SAA-C03 Design Secure Architectures Practice Test 28 — 15 Questions

Question 1

A media company uses an Amazon CloudFront distribution to serve content from a private S3 bucket. The security team wants to ensure that users cannot bypass CloudFront and access the S3 bucket directly, and that only the distribution can read objects. Which configuration should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an origin access control (OAC) for the distribution, update the bucket policy to allow the OAC, and block public access on the bucket.. Origin access control (OAC) is the modern, recommended way to secure S3 origins for CloudFront. It allows the distribution to sign requests to S3, and the bucket policy can be scoped to the OAC. Blocking public access ensures users cannot bypass CloudFront. This satisfies both requirements.

Answer

Configure the S3 bucket as a website endpoint and use a bucket policy that allows only the CloudFront distribution's IP addresses.

Answer

Set the S3 bucket ACL to private and enable CloudFront signed URLs for all objects.

Answer

Create an origin access identity (OAI) for the distribution, update the bucket policy to allow the OAI, and block public access on the bucket.

Question 2

A company is designing a secure architecture for a new application on AWS. The application will store sensitive data in Amazon S3 and will be accessed by users from a web browser. The security team requires that data be encrypted in transit and at rest, and that access to the S3 bucket be limited to only the application's users. The company also wants to minimize operational overhead. Which two actions should a solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

Configure the S3 bucket policy to deny requests that do not use TLS (aws:SecureTransport condition).. To encrypt data in transit, a bucket policy that denies non-TLS requests enforces HTTPS. To limit access to application users, Cognito user pools authenticate users and identity pools issue temporary credentials with an IAM role scoped to the bucket. Together, these provide secure access with minimal operational overhead. The other options either do not address both requirements or increase management burden.

Answer

Create an IAM user for each application user and attach a policy that allows access to the S3 bucket.

Answer

Configure the S3 bucket to use server access logging and enable AWS CloudTrail data events for the bucket.

Answer

Enable S3 default encryption with SSE-S3 and enable versioning on the bucket.

Question 3

A company is designing a secure architecture for a three-tier web application on AWS. The web tier runs on Amazon EC2 instances in public subnets, the application tier runs on EC2 instances in private subnets, and the database tier runs on Amazon RDS in private subnets. The security team requires that the application tier instances can access the internet for software updates without being directly reachable from the internet, and that the database tier is not accessible from the internet. Which two actions should a solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

Configure the RDS database security group to allow inbound traffic only from the application tier security group.. A NAT gateway in a public subnet allows private application instances to initiate outbound internet traffic for updates without being reachable inbound. Referencing the application security group in the RDS security group restricts database access to only those instances. Together, these actions provide secure outbound access and database isolation.

Answer

Place the RDS database in a public subnet and rely on a security group that allows only the application tier's IP range.

Answer

Create a VPC peering connection between the application tier VPC and the database tier VPC, and route all database traffic over the peering connection.

Answer

Attach an Elastic IP address to each application tier instance and configure security groups to allow only outbound traffic.

Question 4

A financial services company runs a three-tier web application on AWS. The application servers run on Amazon EC2 instances in private subnets and must retrieve database credentials from AWS Secrets Manager at startup. The security team wants to ensure that the credentials are never stored in plaintext on the instances and that access is auditable. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Store the credentials in AWS Secrets Manager and configure the application to retrieve them using the AWS SDK with an IAM role attached to the instances.. AWS Secrets Manager provides secure storage, automatic rotation, and fine-grained access control through IAM policies. When EC2 instances use an IAM role, the application can retrieve secrets programmatically without embedding credentials, and all access is logged in CloudTrail. This minimizes operational overhead while meeting the security and auditability requirements.

Answer

Store the credentials in an encrypted Amazon S3 object and have the instances download the object at boot using an IAM role.

Answer

Use AWS Systems Manager Parameter Store with SecureString parameters and retrieve the credentials via the SSM agent at startup.

Answer

Embed the credentials in the EC2 user data script and rely on instance metadata protection to prevent unauthorized access.

Question 5

A company uses AWS Organizations to manage multiple AWS accounts. A security engineer needs to prevent any IAM user in the organization from disabling AWS CloudTrail logging in any account. The solution must apply automatically to all existing and future accounts. What should the security engineer do?

Accepted Answer

Enable AWS CloudTrail organization trail and configure an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.. Service control policies (SCPs) in AWS Organizations provide centralized control over the maximum available permissions for all accounts. By denying cloudtrail:StopLogging and cloudtrail:DeleteTrail, the SCP ensures that no principal, including root, can disable the organization trail. This solution automatically applies to all current and future accounts, satisfying the requirement.

Answer

Create an IAM policy that denies the cloudtrail:StopLogging action and attach it to all IAM users in each account.

Answer

Use AWS Config to monitor CloudTrail configuration changes and trigger an AWS Lambda function to re-enable logging if it is stopped.

Answer

Create an IAM role in each account with a permissions boundary that denies cloudtrail:StopLogging and assign it to all users.

