SAA-C03 Design Secure Architectures Practice Test 21 — 15 Questions

Question 1

A public API for a customer analytics portal is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used? The design must avoid adding custom operational scripts.

Accepted Answer

JWT authorizer configured for the OpenID Connect issuer. Option B is correct because a JWT authorizer in API Gateway can validate tokens issued by an external OpenID Connect (OIDC) provider without requiring custom code. The JWT authorizer automatically verifies the token's signature, expiry, and issuer against the OIDC provider's JWKS endpoint, meeting the requirement for standards-based authentication and avoiding custom operational scripts.

Answer

API keys only

Answer

IAM authorization for all internet users

Answer

A VPC endpoint policy

Question 2

A company is encrypting sensitive S3 data for a IoT ingestion API with AWS KMS. Which two controls help prevent accidental use of the KMS key by unauthorized principals? The design must avoid adding custom operational scripts.

Accepted Answer

IAM policies that grant kms:Decrypt only to required application roles. Option A is correct because IAM policies can explicitly grant kms:Decrypt only to specific application roles, ensuring that only authorized principals (e.g., the IoT ingestion service role) can use the KMS key for decryption. This prevents unauthorized principals from accidentally or maliciously decrypting S3 objects, as the policy restricts the action to required roles without needing custom scripts.

Answer

S3 Transfer Acceleration

Answer

A larger KMS key rotation period

Question 3

Developers for a e-learning platform need temporary elevated access to production resources for troubleshooting. The security team wants approvals, expiry, and audit logging. Which approach is best? The design must avoid adding custom operational scripts.

Accepted Answer

Use IAM Identity Center permission sets with time-bound access processes and CloudTrail auditing. IAM Identity Center permission sets allow administrators to define time-bound access policies that grant temporary elevated permissions to specific users or roles. When combined with AWS CloudTrail, every API call made during the troubleshooting session is logged, providing full auditability. This approach meets the security team's requirements for approvals (via the permission set assignment process), expiry (via session duration settings), and audit logging without requiring custom scripts.

Answer

Disable CloudTrail during troubleshooting

Answer

Attach AdministratorAccess permanently to every developer role

Answer

Create shared administrator access keys for the team

Question 4

A claims portal must ensure that only encrypted EBS volumes can be created in the account. What is the strongest preventive control? The design must avoid adding custom operational scripts.

Accepted Answer

Use an SCP that denies ec2:CreateVolume when the encrypted condition is false. Option C is correct because an SCP (Service Control Policy) at the AWS Organizations level can deny the ec2:CreateVolume API call when the encryption condition (aws:RequestTag/Encrypted or ec2:Encrypted) is false. This is a preventive control that blocks the creation of unencrypted volumes before they exist, and it requires no custom operational scripts, aligning with the design constraint.

Answer

Tag encrypted volumes after creation

Answer

Enable VPC Flow Logs

Answer

Run a daily Lambda function to encrypt unencrypted volumes

Question 5

A company hosts a image sharing application on EC2. Administrators must connect without opening SSH or RDP ports to the internet. What should the architect use? The design must avoid adding custom operational scripts.

Accepted Answer

AWS Systems Manager Session Manager with the required instance role. AWS Systems Manager Session Manager allows secure shell access to EC2 instances without opening inbound ports (SSH 22 or RDP 3389) to the internet. It uses the AWS Systems Manager agent and an IAM instance role to establish a bidirectional connection via the AWS API, eliminating the need for a bastion host or public IP. This meets the requirement of avoiding custom operational scripts because Session Manager is a fully managed service with no additional configuration beyond the agent and role.

Answer

An internet gateway attached to the private subnet

Answer

A public Elastic IP address on each instance

Answer

A bastion host with SSH open to 0.0.0.0/0

Question 6

A order processing API stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured? The design must avoid adding custom operational scripts.

Accepted Answer

S3 Object Lock in compliance mode with an appropriate retention period. S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This meets the compliance requirement of a seven-year immutable audit log without custom scripts. Compliance mode enforces a legal hold that cannot be removed by any user, ensuring logs remain intact.

Answer

S3 server access logging

Answer

S3 lifecycle expiration after seven years

Answer

S3 versioning only

Question 7

A financial reporting platform uses CloudFront in front of an S3 origin. Which two settings help keep users from bypassing CloudFront and accessing the bucket directly? The design must avoid adding custom operational scripts.

Accepted Answer

Use an S3 bucket policy that allows access only from the CloudFront distribution. Option A is correct because an S3 bucket policy that explicitly denies access to any principal except the CloudFront distribution's origin access identity (OAI) or origin access control (OAC) ensures that direct requests to the S3 bucket endpoint are rejected. This policy leverages the aws:SourceArn or aws:SourceIp condition key to restrict access solely to CloudFront, preventing users from bypassing the CDN and hitting the bucket directly.

Answer

Enable CloudFront standard logging

Answer

Enable S3 static website hosting

Question 8

A solutions architect is designing an S3 bucket for a healthcare document service. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure? The design must avoid adding custom operational scripts.

