SAA-C03 Design Secure Architectures Practice Test 20 — 15 Questions

Question 1

Based on the exhibit, a company stores sensitive PDFs in S3 and serves them through CloudFront. Direct requests to the S3 object URL must fail, but CloudFront should still be able to fetch the files securely. Which solution best satisfies the requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure CloudFront Origin Access Control for the S3 origin and update the bucket policy to allow only that distribution.. CloudFront Origin Access Control (OAC) allows CloudFront to authenticate requests to an S3 origin using a specific identity, and the bucket policy can be configured to grant access only to that CloudFront distribution. This ensures that direct S3 object URL requests fail (since they lack the CloudFront signature), while CloudFront can still fetch the files securely using the OAC mechanism.

Answer

Leave the bucket public but require CloudFront signed cookies for all users.

Answer

Use an S3 access point and give it a public policy so CloudFront can reach the objects.

Answer

Use S3 object ACLs to grant read access only to users behind CloudFront.

Question 2

Based on the exhibit, the security team wants centralized detection and alerting for both successful and failed attempts to change S3 bucket policies and KMS key policies across multiple accounts. Which approach best meets the requirement?

Accepted Answer

Create an organization CloudTrail trail for management events and add EventBridge rules in the security account to alert on PutBucketPolicy and PutKeyPolicy events, including failed calls.. An organization CloudTrail trail captures management events (including PutBucketPolicy and PutKeyPolicy) across all accounts in the organization, and EventBridge rules in the security account can filter for both successful and failed API calls (using the `errorCode` field) to trigger centralized alerts. This provides the required centralized detection and alerting for policy changes across multiple accounts.

Answer

Enable S3 server access logging on each bucket and archive the logs in the security account.

Answer

Use AWS Config rules only, because Config records every successful and failed API call automatically.

Answer

Enable GuardDuty in every account and use its findings as the main source for policy change notifications.

Question 3

Based on the exhibit, a public API is behind CloudFront. A single client IP is sending bursts of requests that are overwhelming the origin, and the team wants AWS to automatically mitigate the abuse at the edge without changing the application code. What should the team do?

Accepted Answer

Associate an AWS WAF web ACL with CloudFront and add a rate-based rule for the offending IP behavior.. AWS WAF rate-based rules automatically block or rate-limit requests from a client IP when the request rate exceeds a threshold you define. By associating the web ACL with CloudFront, the rule is enforced at the edge before traffic reaches the origin, mitigating abuse without modifying application code.

Answer

Increase the ALB idle timeout to allow the origin to absorb more concurrent requests.

Answer

Add an Amazon Route 53 health check to fail over traffic to another DNS name.

Answer

Enable AWS Shield Advanced and rely on automatic DDoS protection for all request bursts.

Question 4

Based on the exhibit, a central deployment role in Account A is assumed by several CI/CD pipelines from Account B. The role must remain reusable, but the team wants the TeamA pipeline to upload artifacts only to s3://artifact-bucket/teamA/prod/ without creating a separate IAM role. What is the best approach?

Accepted Answer

Pass an STS session policy when TeamA assumes the role to further restrict the temporary credentials to the teamA/prod prefix.. When the TeamA pipeline assumes the central IAM role in Account A, it can pass an STS session policy that further restricts the temporary credentials to only allow actions on the s3://artifact-bucket/teamA/prod/ prefix. This approach keeps the role reusable for other pipelines while enforcing a narrower permission scope at the session level, without requiring a separate IAM role.

Answer

Use an IAM user in Account B and hard-code the narrower S3 path in its access key policy.

Answer

Add a bucket ACL that grants write access only to the TeamA pipeline session name.

Answer

Attach a permissions boundary to the central role so every pipeline session inherits the narrower prefix automatically.

Question 5

Company A must allow workloads in Company B to assume an IAM role in Company A (RoleInA). To mitigate confused-deputy attacks, a Security requirement is to use an External ID. Company A should restrict who can assume RoleInA. Which trust-policy configuration is the best choice?

Accepted Answer

In Company A role trust policy, allow sts:AssumeRole only for principal "arn:aws:iam:::role/" and require a condition where sts:ExternalId equals the expected External ID value.. It restricts the trust policy to a specific IAM role in Company B (using the principal ARN) and requires the `sts:ExternalId` condition to match a predefined value. This ensures only the intended role in Company B can assume RoleInA, and the External ID prevents a confused-deputy attack by requiring the third party to provide a unique identifier that only the legitimate service knows.

