SAA-C03 Design Secure Architectures Practice Test 19 — 15 Questions

Question 1

A containerized service needs to read exactly one secret value from AWS Secrets Manager. The secret’s ARN is already known, and the secret is encrypted with the AWS-managed KMS key for Secrets Manager, so no separate KMS permissions are needed for this question. The service does not need to list secrets, create secrets, rotate them, or write updates. What is the most least-privilege IAM permission statement to grant the service role?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Allow secretsmanager:GetSecretValue on the specific secret ARN only.. The service only needs to read a single secret value, and the least-privilege permission is to allow only the `secretsmanager:GetSecretValue` action on that specific secret's ARN. This grants exactly the required read access without any additional capabilities, adhering to the principle of least privilege. Since the secret is encrypted with the AWS-managed KMS key for Secrets Manager, no separate KMS permissions are needed, as the key policy automatically grants access to the Secrets Manager service.

Answer

Allow secretsmanager:* on all resources in the account.

Answer

Allow secretsmanager:ListSecrets so the service can discover the secret ARN at runtime.

Answer

Allow secretsmanager:PutSecretValue so the service can retrieve and update the secret value.

Question 2

A security team needs an audit trail to investigate suspicious API activity across multiple AWS accounts. Which AWS approach best provides centralized visibility into who did what, when, for service API calls?

Accepted Answer

Create an AWS CloudTrail organization trail that delivers logs to a centralized, access-controlled S3 bucket.. AWS CloudTrail organization trail is the correct approach because it captures all management and data events across multiple AWS accounts within an AWS Organizations structure, delivering them to a single, centralized S3 bucket. This provides a unified, immutable audit trail of who performed which API call, when, and from which source IP, enabling the security team to investigate suspicious activity with full visibility. The centralized bucket can be access-controlled with S3 bucket policies and IAM to ensure only authorized personnel can view the logs.

Answer

Enable AWS Config only for EC2 security groups and rely on it for API call auditing.

Answer

Turn on S3 server access logging for every bucket and assume it covers all AWS services.

Answer

Use only Amazon CloudWatch alarms with no logging destination to reduce storage costs.

Question 3

An internal web application must require encrypted client connections. The company currently has an ALB listener on port 80 (HTTP), and users can access the application over plain HTTP. What is the best change to ensure all client traffic uses HTTPS?

Accepted Answer

Configure an HTTPS (port 443) listener using an ACM certificate and update the port 80 listener to redirect to HTTPS (or to block plain HTTP requests).. It uses an HTTPS listener on port 443 with an ACM certificate to enforce encrypted client connections, and redirecting HTTP (port 80) traffic to HTTPS ensures all traffic is encrypted in transit. This is the standard AWS best practice for enforcing HTTPS on an ALB, as it directly controls the listener behavior at the load balancer level without requiring application changes.

Answer

Enable S3 default encryption so HTTP requests are automatically encrypted in transit.

Answer

Set the application to encrypt data only after it is received by the ALB.

Answer

Rely on WAF alone to encrypt HTTP traffic.

Question 4

Based on the exhibit, a workload in Account B must assume a role in Account A. Security requires that only the specific role arn:aws:iam::444455556666:role/PipelineExecRole can assume it, and only when the caller supplies the external ID acct-b-prod-7788. Which change best satisfies the requirement with the least privilege?

Accepted Answer

Replace the principal with arn:aws:iam::444455556666:role/PipelineExecRole and add a StringEquals condition on sts:ExternalId = acct-b-prod-7788.. It explicitly restricts the trust policy principal to the specific IAM role ARN `arn:aws:iam::444455556666:role/PipelineExecRole` and adds a `StringEquals` condition on `sts:ExternalId` set to `acct-b-prod-7788`. This satisfies the security requirement by ensuring only that exact role can assume the role in Account A, and only when the correct external ID is provided, following the principle of least privilege.

Answer

Keep the root principal and add an aws:PrincipalTag condition in the trust policy to require the tag acct-b-prod-7788.

