SAA-C03 Design Secure Architectures Practice Test 22 — 15 Questions

Question 1

A company is encrypting sensitive S3 data for a order processing API with AWS KMS. Which two controls help prevent accidental use of the KMS key by unauthorized principals? The design must avoid adding custom operational scripts.

Accepted Answer

A key policy that limits key administrators and key users. Option B is correct because a KMS key policy explicitly defines which principals (IAM users, roles, or AWS accounts) are allowed to administer or use the key. By restricting key users to only the required application roles, you prevent unauthorized principals from accidentally invoking KMS operations on the key, even if they have broad IAM permissions. This is a fundamental access control that does not require custom scripts.

Answer

A larger KMS key rotation period

Answer

S3 Transfer Acceleration

Question 2

Developers for a financial reporting platform need temporary elevated access to production resources for troubleshooting. The security team wants approvals, expiry, and audit logging. Which approach is best? The design must avoid adding custom operational scripts.

Accepted Answer

Use IAM Identity Center permission sets with time-bound access processes and CloudTrail auditing. IAM Identity Center permission sets allow granting time-bound, least-privilege access to production resources. Combined with CloudTrail auditing, this provides full logging of all actions taken during the elevated access period. The solution meets the security team's requirements for approvals (via the permission set request workflow), expiry (via session duration or time-bound assignments), and audit logging (via CloudTrail), without requiring custom operational scripts.

Answer

Disable CloudTrail during troubleshooting

Answer

Create shared administrator access keys for the team

Answer

Attach AdministratorAccess permanently to every developer role

Question 3

A healthcare document service must ensure that only encrypted EBS volumes can be created in the account. What is the strongest preventive control? The design must avoid adding custom operational scripts.

Accepted Answer

Use an SCP that denies ec2:CreateVolume when the encrypted condition is false. AWS Organizations Service Control Policies (SCPs) provide a preventive guardrail that can deny the ec2:CreateVolume API call when the encryption condition is false, ensuring that no unencrypted EBS volumes can be created in the account. This is the strongest preventive control because it blocks the action at the API level before any resource is created, and it does not require custom scripts or post-creation remediation. The condition key ec2:Encrypted must be set to true in the SCP policy to enforce encryption at creation time.

Answer

Tag encrypted volumes after creation

Answer

Enable VPC Flow Logs

Answer

Run a daily Lambda function to encrypt unencrypted volumes

Question 4

A company hosts a B2B file exchange site on EC2. Administrators must connect without opening SSH or RDP ports to the internet. What should the architect use? The design must avoid adding custom operational scripts.

Accepted Answer

AWS Systems Manager Session Manager with the required instance role. AWS Systems Manager Session Manager allows administrators to establish secure shell access to EC2 instances without opening inbound SSH or RDP ports, using the Systems Manager agent and an IAM instance role. This meets the requirement for no internet-exposed ports and avoids custom operational scripts because Session Manager is a fully managed AWS service.

Answer

A bastion host with SSH open to 0.0.0.0/0

Answer

A public Elastic IP address on each instance

Answer

An internet gateway attached to the private subnet

Question 5

A mobile banking backend stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured? The design must avoid adding custom operational scripts.

Accepted Answer

S3 Object Lock in compliance mode with an appropriate retention period. S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This meets the compliance requirement of immutable audit logs for seven years without custom scripts. Compliance mode enforces a legal hold that cannot be removed by any user, ensuring logs are write-once-read-many (WORM) protected.

Answer

S3 server access logging

Answer

S3 lifecycle expiration after seven years

Answer

S3 versioning only

Question 6

A customer analytics portal uses CloudFront in front of an S3 origin. Which two settings help keep users from bypassing CloudFront and accessing the bucket directly? The design must avoid adding custom operational scripts.

Accepted Answer

Configure Origin Access Control for the S3 origin. Option B is correct because Origin Access Control (OAC) is a CloudFront feature that restricts access to an S3 origin so that only the CloudFront distribution can retrieve objects. OAC uses a signed request mechanism that prevents direct S3 access, ensuring users cannot bypass CloudFront and hit the bucket directly without custom scripts.

Answer

Enable CloudFront standard logging

Answer

Enable S3 static website hosting

Question 7

A solutions architect is designing an S3 bucket for a IoT ingestion API. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure? The design must avoid adding custom operational scripts.

