SAA-C03 Design Secure Architectures Practice Test 6 — 15 Questions

Question 1

A order processing API stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured?

Accepted Answer

S3 Object Lock in compliance mode with an appropriate retention period. S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This meets the compliance requirement of immutable audit logs for seven years, as compliance mode enforces a legal hold that cannot be removed by any party.

Answer

S3 server access logging

Answer

S3 lifecycle expiration after seven years

Answer

S3 versioning only

Question 2

A financial reporting platform uses CloudFront in front of an S3 origin. Which two settings help keep users from bypassing CloudFront and accessing the bucket directly?

Accepted Answer

Use an S3 bucket policy that allows access only from the CloudFront distribution. An S3 bucket policy can explicitly deny access to any principal except the CloudFront distribution's origin access identity (OAI) or origin access control (OAC). This ensures that direct requests to the S3 bucket URL are rejected, forcing all traffic through CloudFront. The policy uses a condition like `aws:SourceArn` or `aws:SourceAccount` to restrict access to the CloudFront distribution's ARN, preventing bypass.

Answer

Enable CloudFront standard logging

Answer

Enable S3 static website hosting

Question 3

An EC2 instance in a private subnet must access an S3 bucket that contains regulated exports for a customer analytics portal. The security team requires access to be allowed only when traffic comes through a specific VPC endpoint. What should the architect add to the bucket policy?

Accepted Answer

A condition that matches aws:sourceVpce to the endpoint ID. The bucket policy can use the `aws:sourceVpce` condition key to restrict access exclusively to traffic originating from a specific VPC endpoint (interface or Gateway Load Balancer endpoint). This ensures that only requests sent through that VPC endpoint are allowed, meeting the security team's requirement for regulated exports.

Answer

A security group rule that allows HTTPS to S3

Answer

A condition that matches aws:RequestedRegion to the bucket Region

Answer

A deny statement for all IAM users except the EC2 role

Question 4

A company is encrypting sensitive S3 data for a order processing API with AWS KMS. Which two controls help prevent accidental use of the KMS key by unauthorized principals?

Accepted Answer

A key policy that limits key administrators and key users. A KMS key policy explicitly defines which principals (IAM users, roles, or AWS accounts) are allowed to administer or use the key. By limiting key administrators and key users in the key policy, you prevent unauthorized principals from accidentally invoking KMS operations on the key, even if they have broad IAM permissions. This is a fundamental resource-based control that overrides any IAM policy that would otherwise grant access.

Answer

A larger KMS key rotation period

Answer

S3 Transfer Acceleration

Question 5

A mobile banking backend stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured?

Accepted Answer

S3 Object Lock in compliance mode with an appropriate retention period. S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects until the retention period expires. This meets the compliance requirement of immutable audit logs for seven years, as compliance mode enforces a legal hold that cannot be removed by any party.

Answer

S3 server access logging

Answer

S3 lifecycle expiration after seven years

Answer

S3 versioning only

Question 6

A customer analytics portal uses CloudFront in front of an S3 origin. Which two settings help keep users from bypassing CloudFront and accessing the bucket directly?

Accepted Answer

Configure Origin Access Control for the S3 origin. Origin Access Control (OAC) is a CloudFront feature that restricts access to an S3 origin so that only the CloudFront distribution can fetch objects. When OAC is configured, CloudFront signs requests using a trusted identity, and the S3 bucket policy can then deny any request that does not come from that identity, effectively blocking direct S3 access.

Answer

Enable CloudFront standard logging

Answer

Enable S3 static website hosting

Question 7

A solutions architect is designing an S3 bucket for a IoT ingestion API. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure?

Accepted Answer

Enable S3 Block Public Access at the account or bucket level. S3 Block Public Access provides a definitive override that prevents any public access to objects regardless of other policies. When enabled at the account or bucket level, it blocks all public access settings, including those from bucket policies, access control lists (ACLs), or object ACLs, ensuring that even if a developer later adds an overly broad bucket policy, the objects remain private. This is the only mechanism that cannot be overridden by a bucket policy, making it the appropriate choice for a strict no-public-access requirement.

Answer

Enable S3 Transfer Acceleration

Answer

Create an IAM policy that denies s3:GetObject to anonymous users

Answer

Enable server access logging on the bucket

Question 8

A partner company needs read-only access to reports in an S3 bucket for a financial reporting platform. The partner has its own AWS account. What is the most secure scalable access pattern?

Accepted Answer

Create a bucket policy that grants the partner role least-privilege access to the required prefix. A bucket policy with a condition that grants read-only access to a specific prefix allows the partner's AWS account to access the S3 bucket without creating IAM users or sharing long-term credentials. This leverages cross-account IAM roles, where the partner assumes a role in their own account that the bucket policy trusts, ensuring least-privilege access and eliminating the need to manage static keys. The policy can be scoped to a specific prefix (e.g., `reports/`) and use the `aws:SourceArn` or `aws:SourceAccount` condition key to restrict access to only the partner's account, providing both security and scalability.

Answer

Create an IAM user in the company account and share the access keys

Answer

Copy the objects to a public website bucket

Answer

Make the objects public and rely on difficult-to-guess object names

Question 9

A company is encrypting sensitive S3 data for a mobile banking backend with AWS KMS. Which two controls help prevent accidental use of the KMS key by unauthorized principals?

