SAA-C03 Design Secure Architectures Practice Test 3 — 15 Questions

Question 1

Based on the exhibit, the platform team wants developers to create application roles for Lambda and ECS, but no developer-created role may ever exceed the approved permission set. Which change best meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach a permissions boundary strategy to the delegated workflow and require every created role to include that boundary using the iam:PermissionsBoundary condition.. It uses a permissions boundary to enforce the maximum permission set that any developer-created role can have. By attaching a permissions boundary to the delegated workflow and using the `iam:PermissionsBoundary` condition in the trust policy, every role created by developers is automatically constrained to the approved boundary, preventing any role from exceeding the approved permission set even if the developer tries to attach additional policies.

Answer

Remove all IAM permissions from AppProvisioner and require a central security team to create every role manually.

Answer

Allow developers to keep creating roles, but add a CloudTrail rule that alerts security after a privileged policy is attached.

Answer

Move the delegated IAM workflow into a separate VPC and restrict it with security groups and network ACLs.

Question 2

A central security account stores encrypted log files in S3 using a customer managed AWS KMS key. A partner account already has S3 bucket access through an assumed role and now must also be able to encrypt and decrypt objects that use the same KMS key. Which two actions are required? Select two.

Accepted Answer

Update the KMS key policy to allow the partner role or account to use the key.. The KMS key policy must explicitly grant the partner account or its assumed role permission to use the key for cryptographic operations. Without this cross-account policy statement, the partner account cannot access the key even if it has IAM permissions, as KMS key policies are the primary access control mechanism for cross-account usage.

Answer

Enable automatic key rotation to solve the cross-account access requirement.

Answer

Replace the CMK with the AWS managed key alias/aws/s3.

Answer

Export the KMS key material and share it with the partner account.

Question 3

A containerized web service on Amazon ECS reads a database password at startup. Today, the password is stored in a plain environment variable and updated manually. Auditors require that credentials: (1) are encrypted at rest using AWS-managed controls, (2) can be rotated without redeploying the task definition, and (3) are accessible only to the running task via least-privilege permissions.

Which solution best meets these requirements?

Accepted Answer

Store the password in AWS Secrets Manager. Configure rotation for the secret. Grant the ECS task role secretsmanager:GetSecretValue for only that secret ARN. Update the application to fetch the secret at runtime and cache it briefly.. AWS Secrets Manager provides automatic rotation of secrets without redeploying the task definition, encryption at rest via AWS KMS, and fine-grained IAM permissions. By granting the ECS task role only `secretsmanager:GetSecretValue` for the specific secret ARN, the application can fetch the password at runtime, meeting all three audit requirements.

Answer

Store the password in Systems Manager Parameter Store as a SecureString and grant the ECS task role GetParameter only for that parameter ARN. Have the application call GetParameter on each request or on a short refresh interval.

Answer

Store the password in a local file within the container image and mount it as a Docker secret at build time to avoid environment variables.

Answer

Store the password in an S3 bucket with server-side encryption and allow all ECS tasks to read it using a broad IAM policy on the bucket prefix.

Question 4

A data lake stores raw files in a single Amazon S3 bucket that is shared by three internal analytics teams. Each team should access only its own prefix, and the company wants to eliminate ACL management because objects come from multiple producers. Which three changes should the architect make? Select three.

Accepted Answer

Create a separate S3 access point for each team and scope it to that team’s prefix.. S3 Access Points allow you to create network endpoints with dedicated access policies scoped to specific prefixes. By creating one access point per team and restricting each to its own prefix, you enforce team-level isolation without managing ACLs on individual objects.

Answer

Leave ACLs enabled so each producer can grant permissions directly on uploaded objects.

Answer

Make the bucket public and rely on application-layer authorization for data protection.

Question 5

A company stores customer invoices in an Amazon S3 bucket. The application must keep the bucket private, ACLs should not be used, and customers should receive temporary download links for individual invoices. Which three changes should the architect make? Select three.