Answer

In Company A role trust policy, allow sts:AssumeRole for principal "arn:aws:iam::<company-b-account-id>:root" with no sts:ExternalId condition.

Answer

In the trust policy, allow iam:PassRole for the Company B principal and include an sts:ExternalId condition.

Answer

In Company A, grant Company B access using an IAM permissions policy attached to RoleInA instead of using a trust policy.

Question 6

You have EC2 instances in private subnets with no NAT gateway. They must retrieve secrets from AWS Secrets Manager without sending traffic to the public internet. Which VPC endpoint type is the correct choice for connecting to AWS Secrets Manager?

Accepted Answer

Create an Interface VPC endpoint (AWS PrivateLink) for Secrets Manager and associate security groups for the endpoint.. AWS Secrets Manager is accessed via an API endpoint that uses HTTPS. Interface VPC endpoints (AWS PrivateLink) are the correct choice for connecting to services like Secrets Manager because they use elastic network interfaces (ENIs) with private IPs in your VPC, allowing traffic to stay within the AWS network. Gateway endpoints only support S3 and DynamoDB, not Secrets Manager.

Answer

Create a Gateway VPC endpoint for Secrets Manager.

Answer

Use a Transit Gateway attachment to route traffic to the public internet for Secrets Manager.

Answer

Deploy a NAT gateway and allow outbound HTTPS traffic to Secrets Manager.

Question 7

An internal web application is exposed through an Application Load Balancer (ALB). The ALB currently has only an HTTP listener on port 80. Security requires that all client traffic be encrypted in transit. What is the best next step?

Accepted Answer

Configure an ALB HTTPS listener on port 443 using an ACM certificate, and redirect HTTP (80) to HTTPS (443).. The requirement to encrypt all client traffic in transit is met by adding an HTTPS listener on port 443 using an ACM certificate, which enables TLS encryption. Additionally, configuring a redirect from HTTP (port 80) to HTTPS (port 443) ensures that any client attempting to connect over unencrypted HTTP is automatically upgraded to HTTPS, enforcing encryption for all traffic.

Answer

Enable S3 bucket encryption for application files, since it ensures encryption in transit.

Answer

Turn on default encryption for CloudFront origin access, which automatically encrypts all ALB traffic.

Answer

Add KMS permissions to the ALB role so TLS is enabled automatically.

Question 8

A company serves a public API through a CloudFront distribution. They want to automatically block common web exploits (for example, OWASP Top 10–style threats) without building custom detection logic. Which AWS service configuration best meets the goal?

Accepted Answer

Enable AWS WAF with AWS Managed Rules and associate the web ACL with the CloudFront distribution.. AWS WAF with AWS Managed Rules provides pre-configured rule sets specifically designed to block common web exploits, including OWASP Top 10 threats, without requiring custom detection logic. By associating the web ACL with a CloudFront distribution, the filtering occurs at the edge, protecting the origin from malicious traffic before it reaches the application.

Answer

Enable AWS Shield Advanced only; it fully replaces the need for WAF rule evaluation.

Answer

Attach a security group rule to the ALB to block malicious patterns based on HTTP request bodies.

Answer

Use Security Hub to block requests automatically when it detects suspicious activity.

Question 9

An application in Account B reads objects from an Amazon S3 bucket in Account A. The bucket uses SSE-KMS with a customer managed key in Account A. The role in Account B already has s3:GetObject, but downloads fail with AccessDenied on decrypt. Which two changes are required for the role to read the object successfully? Select two.

Accepted Answer

Add kms:Decrypt permission in the role's IAM policy for the KMS key.. The role in Account B needs explicit kms:Decrypt permission in its IAM policy to use the KMS key for decrypting the S3 objects. Option C is correct because the KMS key policy in Account A must grant the role from Account B permission to call kms:Decrypt, as the key is customer managed and cross-account access requires both the key policy and the IAM policy to allow the action.

Answer

Add an SCP that grants the role additional permissions for KMS usage.

