SAA-C03 Design Secure Architectures Practice Test 3 — 15 Questions

Question 1

A platform team wants application developers to create IAM roles for their ECS tasks, but security must guarantee that no role created by those developers can ever exceed a predefined permission set. The developers also should not be able to attach broader permissions to themselves later. What should the team implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an IAM permission boundary on the developer principals and require created roles to include the boundary.. IAM permission boundaries allow the platform team to define a maximum set of permissions that any role created by the developers can have. By attaching a permission boundary to the developers' IAM user or role, and requiring that any new role they create includes that boundary, the developers cannot grant permissions beyond the boundary—even if they attach a broader policy. This ensures that no role can ever exceed the predefined permission set, and developers cannot escalate their own privileges later.

Answer

Attach a customer-managed IAM policy to the developers and let them create roles freely.

Answer

Create a service-linked role for ECS and let developers reuse it for all workloads.

Answer

Add an S3 bucket policy that only allows tagged roles to be created.

Question 2

An engineering team runs application servers in private subnets. The instances must download patches and software packages from Amazon S3, but the company does not want the traffic to traverse the internet or a NAT gateway. Which design should they use?

Accepted Answer

Use an Amazon S3 gateway VPC endpoint in the route tables for the private subnets.. An S3 Gateway VPC endpoint allows instances in private subnets to access Amazon S3 without traversing the internet or a NAT gateway. The endpoint uses AWS’s internal network and is added to the route table of the private subnets, directing S3 traffic through the endpoint prefix list. This design meets the requirement of keeping traffic off the internet while providing secure, low-latency access to S3.

Answer

Add an internet gateway to the VPC and route private subnet traffic through it.

Answer

Use a security group rule that allows outbound traffic to the S3 public IP range.

Answer

Create a VPC peering connection to the S3 service VPC.

Question 3

Based on the exhibit, why is the IAM role still receiving AccessDenied even though it has AdministratorAccess attached?

Accepted Answer

The SCP is acting as a maximum permission guardrail, so its explicit deny overrides the IAM allow.. B is correct because Service Control Policies (SCPs) act as a maximum permission guardrail in AWS Organizations. Even if an IAM role has the AdministratorAccess policy attached, an SCP with an explicit deny on the ec2:CreateSnapshot action will override that allow, resulting in an AccessDenied error. SCPs are evaluated after IAM policies, and an explicit deny in an SCP cannot be overridden by any IAM allow.

Answer

AdministratorAccess is always evaluated before SCPs, so the SCP is ignored in production accounts.

Answer

The role needs a session duration of at least 12 hours before SCPs stop applying.

Answer

The account needs an AWS Config rule to approve the snapshot action before IAM can work.

Question 4

A startup has an HTTP API with highly unpredictable traffic from mobile devices. Each request performs lightweight validation, writes an event record, and triggers downstream notifications. The current EC2 fleet stays mostly idle, and the team wants to reduce infrastructure management and pay only for usage. Which two changes best fit the requirement? Select two.

Accepted Answer

Place Amazon API Gateway in front of AWS Lambda functions for request handling.. Amazon API Gateway can directly invoke AWS Lambda functions, eliminating the need to manage EC2 instances. This serverless architecture scales automatically with unpredictable traffic, and you pay only for the requests and compute time consumed, which aligns with the startup's goal of reducing idle costs and infrastructure management.

Answer

Keep the EC2 fleet and add more instances so the idle cost is less noticeable.

Answer

Move the API to an Application Load Balancer only, without changing compute.

Answer

Store runtime secrets in user data on each instance.

Question 5

A company runs a customer portal in us-east-1 and a warm standby in us-west-2. The DNS name must send users to us-east-1 while it is healthy and automatically switch to us-west-2 if the primary application endpoint stops responding. Which two actions should the architect take? Select two.

Accepted Answer

Create Route 53 failover records for the same DNS name with primary and secondary targets.. Route 53 failover routing allows you to configure active-passive failover by associating a primary and secondary record with the same DNS name. When the primary endpoint fails, Route 53 automatically returns the secondary record's IP address, directing traffic to the warm standby in us-west-2. This directly meets the requirement for automatic failover based on endpoint health.

Answer

Use latency-based routing so Route 53 always returns the lowest-latency Region.

Answer

Use weighted records with a 50/50 split to balance traffic across both Regions.

Answer

Place the standby application in a private hosted zone so only internal systems can resolve it.

Question 6

A web application uses Amazon RDS for MySQL in a Multi-AZ deployment. During a planned maintenance event, the team wants to understand which two statements about failover are accurate so they can design connection handling correctly. Which two statements are accurate? Select two.

Accepted Answer

RDS automatically promotes the synchronous standby in the same Region if the primary instance becomes unavailable.. In a Multi-AZ RDS for MySQL deployment, Amazon RDS automatically maintains a synchronous standby replica in a different Availability Zone. If the primary instance becomes unavailable due to a planned maintenance event or failure, RDS automatically fails over to the standby, promoting it to become the new primary. This failover is transparent to the application when using the same DNS endpoint, as RDS updates the DNS record to point to the new primary.

Answer

The standby instance can serve production read traffic to improve read scaling in standard RDS Multi-AZ.

Answer

The application must permanently change its connection string to a new host after failover completes.

Answer

Multi-AZ provides protection against a full Region outage without any additional design changes.

Question 7

A studio keeps 4 PB of completed video projects in Amazon S3. Editors work on active projects for about 60 days, auditors occasionally review the same objects for several months, and legal policy requires retention for 7 years. Retrieval of very old files can take hours. Which three actions should the architect recommend? Select three.