Accepted Answer

Enable S3 Block Public Access on both the bucket and the AWS account.. Enabling S3 Block Public Access at both the bucket and account level ensures that no public access is granted to the bucket or its objects, which aligns with the requirement to keep the bucket private. This setting overrides any other permissions that might inadvertently allow public access, providing a strong security baseline.

Answer

Continue using object ACLs so each customer invoice can be made public briefly.

Answer

Move the bucket to another AWS Region to isolate it from the internet.

Question 6

A retail company lets developers deploy ECS services but they must never be able to modify IAM. The team currently uses an IAM user per developer with an admin-like policy, and several access keys have been leaked. You are asked to redesign access so that: (1) developers authenticate with temporary credentials, (2) they can create/update ECS services and related autoscaling resources, and (3) IAM changes are impossible even if a developer tries to attach new policies.

Which design best meets all requirements?

Accepted Answer

Use an IAM role that developers assume for deployments; attach least-privilege policies for ECS and Auto Scaling; and attach a permission boundary that does not allow iam:* actions, so additional inline or managed policies cannot grant IAM permissions.. It uses an IAM role with temporary credentials (via AWS STS AssumeRole), satisfying the requirement to avoid long-lived access keys. The least-privilege policies for ECS and Auto Scaling grant only the necessary permissions, while the permission boundary explicitly denies iam:* actions, preventing developers from escalating privileges by attaching new policies. This combination ensures developers can deploy ECS services but cannot modify IAM in any way.

Answer

Create an IAM user for each developer and keep the existing broad permissions, rotating keys every 90 days.

Answer

Attach a policy that allows ecs:* and autoscaling:* and rely on developers to self-review that no IAM statements are added to their roles.

Answer

Create a single shared IAM role with full administrator permissions so developers can troubleshoot faster when deployments fail.

Question 7

A company runs an application in private subnets (no inbound internet). The application must access Amazon S3 and AWS Secrets Manager endpoints without routing through the public internet and without exposing the instances to NAT gateways due to cost. Security requirements also state that only the required VPC traffic should be allowed to reach AWS services.

Which architecture best satisfies these requirements?

Accepted Answer

Add a VPC gateway endpoint for S3 and an interface VPC endpoint for Secrets Manager; keep instances in private subnets and configure security group rules attached to the endpoints to allow inbound traffic only from the application subnets.. It uses a VPC gateway endpoint for Amazon S3 and an interface VPC endpoint for AWS Secrets Manager, both of which allow private subnet instances to access these services without traversing the public internet or requiring a NAT gateway. The security group rules attached to the interface endpoint restrict inbound traffic to only the application subnets, satisfying the security requirement of allowing only required VPC traffic. This architecture meets all constraints: no public internet, no NAT gateway cost, and least-privilege access.

Answer

Place instances in private subnets but use NAT gateways so traffic to S3 and Secrets Manager goes through the internet; restrict security groups to instance-to-instance only.

Answer

Use public subnets with instances that have no security group rules; rely on AWS services to reject unauthorized traffic.

Answer

Create an S3 bucket policy that allows requests from the application instances’ private IP addresses and enable public access to Secrets Manager via the default service endpoint.

Question 8

A containerized service on Amazon ECS connects to a database with a password that must never be stored in plaintext or hardcoded in the image. The application reads the password at startup and occasionally reconnects later, so it needs to retrieve the current secret when needed. Which three actions should the architect take? Select three.

Accepted Answer

Store the database password in AWS Secrets Manager.. AWS Secrets Manager is the correct service for securely storing and automatically rotating database credentials. It eliminates the need to hardcode secrets in the container image or store them in plaintext. The application retrieves the secret at runtime via the AWS SDK, ensuring the current password is always used.

Answer

Store the password in a plain environment variable and update it manually during maintenance windows.

Answer

Use an IAM user access key inside the container so the database password can be embedded in code.

