SAA-C03 Design Secure Architectures Practice Test 26 — 15 Questions

Question 1

A healthcare analytics company runs an Amazon RDS for MySQL database in a private subnet. A compliance requirement mandates that all data at rest be encrypted with a key that the company can rotate, audit, and immediately revoke. The database is currently unencrypted. What is the MOST operationally efficient way to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Take a snapshot of the DB instance, restore it with encryption enabled using a customer managed KMS key, and repoint the application to the new instance.. Encryption at rest for RDS must be enabled at creation. For an existing unencrypted instance, the supported path is to snapshot, restore with encryption using a customer managed KMS key, and repoint the application. This meets the need for customer-controlled rotation, audit trails, and revocability.

Answer

Enable encryption on the existing DB instance by modifying it and specifying a customer managed AWS KMS key.

Answer

Create an encrypted read replica from the unencrypted instance, promote it, and update the application endpoint.

Answer

Enable encryption by restoring the automated backup to a new instance with the default AWS managed key aws/rds.

Question 2

A financial services company runs a three-tier web application on AWS. The application servers in a private subnet must retrieve database credentials from AWS Secrets Manager at startup. The security team requires that the credentials never be stored on disk and that access be granted only to the specific IAM role attached to the instances. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Retrieve the secret from AWS Secrets Manager using the AWS SDK with the instance's IAM role, and configure automatic rotation for the secret.. AWS Secrets Manager is purpose-built for storing and rotating database credentials. Using the instance's IAM role to call GetSecretValue keeps credentials in memory, avoids disk storage, and supports least privilege through IAM policies scoped to the specific secret. Automatic rotation removes manual effort. The other options either require custom rotation logic, expose secrets in less secure locations, or add unnecessary components.

Answer

Use AWS Systems Manager Parameter Store SecureString parameters and retrieve them with the AWS CLI during instance bootstrap.

Answer

Embed the credentials in the AWS Lambda environment variables and have the application servers retrieve them through an API Gateway endpoint.

Answer

Store the credentials in an encrypted Amazon S3 object and have the application download and decrypt them at startup using the instance role.

Question 3

A financial services company runs a three-tier web application on AWS. The application tier consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer. Security policy requires that the EC2 instances never receive public IP addresses and that all outbound internet traffic from the application tier be routed through a NAT gateway. The company also wants to ensure that only the load balancer can initiate connections to the application instances on port 443. Which combination of VPC configuration and security group rules should a solutions architect implement to meet these requirements?

Accepted Answer

Place the EC2 instances in private subnets. Configure the instances' security group to allow inbound TCP 443 from the load balancer's security group, and configure the load balancer's security group to allow inbound TCP 443 from 0.0.0.0/0. Route 0.0.0.0/0 through a NAT gateway in a public subnet.. The requirement to keep instances off the public internet while allowing outbound access is met by private subnets plus a NAT gateway in a public subnet. Restricting inbound port 443 to the load balancer's security group as the source enforces that only the ALB can initiate connections to the application tier, which is the tightest and most maintainable control for this scenario.

Answer

Place the EC2 instances in private subnets. Configure the instances' security group to allow inbound TCP 443 from 0.0.0.0/0, and route 0.0.0.0/0 through a NAT gateway in a public subnet.

Answer

Place the EC2 instances in private subnets. Configure the instances' security group to allow inbound TCP 443 from the load balancer's security group, and attach an internet gateway directly to the private subnets to provide outbound access.

Answer

Place the EC2 instances in public subnets with an internet gateway. Configure the instances' security group to allow inbound TCP 443 from the load balancer's IP addresses, and route 0.0.0.0/0 through the internet gateway.

