SAA-C03 Design Secure Architectures Practice Test 27 — 15 Questions

Question 1

A financial services firm stores trade confirmations in an Amazon S3 bucket. Regulations require that every object be encrypted at rest with a key the firm controls and can audit independently of AWS, and that key usage be logged. The firm wants to avoid changing application code. Which encryption approach should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSE-KMS with a customer managed key in AWS KMS, with CloudTrail logging of KMS API calls.. SSE-KMS with a customer managed key provides server-side encryption that requires no application changes while giving the firm ownership of the key policy, rotation, and access. KMS integrates with CloudTrail so every use of the key can be audited independently. SSE-S3, SSE-C, and client-side encryption each fall short on either customer control, auditability, or the no-code-change constraint.

Answer

SSE-S3 with bucket default encryption enabled.

Answer

SSE-C with the customer providing an encryption key on every PUT and GET request.

Answer

Client-side encryption using a key stored in an application configuration file on each server.

Question 2

A company hosts a web application on Amazon EC2 instances in a VPC. The application must access an Amazon RDS for MySQL database. The security team requires that database credentials never be stored in application code or on disk, and that credentials be automatically rotated every 30 days. Which solution should a solutions architect implement?

Accepted Answer

Store the credentials in AWS Secrets Manager and configure automatic rotation using the provided RDS rotation Lambda function.. AWS Secrets Manager provides managed storage and native rotation for RDS credentials. The application retrieves the secret at runtime, so no credentials are embedded in code or persisted on disk. The built-in rotation Lambda handles the 30-day schedule automatically, meeting both the security and operational requirements without custom code.

Answer

Store the credentials in an encrypted Amazon S3 object and have the application download and decrypt it at startup.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString parameter and enable automatic rotation with a custom Lambda function.

Answer

Use IAM database authentication for RDS and eliminate the need for a database password entirely.

Question 3

A startup is deploying a new web application on AWS. The security team wants to ensure that all data stored in Amazon S3 is encrypted at rest and that the company retains full control over the encryption keys, including the ability to audit key usage and rotate keys on demand. The team also wants to minimize the operational burden of managing key infrastructure. Which S3 encryption option should a solutions architect recommend?

Accepted Answer

Server-side encryption with AWS KMS customer managed keys (SSE-KMS).. SSE-KMS with customer managed keys provides encryption at rest while giving the company control over key policies, rotation, and auditing via CloudTrail. AWS handles the key infrastructure, so operational burden stays low. SSE-S3 offers no customer key control, SSE-C requires per-request key management, and client-side encryption shifts significant complexity to the application, making SSE-KMS the appropriate choice.

Answer

Client-side encryption with a key stored in AWS Secrets Manager.

Answer

Server-side encryption with customer-provided keys (SSE-C).

Answer

Server-side encryption with Amazon S3 managed keys (SSE-S3).

Question 4

A logistics company runs workloads in a VPC with private subnets that have no internet gateway route. Instances in these subnets must retrieve secrets from AWS Secrets Manager and download patches from an Amazon S3 bucket owned by the company. The security team requires that this traffic never traverse the public internet. (Choose two.)

Accepted Answer

Create a gateway VPC endpoint for Amazon S3 and associate it with the private subnets' route tables.. Private connectivity to AWS services uses VPC endpoints. Secrets Manager requires an interface endpoint because it is accessed over its API through PrivateLink, while S3 supports a gateway endpoint that adds a route to the subnet route tables. Together these endpoints keep both secret retrieval and patch downloads inside the AWS network without an internet gateway or NAT gateway.

Answer

Create a VPC peering connection between the private subnets' VPC and the S3 service VPC in the same region.

Answer

Deploy a NAT gateway in a public subnet and route the private subnets' traffic to it.

Answer

Attach an internet gateway to the VPC and add a route for 0.0.0.0/0 to the private subnets' route tables.

Question 5

A financial services company stores sensitive customer statements in an Amazon S3 bucket. The security team requires that all data be encrypted at rest using keys that the company manages and rotates on its own schedule. The company also needs an audit trail of every time a key was used to encrypt or decrypt data. Which solution meets these requirements?

