SAA-C03 Design Secure Architectures Practice Test 29 — 15 Questions

Question 1

A company runs a three-tier web application on AWS. The database tier uses Amazon Aurora MySQL, and the application tier runs on Amazon EC2 instances behind an Application Load Balancer. A security audit reveals that the database credentials are stored in plaintext in a configuration file on the EC2 instances, and the same credentials have been in use for over a year. The security team must eliminate hardcoded credentials and ensure automatic rotation of the database password every 30 days without modifying application code to handle rotation events. Which solution meets these requirements with the LEAST operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Store the database credentials in AWS Secrets Manager and enable automatic rotation using a Lambda rotation function. Grant the EC2 instance role permission to call secretsmanager:GetSecretValue.. AWS Secrets Manager is designed for this exact use case: it stores database credentials securely and provides managed rotation for Amazon Aurora MySQL without custom code. The EC2 instance role grants access to the secret, and the application retrieves it at runtime. This removes hardcoded credentials and automates password rotation every 30 days, meeting the requirements with minimal operational effort.

Answer

Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter and configure automatic rotation using a custom Lambda function that updates the parameter.

Answer

Store the database credentials in an encrypted Amazon S3 object and use an AWS Lambda function triggered by Amazon EventBridge to rotate the password and update the object every 30 days.

Answer

Use IAM database authentication for Aurora MySQL so that the EC2 instances authenticate using their IAM role, eliminating the need for a database password.

Question 2

A company runs a containerized application on Amazon ECS on AWS Fargate. The application must read from an Amazon DynamoDB table and write logs to Amazon CloudWatch Logs. Security policy requires that the application use only temporary credentials and that each task have the least privilege needed. What should the company configure?

Accepted Answer

Attach a task IAM role to the ECS task definition that grants DynamoDB read access and CloudWatch Logs write access.. An ECS task IAM role delivers temporary credentials to the application inside the container and scopes permissions to the specific needs of the task. This satisfies the temporary-credential policy and enforces least privilege. The task execution role serves the ECS agent, not the application, and Fargate has no customer-visible instance profile to attach.

Answer

Attach an EC2 instance profile to the underlying Fargate host so containers inherit its permissions.

Answer

Use the ECS task execution role to grant the application access to DynamoDB and CloudWatch Logs.

Answer

Store IAM user credentials in AWS Secrets Manager and inject them into the container as environment variables.

Question 3

A company runs an EC2 Auto Scaling group behind an internet-facing Application Load Balancer. The security team must ensure that the instances accept HTTP traffic only from the ALB and never directly from the internet, while the ALB itself must accept traffic only from a specific corporate CIDR range. Which combination of security group configurations should a solutions architect implement?

Accepted Answer

Create an inbound rule on the instance security group allowing TCP 80 from the ALB's security group, and an inbound rule on the ALB security group allowing TCP 80 from the corporate CIDR range.. The secure pattern is to make the instances trust only the load balancer by referencing the ALB's security group as the source, and to make the ALB trust only the intended clients by scoping its inbound rule to the corporate CIDR range. This creates a chained trust model where the instances never accept direct internet connections and the ALB is not exposed beyond the approved network range.

Answer

Create an inbound rule on the instance security group allowing TCP 80 from 0.0.0.0/0, and an inbound rule on the ALB security group allowing TCP 80 from the corporate CIDR range.

Answer

Create an inbound rule on the instance security group allowing TCP 80 from the corporate CIDR range, and an inbound rule on the ALB security group allowing TCP 80 from the ALB's security group.

Answer

Create an inbound rule on the instance security group allowing TCP 80 from the corporate CIDR range, and an inbound rule on the ALB security group allowing TCP 80 from 0.0.0.0/0.

Question 4

A company needs to give an external auditing firm read-only access to specific objects in an Amazon S3 bucket for 30 days. The firm has its own AWS account and should not receive long-term credentials. The company wants to minimize the blast radius if the firm's account is compromised. Which two steps should the company take? (Choose two.)

Accepted Answer

Create an IAM role in the company account with a trust policy that allows the auditing firm's AWS account to assume it, and attach a policy granting s3:GetObject on the specific object prefix.. Cross-account temporary access is best implemented with an IAM role in the resource account that the external account assumes. Scoping the role policy to the specific prefix and requiring sts:AssumeRole with a maximum session duration and an external ID limits what a compromised external account can do and prevents the confused deputy problem. Long-term IAM users and public buckets fail the security goals.