Accepted Answer

A key policy that limits key administrators and key users. A KMS key policy explicitly defines which principals (IAM users, roles, AWS accounts) can administer or use the key. By limiting key administrators and key users in the key policy, you prevent unauthorized principals from accidentally invoking KMS operations on that key, even if they have broad IAM permissions. This is a direct access control mechanism at the key level.

Answer

A larger KMS key rotation period

Answer

S3 Transfer Acceleration

Question 10

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use? The team wants the control to be enforceable during normal operations.

Accepted Answer

Interface VPC endpoint for Systems Manager. An Interface VPC endpoint (AWS PrivateLink) for Systems Manager allows the private subnets to securely access Systems Manager Parameter Store without traversing the internet, using private IP addresses within the VPC. This ensures traffic stays within the AWS network and is enforceable via VPC endpoint policies and security groups.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone

Question 11

An EC2 instance in a private subnet must access an S3 bucket that contains regulated exports for a B2B file exchange site. The security team requires access to be allowed only when traffic comes through a specific VPC endpoint. What should the architect add to the bucket policy?

Accepted Answer

A condition that matches aws:sourceVpce to the endpoint ID. The bucket policy must include a condition that matches `aws:sourceVpce` to the specific VPC endpoint ID. This ensures that only traffic originating from that VPC endpoint (e.g., `vpce-12345678`) is allowed to access the S3 bucket, meeting the security team's requirement. Without this condition, any traffic from the private subnet that routes through the endpoint would be allowed, but the policy explicitly restricts access to only that endpoint.

Answer

A deny statement for all IAM users except the EC2 role

Answer

A condition that matches aws:RequestedRegion to the bucket Region

Answer

A security group rule that allows HTTPS to S3

Question 12

A company is encrypting sensitive S3 data for a claims portal with AWS KMS. Which two controls help prevent accidental use of the KMS key by unauthorized principals?

Accepted Answer

IAM policies that grant kms:Decrypt only to required application roles. Option B is correct because IAM policies scoped to grant kms:Decrypt only to the specific application roles that need to decrypt the claims data enforce least privilege, so any other principal attempting to use the key is denied by IAM. Option C is correct because the KMS key policy is the primary access control for a CMK and explicitly defining which principals are key administrators and key users restricts who can manage or use the key, preventing unauthorized principals from gaining usage rights. Together these two controls limit both the identity-based and resource-based authorization paths to the KMS key. Option A is not correct because a longer rotation period only affects how often the backing key material is rotated; it does not restrict which principals can call the key. Option D is not correct because S3 Transfer Acceleration only speeds up uploads/downloads over long distances via edge locations and has no bearing on KMS key authorization.

Answer

A larger KMS key rotation period

Answer

S3 Transfer Acceleration

Question 13

Developers for a image sharing application need temporary elevated access to production resources for troubleshooting. The security team wants approvals, expiry, and audit logging. Which approach is best?

Accepted Answer

Use IAM Identity Center permission sets with time-bound access processes and CloudTrail auditing. IAM Identity Center (formerly AWS SSO) allows you to define permission sets that grant time-bound, elevated access to production resources. By integrating with CloudTrail, every access request, approval, and action is logged for audit. This meets the security team's requirements for approvals, expiry, and audit logging without compromising security.

Answer

Disable CloudTrail during troubleshooting

Answer

Create shared administrator access keys for the team

Answer

Attach AdministratorAccess permanently to every developer role

Question 14

A B2B file exchange site uses CloudFront in front of an S3 origin. Which two settings help keep users from bypassing CloudFront and accessing the bucket directly?

Accepted Answer

Use an S3 bucket policy that allows access only from the CloudFront distribution. Configuring Origin Access Control (OAC) for the S3 origin (or the older Origin Access Identity - OAI) establishes a secure identity for the CloudFront distribution. An S3 bucket policy then uses this OAC/OAI identity to explicitly deny access to any principal *except* the CloudFront distribution. This combination ensures that direct requests to the S3 bucket are blocked, preventing users from bypassing CloudFront and accessing the bucket directly via its S3 endpoint. The bucket policy typically uses the `aws:SourceArn` or `aws:SourceAccount` condition key to restrict access exclusively to the CloudFront service. Without OAC/OAI, CloudFront cannot securely access a private S3 bucket, and without the corresponding S3 bucket policy, users could still bypass CloudFront and access the bucket directly.

Answer

Enable S3 static website hosting

Answer

Enable CloudFront standard logging

Question 15

A private application in two private subnets must download objects from S3 and read parameters from Systems Manager Parameter Store without routing traffic through the public internet. Which two components should the architect use? The business wants to avoid a reactive-only remediation approach.

Accepted Answer

Interface VPC endpoint for Systems Manager. An Interface VPC endpoint for Systems Manager (using AWS PrivateLink) allows the private application to securely read parameters from Parameter Store without traversing the internet. A Gateway VPC endpoint for S3 provides a private, highly available route to download objects from S3 using the S3 service's prefix list and route table entries, avoiding NAT or internet gateways. Together, these endpoints ensure all traffic stays within the AWS network, meeting the requirement to avoid public internet routing.

Answer

Internet gateway attached to the VPC

Answer

NAT gateway in each Availability Zone