Accepted Answer

Use S3 server-side encryption with AWS KMS customer managed keys (SSE-KMS).. SSE-KMS with customer managed keys gives the company ownership of the key material lifecycle, including rotation, and integrates with AWS CloudTrail so every Encrypt and Decrypt call is logged. This combination directly addresses both the control and audit requirements. Other S3 encryption options either do not allow customer-managed rotation or do not produce a usable key usage audit trail.

Answer

Enable default encryption on the bucket using Amazon S3 managed keys and enable versioning.

Answer

Use S3 server-side encryption with Amazon S3 managed keys (SSE-S3).

Answer

Use S3 server-side encryption with customer-provided keys (SSE-C).

Question 6

A media company runs a two-tier web application in a VPC. The web tier is in public subnets behind an internet-facing Application Load Balancer, and the database tier is in private subnets running Amazon RDS. A security review found that the RDS security group allows traffic from 0.0.0.0/0 on port 3306. What is the MOST secure way to restrict database access to only the web tier?

Accepted Answer

Change the RDS security group inbound rule to allow port 3306 from the web tier's security group ID.. Security group referencing lets the database accept connections only from instances that belong to the web tier's security group, which is the tightest and most maintainable control. It removes the 0.0.0.0/0 exposure and automatically adapts as the web tier scales. VPC-wide CIDRs, public subnets, and network ACL CIDR rules are all broader or more fragile than a security group reference.

Answer

Create a network ACL on the database subnet that denies all traffic except port 3306 from the web subnet CIDR.

Answer

Change the RDS security group inbound rule to allow port 3306 from the VPC CIDR range.

Answer

Move the RDS instance into a public subnet and attach an Elastic IP, then restrict access by IP allowlist.

Question 7

A company wants to give a third-party auditor read-only access to a specific Amazon S3 bucket for a limited period. The auditor has an AWS account and will use their own IAM credentials. The company must not share long-term credentials and wants to revoke access automatically when the audit ends. What is the most secure way to grant this access?

Accepted Answer

Create an IAM role in the company account with a trust policy that allows the auditor's AWS account to assume it, and attach a read-only S3 policy with a condition limiting access to the audit period.. Cross-account IAM role assumption is the standard secure pattern for granting temporary access to external parties. The auditor assumes a role using their own identity, receives temporary credentials, and the company retains full control over permissions and revocation. This avoids sharing long-term credentials and supports time-bound access conditions.

Answer

Enable S3 Block Public Access and provide the auditor with the bucket's ARN so they can configure their own access.

Answer

Create an IAM user in the company account with read-only S3 permissions and share the access keys with the auditor.

Answer

Generate a presigned URL for each object in the bucket and send the URLs to the auditor.

Question 8

A startup runs a public web application on Amazon EC2 instances behind an Application Load Balancer. The instances are in a public subnet and currently allow SSH from 0.0.0.0/0 so that engineers can troubleshoot. Auditors flagged this exposure. Engineers still need occasional shell access to the instances, and the company wants the access to be auditable per engineer without managing bastion hosts or distributing key pairs. Which solution best meets these requirements?

Accepted Answer

Move the instances to private subnets, remove the inbound SSH rule, and grant engineers access through AWS Systems Manager Session Manager with IAM policies and session logging to Amazon S3 and CloudWatch Logs.. Session Manager removes the need for inbound SSH, bastion hosts, and key pairs by having the Systems Manager agent establish outbound connections to the service. IAM policies determine which engineers can start sessions on which instances, giving per-person attribution, and session logging to Amazon S3 and CloudWatch Logs satisfies the audit requirement without exposing any listening port.

Answer

Keep the instances in the public subnet, restrict SSH to the corporate office CIDR, and distribute a shared PEM key pair to all engineers through AWS Secrets Manager.

Answer

Attach an EC2 instance profile granting AmazonSSMManagedInstanceCore to the instances and open port 22 only to the VPC CIDR so Session Manager can reach the instances.