Question 4

A media company stores its video uploads in an Amazon S3 bucket. The security team wants to ensure that any objects uploaded to the bucket are encrypted at rest using keys managed in AWS Key Management Service (AWS KMS) and that the encryption key is rotated annually. Which solution should a solutions architect recommend?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-KMS with a customer managed key configured for annual rotation.. Using SSE-KMS with a customer managed key satisfies both the encryption at rest requirement and the annual key rotation requirement. S3 default encryption automatically applies the chosen encryption method to all new objects, ensuring consistent protection without relying on upload headers. This approach provides the necessary control over the encryption keys.

Answer

Configure a bucket policy that denies uploads unless the request includes the x-amz-server-side-encryption header with the value AES256.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Answer

Use S3 server access logs to verify that objects are encrypted with a KMS key.

Question 5

A financial services company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The security team wants to inspect incoming requests for common web exploits and block malicious traffic before it reaches the application. They also need to monitor for SQL injection attempts and receive near-real-time metrics. Which AWS service should be used to meet these requirements?

Accepted Answer

AWS WAF. The need to inspect HTTP requests for SQL injection and common web exploits, block them inline, and emit metrics points to AWS WAF. It attaches to the Application Load Balancer and evaluates requests against rule groups, including managed rules for SQL injection and other OWASP threats. Shield Advanced, GuardDuty, and Network Firewall address DDoS, threat detection, and network-layer filtering, respectively, not application-layer request inspection.

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Question 6

A startup runs a public-facing web application on Amazon EC2 instances behind an Application Load Balancer. The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting, and also wants to rate-limit requests from specific IP addresses. Which AWS service should be used to meet these requirements?

Accepted Answer

AWS WAF. AWS WAF is the service designed to filter and monitor HTTP requests at the application layer. It provides managed rule groups that block SQL injection and cross-site scripting, and rate-based rules that limit requests from specific IP addresses. Associating a web ACL with the Application Load Balancer enforces these protections directly on incoming traffic, meeting both requirements.

Answer

Amazon GuardDuty

Answer

AWS Shield Advanced

Answer

AWS Network Firewall

Question 7

A media company stores video masters in an Amazon S3 bucket encrypted with a customer managed AWS KMS key. Editors sign in through a corporate identity provider that is federated to AWS IAM Identity Center, and they must be able to download and re-upload objects. The security team wants every editor's read of the key material recorded in CloudTrail with the editor's own identity, and wants to be able to revoke one editor's access without affecting the others. Which configuration meets these requirements?

Accepted Answer

Create a KMS key policy statement that allows kms:Decrypt and kms:GenerateDataKey to the IAM Identity Center permission set role, and let each editor assume that role with their federated identity.. When objects use SSE-KMS, every download requires kms:Decrypt and every upload requires kms:GenerateDataKey, and those calls appear in CloudTrail tied to the calling principal. Federating editors into a permission set role means the role session carries their identity, giving per-person audit records and per-person revocation by removing the assignment, while the key policy authorizes the shared role.

Answer

Generate a data key with kms:GenerateDataKeyWithoutPlaintext once, store it in AWS Secrets Manager, and have each editor retrieve it to encrypt and decrypt objects locally before uploading.

Answer

Enable S3 server access logging on the bucket and create a separate IAM user for each editor with an inline policy allowing kms:Decrypt on the key.

Answer

Attach a bucket policy to the S3 bucket that grants s3:GetObject to the federated principal, and rely on the default aws/s3 AWS managed key for encryption so no KMS permissions are needed.

Question 8

A financial services company runs a three-tier web application on AWS. The application tier consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. A security audit reveals that the application instances are receiving large volumes of unwanted traffic directly from the internet on port 443, bypassing the load balancer. The company wants to ensure that only traffic from the ALB can reach the application instances, while allowing the instances to download software updates from the internet. What should a solutions architect recommend?

Accepted Answer

Configure the application instances' security group to allow inbound traffic only from the ALB's security group, and place the instances in private subnets with a NAT gateway for outbound internet access.. The most secure and operationally sound approach is to use security group referencing so that the instances accept traffic only from the load balancer, and to remove direct internet exposure by placing instances in private subnets. A NAT gateway then allows outbound updates. This combination enforces the traffic path through the ALB while preserving necessary outbound connectivity.