Answer

Attach a permission boundary to the role in Account A so that only PipelineExecRole can use it.

Answer

Add an SCP in Account B that allows sts:AssumeRole only for PipelineExecRole.

Question 5

Based on the exhibit, an automation pipeline in several member accounts creates IAM roles for application deployments. Security says no future role may exceed the approved boundary arn:aws:iam::123456789012:policy/DeployBoundary, even if someone later attaches AdministratorAccess. What should you implement to enforce this across the organization?

Accepted Answer

Create an SCP that denies iam:CreateRole unless iam:PermissionsBoundary equals arn:aws:iam::123456789012:policy/DeployBoundary, and also deny removing that boundary from created roles.. It uses an SCP to enforce that any IAM role creation must include the specific permissions boundary `arn:aws:iam::123456789012:policy/DeployBoundary`, and also prevents removal or modification of that boundary from existing roles. This ensures that even if an attacker or administrator later attaches a policy like AdministratorAccess, the effective permissions are still limited by the boundary, meeting the security requirement across all member accounts in the organization.

Answer

Attach DeployBoundary to the automation role only, because that automatically forces every created role to inherit the same boundary.

Answer

Create an SCP that denies iam:CreateRole and iam:PutRolePermissionsBoundary unless aws:RequestTag equals DeployBoundary.

Answer

Use AWS Access Analyzer to automatically attach the approved boundary whenever a role is created without one.

Question 6

Based on the exhibit, an application role in Account B can reach an S3 bucket in Account A, but reads fail with AccessDenied on KMS. The bucket objects use SSE-KMS with a customer managed key in Account A. What change is required so the application can decrypt the objects while keeping the access restricted?

Accepted Answer

Add the Account B role ARN to the KMS key policy with kms:Decrypt and kms:DescribeKey permissions, scoped to S3 usage in us-east-1.. When using SSE-KMS with a customer managed key, cross-account access requires the KMS key policy to explicitly grant the external IAM role (from Account B) the kms:Decrypt and kms:DescribeKey permissions. Without these, S3 can retrieve the encrypted object, but KMS will deny the decryption request, resulting in an AccessDenied error. Scoping the policy to S3 usage in us-east-1 follows the principle of least privilege while enabling the necessary decryption.

Answer

Add s3:GetEncryptionConfiguration to the Account B IAM policy so S3 can use the customer managed key on reads.

Answer

Change the bucket to SSE-S3 because SSE-S3 always allows cross-account reads without any KMS policy changes.

Answer

Add the Account B role to the bucket ACL with FULL_CONTROL so S3 can bypass KMS on behalf of the reader.

Question 7

Based on the exhibit, an EC2 application runs in private subnets with no NAT gateway and must retrieve a secret from AWS Secrets Manager. The secret uses a customer managed KMS key. Which change will allow the application to reach the service while keeping traffic off the internet?

Accepted Answer

Create an interface VPC endpoint for Secrets Manager and another interface VPC endpoint for KMS, and enable private DNS for both.. It creates interface VPC endpoints for both Secrets Manager and KMS, which allows the EC2 instance in the private subnet to securely access these services over the AWS network without traversing the internet. Enabling private DNS ensures that the standard service endpoints resolve to the private IP addresses of the VPC endpoints, eliminating the need for a NAT gateway or internet gateway.

Answer

Create an S3 gateway endpoint for Secrets Manager and use the existing S3 gateway endpoint for both secret retrieval and KMS decryption.

Answer

Add a NAT gateway in a public subnet and route 0.0.0.0/0 from the private subnets to the NAT gateway.

Answer

Move the application into a public subnet so it can call the public Secrets Manager endpoint directly.

Question 8

Based on the exhibit, users must access private PDF reports only through CloudFront. Direct requests to the S3 object URL must fail, and the bucket should not be publicly readable. Which solution is the best fit?