Question 9

A media platform stores originals in an S3 bucket. The application must: (1) prevent any public access to the bucket, (2) allow authenticated users to upload and download objects using presigned URLs, and (3) enforce that all requests use HTTPS and only touch objects under the user-specific prefix (for example, s3://media-originals/user-123/*). The bucket currently allows uploads but sometimes returns 403 AccessDenied for presigned URLs.

Which change is the best fix while meeting the security requirements?

Accepted Answer

Keep Block Public Access enabled, remove any Allow statement to Principal="*", and use a bucket policy or access point policy that denies non-HTTPS requests and allows PutObject/GetObject only when the object key matches the authenticated user's session tag, such as arn:aws:s3:::media-originals/${aws:PrincipalTag/userId}/*.. It keeps S3 Block Public Access enabled (preventing any public access), uses a bucket policy or access point policy with a condition key like `aws:PrincipalTag` to restrict `PutObject`/`GetObject` to the user-specific prefix (e.g., `arn:aws:s3:::media-originals/${aws:PrincipalTag/userId}/*`), and denies non-HTTPS requests via a `aws:SecureTransport` condition. This ensures presigned URLs work only for authenticated users with the correct session tag, while eliminating the 403 errors caused by overly restrictive policies or missing principal restrictions.

Answer

Disable S3 Block Public Access and add an ACL that grants READ and WRITE to the bucket owner only.

Answer

Use bucket website hosting and allow public GET requests so presigned URLs are not needed for downloads.

Answer

Use ACLs to grant ObjectOwner full control and rely on the application to generate presigned URLs with longer expirations to avoid 403 errors.

Question 10

Based on the exhibit, a partner account uploads encrypted objects to a central S3 bucket and later reads them back. The S3 permissions are correct, but the requests still fail. What change is required so the partner workload can use the customer-managed KMS key safely?

Accepted Answer

Update the CMK key policy, or add a tightly scoped grant, to allow the partner role the required KMS actions through S3.. When using a customer-managed KMS key (CMK) for SSE-KMS in a cross-account scenario, the key policy must explicitly grant the partner account's IAM role the necessary KMS actions (kms:Decrypt, kms:GenerateDataKey) to allow S3 to perform the encryption/decryption on behalf of the partner. Without this policy update or a tightly scoped grant, the KMS service will deny the request even if S3 bucket policies are correctly configured.

Answer

Replace SSE-KMS with S3 object ACLs so the partner account can bypass KMS authorization.

Answer

Create a new bucket in the partner account and copy the objects there to avoid cross-account encryption.

Answer

Switch the bucket to SSE-S3 so the partner role no longer needs KMS permissions.

Question 11

Based on the exhibit, the platform team wants developers to create application roles for Lambda and ECS, but no developer-created role may ever exceed the approved permission set. Which change best meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach a permissions boundary strategy to the delegated workflow and require every created role to include that boundary using the iam:PermissionsBoundary condition.. It uses an IAM permissions boundary attached to the delegated role creation workflow, combined with the `iam:PermissionsBoundary` condition key to enforce that every developer-created role must include that boundary. This ensures no role can exceed the approved permission set, as the boundary acts as a maximum limit on permissions, even if the role's policy grants more. The delegated workflow (e.g., AWS Service Catalog or IAM Role creation via Lambda) can create roles, but the boundary prevents any escalation beyond the predefined scope.

Answer

Remove all IAM permissions from AppProvisioner and require a central security team to create every role manually.

Answer

Allow developers to keep creating roles, but add a CloudTrail rule that alerts security after a privileged policy is attached.

Answer

Move the delegated IAM workflow into a separate VPC and restrict it with security groups and network ACLs.

Question 12

An administrator needs the ability to read and update infrastructure for a specific AWS account, but only when using MFA. The security team wants to eliminate long-lived administrator access keys and ensure that even if someone obtains temporary session credentials, actions are only allowed with MFA present.

Which IAM design best meets these requirements?