Answer

Modify the network ACL on the application subnets to deny inbound traffic on port 443 from all sources except the ALB's private IP addresses.

Answer

Attach an AWS WAF web ACL to the ALB and create a rule to block all IP addresses except those in the ALB's subnet CIDR range.

Answer

Move the application instances to a placement group and enable enhanced networking to prevent direct internet access.

Question 9

A media company hosts a public-facing web application on Amazon EC2 instances behind an Application Load Balancer. The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting, and also wants to rate-limit requests from specific IP addresses that exhibit abusive behavior. Which combination of AWS services should a solutions architect recommend?

Accepted Answer

AWS WAF attached to the Application Load Balancer with managed rule groups and rate-based rules.. AWS WAF is the managed application-layer firewall that attaches to Application Load Balancers, Amazon CloudFront, and API Gateway. Managed rule groups provide prebuilt protections against SQL injection, XSS, and other OWASP threats, while rate-based rules track request counts per IP and block offenders automatically. This directly addresses both the exploit protection and the abusive IP rate-limiting requirements with a single integrated service.

Answer

AWS Shield Advanced with automatic application layer DDoS mitigation enabled on the ALB.

Answer

Amazon GuardDuty with suppression rules configured for the EC2 instances and ALB.

Answer

AWS Network Firewall deployed in a subnet in front of the ALB with stateful rules for HTTP inspection.

Question 10

A healthcare analytics firm stores protected health information in an Amazon S3 bucket encrypted with SSE-KMS using a customer managed key. The firm's security team wants to ensure that only a specific IAM role used by an analytics application can decrypt objects, while other principals in the same account with broad S3 permissions cannot. The key policy currently grants kms:* to the account root. Which change should a solutions architect make to enforce the restriction?

Accepted Answer

Edit the KMS key policy to remove kms:Decrypt from the account root statement and add a statement that allows kms:Decrypt only to the analytics application's IAM role, then remove any identity-based policies that grant kms:Decrypt to other principals.. For SSE-KMS objects, reading an object requires permission to both the S3 object and the KMS key. The KMS key policy is the authoritative control that can limit kms:Decrypt to the analytics application's role. Removing broad decrypt grants from the root statement and from other identity-based policies ensures that other principals with S3 permissions cannot decrypt the protected health information.

Answer

Enable S3 Block Public Access on the bucket and require requests to use TLS by adding a bucket policy condition aws:SecureTransport.

Answer

Add an S3 bucket policy that denies s3:GetObject to all principals except the analytics application's IAM role.

Answer

Change the bucket's default encryption from SSE-KMS to SSE-S3 so that AWS manages the keys and only the bucket owner can read objects.

Question 11

A company stores sensitive customer data in an Amazon S3 bucket. The security team wants to ensure that all data is encrypted at rest using keys that the company controls, including the ability to rotate keys and audit key usage. They also want to minimize operational overhead for key management. Which solution meets these requirements?

Accepted Answer

Use S3 server-side encryption with AWS KMS customer managed keys (SSE-KMS).. SSE-KMS with customer managed keys allows the company to control the KMS keys, configure automatic rotation, and audit key usage through CloudTrail. It is a native S3 feature, so no application changes are needed. SSE-S3 does not give key control, SSE-C requires the customer to manage keys per request, and client-side encryption adds significant operational burden.

Answer

Use S3 server-side encryption with customer-provided keys (SSE-C).

Answer

Use S3 server-side encryption with Amazon S3 managed keys (SSE-S3).

Answer

Encrypt the data client-side before uploading to S3 using an open-source library, and store the keys in AWS Secrets Manager.

Question 12

A healthcare company stores protected health information in an Amazon S3 bucket. Compliance requires that all data be encrypted at rest with keys that the company controls and can rotate on demand. The security team also needs to audit every use of the encryption keys and immediately revoke access for a compromised IAM role without affecting other roles. Which solution meets these requirements?

