SAA-C03 Design Secure Architectures Practice Test 2 — 15 Questions

Question 1

Your company requires that all requests to an S3 bucket use HTTPS and that all objects uploaded to the bucket are encrypted at rest. You manage the S3 bucket policy and want enforcement that does not rely on application code compliance.

Which bucket policy change best enforces both requirements?

Accepted Answer

Add a Deny statement for all S3 actions on the bucket and its objects when aws:SecureTransport is false, and add a Deny statement for s3:PutObject when the request does not specify server-side encryption with AES256 (s3:x-amz-server-side-encryption = "AES256").. It uses a Deny statement with the `aws:SecureTransport` condition to block any request that does not use HTTPS, enforcing encryption in transit. It also adds a Deny statement for `s3:PutObject` when the request does not include the `x-amz-server-side-encryption` header set to `AES256`, ensuring that all uploaded objects are encrypted at rest with SSE-S3. This policy-based enforcement works regardless of application code, meeting the requirement for non-reliance on client-side compliance.

Answer

Use S3 website hosting to redirect users to HTTPS and rely on bucket default encryption for all uploads.

Answer

Add a Deny statement for s3:GetObject when aws:SecureTransport is false, and enable default encryption on the bucket.

Answer

Allow only IAM principals from your account to access the bucket and require clients to configure HTTPS in their applications.

Question 2

A reporting application in Account B must read files from an S3 bucket in Account A. The bucket contains objects encrypted with a customer managed KMS key in Account A. The application role in Account B already has an identity policy allowing s3:GetObject on the bucket prefix, but requests still fail with AccessDenied. Which two changes are required for the application to read the objects? Select two.

Accepted Answer

Add a bucket policy in Account A that allows the Account B role to perform s3:GetObject on the required prefix.. Cross-account S3 access requires the destination account (Account A) to explicitly grant access via a bucket policy that allows the source account's role (Account B) to perform s3:GetObject on the specified prefix. Without this bucket policy, the S3 service in Account A will deny the request, even if the IAM identity policy in Account B permits the action. Option B is correct because the objects are encrypted with a customer managed KMS key in Account A; the application role in Account B must be added to the KMS key policy with kms:Decrypt permission to decrypt the objects during retrieval. Both the S3 bucket policy and the KMS key policy are required for cross-account encrypted access.

Answer

Attach an IAM policy in Account B that grants s3:* on the bucket and its objects.

Answer

Create an S3 gateway endpoint in Account B so the application can reach the bucket privately.

Answer

Add an SCP in Account A that allows the Account B role to bypass KMS encryption checks.

Question 3

Your company allows application teams to create IAM roles. Each team must be prevented from granting permissions beyond a defined per-role baseline, even if they attach overly permissive identity-based policies to the role. Which AWS feature best enforces this ceiling at the IAM role level?

Accepted Answer

Attach a permission boundary to every role that teams create so the boundary limits the role’s maximum effective permissions. Permission boundaries are an AWS IAM feature that sets the maximum permissions that an identity-based policy can grant to an IAM role. When a permission boundary is attached to a role, the effective permissions are the intersection of the boundary and the role's identity-based policy, ensuring that even if a team attaches an overly permissive policy, the role cannot exceed the boundary's defined limits. This directly enforces a per-role ceiling on permissions, making option B the correct choice.

Answer

Use an Organizations service control policy (SCP) to cap the maximum permissions for role creation in each account

Answer

Rely on KMS key policies to restrict permissions because IAM policies cannot override KMS restrictions

Answer

Require multi-factor authentication (MFA) for all role creation requests and deny any request without MFA

Question 4

A public web application sits behind Amazon CloudFront with an Application Load Balancer as the origin. The security team wants all edge traffic inspected by AWS WAF and also wants to prevent anyone on the internet from reaching the ALB directly. Which two changes should be made? Select two.

Accepted Answer

Associate an AWS WAF web ACL with the CloudFront distribution.. AWS WAF can be associated directly with a CloudFront distribution to inspect all edge traffic before it reaches the origin. This allows the security team to filter malicious requests at the AWS edge locations, reducing the attack surface and offloading processing from the Application Load Balancer.

