SAA-C03 Design Secure Architectures Practice Test 20 — 15 Questions

Question 1

A order processing API uses Amazon RDS for PostgreSQL. Application credentials must not be stored on the EC2 instances, and authentication should use short-lived credentials. What should the architect recommend?

Accepted Answer

IAM database authentication for RDS with an EC2 instance role. IAM database authentication for RDS allows EC2 instances to authenticate to PostgreSQL using a short-lived token generated via the AWS CLI or SDK, instead of a static password. By assigning an IAM instance role to the EC2 instance, the application can obtain the token without storing any credentials on the instance, meeting both security requirements. This approach uses the IAM role's temporary security credentials to generate a password token that is valid for 15 minutes, after which a new token must be obtained.

Answer

Store the database password in user data

Answer

Use a security group rule that allows only application instances

Answer

Embed the database password in the AMI

Question 2

A public API for a financial reporting platform is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used?

Accepted Answer

JWT authorizer configured for the OpenID Connect issuer. Option A is correct because the scenario requires standards-based token authentication from an external OpenID Connect (OIDC) provider. API Gateway's JWT authorizer can validate JSON Web Tokens (JWTs) directly against the OIDC issuer's well-known configuration (JWKS URI) without custom Lambda code, making it the simplest and most secure choice for token-based authentication.

Answer

IAM authorization for all internet users

Answer

API keys only

Answer

A VPC endpoint policy

Question 3

A company is encrypting sensitive S3 data for a healthcare document service with AWS KMS. Which two controls help prevent accidental use of the KMS key by unauthorized principals?

Accepted Answer

A key policy that limits key administrators and key users. Option B is correct because a key policy in AWS KMS explicitly defines which principals (users, roles, or AWS services) are allowed to use the key for cryptographic operations. By restricting key usage to specific key users, you prevent unauthorized principals—even those with broad IAM permissions—from accidentally invoking the key. This is a critical control for sensitive data like healthcare documents, where compliance requires strict access boundaries.

Answer

S3 Transfer Acceleration

Answer

A larger KMS key rotation period

Question 4

Developers for a B2B file exchange site need temporary elevated access to production resources for troubleshooting. The security team wants approvals, expiry, and audit logging. Which approach is best?

Accepted Answer

Use IAM Identity Center permission sets with time-bound access processes and CloudTrail auditing. IAM Identity Center (formerly AWS SSO) enables time-bound permission sets that grant temporary elevated access with automatic expiry, satisfying the security team's requirements for approvals and audit logging via AWS CloudTrail. This approach follows the principle of least privilege by providing just-in-time access rather than permanent permissions, and all actions are recorded in CloudTrail for compliance.

Answer

Attach AdministratorAccess permanently to every developer role

Answer

Create shared administrator access keys for the team

Answer

Disable CloudTrail during troubleshooting

Question 5

A mobile banking backend must ensure that only encrypted EBS volumes can be created in the account. What is the strongest preventive control?

Accepted Answer

Use an SCP that denies ec2:CreateVolume when the encrypted condition is false. Option D is correct because Service Control Policies (SCPs) are a preventive control that can deny the ec2:CreateVolume action when the encrypted condition is false. This ensures that only encrypted EBS volumes can be created, enforcing encryption at the point of request before any volume is provisioned. SCPs operate at the AWS Organizations level, making them the strongest preventive mechanism for account-wide enforcement.

Answer

Run a daily Lambda function to encrypt unencrypted volumes

Answer

Enable VPC Flow Logs

Answer

Tag encrypted volumes after creation

Question 6

A company hosts a customer analytics portal on EC2. Administrators must connect without opening SSH or RDP ports to the internet. What should the architect use?

Accepted Answer

AWS Systems Manager Session Manager with the required instance role. AWS Systems Manager Session Manager allows secure, auditable shell access to EC2 instances without opening inbound SSH (port 22) or RDP (port 3389) ports to the internet. It uses the AWS Systems Manager agent on the instance, which initiates an outbound connection to the AWS Systems Manager service over HTTPS (port 443), and the required IAM instance role grants permissions for this communication. This eliminates the need for a bastion host or public IP addresses, meeting the security requirement of no open inbound ports.

Answer

An internet gateway attached to the private subnet

Answer

A public Elastic IP address on each instance

Answer

A bastion host with SSH open to 0.0.0.0/0

Question 7

A IoT ingestion API stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured?

Accepted Answer

S3 Object Lock in compliance mode with an appropriate retention period. Option D is correct because S3 Object Lock with compliance mode provides a write-once-read-many (WORM) model that prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This meets the compliance requirement of a seven-year immutable audit log, as compliance mode enforces a legal hold that cannot be removed by any entity, including AWS support.

Answer

S3 lifecycle expiration after seven years

Answer

S3 versioning only

Answer

S3 server access logging

Question 8

A e-learning platform uses CloudFront in front of an S3 origin. Which two settings help keep users from bypassing CloudFront and accessing the bucket directly?

