the needed secret. What is the best network setup to meet the requirement?

Accepted Answer

Create an Interface VPC Endpoint for Secrets Manager (com.amazonaws.<region>.secretsmanager) and allow it via the endpoint security group; optionally enable private DNS.. An Interface VPC Endpoint (AWS PrivateLink) for Secrets Manager allows the microservice to access the secret privately without traversing the public internet. Since the subnet has no NAT Gateway and no public IP, this is the only way to keep traffic within the AWS network. Enabling private DNS ensures the standard Secrets Manager endpoint resolves to the private IP of the endpoint, eliminating the need for route table changes.

Answer

Create an S3 Gateway VPC endpoint and use it for Secrets Manager requests because both services use HTTPS.

Answer

Assign a public IP address to the tasks so they can call Secrets Manager over the internet without NAT.

Answer

Change the route table to send all 0.0.0.0/0 traffic directly to an Internet Gateway.

Question 4

A company runs EC2 instances in private subnets and needs to access Amazon S3 objects without using a NAT gateway. They want the traffic to stay within AWS private networking as much as possible (no internet egress). Which VPC endpoint type should they create for Amazon S3?

Accepted Answer

Create a Gateway VPC endpoint for S3 and update the route tables to use it. A Gateway VPC endpoint for S3 is the correct choice because it uses prefix lists and route table entries to send S3 traffic directly through AWS's private network without leaving the AWS backbone or requiring a NAT gateway. This endpoint type supports S3 and DynamoDB only, and it does not incur hourly charges, making it cost-effective for private subnet instances to access S3 objects securely.

Answer

Create an Interface VPC endpoint for S3 and point the instances to it

Answer

Create a NAT gateway and allow outbound HTTPS to S3

Answer

Create a VPC endpoint service and manually register S3 as a provider endpoint

Question 5

You must ensure that all requests to an S3 bucket use TLS (HTTPS). Which S3 bucket policy approach best enforces this requirement for S3 access?

Accepted Answer

Use a policy statement that explicitly Denies any action when aws:SecureTransport is false. The `aws:SecureTransport` condition key evaluates whether the request was sent using TLS. By explicitly denying all S3 actions when `aws:SecureTransport` is false, any HTTP request is rejected, ensuring only HTTPS requests succeed. This approach uses an explicit deny, which overrides any allow, making it the most secure and reliable method to enforce TLS.

Answer

Allow all principals to GetObject when aws:SecureTransport is true

Answer

Deny requests only when the bucket name is not matched exactly in the request

Answer

Require that the requester uses SSE-KMS and reject requests without SSE-KMS configuration

Question 6

Your AWS Organizations environment has an SCP that explicitly denies kms:Decrypt for principals in the Production OU. A member account IAM policy for a user grants kms:Decrypt on the required KMS key. If that user attempts kms:Decrypt, what happens?

Accepted Answer

The request is denied because the SCP explicit deny overrides IAM allows. In AWS Organizations, Service Control Policies (SCPs) act as a guardrail that sets the maximum available permissions for all accounts in an OU. An explicit deny in an SCP overrides any allow in an IAM policy, even if the IAM policy explicitly grants the action. Therefore, the user's kms:Decrypt request is denied because the SCP's explicit deny takes precedence over the IAM allow.

Answer

The request succeeds because the IAM policy explicitly allows kms:Decrypt

Answer

The request succeeds, but only when using the KMS key policy to allow the user

Answer

The request succeeds for read-only actions and fails only for writes

Question 7

A microservice needs to read exactly one secret value from AWS Secrets Manager. Which IAM permission statement provides the best least-privilege approach to allow the microservice to retrieve that secret value?

Accepted Answer

Allow secretsmanager:GetSecretValue only on the specific secret ARN required by the service. It grants the minimum necessary permission—secretsmanager:GetSecretValue—scoped to the exact Amazon Resource Name (ARN) of the secret the microservice needs. This follows the AWS least-privilege principle by restricting access to a single action on a single resource, preventing the microservice from reading other secrets even if compromised.