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. S3 Block Public Access provides a definitive override that prevents any public access to S3 objects, regardless of bucket policies or ACLs. By enabling this setting at the account or bucket level, the architect ensures that even if a developer later attaches an overly permissive bucket policy, the objects remain inaccessible to anonymous users. This meets the requirement without requiring custom operational scripts.

Answer

Enable server access logging on the bucket

Answer

Enable S3 Transfer Acceleration

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Question 9

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use? The security team requires the decision to be auditable.

Accepted Answer

Interface VPC endpoint for Systems Manager. Interface VPC endpoints (AWS PrivateLink) allow private subnets to access Systems Manager Parameter Store without traversing the internet, using private IP addresses within the VPC. This meets the requirement for private, auditable access because all traffic stays within the AWS network and can be logged via VPC Flow Logs.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone

Question 10

A Lambda function for a mobile banking backend needs to read a database password. The password must rotate automatically every 30 days and should not be stored in environment variables. Which service should be used? The design must avoid adding custom operational scripts.

Accepted Answer

AWS Secrets Manager with rotation enabled. AWS Secrets Manager is the correct choice because it natively supports automatic rotation of secrets on a configurable schedule (e.g., every 30 days) without requiring custom scripts. It also provides fine-grained access control and integrates directly with Lambda via the AWS SDK, keeping the password out of environment variables and code.

Answer

An encrypted object in Amazon S3

Answer

AWS Systems Manager Parameter Store SecureString without automation

Answer

A KMS-encrypted Lambda environment variable

Question 11

An EC2 instance in a private subnet must access an S3 bucket that contains regulated exports for a customer analytics portal. The security team requires access to be allowed only when traffic comes through a specific VPC endpoint. What should the architect add to the bucket policy? The design must avoid adding custom operational scripts.

Accepted Answer

A condition that matches aws:sourceVpce to the endpoint ID. Option D is correct because the bucket policy can use the `aws:sourceVpce` condition key to restrict access exclusively to traffic originating from a specific VPC endpoint ID. This ensures that only requests sent through that VPC endpoint are allowed, meeting the security team's requirement without requiring custom scripts or additional infrastructure.

Answer

A security group rule that allows HTTPS to S3

Answer

A condition that matches aws:RequestedRegion to the bucket Region

Answer

A deny statement for all IAM users except the EC2 role

Question 12

A web application for a IoT ingestion API is behind an Application Load Balancer. The application must be protected from common SQL injection and cross-site scripting attacks with minimum operational overhead. What should the architect deploy? The design must avoid adding custom operational scripts.

Accepted Answer

AWS WAF associated with the Application Load Balancer. AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). By associating an AWS WAF web ACL with the Application Load Balancer, you can filter and monitor HTTP(S) requests based on rules that match malicious patterns, with no custom scripts or operational overhead. This is the most efficient and managed solution for the stated requirements.

Answer

Network ACLs on the public subnets

Answer

Security groups on the application instances

Answer

AWS Shield Advanced only

Question 13

A partner company needs read-only access to reports in an S3 bucket for a e-learning platform. The partner has its own AWS account. What is the most secure scalable access pattern? The design must avoid adding custom operational scripts.

Accepted Answer

Create a bucket policy that grants the partner role least-privilege access to the required prefix. Option C is correct because it uses a resource-based bucket policy that grants the partner's IAM role cross-account read-only access to a specific prefix, adhering to the principle of least privilege. This approach is secure (no public exposure), scalable (no manual key rotation), and requires no custom scripts, as AWS handles the cross-account trust automatically via the bucket policy's Principal element referencing the partner's AWS account ID.

Answer

Copy the objects to a public website bucket

Answer

Create an IAM user in the company account and share the access keys

Answer

Make the objects public and rely on difficult-to-guess object names

Question 14

A claims portal uses Amazon RDS for PostgreSQL. Application credentials must not be stored on the EC2 instances, and authentication should use short-lived credentials. What should the architect recommend? The design must avoid adding custom operational scripts.

Accepted Answer

IAM database authentication for RDS with an EC2 instance role. Option C is correct because IAM database authentication for RDS PostgreSQL allows EC2 instances to authenticate using short-lived credentials (tokens) obtained via the IAM instance profile role, eliminating the need to store long-term credentials on the instance. The EC2 instance assumes an IAM role, which grants permission to generate an authentication token (valid for 15 minutes) using the AWS CLI or SDK, and that token is used as the password for the database connection. This approach satisfies the requirements of no stored credentials, short-lived authentication, and no custom operational scripts.

Answer

Store the database password in user data

Answer

Embed the database password in the AMI

Answer

Use a security group rule that allows only application instances

Question 15

A public API for a image sharing application is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used? The design must avoid adding custom operational scripts.

Accepted Answer

JWT authorizer configured for the OpenID Connect issuer. C is correct because the scenario requires standards-based token authentication from an external OpenID Connect (OIDC) provider, and API Gateway's JWT authorizer natively validates JWTs issued by OIDC providers without requiring custom code. This authorizer verifies the token's signature, expiry, and issuer against the OIDC discovery endpoint, meeting the requirement to avoid custom operational scripts.

Answer

A VPC endpoint policy

Answer

API keys only

Answer

IAM authorization for all internet users