Accepted Answer

Use S3 server-side encryption with AWS KMS customer managed keys (SSE-KMS), and manage access through the KMS key policy.. Customer managed KMS keys provide the needed control: the company can rotate them, audit every cryptographic operation through CloudTrail, and enforce or revoke access using the key policy. AWS managed keys and S3 managed keys lack customer-controlled rotation and granular, auditable access control, so they cannot meet the compliance and revocation requirements.

Answer

Use S3 server-side encryption with Amazon S3 managed keys (SSE-S3) and enable bucket versioning.

Answer

Use S3 server-side encryption with AWS KMS AWS managed keys (SSE-KMS) and enable S3 server access logging.

Answer

Use client-side encryption with an AWS KMS customer managed key and store the encrypted data key in S3 object metadata.

Question 13

A company is designing a secure architecture for an internal microservices application running on Amazon ECS with the Fargate launch type. The security team wants each microservice to have its own fine-grained permissions to access specific AWS resources, and wants to avoid storing long-term AWS credentials in the container images or task definitions. The company also wants to encrypt data in transit between services. (Choose two.)

Accepted Answer

Implement mutual TLS between microservices using AWS App Mesh with certificate management through AWS Certificate Manager Private CA.. ECS task IAM roles provide each microservice with temporary, scoped credentials without storing secrets in images or task definitions, meeting the fine-grained permission and credential-hygiene requirements. AWS App Mesh with mutual TLS encrypts and authenticates service-to-service traffic using certificates from ACM Private CA, satisfying the in-transit encryption requirement. Together they form a least-privilege, encrypted microservices architecture.

Answer

Enable AWS PrivateLink for communication between microservices and use TLS termination at the Network Load Balancer.

Answer

Attach an IAM user access key to each container through a mounted Amazon EFS volume.

Answer

Store AWS credentials in AWS Secrets Manager and inject them as environment variables in the task definition.

Question 14

A healthcare company runs a three-tier web application on AWS. The application tier consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer. The security team must ensure that the application instances accept traffic only from the load balancer and that no instance can be reached directly from the internet. The instances are in private subnets and have a security group attached. What should a solutions architect do to meet these requirements?

Accepted Answer

Configure the instance security group to allow inbound traffic on the application port only from the load balancer's security group.. The most secure and operationally simple way to restrict instance access to the load balancer is to reference the load balancer's security group in the instance security group's inbound rule. This creates a logical relationship rather than an IP-based one, so it remains correct as the ALB scales and its node IPs change. It also prevents direct internet access because private instances have no public addresses.

Answer

Configure the instance security group to allow inbound traffic on the application port from the VPC CIDR range.

Answer

Create a network ACL that denies all inbound traffic except from the load balancer's subnet CIDR range.

Answer

Attach an Elastic IP address to each instance and allow inbound traffic only from the load balancer's public IP addresses.

Question 15

A media company hosts a public-facing web application on Amazon EC2 instances behind an Application Load Balancer. The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting, and also wants to rate-limit requests from individual IP addresses to mitigate scraping. Which AWS service should a solutions architect associate with the load balancer to meet both requirements?

Accepted Answer

AWS WAF with a web ACL attached to the Application Load Balancer, using managed rule groups for SQL injection and XSS plus a rate-based rule.. AWS WAF is the service designed to filter HTTP requests at the application layer and integrates natively with Application Load Balancers. Managed rule groups cover SQL injection and cross-site scripting signatures, and rate-based rules track request counts per originating IP. Attaching a web ACL to the ALB inspects traffic before it reaches the EC2 instances, meeting both protection goals with one service.

Answer

AWS Shield Advanced with automatic application layer DDoS mitigation enabled on the load balancer.

Answer

Amazon GuardDuty with the S3 protection and EKS protection features enabled for the account.

Answer

AWS Network Firewall deployed in a subnet and referenced by the load balancer's target group.