Accepted Answer

Enable CloudFront Origin Access Control for the distribution and update the bucket policy to allow only the CloudFront distribution principal with its SourceArn.. CloudFront Origin Access Control (OAC) allows you to restrict access to an S3 bucket so that only the specific CloudFront distribution can retrieve objects. By updating the bucket policy to allow the CloudFront distribution principal with its SourceArn, you ensure that direct requests to the S3 object URL are denied, while CloudFront-signed URLs or cookies can still control user access. This meets the requirement of blocking direct S3 access while keeping the bucket private.

Answer

Keep the bucket public and require signed URLs at CloudFront, because signed URLs automatically block all direct S3 requests.

Answer

Add an S3 access point and allow the CloudFront distribution to use it without changing the bucket policy.

Answer

Attach AWS WAF to the distribution and block requests that do not include a signed cookie.

Question 9

Based on the exhibit, the security team needs to detect and alert on both successful and failed attempts to change S3 bucket policies and KMS key policies across the organization. Which solution best meets that requirement?

Accepted Answer

Enable an organization trail for management events in all regions and create an EventBridge rule that matches PutBucketPolicy and PutKeyPolicy, then send alerts to SNS.. AWS CloudTrail management events capture all API calls that modify S3 bucket policies (PutBucketPolicy) and KMS key policies (PutKeyPolicy). By enabling an organization trail for all regions, you centralize these events across the entire AWS Organization. An Amazon EventBridge rule can then filter for these specific API calls and send alerts via Amazon SNS, meeting the requirement to detect both successful and failed attempts.

Answer

Enable AWS Config in all accounts and use only a periodic compliance evaluation to alert when bucket or key policies drift.

Answer

Use IAM Access Analyzer because it continuously blocks policy changes that would expose the resources publicly.

Answer

Turn on S3 server access logging and KMS key rotation, because both services will capture policy modifications automatically.

Question 10

Based on the exhibit, a public API is behind CloudFront and is experiencing bursts of requests from the same client IP, causing upstream saturation. The team wants AWS to automatically block that IP when the request rate becomes excessive while keeping enforcement as close to the client as possible. Which control should they add?

Accepted Answer

Add an AWS WAF rate-based rule to the CloudFront distribution and configure it to block the source IP after the threshold is exceeded.. AWS WAF rate-based rules are designed to automatically block IP addresses that exceed a specified request rate within a 5-minute evaluation window. By attaching this rule to a CloudFront distribution, enforcement occurs at the edge location closest to the client, preventing excessive requests from reaching the upstream API and mitigating saturation.

Answer

Add a network ACL rule that denies the source IP after five requests are observed.

Answer

Enable AWS Shield Advanced and create a custom protection group for the single IP address.

Answer

Place the API behind a security group rule that allows only the current client IP range.

Question 11

Based on the exhibit, a CI pipeline assumes a shared deployment role in Account A. The role can access several artifact prefixes, but this pipeline must only upload to teamA/prod/ and decrypt using a single KMS key for this execution. Changing the shared role would affect other pipelines. Which approach should the pipeline use?

Accepted Answer

Pass an inline session policy in the AssumeRole request that further restricts the temporary credentials to teamA/prod/ and the approved KMS key.. An inline session policy passed in the AssumeRole request allows you to further restrict the temporary credentials' permissions without modifying the shared role itself. This ensures the pipeline can only upload to teamA/prod/ and decrypt using the specified KMS key, while other pipelines using the same role remain unaffected.

Answer

Attach a permission boundary to the pipeline's assumed session so the temporary credentials cannot exceed the shared role permissions.

Answer

Add an SCP to Account A that forces all roles to use the same S3 prefix and key whenever they are assumed.

Answer

Change the role trust policy to allow only the teamA/prod/ prefix and the key ARN because trust policies can scope S3 object paths directly.

Question 12

Based on the exhibit, a company wants EC2 instances in private subnets to access Amazon S3 without using a NAT gateway, and bucket access must be allowed only when requests come through the approved VPC endpoint. Which design is the most appropriate?

