SAA-C03 Design Secure Architectures Practice Test 5 — 15 Questions

Question 1

A service reads encrypted data from Amazon S3. The S3 objects use a customer-managed CMK. The IAM role used by the service has kms:Decrypt in its identity policy, but decryption fails with a KMS error stating the role is not authorized to perform kms:CreateGrant. The CMK’s key policy allows kms:Decrypt for the role but does not include kms:CreateGrant. What is the most appropriate change to resolve the failure while preserving least privilege?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add kms:CreateGrant permission to the CMK key policy for the role (scoped to the necessary CMK), keeping other KMS permissions minimal.. The error indicates that the service requires a grant to allow the KMS key to be used in a cryptographic operation that involves a grant-based workflow (e.g., using the S3 bucket key or cross-account access). The IAM role has kms:Decrypt, but the key policy does not grant kms:CreateGrant, which is necessary for the service to create a grant on the CMK. Adding kms:CreateGrant to the key policy scoped to the role resolves the failure while adhering to least privilege by only granting the minimum additional permission needed.

Answer

Enable key rotation because it makes grant creation unnecessary.

Answer

Add kms:DescribeKey to the key policy and remove kms:Decrypt to reduce permissions.

Answer

Update the IAM role to use kms:ScheduleKeyDeletion so future decrypt attempts succeed.

Question 2

A microservice running in ECS retrieves a secret from AWS Secrets Manager. The secret is encrypted with a customer-managed CMK. An administrator re-keyed the secret to a new CMK (the key ARN changed), but kept the same KMS alias name. After re-keying, the service fails with an error from KMS: AccessDenied for kms:Decrypt. The ECS task role’s IAM policy still grants kms:Decrypt but only for the old CMK ARN. What is the best remediation to restore access while maintaining least privilege?

Accepted Answer

Update the ECS task role IAM policy to grant kms:Decrypt on the CMK alias ARN (arn:aws:kms:region:account-id:alias/<alias-name>) or to include the new CMK ARN, so decrypt authorization matches the re-keyed CMK.. The ECS task role's IAM policy still references the old CMK ARN, but the secret is now encrypted with a new CMK. Since KMS authorization is based on the key ARN (not the alias), the policy must be updated to grant kms:Decrypt on the new CMK ARN or on the alias ARN (which resolves to the current underlying key). This restores access while maintaining least privilege by scoping permissions to the specific key used for decryption.

Answer

Update the IAM policy to allow kms:Decrypt for all CMKs in the account using a wildcard resource (for example, arn:aws:kms:region:account-id:key/*).

Answer

Change the application to decrypt the secret itself using SSE-C keys so Secrets Manager no longer needs KMS.

Answer

Enable KMS key rotation for the old CMK so the CMK ARN resolves to the new key.

Question 3

A customer-managed KMS key (CMK) encrypts SQS messages. A consumer service uses an IAM role that includes kms:Decrypt permission for that CMK. After a security change, the consumer fails with: "AccessDeniedException: kms:Decrypt is not allowed" CloudTrail indicates the KMS request is reaching KMS, but the CMK key policy no longer includes the consumer role (or its principal). What is the best fix?

Accepted Answer

Update the CMK key policy to allow the consumer role principal to perform kms:Decrypt on the CMK.. The error indicates that the KMS key policy explicitly denies the consumer role's kms:Decrypt request. Since KMS key policies are the primary access control for CMKs, adding the consumer role principal with kms:Decrypt permission resolves the issue. The CloudTrail log confirms the request reaches KMS, so the problem is solely the missing key policy statement.

Answer

Update only the consumer role identity policy because identity policies always override key policies.

Answer

Enable default encryption on SQS so that KMS permissions are no longer required.

Answer

Create an S3 bucket policy statement allowing kms:Decrypt because the messages are stored in S3.

Question 4

Company A (account 1111) hosts an IAM role (RoleInAccountA) that is assumed by a workload in Company B (account 2222) using sts:AssumeRole. Security requires that only Company B’s intended workload can assume the role, even if another principal in account 2222 tries to assume it. The trust policy already restricts who can assume the role to account 2222. What additional trust policy condition most directly satisfies this requirement?

Accepted Answer

Add a condition requiring sts:ExternalId to equal a specific value that Company B’s workload must provide in sts:AssumeRole.. The sts:ExternalId condition key is specifically designed to prevent the confused deputy problem. By requiring a unique external ID that only Company B's intended workload knows and passes in the sts:AssumeRole call, the trust policy ensures that even if another principal in account 2222 attempts to assume the role, it cannot provide the correct external ID, thus blocking the request.

Answer

Add a condition requiring aws:PrincipalArn to start with arn:aws:iam::2222:role/.

Answer

Add a condition requiring sts:RoleSessionName to match the string "integration".