Answer

Create an IAM user in the company account for the auditing firm and email the access key and secret key to the firm's security contact.

Answer

Attach an S3 bucket policy that grants s3:GetObject to the auditing firm's IAM user ARN, and disable S3 Block Public Access to allow the cross-account policy to work.

Answer

Make the S3 bucket public and share the object URLs with the auditing firm so no AWS credentials are needed.

Question 5

A company has a VPC with a CIDR block of 10.0.0.0/16. The company wants to allow its EC2 instances in a private subnet to access Amazon S3 without traversing the public internet. The company also wants to minimize data transfer costs. Which solution should a solutions architect recommend?

Accepted Answer

Create a gateway VPC endpoint for Amazon S3 and update the route tables for the private subnets to use the endpoint.. A gateway VPC endpoint for Amazon S3 is the correct choice because it provides private connectivity from the VPC to S3 without using the public internet and is free of charge. Updating the route tables ensures that traffic to S3 is directed through the endpoint, meeting both the private access and cost minimization requirements.

Answer

Configure an AWS Site-to-Site VPN connection to an on-premises data center that has a direct connection to Amazon S3.

Answer

Create an interface VPC endpoint for Amazon S3 in the VPC and update the route tables to use the endpoint.

Answer

Attach an internet gateway to the VPC and configure a NAT gateway in a public subnet to allow outbound traffic to Amazon S3.

Question 6

A company uses AWS Organizations with multiple accounts. A security engineer must ensure that no IAM user in any member account can create an access key for the root user or perform any action as the root user, even if an administrator in that account tries to allow it. What should the security engineer do?

Accepted Answer

Attach a service control policy to the organization root or OUs that denies all actions when the principal is the root user, and denies iam:CreateAccessKey for the root user.. A service control policy attached to the organization root or the relevant OUs is evaluated for all member account principals, including the root user. Denying root user actions and iam:CreateAccessKey for the root user enforces the restriction regardless of local administrator intent. Detective tools like IAM Access Analyzer and AWS Config, and authentication controls like MFA, do not block the action.

Answer

Enable AWS IAM Access Analyzer in each member account and review findings for root user access keys.

Answer

Enable multi-factor authentication for the root user in every member account and require it for all IAM users through a password policy.

Answer

Configure an AWS Config managed rule in each account that checks for root user access keys and sends an Amazon SNS notification to the security team.

Question 7

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must be accessible only to users from a specific IP range, and the company wants to protect against common web exploits such as SQL injection and cross-site scripting. The company also wants to monitor and rate-limit requests from specific IP addresses. Which solution should a solutions architect implement?

Accepted Answer

Configure an AWS WAF web ACL with rules for IP matching, SQL injection, and cross-site scripting, and associate it with the ALB. Use rate-based rules to limit requests from specific IPs.. AWS WAF integrated with the ALB provides the required protections: IP matching to restrict access to a specific IP range, managed rules for SQL injection and cross-site scripting, and rate-based rules to limit requests from specific IPs. This solution directly addresses all requirements without unnecessary components.

Answer

Deploy AWS Firewall Manager to create a security policy that includes AWS WAF rules for IP matching and rate limiting, and apply it to the ALB.

Answer

Configure an Amazon CloudFront distribution in front of the ALB, use AWS WAF with the CloudFront distribution, and set up geo-restriction to allow only specific IPs.

Answer

Use security groups on the ALB to allow traffic only from the specific IP range, and enable AWS Shield Advanced for protection against web exploits.

Question 8

A solutions architect must store application configuration data in AWS Systems Manager Parameter Store. Compliance requires that the values be encrypted with a key the company controls and can rotate on demand, and that only a specific IAM role used by the application can decrypt them. Which configuration meets these requirements?

Accepted Answer

Create SecureString parameters using a customer managed KMS key, grant the application role ssm:GetParameter and kms:Decrypt on that key, and restrict the key policy to the application role.. Meeting the requirements needs two things at once: a customer managed KMS key so the company controls rotation and the key policy, and the right pair of permissions so the application can both read the parameter and decrypt it. SecureString is the only parameter type that encrypts values with KMS, and scoping the key policy to the application role enforces least privilege.