Answer

Allow secretsmanager:GetSecretValue on all secrets using Resource: "*"

Answer

Allow secretsmanager:* on the secret name prefix using a wildcard pattern

Answer

Allow secretsmanager:GetSecretValue on the AWS account root ARN

Question 8

A company has an Amazon S3 bucket for sensitive reports. They must ensure that any object uploaded with s3:PutObject is encrypted using AWS KMS (SSE-KMS). Which S3 bucket policy approach best enforces this by denying uploads that do not use SSE-KMS?

Accepted Answer

Use a Deny statement for s3:PutObject with a condition that denies requests where s3:x-amz-server-side-encryption is not "aws:kms" (SSE-KMS), for example: Condition { StringNotEquals: { "s3:x-amz-server-side-encryption": "aws:kms" } }. It uses a Deny statement with the condition `StringNotEquals` on the `s3:x-amz-server-side-encryption` request header, which explicitly denies any `s3:PutObject` request that does not include the value `aws:kms` for that header. This ensures that only objects encrypted with SSE-KMS are uploaded, as any request lacking the header or using a different encryption type (e.g., AES256) will be denied. The condition is evaluated at the time of the request, making it an effective enforcement mechanism.

Answer

Use a Deny statement that denies requests when aws:SecureTransport is false.

Answer

Use a Deny statement that checks the specific KMS key ID (s3:x-amz-server-side-encryption-aws-kms-key-id) and denies requests that don’t match a single alias value.

Answer

Use a Deny or Allow statement that limits object keys using s3:prefix (for example, only allow keys under "reports/").

Question 9

Account A hosts an IAM role (RoleInAccountA). The trust policy in Account A correctly allows a specific principal from Account B to call sts:AssumeRole. However, when Account B’s application calls sts:AssumeRole, it receives an AccessDenied error. What is the most likely missing requirement in Account B?

Accepted Answer

Account B’s calling principal must have an identity-based policy that allows sts:AssumeRole on RoleInAccountA’s role ARN.. For an IAM role in Account A to be assumed by a principal in Account B, two conditions must be met: (1) the trust policy of the role in Account A must grant the sts:AssumeRole permission to the Account B principal, and (2) the calling principal in Account B must have an identity-based policy that explicitly allows sts:AssumeRole on the ARN of RoleInAccountA. Without this identity-based policy in Account B, the request is denied by AWS's explicit deny default, even if the trust policy in Account A is correctly configured.

Answer

Account A must attach an S3 bucket policy statement to allow sts:AssumeRole from Account B.

Answer

Account B must add kms:Decrypt permissions to the caller to satisfy AssumeRole.

Answer

Account B must create an SCP in the organization to allow sts:AssumeRole.

Question 10

A service role has an IAM policy granting kms:Decrypt for a specific AWS KMS key. The application still fails to decrypt with an AccessDenied error. What change most directly fixes this when the KMS key policy is missing the role’s permissions?

Accepted Answer

Update the KMS key policy to allow kms:Decrypt for the service role principal (or the assumed-role principal identity that the KMS key evaluates).. The AccessDenied error occurs because the KMS key policy does not grant the service role (or its assumed-role principal) permission to call kms:Decrypt. Even if the IAM policy attached to the role allows kms:Decrypt, KMS requires that the key policy explicitly authorize the principal (or the role’s assumed-role session) when the key policy is the sole authorization mechanism. Updating the key policy to include the service role principal (or the assumed-role ARN) with kms:Decrypt directly resolves the missing permission.

Answer

Add an IAM policy statement allowing s3:GetObject for the bucket that stores the encrypted data.

Answer

Enable a CloudFront distribution for the KMS key alias.

Answer

Create a VPC gateway endpoint for KMS to route decryption requests privately.

Question 11

Your application runs in private subnets with no NAT gateway. It needs to call AWS Secrets Manager to retrieve secrets. For private connectivity without internet egress, which VPC endpoint type should you create for AWS Secrets Manager?

Accepted Answer

An Interface VPC endpoint (AWS PrivateLink) for secretsmanager in your Region. An Interface VPC endpoint (AWS PrivateLink) creates an elastic network interface in your subnet with a private IP address, allowing your instances to communicate with AWS Secrets Manager over the AWS network without traversing the internet. Since your application runs in private subnets with no NAT gateway, this is the only supported endpoint type for Secrets Manager, as Gateway endpoints are only available for S3 and DynamoDB.