Answer

Deploy a bastion host in a public subnet with a security group that allows SSH only from the corporate CIDR, and have engineers forward through it to reach the instances.

Question 9

A startup stores application configuration files in an Amazon S3 bucket. The security team wants to ensure that objects in the bucket are encrypted at rest with keys that the company manages and can rotate on its own schedule. Which S3 encryption option should a solutions architect choose?

Accepted Answer

Server-side encryption with AWS KMS keys (SSE-KMS) using a customer managed key.. SSE-KMS with a customer managed key gives the company ownership of the key policy, the ability to enable and schedule automatic key rotation, and CloudTrail visibility into key usage. The other S3 encryption options either leave key management to AWS, require the application to supply keys per request, or move encryption entirely to the client, none of which matches the requirement for company-managed, rotatable keys.

Answer

Server-side encryption with customer-provided keys (SSE-C).

Answer

Client-side encryption with an AWS KMS key before uploading objects to the bucket.

Answer

Server-side encryption with Amazon S3 managed keys (SSE-S3).

Question 10

A startup runs a web application on Amazon EC2 instances behind an Application Load Balancer. The security team wants to encrypt data in transit between clients and the load balancer using a certificate managed by AWS, with minimal operational overhead. Which solution meets these requirements?

Accepted Answer

Request a public certificate in AWS Certificate Manager (ACM), validate it via DNS, and attach it to an HTTPS listener on the Application Load Balancer.. AWS Certificate Manager (ACM) issues free public certificates that can be automatically renewed when DNS validation is used, and it integrates directly with Application Load Balancers. Attaching an ACM certificate to an HTTPS listener encrypts client traffic with minimal operational effort, satisfying the requirement.

Answer

Import a self-signed certificate into AWS Certificate Manager (ACM) and attach it to the load balancer's HTTPS listener.

Answer

Use an Amazon-issued certificate from IAM and attach it to the load balancer's HTTPS listener.

Answer

Generate a certificate using AWS KMS, store it in AWS Secrets Manager, and configure the load balancer to retrieve it at runtime.

Question 11

A healthcare company is designing a new application on AWS. The application will store protected health information (PHI) in an Amazon S3 bucket. The security team requires that all data be encrypted at rest using a customer managed AWS KMS key so that they can control key rotation and audit key usage. They also need to ensure that only the application's IAM role can decrypt the data. Which solution meets these requirements?

Accepted Answer

Use SSE-KMS with a customer managed KMS key and update the key policy to allow only the application's IAM role to decrypt.. The requirement is for server-side encryption with a customer managed KMS key, enabling control over rotation and auditing. SSE-KMS with a customer managed key provides this, and the key policy can restrict decryption to the application's IAM role. Other options either use AWS-managed keys, require custom key management, or shift encryption to the client side, none of which fully satisfy the stated needs.

Answer

Use SSE-C with a customer-provided key stored in AWS Secrets Manager and grant the application's IAM role access to the secret.

Answer

Use client-side encryption with an AWS KMS customer managed key before uploading to S3, and store the encrypted data in the bucket.

Answer

Use SSE-S3 with an S3 Bucket Key and restrict access with a bucket policy that allows only the application's IAM role.

Question 12

A fintech company runs a containerized payment API on Amazon ECS with AWS Fargate. The security team requires that the API access a stored database credential without hardcoding it in the task definition or environment variables. The credential must be encrypted at rest and automatically rotated every 90 days. The API also needs to retrieve the credential at container startup with minimal latency. Which solution meets these requirements?

Accepted Answer

Store the credential in AWS Secrets Manager, enable automatic rotation, and grant the ECS task role permission to call secretsmanager:GetSecretValue.. AWS Secrets Manager is designed for storing, encrypting, and automatically rotating secrets such as database credentials. By using the ECS task role to call GetSecretValue, the container retrieves the credential at startup without embedding it in the task definition. Native rotation every 90 days satisfies the compliance requirement, and KMS encryption at rest plus IAM policies enforce least privilege.

