SAA-C03 Design Secure Architectures Practice Test 22 — 15 Questions

Question 1

Based on the exhibit, a public API is behind CloudFront. A single client IP is sending bursts of requests that are overwhelming the origin, and the team wants AWS to automatically mitigate the abuse at the edge without changing the application code. What should the team do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Associate an AWS WAF web ACL with CloudFront and add a rate-based rule for the offending IP behavior.. AWS WAF rate-based rules automatically block or rate-limit requests from a client IP when the request rate exceeds a threshold you define. By associating the web ACL with CloudFront, the rule is enforced at the edge before traffic reaches the origin, mitigating abuse without modifying application code.

Answer

Increase the ALB idle timeout to allow the origin to absorb more concurrent requests.

Answer

Add an Amazon Route 53 health check to fail over traffic to another DNS name.

Answer

Enable AWS Shield Advanced and rely on automatic DDoS protection for all request bursts.

Question 2

A platform team lets application teams create IAM roles in member accounts through Infrastructure as Code. Security says every new role must stay within a centrally approved permission ceiling, even if someone later attaches broader managed policies or inline policies. Which control should be used to enforce that maximum permission set?

Accepted Answer

Attach a permissions boundary to each role so the role can never exceed the approved ceiling.. A permissions boundary is an AWS IAM feature that sets the maximum permissions an IAM role can have. When attached to a role, any policy that grants permissions beyond the boundary is effectively ignored, ensuring the role cannot exceed the approved permission ceiling even if broader managed or inline policies are later attached. This directly enforces the security requirement without restricting the application teams' ability to create roles via Infrastructure as Code.

Answer

Use an AWS Organizations service control policy to grant the role all needed permissions directly.

Answer

Use a resource-based policy on Amazon S3 to restrict the permissions that IAM roles can receive.

Answer

Require temporary STS session policies whenever the role is assumed.

Question 3

A public API for a customer analytics portal is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used?

Accepted Answer

JWT authorizer configured for the OpenID Connect issuer. The scenario requires standards-based token authentication from an external OpenID Connect (OIDC) provider. API Gateway's JWT authorizer natively validates JSON Web Tokens (JWTs) issued by OIDC providers by verifying the token's signature against the provider's JWKS endpoint, checking the `iss` and `aud` claims, and enforcing token expiration. This directly meets the requirement without needing custom Lambda authorizers or additional infrastructure.

Answer

API keys only

Answer

IAM authorization for all internet users

Answer

A VPC endpoint policy

Question 4

Developers for a e-learning platform need temporary elevated access to production resources for troubleshooting. The security team wants approvals, expiry, and audit logging. Which approach is best?

Accepted Answer

Use IAM Identity Center permission sets with time-bound access processes and CloudTrail auditing. IAM Identity Center permission sets allow you to define fine-grained permissions and assign them to users or groups with time-bound access (e.g., using a session duration or approval workflow). Combined with CloudTrail, every API call made during the elevated session is logged for audit, meeting the security team's requirements for approvals, expiry, and audit logging.

Answer

Disable CloudTrail during troubleshooting

Answer

Attach AdministratorAccess permanently to every developer role

Answer

Create shared administrator access keys for the team

Question 5

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use? The design must avoid adding custom operational scripts.

Accepted Answer

Interface VPC endpoint for Systems Manager. An Interface VPC endpoint for Systems Manager (SSM) allows private subnets to communicate with AWS Systems Manager Parameter Store over the AWS network using private IP addresses, without traversing the internet. This endpoint uses AWS PrivateLink, enabling secure and private access to SSM APIs, which is required for reading parameters from Parameter Store.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone

Question 6

A claims portal uses Amazon RDS for PostgreSQL. Application credentials must not be stored on the EC2 instances, and authentication should use short-lived credentials. What should the architect recommend?

Accepted Answer

IAM database authentication for RDS with an EC2 instance role. IAM database authentication for RDS with an EC2 instance role allows the application to obtain a short-lived authentication token (valid for 15 minutes) using the AWS CLI or SDK, without storing any credentials on the instance. The EC2 instance role provides the necessary permissions to generate the token, which is then used instead of a static password, meeting both security requirements.

Answer

Store the database password in user data

Answer

Embed the database password in the AMI

Answer

Use a security group rule that allows only application instances

Question 7

A image sharing application uses CloudFront in front of an S3 origin. Which two settings help keep users from bypassing CloudFront and accessing the bucket directly?

Accepted Answer

Configure Origin Access Control for the S3 origin. Origin Access Control (OAC) is a CloudFront feature that restricts access to an S3 origin by requiring that all requests include a specific signature that only CloudFront can generate. When you configure OAC, CloudFront signs requests to S3 using its own credentials, and the S3 bucket policy is updated to allow access only to the CloudFront distribution's canonical user ID. This ensures that direct requests to the S3 bucket URL are denied, preventing users from bypassing CloudFront.

Answer

Enable CloudFront standard logging

Answer

Enable S3 static website hosting

Question 8

A solutions architect is designing an S3 bucket for a order processing API. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure?