Answer

A Gateway VPC endpoint for secretsmanager

Answer

A NAT gateway in the private subnet route table

Answer

A VPC peering connection to the AWS public network hosting Secrets Manager

Question 12

A company stores private report PDFs in an S3 bucket. They want users to access PDFs only through CloudFront. Even if someone knows the S3 object URL, direct S3 access must fail. What is the best S3 bucket policy approach?

Accepted Answer

Keep the bucket private and allow s3:GetObject only to the CloudFront origin access identity (OAI) or origin access control (OAC) principal (optionally restricting with aws:SourceArn for the specific distribution).. It uses an Origin Access Identity (OAI) or Origin Access Control (OAC) to grant CloudFront exclusive read access to the S3 bucket. By setting a bucket policy that allows s3:GetObject only to the CloudFront OAI/OAC principal (and optionally restricting with aws:SourceArn for the specific distribution), direct S3 object URL requests are denied, ensuring users can only access PDFs through CloudFront.

Answer

Allow s3:GetObject to "Principal": "*" but rely on CloudFront signed URLs to prevent access.

Answer

Allow s3:GetObject to the CloudFront distribution using a Condition on aws:SourceIp without restricting the Principal.

Answer

Only enable default encryption (SSE-KMS) and leave bucket permissions unchanged.

Question 13

A company’s private workload in a VPC uploads objects to an S3 bucket. Security requires that S3 requests are allowed only when they traverse a specific S3 Gateway VPC Endpoint (vpce-0abc123example). Which change best enforces this restriction at the S3 bucket level?

Accepted Answer

Add an S3 bucket policy Deny statement for s3:PutObject when aws:sourceVpce is not equal to vpce-0abc123example.. It uses an S3 bucket policy with a Deny statement that explicitly denies any s3:PutObject request unless the request originates from the specified VPC Endpoint (vpce-0abc123example). The aws:sourceVpce condition key evaluates the VPC endpoint ID from which the request is made, ensuring that only traffic through that specific Gateway VPC Endpoint is allowed. This enforces the security requirement at the bucket level, overriding any other policies that might allow access from other sources.

Answer

Add an S3 bucket policy Deny statement that blocks requests unless the principal uses MFA.

Answer

Enable Block Public Access and remove the public bucket policy statement.

Answer

Attach an IAM policy to the workload role that allows s3:PutObject only to the bucket ARN.

Question 14

A public API is served through an Application Load Balancer and protected by AWS WAF. The team wants AWS to automatically block clients that send too many requests from the same IP address within a short time window. Which AWS WAF feature is the best fit?

Accepted Answer

Use a rate-based rule in AWS WAF to block when requests per IP exceed a configured threshold over the WAF rate-based evaluation window.. A rate-based rule in AWS WAF is specifically designed to automatically block clients when the number of requests from a single IP address exceeds a configured threshold within a rolling evaluation window (typically 5 minutes). This feature directly addresses the requirement to mitigate high request rates from the same IP, making it the best fit for the described use case.

Answer

Use an AWS IAM policy on the ALB listener to deny requests when request count exceeds a threshold.

Answer

Enable S3 server access logs for the bucket that stores API responses and alert on high log volume.

Answer

Configure an AWS Lambda authorizer to reject requests after the Nth request from an IP address.

Question 15

An S3 bucket uses a customer-managed KMS key as the default for SSE-KMS encryption. A service role will upload objects using s3:PutObject. Assuming the role already has permission to write to the bucket, which KMS permission is most directly required for the role to let S3 encrypt the object during upload?

Accepted Answer

kms:GenerateDataKey (and optionally kms:DescribeKey). When S3 uses SSE-KMS with a customer-managed KMS key, the service calls KMS to generate a data key for encrypting the object. The s3:PutObject operation requires the caller to have kms:GenerateDataKey permission on the KMS key so that S3 can obtain the plaintext and encrypted versions of the data key. Optionally, kms:DescribeKey may be needed for S3 to verify the key exists, but kms:GenerateDataKey is the most directly required permission.

Answer

kms:Decrypt only

Answer

kms:CreateAlias and kms:UpdateAlias only

Answer

kms:ScheduleKeyDeletion and kms:CancelKeyDeletion only