Answer

Rely only on an SCP in account 1111 to block all sts:AssumeRole calls except from Company B’s OU.

Question 5

Your company uses an OIDC identity provider to let users assume an IAM role without long-term AWS credentials. In the IAM role trust policy, which STS action must be allowed to support this type of federation?

Accepted Answer

sts:AssumeRoleWithWebIdentity. Sts:AssumeRoleWithWebIdentity is the STS API action specifically designed for federated users authenticated by an OIDC or SAML identity provider. This action returns temporary security credentials without requiring long-term AWS access keys, enabling the OIDC-based federation described in the question.

Answer

sts:AssumeRole

Answer

sts:GetCallerIdentity

Answer

sts:TagSession

Question 6

Based on the exhibit, a development team in member accounts can create IAM roles, but one team created a role without the required permissions boundary. Security wants to ensure that no future role in the organization can exceed the approved boundary, even if a developer has broad IAM permissions. What is the best control to add?

Accepted Answer

Add an SCP that denies iam:CreateRole and iam:PutRolePermissionsBoundary unless the request specifies the ApprovedAppBoundary ARN.. A Service Control Policy (SCP) at the organization root or in the member account's OU can deny IAM actions unless the required permissions boundary (ApprovedAppBoundary) is specified. This prevents any role creation or modification that would bypass the boundary, even if the developer has full IAM permissions in their account. SCPs are the only control that can enforce this across all principals in an account, including the account root user.

Answer

Add a permission boundary to the developer role that points to ApprovedAppBoundary.

Answer

Use an S3 bucket policy to block policy documents that grant AdministratorAccess.

Answer

Require team members to use STS session policies when they create new roles.

Question 7

A microservice runs on an EC2 instance using an instance role. It must retrieve exactly one secret value from AWS Secrets Manager. The secret ARN is arn:aws:secretsmanager:us-east-1:111122223333:secret:prod/dbPassword-AbCdEf. The secret is encrypted with the default AWS-managed Secrets Manager KMS key (alias/aws/secretsmanager). Which IAM policy statement provides the best least-privilege access?

Accepted Answer

Allow secretsmanager:GetSecretValue only for the specific secret ARN: Resource "arn:aws:secretsmanager:us-east-1:111122223333:secret:prod/dbPassword-AbCdEf".. It grants the least-privilege access by restricting the secretsmanager:GetSecretValue action to the exact secret ARN required. Since the secret is encrypted with the default AWS-managed KMS key (alias/aws/secretsmanager), no additional kms:Decrypt permission is needed because Secrets Manager automatically handles decryption with the default key when using GetSecretValue. This policy ensures the microservice can retrieve only the intended secret and no others.

Answer

Allow secretsmanager:GetSecretValue on all secrets: Resource "*".

Answer

Allow secretsmanager:DescribeSecret on the secret ARN, but not secretsmanager:GetSecretValue.

Answer

Allow secretsmanager:GetSecretValue on all secrets with the prefix: Resource "arn:aws:secretsmanager:us-east-1:111122223333:secret:prod/*".

Question 8

A cross-account IAM role in Account B reads encrypted S3 objects from Account A. The objects use SSE-KMS with a customer-managed KMS key in Account A. Account B can successfully call s3:GetObject, but decryption fails with an AccessDeniedException from KMS. What change most directly fixes the issue?

Accepted Answer

Update the customer-managed KMS key policy in Account A to allow kms:Decrypt for the specific Account B role principal.. SSE-KMS with a customer-managed KMS key requires explicit permission to use the key for decryption. The S3 GetObject call succeeds because the bucket policy allows it, but KMS decryption fails because the KMS key policy in Account A does not grant kms:Decrypt to the IAM role principal in Account B. Updating the KMS key policy to allow the Account B role principal to call kms:Decrypt directly resolves the AccessDeniedException.

Answer

Add kms:Decrypt only to the Account B role’s IAM policy, without changing the customer-managed KMS key policy in Account A.

Answer

Update the Account A S3 bucket policy to grant kms:Decrypt to Account B.

Answer

Enable KMS key rotation, which automatically allows cross-account decrypt permissions.

Question 9

A company stores sensitive PDFs in Amazon S3 and serves them through CloudFront. Users must access PDFs only through CloudFront, and direct S3 URL requests must fail. Which three changes should be implemented? Select three.

Accepted Answer

Enable CloudFront Origin Access Control (OAC) for the S3 origin.. CloudFront Origin Access Control (OAC) is the modern, recommended method to restrict S3 bucket access exclusively to a CloudFront distribution. OAC uses a signed request mechanism that verifies the request originates from CloudFront, ensuring direct S3 URL requests are denied. This replaces the older Origin Access Identity (OAI) and provides stronger security with support for features like cross-region buckets and server-side encryption with KMS.