Answer

Create SecureString parameters using the default aws/ssm key, and grant the application role ssm:GetParameter.

Answer

Create SecureString parameters using a customer managed KMS key, and grant the application role only kms:Decrypt on that key.

Answer

Create String parameters using a customer managed KMS key, and grant the application role ssm:GetParameter and kms:Decrypt on that key.

Question 9

A company runs a two-tier web application on Amazon EC2 instances in a public subnet. The EC2 instances must access an Amazon Aurora MySQL DB cluster in private subnets. A security engineer must ensure that only the web tier can reach the database on port 3306, and that no other resources in the VPC can connect. Which combination of security group configuration and subnet placement should the engineer implement?

Accepted Answer

Attach a security group to the Aurora cluster that allows inbound TCP 3306 from the security group attached to the EC2 instances, and place the Aurora cluster in private subnets.. The secure pattern is to keep the database in private subnets and use a security group inbound rule that references the web tier's security group as the source. Security group references are evaluated dynamically, so only instances carrying that group can open a connection on the database port, and private subnet placement prevents any inbound path from the internet.

Answer

Attach a security group to the Aurora cluster that allows inbound TCP 3306 from the CIDR block of the public subnet, and place the Aurora cluster in private subnets.

Answer

Attach a security group to the Aurora cluster that allows inbound TCP 3306 from the security group attached to the EC2 instances, and place the Aurora cluster in the same public subnet as the EC2 instances.

Answer

Attach a network ACL to the private subnets that allows inbound TCP 3306 from the public subnet CIDR block, and rely on the default security group for the Aurora cluster.

Question 10

A company stores sensitive documents in an Amazon S3 bucket and must ensure that every object is encrypted at rest with keys that the company can audit and rotate. The security team also wants to detect and automatically respond if anyone attempts to disable encryption on the bucket. Which approach best satisfies these goals?

Accepted Answer

Enable default encryption with SSE-KMS using a customer managed key, block public access, and use AWS CloudTrail with an Amazon EventBridge rule and AWS Lambda to remediate unauthorized changes.. The requirements combine key control with automated detection and response. Customer managed KMS keys provide auditable, rotatable encryption, while CloudTrail captures the configuration API calls and EventBridge plus Lambda turn those events into automatic remediation. Block Public Access is a useful hardening step but is not the mechanism that detects an encryption change.

Answer

Enable default encryption with SSE-S3 and turn on S3 server access logging to a separate bucket.

Answer

Enable default encryption with SSE-KMS using an AWS managed key and enable S3 Block Public Access at the account level.

Answer

Require client-side encryption before upload and enable versioning on the bucket to preserve prior object states.

Question 11

A company has a critical application running on Amazon EC2 instances that must access an Amazon RDS for MySQL database. The security team requires that the database credentials are never stored on the EC2 instances and that access to the database is auditable. The database is in a private subnet and only accepts connections from the application's security group. The company wants to implement a solution that automatically rotates the database password every 90 days. Which solution meets these requirements?

Accepted Answer

Store the database credentials in AWS Secrets Manager with automatic rotation enabled. Configure the EC2 instance role to allow secretsmanager:GetSecretValue, and have the application retrieve the secret at runtime.. AWS Secrets Manager is the managed service designed for storing and rotating database credentials. It provides automatic rotation for Amazon RDS for MySQL, integrates with IAM for access control, and logs access via CloudTrail. The EC2 instances retrieve the secret at runtime, so credentials are never stored locally. This meets the no-hardcoded-credentials, automatic rotation, and auditability requirements.

Answer

Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter. Use a custom Lambda function to rotate the password every 90 days and update the parameter.

Answer

Use IAM database authentication for Amazon RDS for MySQL. Configure the EC2 instance role with rds-db:connect permission, and have the application generate an authentication token.

Answer

Store the database credentials in an encrypted Amazon S3 bucket. Use an AWS Lambda function triggered by Amazon EventBridge to rotate the password every 90 days and update the S3 object.

Question 12

A security team stores sensitive documents in an Amazon S3 bucket that is encrypted with SSE-KMS using a customer managed key. An auditor requires that every object upload be traceable to the IAM principal that performed it and that the key's usage be independently auditable. The team also wants to prevent any principal, including account administrators, from reading objects without a corresponding key grant. Which configuration combination meets these requirements?