Answer

Store the credential in an encrypted Amazon S3 object and grant the ECS task role s3:GetObject. Configure a Lambda function to rotate the credential every 90 days.

Answer

Store the credential in AWS Systems Manager Parameter Store as a SecureString, and grant the ECS task role ssm:GetParameter. Enable automatic rotation through Parameter Store.

Answer

Store the credential in an encrypted Amazon EBS volume attached to the Fargate task, and grant the task role permission to mount the volume.

Question 13

A company is migrating a legacy application to AWS. The application uses a fixed set of credentials stored in a configuration file to access an Amazon RDS database. The security team wants to eliminate hardcoded credentials and automatically rotate them every 30 days. The application runs on Amazon EC2 instances and can be modified to retrieve credentials at startup. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Store the credentials in AWS Secrets Manager and configure automatic rotation every 30 days. Modify the application to retrieve the secret using the AWS SDK.. AWS Secrets Manager is designed for this use case: it stores and automatically rotates database credentials using a Lambda rotation function, with minimal setup. The application retrieves the secret via the AWS SDK, eliminating hardcoded credentials. Other options lack built-in rotation or require custom development, increasing operational overhead.

Answer

Store the credentials in an encrypted Amazon S3 object and use S3 Object Lambda to decrypt them at runtime. Configure a lifecycle policy to delete and recreate the object every 30 days.

Answer

Use AWS KMS to encrypt the credentials and store them in an EC2 instance's user data. Use an AWS Lambda function to rotate the credentials and update the user data every 30 days.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString parameter and write a custom Lambda function to rotate them every 30 days.

Question 14

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to deploy a web application that must be accessible from the internet. The application will run on Amazon EC2 instances in an Auto Scaling group. The security team requires that the instances be in private subnets and that inbound traffic from the internet be allowed only on ports 80 and 443. They also want to use an Application Load Balancer (ALB) for load balancing and SSL termination. Which architecture meets these requirements?

Accepted Answer

Deploy the ALB in public subnets, the EC2 instances in private subnets, and configure the ALB security group to allow inbound 80/443 from 0.0.0.0/0. Configure the EC2 security group to allow inbound traffic only from the ALB security group.. The correct architecture uses public subnets for the ALB and private subnets for the EC2 instances. The ALB security group allows inbound internet traffic on 80/443, while the EC2 security group allows inbound only from the ALB. This design ensures the instances are not directly accessible from the internet and meets the load balancing and SSL termination requirements.

Answer

Deploy the ALB in public subnets, the EC2 instances in private subnets, and configure the ALB security group to allow inbound 80/443 from the VPC CIDR. Configure the EC2 security group to allow inbound traffic from the ALB security group.

Answer

Deploy the ALB in public subnets, the EC2 instances in public subnets, and configure both security groups to allow inbound 80/443 from 0.0.0.0/0. Configure the EC2 instances to use an Elastic IP address.

Answer

Deploy the ALB in private subnets, the EC2 instances in public subnets, and configure the ALB security group to allow inbound 80/443 from 0.0.0.0/0. Configure the EC2 security group to allow inbound traffic only from the ALB security group.

Question 15

A company is deploying a web application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer. The company wants to protect the application from common web exploits such as SQL injection and cross-site scripting, and also wants to restrict access to specific geographic regions. Which combination of AWS services should a solutions architect use to meet these requirements?

Accepted Answer

AWS WAF with managed rule groups and geographic match conditions.. AWS WAF is the appropriate service for protecting web applications behind an Application Load Balancer from application-layer attacks. Its managed rule groups cover common threats like SQL injection and cross-site scripting, and geographic match conditions can allow or block traffic by country. The other services either operate at different layers or provide detection rather than inline prevention.

Answer

AWS Network Firewall with stateful rule groups and domain lists.

Answer

AWS Shield Advanced with a web ACL and IP set rules.

Answer

Amazon GuardDuty with threat intelligence and custom findings.