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. S3 Block Public Access provides a definitive override that prevents any public access to objects, regardless of bucket policies or ACLs. By enabling this setting at the account or bucket level, the architect ensures that even if a developer later adds an overly broad bucket policy, the objects remain inaccessible to anonymous users. This is the only option that guarantees no public access can be inadvertently granted.

Answer

Enable server access logging on the bucket

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Answer

Enable S3 Transfer Acceleration

Question 9

A partner company needs read-only access to reports in an S3 bucket for a customer analytics portal. The partner has its own AWS account. What is the most secure scalable access pattern?

Accepted Answer

Create a bucket policy that grants the partner role least-privilege access to the required prefix. A bucket policy that grants the partner's IAM role (from the partner's AWS account) least-privilege access to a specific prefix is the most secure and scalable pattern. This uses cross-account IAM roles, avoiding long-term credentials and allowing the partner to manage their own users and permissions. The bucket policy explicitly trusts the partner's AWS account, and the partner assumes the role to access only the required objects, following the principle of least privilege.

Answer

Make the objects public and rely on difficult-to-guess object names

Answer

Copy the objects to a public website bucket

Answer

Create an IAM user in the company account and share the access keys

Question 10

A company is encrypting sensitive S3 data for a claims portal with AWS KMS. Which two controls help prevent accidental use of the KMS key by unauthorized principals?

Accepted Answer

IAM policies that grant kms:Decrypt only to required application roles. IAM policies can be used to restrict the `kms:Decrypt` action to only the specific IAM roles that require it for the claims portal. This ensures that even if an unauthorized principal has access to the encrypted S3 object, they cannot decrypt it without the explicit IAM permission to use the KMS key. Option C is correct because a key policy that explicitly defines key administrators and key users limits who can manage or use the KMS key, preventing accidental use by unauthorized principals.

Answer

A larger KMS key rotation period

Answer

S3 Transfer Acceleration

Question 11

A order processing API must ensure that only encrypted EBS volumes can be created in the account. What is the strongest preventive control?

Accepted Answer

Use an SCP that denies ec2:CreateVolume when the encrypted condition is false. Service Control Policies (SCPs) are a preventive control that can deny the ec2:CreateVolume API call when the encryption condition (ec2:Encrypted) is false. This ensures that no unencrypted EBS volumes can be created at the account level, regardless of IAM permissions. SCPs operate at the AWS Organizations root, OU, or account level and are evaluated before any IAM policies, making them the strongest preventive mechanism.

Answer

Run a daily Lambda function to encrypt unencrypted volumes

Answer

Enable VPC Flow Logs

Answer

Tag encrypted volumes after creation

Question 12

A healthcare document service stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured?

Accepted Answer

S3 Object Lock in compliance mode with an appropriate retention period. S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This meets the compliance requirement of immutable audit logs for seven years, as compliance mode enforces a strict write-once-read-many (WORM) model that cannot be bypassed.

Answer

S3 server access logging

Answer

S3 lifecycle expiration after seven years

Answer

S3 versioning only

Question 13

Developers for a B2B file exchange site need temporary elevated access to production resources for troubleshooting. The security team wants approvals, expiry, and audit logging. Which approach is best?

Accepted Answer

Use IAM Identity Center permission sets with time-bound access processes and CloudTrail auditing. IAM Identity Center (formerly AWS SSO) enables time-bound permission sets that grant temporary elevated access with automatic expiry, satisfying the security team's requirements for approvals and audit logging via AWS CloudTrail. This approach follows the principle of least privilege by providing just-in-time access rather than permanent permissions, and all actions are recorded in CloudTrail for compliance.

Answer

Attach AdministratorAccess permanently to every developer role

Answer

Create shared administrator access keys for the team

Answer

Disable CloudTrail during troubleshooting

Question 14

A solutions architect is designing an S3 bucket for a claims portal. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure? The design must avoid adding custom operational scripts.

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. S3 Block Public Access provides a definitive override that prevents any public access to S3 objects, even if a bucket policy or ACL later grants public access. This setting can be applied at the account or bucket level and ensures that all access is denied to anonymous users, meeting the requirement without custom scripts.

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Answer

Enable server access logging on the bucket

Answer

Enable S3 Transfer Acceleration

Question 15

A web application for a healthcare document service is behind an Application Load Balancer. The application must be protected from common SQL injection and cross-site scripting attacks with minimum operational overhead. What should the architect deploy? The design must avoid adding custom operational scripts.

Accepted Answer

AWS WAF associated with the Application Load Balancer. AWS WAF is a web application firewall that integrates directly with an Application Load Balancer to filter and monitor HTTP/HTTPS requests. It provides managed rules specifically designed to block common attack patterns like SQL injection and cross-site scripting (XSS) without requiring custom scripts or manual rule maintenance, thus meeting the requirement for minimum operational overhead.

Answer

Security groups on the application instances

Answer

Network ACLs on the public subnets

Answer

AWS Shield Advanced only