Question 6

A company stores sensitive data in an Amazon S3 bucket. The security team must ensure that all data is encrypted at rest using a customer managed AWS KMS key (CMK) and that the key's usage is auditable. They also need to be able to rotate the key annually. Which solution meets these requirements?

Accepted Answer

Use server-side encryption with AWS KMS (SSE-KMS) with a customer managed CMK and enable automatic key rotation.. SSE-KMS with a customer managed CMK provides encryption at rest using a key that the customer controls. AWS KMS integrates with CloudTrail to log key usage, enabling auditing. Automatic key rotation can be enabled for the CMK, rotating the backing key annually. This solution meets all specified requirements: encryption with a CMK, auditability, and rotation.

Answer

Use server-side encryption with Amazon S3 managed keys (SSE-S3) and enable versioning on the bucket.

Answer

Use server-side encryption with customer-provided keys (SSE-C) and rotate the keys manually every year.

Answer

Use client-side encryption with a customer-provided key stored in AWS Secrets Manager.

Question 7

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to allow an on-premises data center (192.168.0.0/24) to access a web application running on EC2 instances in a private subnet. The security team wants to ensure that only HTTP and HTTPS traffic from the on-premises network is allowed, and that the traffic is encrypted in transit. Which combination of AWS services should they use?

Accepted Answer

Set up an AWS Site-to-Site VPN connection and configure security groups to allow HTTP/HTTPS from 192.168.0.0/24.. An AWS Site-to-Site VPN creates an encrypted tunnel between the on-premises network and the VPC, ensuring data in transit is protected. Security groups can then be configured to allow only HTTP and HTTPS traffic from the specific on-premises CIDR block, restricting access to the required ports. This combination satisfies both the encryption and traffic restriction requirements.

Answer

Set up an AWS Transit Gateway with a VPN attachment and configure security groups to allow all traffic from 192.168.0.0/24.

Answer

Set up an AWS Client VPN endpoint and configure security groups to allow HTTP/HTTPS from the VPN client CIDR.

Answer

Set up an AWS Direct Connect connection and configure network ACLs to allow HTTP/HTTPS from 192.168.0.0/24.

Question 8

A company has an application running on Amazon EC2 instances that needs to access an Amazon S3 bucket. The security team wants to avoid storing long-term AWS credentials on the instances. Which solution should they implement?

Accepted Answer

Create an IAM role with the necessary S3 permissions and attach it to the EC2 instances.. Attaching an IAM role to EC2 instances allows the instances to obtain temporary credentials from the instance metadata service. These credentials are automatically rotated and do not need to be stored on the instance. This eliminates the need for long-term credentials and is the recommended approach for granting AWS permissions to EC2 instances.

Answer

Generate an AWS access key and secret key for an IAM user and embed them in the application code.

Answer

Store AWS credentials in a configuration file on each EC2 instance and restrict file permissions.

Answer

Use AWS Secrets Manager to store the credentials and retrieve them at runtime.

Question 9

A healthcare company stores patient records in an Amazon S3 bucket. Compliance requires that every object be encrypted with a key that the company rotates on its own schedule, that key usage be logged separately from S3 data events, and that a specific group of IAM principals be the only identities allowed to use the key for cryptographic operations. The security team has already created a symmetric AWS KMS customer managed key. Which combination of actions should the team take to meet these requirements?

Accepted Answer

Configure the bucket to use SSE-KMS with the customer managed key, and edit the key policy so only the designated principals have kms:Decrypt, kms:GenerateDataKey, and related permissions.. A customer managed key in AWS KMS is the only option that gives the organization control over rotation, produces dedicated CloudTrail logging of key usage, and enforces who may perform cryptographic operations through the key policy. Pairing it with SSE-KMS on the bucket applies that governance to every object written to the bucket without application changes.

Answer

Enable SSE-C on the bucket and distribute the raw encryption key to the application team so they pass it in the x-amz-server-side-encryption-customer-key header with each request.

Answer

Enable S3 default encryption with SSE-S3 (AES-256) on the bucket, and rely on the AWS managed key aws/s3 for rotation and audit logging.

Answer

Use client-side encryption with the AWS Encryption SDK, store the data key in AWS Secrets Manager, and let any principal in the account retrieve it when needed.

Question 10

A healthcare company stores patient records in an Amazon S3 bucket. Compliance requires that every object be encrypted at rest with a key that the company fully controls, including the ability to rotate and immediately revoke access. The security team also needs a record of every time the key is used to decrypt an object. Which encryption configuration should the company implement?

Accepted Answer

Use SSE-KMS with a customer managed key in AWS KMS.. The requirement is customer-controlled encryption with the ability to rotate and revoke keys and to audit every decryption. A customer managed key in AWS KMS provides editable key policies, scheduled or on-demand rotation, the ability to disable the key to cut off access, and CloudTrail logging of cryptographic operations. Other S3 encryption options either lack customer key control or lack a per-use audit trail.

Answer

Use SSE-C where the customer provides the encryption key on each request.

Answer

Use SSE-S3 with the default AWS managed key for the bucket.

Answer

Use client-side encryption with an AWS managed key before uploading objects.