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. Option C is correct because S3 Block Public Access provides a definitive override that prevents any public access to objects, regardless of bucket policies or object ACLs. This setting, when enabled at the account or bucket level, ensures that even if a developer later attaches an overly permissive bucket policy, the public access is blocked. It meets the requirement of avoiding custom operational scripts by being a native, configurable S3 feature.

Answer

Enable S3 Transfer Acceleration

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Answer

Enable server access logging on the bucket

Question 8

A company stores RDS database credentials in AWS Systems Manager Parameter Store as SecureString parameters. The security team requires that database passwords rotate automatically every 30 days. Which change should a solutions architect recommend?

Accepted Answer

Migrate the credentials to AWS Secrets Manager and enable automatic rotation with a 30-day schedule. AWS Secrets Manager provides native automatic rotation for RDS credentials using a managed Lambda function that rotates the secret on a defined schedule and updates the database password atomically.

Parameter Store SecureString does not support built-in automatic rotation — rotation must be implemented manually with custom automation. Secrets Manager is specifically designed for secrets requiring lifecycle management including rotation, auditing, and fine-grained access control.

Answer

Create a scheduled EventBridge rule to invoke a Lambda function that updates the Parameter Store SecureString value every 30 days

Answer

Enable Parameter Store SecureString automatic rotation in the AWS console

Answer

Configure AWS Config to detect password age and trigger an SNS notification after 30 days

Question 9

A financial services company must store audit logs in S3 for 7 years and ensure that no one — including the AWS account root user — can delete or overwrite the logs during the retention period. Which S3 Object Lock configuration should a solutions architect use?

Accepted Answer

Object Lock in Compliance mode with a 7-year retention period. S3 Object Lock in Compliance mode prevents ALL users — including the root account — from deleting or overwriting objects before the retention period expires. The retention period itself cannot be shortened once set in Compliance mode.

Governance mode also prevents most deletions, but users with s3:BypassGovernanceRetention permission (and the root account) can delete objects or shorten the retention period. For regulatory requirements where not even root can override, Compliance mode is mandatory.

Answer

Object Lock in Governance mode with a 7-year retention period

Answer

S3 Versioning with a lifecycle rule to transition objects to Glacier after 7 years

Answer

A bucket policy with Deny for s3:DeleteObject applied to all principals including root

Question 10

A company uses AWS Organizations and wants to prevent any account in the organization from launching resources in regions other than us-east-1 and eu-west-1. This restriction must apply even if an administrator in a member account grants full IAM permissions. Which approach should a solutions architect use?

Accepted Answer

Create an SCP with a Deny on all actions for regions outside us-east-1 and eu-west-1, attached to the Organization root. Service Control Policies (SCPs) in AWS Organizations provide a guardrail that applies to all principals in member accounts — including IAM users, roles, and even the account root. SCPs restrict the maximum permissions that can be granted within an account.

An SCP with Deny on all actions for all regions except us-east-1 and eu-west-1, attached to the organization root, prevents any account from launching resources in other regions regardless of account-level IAM permissions. IAM policies in member accounts cannot override SCPs.

Answer

Create IAM policies with Deny for disallowed regions and attach them to all IAM users and roles in each account

Answer

Enable AWS Config rules to detect resources launched in disallowed regions and trigger auto-remediation to delete them

Answer

Use AWS Control Tower guardrails to enforce region restriction for all accounts

Question 11

A company is designing a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), an Amazon EC2 Auto Scaling group for the web tier, and an Amazon RDS for MySQL database. The security team requires that the web tier instances have no public IP addresses and that all outbound traffic to the internet is blocked, except for specific software updates from a trusted vendor. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Place the web tier instances in a private subnet and use a NAT gateway in a public subnet for outbound traffic to the trusted vendor.. Placing the web tier instances in a private subnet ensures they have no public IP addresses, meeting the security requirement. Using a security group on the web tier instances to deny all outbound traffic except to the trusted vendor's IP range provides a stateful, instance-level control that blocks all other outbound internet traffic. Additionally, a network ACL on the private subnet must allow outbound traffic to the trusted vendor's IP range and to the NAT gateway, because the NAT gateway itself needs to send traffic to the vendor, and the network ACL acts as a stateless subnet-level filter that must explicitly permit this return traffic.

Answer

Configure a VPC endpoint for the trusted vendor's software update service.

Answer

Deploy the web tier instances in a public subnet and use a network ACL to block all inbound traffic from the internet.

Answer

Configure the ALB to be internet-facing and place the web tier instances in a public subnet.