Answer

Place the ALB in private subnets and keep the CloudFront distribution unchanged.

Answer

Use an S3 Origin Access Control instead of a security group change.

Answer

Open the ALB to 0.0.0.0/0 and rely on WAF alone for protection.

Question 5

Account A hosts an IAM role that Account B developers must assume for a limited task. You want to require MFA for anyone assuming the role. Which trust policy condition most directly enforces that requirement for sts:AssumeRole?

Accepted Answer

Add a statement condition requiring "Bool": {"aws:MultiFactorAuthPresent": "true"} in the role trust policy.. The `aws:MultiFactorAuthPresent` condition key in the role trust policy directly checks whether the caller authenticated with a valid MFA device before calling `sts:AssumeRole`. When set to "true" with a Bool condition, it enforces that the session must have been established after MFA verification, which is the most direct and standard way to require MFA for role assumption.

Answer

Add a condition requiring "StringEquals": {"aws:PrincipalOrgID": "o-example"} without any MFA condition.

Answer

Add a statement that denies sts:AssumeRole when the requested role session name contains the text "dev".

Answer

Require HTTPS by setting a condition on "aws:SecureTransport": "true" in the trust policy.

Question 6

Your organization hosts an internet-facing application behind an Amazon CloudFront distribution. You want to mitigate common web exploits (for example, SQL injection and XSS) at the edge. Which action is the most appropriate way to do this using AWS services?

Accepted Answer

Create an AWS WAF web ACL using managed rule sets and associate it with the CloudFront distribution.. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). By creating a web ACL with managed rule sets (e.g., the AWS Managed Rules for SQL injection and XSS) and associating it with your CloudFront distribution, you can inspect incoming HTTP/HTTPS requests at the edge and block malicious payloads before they reach your origin. This is the most appropriate and scalable way to mitigate these threats at the edge.

Answer

Add inbound rules to the security group so that only port 443 is open from the internet.

Answer

Enable AWS Shield Advanced to block SQL injection and XSS.

Answer

Restrict IAM permissions for the application’s EC2 instances so that SQL injection payloads cannot be executed.

Question 7

A web application behind an Application Load Balancer (ALB) currently allows client connections over HTTP (port 80). The security policy requires all client traffic to use HTTPS. What is the best ALB change to enforce this requirement?

Accepted Answer

Add an HTTP listener on port 80 with a redirect action to HTTPS on port 443, and configure an HTTPS listener using an ACM certificate. It uses an ALB HTTP-to-HTTPS redirect action, which is the most efficient and AWS-native way to enforce HTTPS-only traffic. The HTTP listener on port 80 automatically redirects all client requests to the HTTPS listener on port 443, which terminates TLS using an ACM certificate. This approach requires no changes to client applications and ensures compliance with the security policy at the load balancer level.

Answer

Enable TLS only on the target group so that traffic between the ALB and targets is encrypted, even if clients connect via HTTP

Answer

Turn on S3 server-side encryption to ensure data is encrypted in transit from clients to the ALB

Answer

Remove port 80 access by removing the port 80 listener and leave only a default target group

Question 8

You have an EC2 instance in private subnets with no NAT Gateway. The instance must access an Amazon S3 bucket (for example, to read configuration files) without sending traffic to the public internet. What VPC endpoint type should you use for S3?

Accepted Answer

Create a Gateway VPC endpoint for the S3 service. A Gateway VPC endpoint is the correct choice because it allows EC2 instances in a private subnet to access S3 without traversing the public internet. It uses prefix lists and route table entries to direct S3 traffic through AWS's internal network, and it does not require a NAT gateway, internet gateway, or public IP addresses. Gateway endpoints are free of charge and scale automatically, making them ideal for private subnet access to S3 and DynamoDB.