Question 11

A startup runs a two-tier web application on Amazon EC2 instances behind an Application Load Balancer. The instances are in private subnets and must reach the internet only to download operating system patches. Security policy forbids any inbound internet traffic to the instances. Which configuration meets these requirements with the least operational overhead?

Accepted Answer

Deploy a NAT gateway in a public subnet and route the private subnets' outbound traffic through it.. Instances in private subnets need outbound internet access for patching but must not accept inbound connections. A NAT gateway placed in a public subnet provides that one-way connectivity and is a fully managed, highly available service, minimizing operational effort. Alternatives either expose the instances publicly or require extra cross-VPC routing, both of which conflict with the policy or the simplicity requirement.

Answer

Assign each EC2 instance an Elastic IP address and open the security group to inbound HTTPS.

Answer

Create a VPC peering connection to a shared services VPC that has an internet gateway.

Answer

Place the instances in public subnets and attach a security group that allows only outbound traffic.

Question 12

A company runs a two-tier web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The EC2 instances must access an Amazon Aurora MySQL DB cluster. A security engineer must ensure that only these EC2 instances can connect to the database, and that no credentials are stored on the instances. What should the security engineer do?

Accepted Answer

Configure the DB cluster security group to allow inbound MySQL traffic from the EC2 instances' security group, and enable IAM database authentication on the cluster.. Restricting the Aurora security group to the EC2 instances' security group enforces network-level isolation so only those instances can open a MySQL session. Enabling IAM database authentication lets the application use its IAM role to obtain a temporary token, so no long-lived database password is stored on the instances, satisfying both the access and credential requirements.

Answer

Create a VPC endpoint for Aurora and attach an IAM policy that allows only the EC2 instance role to use the endpoint.

Answer

Store the Aurora master credentials in AWS Secrets Manager and grant the EC2 instance role permission to retrieve the secret at boot.

Answer

Place the DB cluster in a private subnet and attach an AWS WAF web ACL to the cluster endpoint to filter incoming connections.

Question 13

A company runs an internal API on Amazon EC2 instances in a private subnet. The API must call AWS Systems Manager Parameter Store to read configuration values. The security team wants to avoid long-lived credentials on the instances and avoid routing traffic over the public internet. Which combination of steps should be taken?

Accepted Answer

Attach an IAM role to the instances and create an interface VPC endpoint for Systems Manager.. Temporary credentials come from an IAM role attached to the instances, eliminating static access keys. Private access to Parameter Store is provided by an interface VPC endpoint, which uses AWS PrivateLink to keep traffic within the AWS network. Combining the role and the interface endpoint satisfies both the credential hygiene and the no-public-internet constraints.

Answer

Attach an IAM role to the instances and route Parameter Store calls through a NAT gateway.

Answer

Use an EC2 instance profile with a gateway VPC endpoint for Systems Manager.

Answer

Store IAM user access keys in AWS Secrets Manager and retrieve them from the instance at boot.

Question 14

A security team must ensure that all data written to a new Amazon S3 bucket is encrypted with a specific customer-managed AWS KMS key, and that any PUT request that does not specify that key is rejected. The team also needs to detect and react if someone attempts to change the bucket policy to remove the restriction. Which combination of actions meets these requirements with the LEAST operational effort?

Accepted Answer

Attach a bucket policy that denies s3:PutObject when the request lacks the required KMS key condition, enable AWS CloudTrail data events, and create an Amazon EventBridge rule that matches PutBucketPolicy API calls and invokes an AWS Lambda function.. A bucket policy with a Deny effect and the KMS key condition rejects any PUT that does not use the required key, which is the only option that enforces encryption at write time. Pairing CloudTrail data events with an EventBridge rule on the PutBucketPolicy API call provides automated detection and response to policy tampering without managing infrastructure.

Answer

Configure an S3 Lifecycle rule to re-encrypt objects with the required KMS key and use AWS Config with the s3-bucket-server-side-encryption-enabled managed rule.

Answer

Use an S3 access point with a custom policy that allows only the required key, and enable AWS Shield Advanced on the bucket.

Answer

Enable default bucket encryption with the required KMS key and turn on S3 Block Public Access at the account level.

Question 15

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application must be reachable only from a specific corporate CIDR range, and the instances must not be directly reachable from the internet. Which combination of security group configurations meets these requirements?

Accepted Answer

Allow inbound HTTP and HTTPS from the corporate CIDR range on the load balancer security group, and allow inbound HTTP from the load balancer security group on the instance security group.. The load balancer security group should allow only the corporate CIDR range on the listener ports, and the instance security group should allow traffic only from the load balancer security group. Referencing a security group as a source is the cleanest way to allow traffic from the load balancer without hardcoding its IP addresses, and it prevents direct client access to the instances.

Answer

Allow inbound HTTP and HTTPS from 0.0.0.0/0 on the load balancer security group, and allow inbound HTTP from the load balancer security group on the instance security group.

Answer

Allow inbound HTTP and HTTPS from the corporate CIDR range on the instance security group, and allow outbound traffic to the load balancer security group.

Answer

Allow inbound HTTP and HTTPS from the corporate CIDR range on both the load balancer security group and the instance security group.