Answer

Grant the role read access with an S3 bucket ACL.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 10

A SaaS vendor’s automation account in Account B needs to assume a role in a customer account in Account A to read a specific S3 bucket and publish a deployment status file. The customer is worried about confused deputy attacks because multiple customers use the same vendor software. Which trust-policy design best meets the requirement?

Accepted Answer

Allow only the vendor’s specific IAM principal to assume the role and require a unique sts:ExternalId condition.. The `sts:ExternalId` condition is specifically designed to prevent the confused deputy problem in cross-account role assumptions. By requiring a unique external ID that only the customer knows, the customer ensures that the vendor's automation can only assume the role when acting on behalf of that specific customer, even if multiple customers use the same vendor software.

Answer

Allow the Account B root principal to assume the role if the caller knows the role ARN.

Answer

Attach a permissions boundary to the role so that the vendor cannot exceed the approved permissions.

Answer

Require MFA for the role assumption because it ensures only the vendor’s production automation can use the role.

Question 11

A platform team lets application teams create IAM roles in member accounts through Infrastructure as Code. Security says every new role must stay within a centrally approved permission ceiling, even if someone later attaches broader managed policies or inline policies. Which control should be used to enforce that maximum permission set?

Accepted Answer

Attach a permissions boundary to each role so the role can never exceed the approved ceiling.. A permissions boundary is an AWS IAM feature that sets the maximum permissions an IAM role can have. When attached to a role, any policy that grants permissions beyond the boundary is effectively ignored, ensuring the role cannot exceed the approved permission ceiling even if broader managed or inline policies are later attached. This directly enforces the security requirement without restricting the application teams' ability to create roles via Infrastructure as Code.

Answer

Use an AWS Organizations service control policy to grant the role all needed permissions directly.

Answer

Use a resource-based policy on Amazon S3 to restrict the permissions that IAM roles can receive.

Answer

Require temporary STS session policies whenever the role is assumed.

Question 12

A solutions architect is designing an S3 bucket for a claims portal. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure?

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. S3 Block Public Access provides a definitive override that prevents any public access to objects, regardless of bucket policies or object ACLs. By enabling this setting at the account or bucket level, the architect ensures that even if a developer later adds an overly broad bucket policy, the S3 service will block all public access. This is the only option that directly and permanently prevents public exposure.

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Answer

Enable server access logging on the bucket

Answer

Enable S3 Transfer Acceleration

Question 13

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use?

Accepted Answer

Interface VPC endpoint for Systems Manager. Interface VPC endpoints (AWS PrivateLink) enable private connectivity to Systems Manager Parameter Store by creating an elastic network interface in the subnet with a private IP, allowing the application to read parameters without traversing the internet. Gateway VPC endpoints for S3 provide private access to S3 objects via route table entries, using the S3 public IP space but staying within the AWS network, avoiding the need for an internet gateway or NAT gateway.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone

Question 14

A Lambda function for a order processing API needs to read a database password. The password must rotate automatically every 30 days and should not be stored in environment variables. Which service should be used?

Accepted Answer

AWS Secrets Manager with rotation enabled. AWS Secrets Manager is designed to securely store, retrieve, and automatically rotate database credentials on a schedule. It natively supports rotation every 30 days via a built-in Lambda rotation function, and it avoids storing the password in environment variables, meeting both security and compliance requirements.

Answer

An encrypted object in Amazon S3

Answer

AWS Systems Manager Parameter Store SecureString without automation

Answer

A KMS-encrypted Lambda environment variable

Question 15

An EC2 instance in a private subnet must access an S3 bucket that contains regulated exports for a financial reporting platform. The security team requires access to be allowed only when traffic comes through a specific VPC endpoint. What should the architect add to the bucket policy?

Accepted Answer

A condition that matches aws:sourceVpce to the endpoint ID. The bucket policy can use the `aws:sourceVpce` condition key to restrict access to requests that originate from a specific VPC endpoint (a Gateway VPC Endpoint for S3). This ensures that only traffic flowing through that endpoint can access the bucket, meeting the security team's requirement. The EC2 instance in the private subnet routes S3 traffic through the endpoint via the subnet's route table, and the bucket policy enforces the restriction at the resource level.

Answer

A security group rule that allows HTTPS to S3

Answer

A condition that matches aws:RequestedRegion to the bucket Region

Answer

A deny statement for all IAM users except the EC2 role