Accepted Answer

Create an IAM role for administration and use a permissions policy that allows only the required read/write actions. Add a condition to deny all allowed actions unless aws:MultiFactorAuthPresent is true.. It uses an IAM role with a permissions policy that includes a condition key `aws:MultiFactorAuthPresent` set to `true`. This ensures that any API call made using temporary credentials from the role requires MFA to be present, eliminating long-lived access keys and enforcing MFA for every action. The role-based approach also aligns with the principle of least privilege by scoping actions to only required read/write operations.

Answer

Create an IAM user for administrators with AdministratorAccess and require MFA only at the IAM user login.

Answer

Attach policies to an IAM user that allow read/write actions and enable MFA in the account, but do not use condition keys in IAM policies.

Answer

Use a role with the correct actions but enforce MFA only in the application by prompting users for an OTP before every API call.

Question 13

Based on the exhibit, a workload in private subnets must reach only Amazon S3 and AWS Secrets Manager. The team wants to eliminate internet exposure for those calls and reduce NAT gateway charges. What change should be made?

Accepted Answer

Create an S3 gateway endpoint and a Secrets Manager interface endpoint with private DNS, then remove NAT dependency for those service calls.. VPC Gateway Endpoints for S3 and VPC Interface Endpoints for Secrets Manager allow private subnet instances to access these services over the AWS network without traversing the internet or a NAT gateway. Enabling private DNS on the interface endpoint ensures that standard DNS names resolve to private IPs, eliminating the need for NAT and reducing costs.

Answer

Move the instances into a public subnet and restrict inbound access with security groups.

Answer

Add a NAT instance and disable the managed NAT gateway to lower cost.

Answer

Use VPC peering to a shared services VPC and route all AWS service traffic through that VPC.

Question 14

Your company has an internal service hosted behind a Network Load Balancer (NLB) in VPC 10.0.0.0/16. A consumer team in a different VPC (10.1.0.0/16) must call the service without using the public internet. You want private connectivity using AWS PrivateLink. Which configuration best enables least-privilege access while keeping the traffic private?

Accepted Answer

Create a VPC endpoint (interface endpoint) in the consumer VPC that points to the service name published by the provider account, and limit allowed clients using the endpoint’s security group rules.. AWS PrivateLink uses an interface VPC endpoint in the consumer VPC to connect privately to a Network Load Balancer (NLB) in the provider VPC, keeping traffic within the AWS network. The endpoint’s security group acts as a stateful firewall to restrict which clients in the consumer VPC can access the service, enforcing least-privilege access. This eliminates exposure to the public internet and avoids complex routing or gateway configurations.

Answer

Expose the NLB with an Internet Gateway route and restrict access using a security group attached to the NLB.

Answer

Create an S3 Gateway endpoint in the consumer VPC and store the service hostname in SSM Parameter Store so clients can resolve privately.

Answer

Use a bastion host in the provider VPC and allow the consumer VPC to SSH to it; from there, the consumer makes HTTP calls to the NLB.

Question 15

A CI/CD pipeline needs to deploy to your production environment. Security requires that the pipeline uses temporary credentials (not long-lived access keys) and only has permissions to read a specific set of parameters from AWS Systems Manager Parameter Store and write application logs to CloudWatch Logs. What is the best AWS approach?

Accepted Answer

Create an IAM role in the production account, grant least-privilege policies, and let the CI assume it using STS AssumeRole.. It uses an IAM role with least-privilege policies that the CI/CD pipeline can assume via AWS STS AssumeRole, generating temporary credentials that automatically expire. This eliminates the need for long-lived access keys and adheres to the security requirement of using temporary credentials. The role's policies can be scoped to exactly read specific parameters from Systems Manager Parameter Store and write logs to CloudWatch Logs.

Answer

Create an IAM user for the pipeline and store access keys in the CI system.

Answer

Attach the required permissions to an IAM group and add the pipeline’s principal to that group directly.

Answer

Use AWS KMS to encrypt the pipeline’s access keys and store the ciphertext in the CI system.