Accepted Answer

Enable AWS CloudTrail data events for the S3 bucket, enable CloudTrail management events for KMS, and ensure the key policy delegates usage only to explicitly named roles.. Object-level traceability requires CloudTrail data events on the bucket, and independent key auditing requires CloudTrail management events on KMS so that Encrypt and Decrypt calls appear in the log. Limiting the key policy to named roles creates a second authorization boundary, so possession of S3 permissions alone is insufficient to read the encrypted objects.

Answer

Enable AWS CloudTrail data events for the S3 bucket, enable KMS key rotation, and apply a bucket policy that requires the aws:SecureTransport condition.

Answer

Enable S3 server access logging to a separate bucket, enable S3 default encryption with SSE-S3, and attach a bucket policy that denies unencrypted uploads.

Answer

Enable S3 Object Lock in compliance mode, enable CloudTrail management events for S3, and use a key policy that grants kms:Decrypt to the account root user.

Question 13

A financial analytics team stores sensitive customer data in an Amazon S3 bucket. The bucket uses SSE-KMS with a customer-managed key. Analysts access objects using an IAM role attached to an EC2 instance in a private subnet. The role has s3:GetObject permission on the bucket. However, analysts report AccessDenied errors when downloading objects. The KMS key policy currently grants full access to the account root user only. What is the most likely cause of the AccessDenied errors?

Accepted Answer

The IAM role lacks the kms:Decrypt permission on the customer-managed KMS key used for SSE-KMS.. Objects encrypted with SSE-KMS using a customer-managed key require the caller to have kms:Decrypt permission on that key. The EC2 role has s3:GetObject but no KMS permissions, and the key policy grants access only to the account root. S3 evaluates both the S3 and KMS permissions when serving the object. Without kms:Decrypt, S3 returns AccessDenied even though the S3 permission is present.

Answer

The S3 bucket is configured with default encryption using SSE-S3, which conflicts with SSE-KMS and causes decryption failures.

Answer

The S3 bucket policy does not explicitly allow the IAM role to perform s3:GetObject.

Answer

The EC2 instance's security group does not allow outbound HTTPS traffic to the AWS KMS endpoint.

Question 14

A startup runs a public-facing web application on Amazon EC2 instances behind an Application Load Balancer. The application must call AWS APIs such as Amazon DynamoDB and Amazon S3. A security engineer must ensure that no long-term AWS credentials are stored on the instances and that each instance receives credentials automatically. Which solution should the engineer use?

Accepted Answer

Attach an IAM role for Amazon EC2 to an instance profile and associate it with each instance so the SDK retrieves temporary credentials from the instance metadata service.. Associating an IAM role with the instances through an instance profile lets the AWS SDK obtain temporary, automatically rotated credentials from the instance metadata service. This removes the need to store access keys on the instances, limits permissions to what the role allows, and satisfies the requirement that each instance receives credentials without manual handling.

Answer

Store an IAM user access key and secret key in AWS Systems Manager Parameter Store as a SecureString and retrieve them at instance boot.

Answer

Configure the instances to call AWS Security Token Service AssumeRole with a shared secret stored in an encrypted Amazon EBS volume.

Answer

Create an IAM user per instance, generate access keys, and rotate them every 90 days using a scheduled AWS Lambda function.

Question 15

A healthcare company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application must be accessible only to users connecting from a specific corporate IP range, and all traffic must be encrypted in transit. The security team wants to enforce these requirements at the load balancer level without modifying the application. Which combination of steps should a solutions architect take?

Accepted Answer

Configure an HTTPS listener on the ALB with an AWS Certificate Manager certificate, and attach a security group that allows inbound HTTPS only from the corporate IP range.. To encrypt traffic in transit and restrict access to a corporate IP range at the ALB, use an HTTPS listener with an ACM certificate and a security group that allows inbound 443 only from the corporate CIDR. The ALB security group provides stateful, resource-level filtering. This meets both requirements without application changes and is the standard secure architecture for internet-facing ALBs.

Answer

Configure an HTTPS listener on the ALB and use a network ACL on the public subnets to allow only the corporate IP range on port 443.

Answer

Configure an HTTPS listener on the ALB and enable AWS Shield Advanced to allow only the corporate IP range.

Answer

Configure an HTTP listener on the ALB and use AWS WAF to block requests from IPs outside the corporate range.