Accepted Answer

Use the S3 gateway VPC endpoint and keep the bucket policy that denies requests unless aws:SourceVpce matches the approved endpoint.. An S3 gateway VPC endpoint allows EC2 instances in private subnets to access S3 without traversing the internet or requiring a NAT gateway. By adding a bucket policy condition that denies access unless `aws:SourceVpce` matches the approved VPC endpoint ID, you ensure that only requests originating from that specific endpoint are allowed, meeting the security requirement.

Answer

Use an interface VPC endpoint for S3 only, because gateway endpoints cannot be used with bucket policies.

Answer

Add a NAT gateway and remove the bucket policy condition because the NAT route will automatically secure the S3 traffic.

Answer

Move the bucket policy restriction to a security group attached to the S3 bucket so only the VPC endpoint can reach it.

Question 13

Based on the exhibit, a batch platform in Account B must assume a role in Account A. Only the specific role arn:aws:iam::222233334444:role/BatchRunner should be allowed to assume it, and the design must prevent any other role in Account B from reusing the same external ID. Which change best meets the requirement?

Accepted Answer

Change the trust policy principal from account root to arn:aws:iam::222233334444:role/BatchRunner and keep the ExternalId condition.. The trust policy on the target role in Account A must restrict the principal to the exact BatchRunner role ARN (arn:aws:iam::222233334444:role/BatchRunner) rather than the entire Account B root. This ensures that only that specific role can assume the target role. Keeping the ExternalId condition adds an additional layer of security by requiring a unique identifier that only BatchRunner knows, preventing any other role in Account B from reusing the same external ID.

Answer

Add an identity-based policy to the BatchRunner role that allows sts:AssumeRole on the target role.

Answer

Replace the ExternalId condition with a role session name condition so only BatchRunner sessions are accepted.

Answer

Attach an SCP to Account B that denies sts:AssumeRole unless the request comes from BatchRunner.

Question 14

Based on the exhibit, an application in the same AWS account can upload and read objects in an S3 bucket encrypted with a customer managed KMS key, but GetObject fails with an AccessDenied error from AWS KMS. The IAM role already has s3:GetObject, s3:PutObject, kms:Decrypt, and kms:GenerateDataKey permissions. What change most directly fixes the issue while preserving least privilege?

Accepted Answer

Update the KMS key policy to allow the application role to use the key, ideally with a kms:ViaService condition for S3.. The error is an AccessDenied from AWS KMS, not from S3, which means the IAM role has the required S3 permissions (s3:GetObject) and KMS API permissions (kms:Decrypt), but the KMS key policy does not explicitly grant the role access to the key. Since customer managed KMS keys require a key policy to grant IAM principals permission to use the key (IAM policies alone are insufficient unless the key policy delegates such authority), updating the key policy to allow the role with a kms:ViaService condition for S3 directly resolves the KMS-side denial while preserving least privilege.

Answer

Add an S3 bucket ACL that grants the application role full control over objects.

Answer

Replace the customer managed key with the AWS managed S3 key so IAM permissions become sufficient.

Answer

Add an S3 bucket policy that grants s3:GetObject and s3:PutObject to the role for all objects.

Question 15

Based on the exhibit, an application runs in private subnets without a NAT gateway and must retrieve a secret from AWS Secrets Manager. Security requires the traffic to stay on the AWS network and not traverse the public internet. What is the best solution?

Accepted Answer

Create an interface VPC endpoint for Secrets Manager and enable private DNS for the endpoint.. An interface VPC endpoint for Secrets Manager allows the application in the private subnet to securely access Secrets Manager over the AWS network using private IP addresses, without needing a NAT gateway or internet gateway. Enabling private DNS ensures that the default Secrets Manager DNS name resolves to the endpoint's private IP addresses, keeping all traffic within the AWS backbone and satisfying the security requirement.

Answer

Add a NAT gateway to the private subnet route table and keep using the public Secrets Manager endpoint.

Answer

Create a gateway VPC endpoint for Secrets Manager and point the route table to it.

Answer

Use VPC peering to connect the application subnet to another VPC that already has internet access.