Answer

Create an Interface VPC endpoint (powered by PrivateLink) for S3

Answer

Use a Transit Gateway to route to S3 over the internet

Answer

Place a NAT Gateway and restrict security group egress to port 443 to reduce exposure

Question 9

A marketing portal serves private PDF files stored in Amazon S3 through CloudFront. Users authenticate to the portal first, and each download link must expire after one hour. The S3 origin must never be directly reachable from the internet. Which three actions should be used? Select three.

Accepted Answer

Use CloudFront signed URLs or signed cookies with a one-hour expiration window.. CloudFront signed URLs or signed cookies allow you to restrict access to content for a specific time window. By setting the expiration to one hour, you ensure that each download link becomes invalid after that period, meeting the requirement for expiring links. This approach also keeps the S3 bucket private, as users must authenticate through CloudFront rather than accessing S3 directly.

Answer

Expose the S3 bucket through the static website endpoint and secure it with security group rules.

Answer

Use an AWS WAF web ACL attached to the S3 bucket instead of CloudFront.

Question 10

A SaaS vendor needs temporary access to an S3 bucket in your AWS account to read customer exports. The vendor will assume an IAM role you created. During integration testing, the vendor reports that their AssumeRole requests succeed, but your security team is concerned about the possibility of confused-deputy attacks. Which trust policy approach most directly mitigates this risk?

Accepted Answer

Add an sts:ExternalId condition to the role trust policy that must match the unique external ID you provide to the vendor.. The `sts:ExternalId` condition in the trust policy forces the vendor to include a unique external ID in their `AssumeRole` API call. This prevents a confused-deputy attack by ensuring that the role can only be assumed when the caller provides the exact external ID you have pre-shared, thereby verifying the intended purpose of the cross-account access.

Answer

Require the vendor to use the same MFA device serial number as your internal administrators in the trust policy.

Answer

Remove the role’s permissions policy and rely only on the S3 bucket policy to validate the caller.

Answer

Allow sts:AssumeRole from the vendor account root principal without restricting to the vendor’s specific IAM role.

Question 11

A security analyst needs to let an external vendor (AWS account 555566667777) read data from a set of internal resources in your AWS account. You created an IAM role called VendorReadRole with a policy that allows the required API calls. However, when the vendor tries to access, CloudTrail shows the call fails at AssumeRole with: "Not authorized to perform: sts:AssumeRole".

What is the most appropriate fix?

Accepted Answer

Add an allow statement for the vendor in the role’s trust policy to permit sts:AssumeRole from the vendor account (and include any required ExternalId condition).. The error 'Not authorized to perform: sts:AssumeRole' indicates that the role's trust policy does not grant the external AWS account (555566667777) permission to assume the role. The trust policy must include an Allow statement with the sts:AssumeRole action, specifying the external account as the principal, and optionally an ExternalId condition to prevent the confused deputy problem. Without this trust policy configuration, even if the permissions policy allows the required API calls, the vendor cannot assume the role.

Answer

Attach the same allow policy to the vendor account’s existing IAM user so the user can call sts:AssumeRole directly into your role.

Answer

Replace the AssumeRole call with GetCallerIdentity so the vendor can infer permissions without assuming the role.

Answer

Enable MFA on the vendor’s IAM user and require MFA for your role using condition keys in the permissions policy.

Question 12

An application runs on EC2 instances in private subnets in a VPC. There is no NAT gateway. The instances need to download objects from S3 over HTTPS and also call DynamoDB. The security group outbound rules allow TCP 443 to the VPC endpoint addresses. After deployment, the app times out when connecting to S3, but it can reach DynamoDB. Which single change is most likely to restore S3 connectivity?

Accepted Answer

Create a Gateway VPC endpoint for S3 and associate it with the private subnet route tables that contain the instances.. The application is in private subnets without a NAT Gateway, so it cannot reach the internet. A Gateway VPC Endpoint for S3 allows private subnet instances to access S3 over the AWS network without internet connectivity. The security group already allows TCP 443 to the VPC endpoint addresses, so the missing piece is the route table association that directs S3 traffic to the endpoint.

Answer

Replace the security group egress rule to allow all outbound traffic to 0.0.0.0/0 on TCP 443.

Answer

Add an Internet Gateway to the VPC and route the private subnet’s 0.0.0.0/0 to the IGW.