Question 12

A financial services company is migrating sensitive customer data to Amazon S3. The data must be encrypted at rest using a customer-managed key stored in AWS KMS, with automatic rotation every 90 days. The company also needs to prevent any access to the data from outside the corporate network, except for approved AWS services. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Enable default encryption on the S3 bucket with SSE-KMS using the customer-managed key.. Enable default encryption on the S3 bucket with SSE-KMS using the customer-managed key ensures data is encrypted at rest with a key the customer controls and can rotate automatically every 90 days. Configure an S3 bucket policy that denies access unless the request is made from the corporate IP range restricts access to the corporate network. Attach an S3 VPC endpoint policy that only allows access from the corporate VPC ensures that traffic to S3 stays within the AWS network and is subject to VPC controls, preventing exposure to the public internet.

Answer

Use an S3 bucket policy that grants access only to the root user of the account.

Answer

Use an S3 bucket policy to require that all requests use HTTPS.

Answer

Enable S3 Block Public Access at the account level.

Question 13

A company is deploying a serverless application using AWS Lambda functions that process credit card transactions. The application stores data in Amazon DynamoDB and sends notifications through Amazon SNS. Compliance requirements mandate that all data in transit and at rest is encrypted, and that no AWS Lambda function can access resources in other AWS accounts. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Attach an IAM policy to the Lambda execution role that denies access to resources outside the account using a condition on aws:SourceAccount.. The correct options enforce account isolation and encryption in transit. Option 2 uses an IAM policy with a condition key like `aws:SourceAccount` to explicitly deny any action where the resource ARN belongs to a different AWS account, preventing cross-account access. Option 3 enables encryption in transit by routing Lambda traffic through an Elastic Network Interface (ENI) in a private subnet, using VPC endpoints for DynamoDB (HTTPS) and SNS (HTTPS) so data never traverses the public internet. Option 4 ensures the Lambda function is attached to the VPC, which is necessary for the VPC endpoints to be used; without this, traffic would still go over the public internet, breaking encryption-in-transit compliance.

Answer

Configure the Lambda function to use an IAM role that allows access to all accounts.

Answer

Use a security group to block all outbound traffic from the Lambda function to the internet.

Answer

Configure DynamoDB to use AWS owned keys for encryption at rest.

Question 14

A company is designing a secure CI/CD pipeline on AWS. Developers push code to AWS CodeCommit, which triggers AWS CodePipeline to build and deploy applications to Amazon EC2 instances running in a VPC. The security team requires that all code is scanned for secrets and vulnerabilities before deployment, and that deployment artifacts are encrypted at rest in Amazon S3. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Add a CodeBuild step in the pipeline that runs a static code analysis tool to scan for secrets and vulnerabilities.. Adding a CodeBuild step that runs static code analysis (e.g., using tools like Checkov, Bandit, or custom scripts) directly addresses the requirement to scan for secrets and vulnerabilities before deployment. This integrates security scanning into the CI/CD pipeline as a gated step, ensuring only compliant code proceeds.

Answer

Configure the S3 bucket used for deployment artifacts to have default encryption with SSE-S3.

Answer

Enable AWS CloudTrail to log all access to the S3 bucket and CodeCommit repository.

Answer

Use an S3 bucket policy that grants full public access to the deployment artifacts for faster downloads.

Question 15

A company is hosting a web application on Amazon ECS Fargate behind an Application Load Balancer. The application needs to authenticate users using Amazon Cognito and store session data in Amazon ElastiCache for Redis. The security team mandates that all traffic between the ALB and ECS tasks must not traverse the public internet, and that session data in ElastiCache is encrypted at rest. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Deploy the ECS tasks in private subnets and configure the ALB as an internal load balancer.. Deploying ECS tasks in private subnets with an internal ALB ensures traffic between the ALB and tasks does not traverse the public internet, as internal load balancers have only private IP addresses. Enabling encryption at rest on ElastiCache for Redis with a customer-managed KMS key meets the security mandate for encrypted session data. Using a security group on ECS tasks that allows inbound traffic only from the ALB's security group provides a precise, stateful firewall rule that enforces the traffic flow restriction.

Answer

Configure the ALB to be internal-facing and place the ECS tasks in public subnets.

Answer

Place the ECS tasks in a public subnet and use network ACLs to block inbound traffic from the internet.

Answer

Configure the ElastiCache cluster to use in-transit encryption only.