Accepted Answer

Transition objects to S3 Standard-IA after 60 days.. After 60 days of active editing, objects can be transitioned to S3 Standard-IA, which offers lower storage costs than S3 Standard while still providing low-latency retrieval for occasional access by auditors. This lifecycle policy optimizes cost without sacrificing availability for the review period.

Answer

Keep the files in S3 Standard indefinitely so retrieval is always fast.

Answer

Copy the files to a single EBS volume for lower per-GB cost.

Question 8

Several EC2 instances in different Availability Zones need to read and write the same shared file system. The file storage should stay available if one AZ has a problem. Which service should the team choose?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones. It is designed for high availability and durability by storing data redundantly across multiple AZs within a region, ensuring continued access even if one AZ fails.

Answer

Amazon EBS

Answer

Amazon S3 only

Answer

Instance store

Question 9

A single EC2 instance hosts a database that needs low-latency block storage and a persistent volume that remains attached to the instance. Which AWS storage service is the best fit?

Accepted Answer

Amazon EBS. Amazon EBS provides persistent block-level storage volumes that can be attached to a single EC2 instance, offering low-latency performance suitable for database workloads. Unlike ephemeral instance store volumes, EBS volumes persist independently of the instance's lifecycle, ensuring data durability even when the instance is stopped or terminated.

Answer

Amazon S3

Answer

Amazon EFS

Answer

AWS Storage Gateway

Question 10

A company runs a steady inventory API on AWS Fargate and AWS Lambda during the day, plus a nightly batch render farm on EC2 that can be interrupted and retried. The finance team wants the lowest predictable discount for the always-on compute and the lowest possible cost for the batch jobs. Which two purchasing choices should the architect recommend? Select two.

Accepted Answer

Purchase a Compute Savings Plan for the steady Fargate and Lambda usage.. A Compute Savings Plan offers the lowest predictable discount (up to 66% compared to On-Demand) and automatically applies to Fargate and Lambda usage, covering the always-on inventory API without requiring instance family or region commitments. This provides flexibility while still delivering significant savings over On-Demand pricing.

Answer

Purchase Standard Reserved Instances for the steady Fargate and Lambda usage.

Answer

Use On-Demand Instances for the batch render farm to avoid interruptions.

Answer

Move the render farm to Dedicated Hosts to improve price predictability.

Question 11

A team runs an application on Amazon EC2 that connects to an Aurora database. The database password must rotate automatically every 30 days, and the application should retrieve the current secret at runtime using an IAM role. Which AWS service is the best fit?

Accepted Answer

AWS Secrets Manager with rotation enabled.. AWS Secrets Manager is the best fit because it natively supports automatic rotation of database credentials on a schedule (e.g., every 30 days) and integrates directly with Amazon RDS/Aurora to update the password. The application can retrieve the current secret at runtime using an IAM role attached to the EC2 instance, without hardcoding credentials. Secrets Manager also provides built-in secret rotation with Lambda, ensuring zero downtime during password changes.

Answer

AWS Systems Manager Parameter Store standard parameters.

Answer

AWS KMS, because KMS stores credentials and rotates them automatically.

Answer

Amazon S3 with server-side encryption and versioning.

Question 12

A team runs a CPU-intensive image processing service on Amazon EC2. The service spends most of its time resizing and compressing images, and the team wants the best price-performance starting point for compute-heavy work. Which EC2 instance family should they choose?

Accepted Answer

Compute optimized instances. Compute optimized instances (C family) are designed for workloads that benefit from high-performance processors, such as batch processing, media transcoding, and image processing. Since the team's service is CPU-intensive (resizing and compressing images), the C family provides the best price-performance starting point for compute-heavy work.

Answer

Memory optimized instances

Answer

Storage optimized instances

Answer

General purpose instances

Question 13

A production application stores critical data on an Amazon EBS volume. The team wants a simple backup method that allows the volume to be restored later if the server is lost. What should they use?

Accepted Answer

Amazon EBS snapshots. Amazon EBS snapshots are the correct choice because they provide a simple, incremental backup method for EBS volumes. Snapshots capture the data on the volume at a specific point in time and are stored in Amazon S3, allowing the volume to be restored to a new EC2 instance if the original server is lost. This directly meets the requirement for a backup that enables restoration after server failure.

Answer

Amazon S3 bucket versioning

Answer

AWS Security Hub

Answer

Amazon CloudFront invalidations

Question 14

A Lambda function processes CPU-heavy JSON transformations and often runs slower than expected. The team wants to improve performance without changing the code. What should they try first?

Accepted Answer

Increase the Lambda memory setting. Increasing the Lambda memory setting allocates more CPU power proportionally, as AWS Lambda allocates CPU credits linearly with memory (up to 10,240 MB). For CPU-heavy JSON transformations, this directly reduces execution time without any code changes, making it the simplest and most effective first step.

Answer

Move the function to Amazon S3

Answer

Change the function to an ALB target

Answer

Disable CloudWatch logging

Question 15

A database administrator wants a regular backup of an Amazon RDS database so the team can restore to a recent point in time if needed. Which AWS feature should they use?

Accepted Answer

RDS automated backups and snapshots. Amazon RDS automated backups and snapshots provide the ability to restore a database to any point within the backup retention period (up to 35 days). Automated backups include transaction logs for point-in-time recovery, while manual snapshots are user-initiated backups stored until explicitly deleted. This directly meets the requirement for regular backups and point-in-time restore capability.

Answer

Amazon Route 53 alias records

Answer

Security groups

Answer

AWS WAF rules