Answer

Switch from network ACLs to security groups by removing the existing NACL allow rules for ephemeral ports.

Question 13

Your company has an internal service hosted behind a Network Load Balancer (NLB) in VPC 10.0.0.0/16. A consumer team in a different VPC (10.1.0.0/16) must call the service without using the public internet. You want private connectivity using AWS PrivateLink. Which configuration best enables least-privilege access while keeping the traffic private?

Accepted Answer

Create a VPC endpoint (interface endpoint) in the consumer VPC that points to the service name published by the provider account, and limit allowed clients using the endpoint’s security group rules.. AWS PrivateLink uses an interface VPC endpoint in the consumer VPC to connect privately to a Network Load Balancer (NLB) in the provider VPC, without traversing the public internet. The endpoint’s security group acts as a least-privilege firewall, allowing only specific clients (by source IP or security group) to access the service. This keeps traffic within the AWS network and avoids exposing the NLB to the internet.

Answer

Expose the NLB with an Internet Gateway route and restrict access using a security group attached to the NLB.

Answer

Create an S3 Gateway endpoint in the consumer VPC and store the service hostname in SSM Parameter Store so clients can resolve privately.

Answer

Use a bastion host in the provider VPC and allow the consumer VPC to SSH to it; from there, the consumer makes HTTP calls to the NLB.

Question 14

An application in account A needs to use an encrypted EBS volume whose snapshots were copied from account B. The EBS volume is encrypted with a customer-managed KMS key in account B. After attaching the volume, the instance fails to mount it and logs show KMS access errors (kms:Decrypt) for the instance role. The instance role in account A already has an IAM policy allowing kms:Decrypt on that key ARN, but the mount still fails. What must be updated in account B to allow the mount to succeed?

Accepted Answer

Update the KMS key policy in account B to allow the instance role’s principal from account A to call kms:Decrypt and kms:CreateGrant.. The instance role in account A has an IAM policy allowing kms:Decrypt on the key ARN, but cross-account KMS access requires the key policy in account B to explicitly grant the external principal (the instance role's ARN) the necessary permissions. Without a key policy statement in account B that allows kms:Decrypt and kms:CreateGrant for the instance role, the KMS service will deny the decryption request, even if the IAM policy in account A permits it. The kms:CreateGrant permission is required because attaching an encrypted EBS volume internally creates a grant to allow the EC2 service to use the key on behalf of the instance.

Answer

Enable KMS automatic key rotation for the customer-managed key in account B.

Answer

Attach the key policy as an IAM permissions policy to the instance role in account A only; key policies are not evaluated cross-account.

Answer

Disable encryption on the EBS volume until authorization is fixed, then re-enable encryption after mount.

Question 15

Your CI system assumes an IAM role RoleForDeploy using STS AssumeRole and includes a session tag called Project=blue. The role’s permissions policy uses an ABAC condition like aws:PrincipalTag/Project to allow access only to resources tagged with the same project.

AssumeRole succeeds, but deployments fail with AccessDenied. CloudTrail shows the role was assumed, yet the effective session does not contain the Project tag.

Which change most directly fixes this issue?

Accepted Answer

Add permissions for sts:TagSession to the IAM role so the CI pipeline is allowed to pass the Project session tag during AssumeRole.. When using AWS Security Token Service (STS) AssumeRole with session tags, the calling entity must have explicit permission to pass those tags via the `sts:TagSession` action. Without this permission, the AssumeRole call succeeds but the session tags are silently dropped, causing the ABAC condition `aws:PrincipalTag/Project` to evaluate to false and deny access to resources. Adding `sts:TagSession` to the role's permissions policy allows the CI pipeline to include the `Project=blue` tag in the assumed role session.

Answer

Remove the ABAC condition using aws:PrincipalTag/Project so the policy ignores session tags.

Answer

Move the aws:PrincipalTag/Project condition into the trust policy so it applies during the AssumeRole call.

Answer

Add kms:Decrypt permission to the CI role because missing tags are typically caused by KMS authorization failures.