Accepted Answer

Configure Origin Access Control for the S3 origin. Origin Access Control (OAC) is the recommended way to restrict access to an S3 bucket so that it only accepts requests from a specific CloudFront distribution. By configuring OAC, CloudFront signs requests to S3 using a trusted identity, and the bucket policy denies any direct access that does not include that signature, effectively preventing users from bypassing CloudFront.

Answer

Enable CloudFront standard logging

Answer

Enable S3 static website hosting

Question 9

A solutions architect is designing an S3 bucket for a claims portal. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure? The design must avoid adding custom operational scripts.

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. Option A is correct because S3 Block Public Access provides a definitive override that prevents any public access to S3 objects, even if a bucket policy or ACL later grants public access. This setting can be applied at the account or bucket level and ensures that all access is denied to anonymous users, meeting the requirement without custom scripts.

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Answer

Enable server access logging on the bucket

Answer

Enable S3 Transfer Acceleration

Question 10

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use? The implementation must work across routine deployments without manual intervention.

Accepted Answer

Interface VPC endpoint for Systems Manager. Interface VPC endpoints (AWS PrivateLink) for Systems Manager allow private subnets to access Systems Manager Parameter Store without traversing the internet, using private IP addresses within the VPC. Gateway VPC endpoints for S3 provide a highly available, redundant path to S3 via route table entries, ensuring traffic stays within the AWS network. Together, they eliminate the need for internet gateways or NAT gateways, meeting the requirement for no public internet routing.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone

Question 11

A Lambda function for a order processing API needs to read a database password. The password must rotate automatically every 30 days and should not be stored in environment variables. Which service should be used? The design must avoid adding custom operational scripts.

Accepted Answer

AWS Secrets Manager with rotation enabled. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing and automatically rotating database credentials. It natively supports rotation every 30 days via a built-in Lambda rotation function, without requiring any custom operational scripts. This meets the requirement to avoid storing the password in environment variables and to automate rotation.

Answer

An encrypted object in Amazon S3

Answer

AWS Systems Manager Parameter Store SecureString without automation

Answer

A KMS-encrypted Lambda environment variable

Question 12

An EC2 instance in a private subnet must access an S3 bucket that contains regulated exports for a financial reporting platform. The security team requires access to be allowed only when traffic comes through a specific VPC endpoint. What should the architect add to the bucket policy? The design must avoid adding custom operational scripts.

Accepted Answer

A condition that matches aws:sourceVpce to the endpoint ID. Option D is correct because the bucket policy can use the `aws:sourceVpce` condition key to restrict access to requests originating from a specific VPC endpoint. This ensures that only traffic routed through that endpoint can access the S3 bucket, meeting the security team's requirement without custom scripts.

Answer

A security group rule that allows HTTPS to S3

Answer

A condition that matches aws:RequestedRegion to the bucket Region

Answer

A deny statement for all IAM users except the EC2 role

Question 13

A web application for a healthcare document service is behind an Application Load Balancer. The application must be protected from common SQL injection and cross-site scripting attacks with minimum operational overhead. What should the architect deploy? The design must avoid adding custom operational scripts.

Accepted Answer

AWS WAF associated with the Application Load Balancer. AWS WAF is a web application firewall that integrates directly with an Application Load Balancer to filter and monitor HTTP/HTTPS requests. It provides managed rules specifically designed to block common attack patterns like SQL injection and cross-site scripting (XSS) without requiring custom scripts or manual rule maintenance, thus meeting the requirement for minimum operational overhead.

Answer

Security groups on the application instances

Answer

Network ACLs on the public subnets

Answer

AWS Shield Advanced only

Question 14

A partner company needs read-only access to reports in an S3 bucket for a B2B file exchange site. The partner has its own AWS account. What is the most secure scalable access pattern? The design must avoid adding custom operational scripts.

Accepted Answer

Create a bucket policy that grants the partner role least-privilege access to the required prefix. Option C is correct because it uses a bucket policy with a principal ARN for the partner's AWS account, granting read-only access to a specific prefix. This is secure (no public exposure), scalable (no per-user credentials to manage), and avoids custom scripts by leveraging native AWS IAM and S3 policy evaluation. The partner can use their own IAM roles to access the bucket without sharing long-term access keys.

Answer

Make the objects public and rely on difficult-to-guess object names

Answer

Create an IAM user in the company account and share the access keys

Answer

Copy the objects to a public website bucket

Question 15

A mobile banking backend uses Amazon RDS for PostgreSQL. Application credentials must not be stored on the EC2 instances, and authentication should use short-lived credentials. What should the architect recommend? The design must avoid adding custom operational scripts.

Accepted Answer

IAM database authentication for RDS with an EC2 instance role. IAM database authentication for RDS allows EC2 instances to authenticate to PostgreSQL using a short-lived token generated via the IAM instance profile, eliminating the need to store credentials on the instance. The token is obtained by calling the RDS generate_db_auth_token API with the instance's IAM role, and it is valid for 15 minutes by default. This approach satisfies the requirement for short-lived credentials and avoids custom operational scripts.

Answer

Store the database password in user data

Answer

Use a security group rule that allows only application instances

Answer

Embed the database password in the AMI