Answer

Enable S3 static website hosting on the bucket.

Answer

Make the object ACLs public so CloudFront can retrieve them.

Question 10

A workload in private subnets must upload logs to Amazon S3 and retrieve one secret from AWS Secrets Manager. The security team forbids internet egress and wants the lowest operational overhead. Which two VPC endpoints should be created? Select two.

Accepted Answer

An Amazon S3 gateway endpoint for private S3 access.. Amazon S3 gateway endpoints allow private subnet resources to access S3 without traversing the internet, using prefix lists and route table entries to direct traffic through AWS's internal network. This satisfies the security team's no-egress requirement and incurs no hourly cost, offering the lowest operational overhead for S3 access.

Answer

A NAT Gateway in the public subnet.

Answer

An Internet Gateway attached to the VPC.

Answer

A DynamoDB gateway endpoint for the log upload path.

Question 11

A software vendor in Account B must assume a role in Account A to process support tickets. Security wants to prevent confused deputy attacks. Which two configurations are required for this access pattern to work safely? Select two.

Accepted Answer

Require a specific sts:ExternalId value in the role trust policy in Account A.. Requiring a specific sts:ExternalId value in the role trust policy in Account A is a standard AWS mechanism to prevent the confused deputy problem. The ExternalId acts as a unique secret that the vendor must provide when assuming the role, ensuring that the role is assumed only for the intended purpose and not by a malicious third party.

Answer

Share long-term access keys from Account A with the vendor.

Answer

Attach a permissions boundary to the role to satisfy the ExternalId requirement.

Answer

Allow sts:GetSessionToken instead of sts:AssumeRole in the trust policy.

Question 12

An organization lets application teams create IAM roles in member accounts. Security wants every newly created role to stay within an approved permission ceiling, and teams must not be able to remove that ceiling later. Which two controls best meet the requirement? Select two.

Accepted Answer

Attach the approved permissions boundary to every role created by the teams.. A permissions boundary is an IAM feature that sets the maximum permissions a role can have. By attaching an approved permissions boundary to every newly created role, the organization enforces a permission ceiling that cannot be exceeded, even if the role has additional policies attached. This directly meets the requirement of keeping roles within an approved ceiling.

Answer

Use an S3 bucket policy to prevent the roles from gaining extra privileges.

Answer

Rely on a role trust policy to limit the permissions the role can have.

Answer

Use a session policy attached to one assumed-role session to enforce the ceiling permanently.

Question 13

A public API is delivered through CloudFront and an Application Load Balancer. The security team wants AWS to automatically block repetitive bursts from the same client IP and also reduce exposure to common web exploits without custom code. Which two AWS WAF features should be enabled? Select two.

Accepted Answer

A rate-based rule that blocks clients exceeding a request threshold from the same source IP.. A rate-based rule in AWS WAF automatically tracks request rates per source IP and blocks clients that exceed a configured threshold within a 5-minute evaluation window. This directly addresses the security team's requirement to block repetitive bursts from the same client IP without custom code.

Answer

ALB sticky sessions for all requests.

Answer

A security group rule that blocks requests based on HTTP path.

Answer

CloudFront origin access control for the API endpoint.

Question 14

An application runs in private subnets and must download objects from Amazon S3 and read one secret from AWS Secrets Manager. NAT gateways are prohibited, and traffic must not traverse the public internet. The secret uses a customer managed KMS key. Which design is best?

Accepted Answer

Create a gateway VPC endpoint for S3 and an interface VPC endpoint for Secrets Manager with private DNS enabled.. It uses a gateway VPC endpoint for S3, which provides private connectivity to S3 without traversing the internet, and an interface VPC endpoint for Secrets Manager, which allows private access via AWS PrivateLink. Enabling private DNS ensures that the standard DNS names for both services resolve to the endpoint IPs, keeping all traffic within the AWS network and meeting the requirement to avoid NAT gateways and public internet.

Answer

Use a NAT gateway for outbound access and rely on security groups to block internet destinations.

Answer

Create interface VPC endpoints for both S3 and Secrets Manager and enable private DNS.

Answer

Use VPC peering to a public subnet that hosts a proxy for S3 and Secrets Manager access.

Question 15

A company is encrypting sensitive S3 data for a IoT ingestion API with AWS KMS. Which two controls help prevent accidental use of the KMS key by unauthorized principals?

Accepted Answer

IAM policies that grant kms:Decrypt only to required application roles. IAM policies that grant kms:Decrypt only to required application roles ensure that only authorized principals can decrypt data encrypted with the KMS key. By explicitly allowing only the Decrypt action and restricting it to specific roles, you prevent unauthorized principals from accidentally using the key for decryption or other operations, even if they have access to the encrypted S3 objects.

Answer

S3 Transfer Acceleration

Answer

A larger KMS key rotation period