SAA-C03 Design Secure Architectures Practice Test 7 — 15 Questions

Question 1

The web tier of an online scheduling app runs on an Auto Scaling group behind an ALB. Traffic spikes every weekday at 13:00 when a corporate newsletter is sent. CloudWatch shows CPU averages 18% outside that window, and the current fleet uses larger instances than the load test requires. The application is stateless and can scale out in a few minutes. Which two changes should the architect recommend? Select two.

Accepted Answer

Use scheduled scaling to raise desired capacity before the known newsletter window and lower it afterward.. Option A is correct because the traffic spike is predictable (every weekday at 13:00), making scheduled scaling the most cost-effective and reliable approach. Scheduled scaling allows you to increase the desired capacity of the Auto Scaling group before the newsletter window and decrease it afterward, ensuring the application can handle the load without relying on dynamic scaling policies that might lag behind the sudden spike. This avoids over-provisioning during non-peak hours while guaranteeing capacity exactly when needed.

Answer

Keep the current oversized instances to avoid any scaling activity.

Answer

Replace the Auto Scaling group with Spot Instances only.

Answer

Disable ALB health checks to save a small amount of traffic.

Question 2

A company wants to protect a critical application from a full Region outage. The secondary Region should keep only a small amount of infrastructure running most of the time to control cost. Which disaster recovery strategy fits best?

Accepted Answer

Pilot light. The pilot light strategy is correct because it keeps a minimal core of infrastructure (e.g., a small database, a few EC2 instances) running in the secondary Region, while the bulk of the application remains dormant. In a full Region outage, the pilot light can be rapidly scaled up to full production capacity, meeting the requirement of low ongoing cost with the ability to recover from a complete Region failure.

Answer

Active-active

Answer

Single-AZ deployment

Answer

Blue/green deployment

Question 3

A company uses AWS Organizations and has separate development, test, and production accounts. The security team wants to ensure that no one in the sandbox organizational unit can disable AWS CloudTrail or delete the central audit bucket, even if an account administrator creates permissive IAM policies later. Which control should they use?

Accepted Answer

Use a service control policy on the sandbox organizational unit to deny the prohibited actions.. Service control policies (SCPs) are the correct mechanism because they act as a centralized guardrail at the AWS Organizations level, setting maximum permissions for all accounts in an organizational unit (OU). Even if an account administrator creates permissive IAM policies later, an SCP that explicitly denies disabling CloudTrail or deleting the central audit bucket will override those permissions, ensuring the security team's requirements are enforced across the sandbox OU.

Answer

Attach an identity-based policy in each account that denies CloudTrail changes.

Answer

Create an S3 bucket policy that allows only the audit team role to delete objects.

Answer

Apply a permission boundary to each IAM user in the sandbox accounts.

Question 4

Based on the exhibit, what should the security team implement so developers can create AWS Lambda execution roles, but no developer-created role can ever exceed the approved permission set?

Accepted Answer

Require a permissions boundary on every developer-created role and set the boundary to the approved maximum permissions.. Option B is correct because a permissions boundary explicitly defines the maximum permissions that an IAM role can have, and when attached to developer-created roles, it prevents any role from exceeding the approved set of permissions, even if the developer attaches a more permissive policy. This directly addresses the requirement that no developer-created role can ever exceed the approved permission set, as the boundary acts as a hard cap.

Answer

Place the developers in an IAM group with a deny-only managed policy attached.

Answer

Use an AWS Organizations SCP to grant only the approved Lambda permissions directly to the developer roles.

Answer

Create the roles with inline policies only, because inline policies are always safer than managed policies.

Question 5

A mobile app reads the same product details many times per minute from Amazon DynamoDB. The table design is already correct, but repeated reads are still causing noticeable latency. Which service should the team add to improve read performance?

Accepted Answer

Amazon DAX. Amazon DAX (DynamoDB Accelerator) is an in-memory cache specifically designed for DynamoDB. It reduces read latency from single-digit milliseconds to microseconds by caching frequently accessed items, which directly addresses the repeated read pattern described in the question.

Answer

Amazon EFS

Answer

AWS Lambda

Answer

Amazon SNS

Question 6

A retail company lets developers deploy ECS services but they must never be able to modify IAM. The team currently uses an IAM user per developer with an admin-like policy, and several access keys have been leaked. You are asked to redesign access so that: (1) developers authenticate with temporary credentials, (2) they can create/update ECS services and related autoscaling resources, and (3) IAM changes are impossible even if a developer tries to attach new policies.

Which design best meets all requirements?

Accepted Answer

Use an IAM role that developers assume for deployments; attach least-privilege policies for ECS and Auto Scaling; and attach a permission boundary that does not allow iam:* actions, so additional inline or managed policies cannot grant IAM permissions.. Option B is correct because it uses an IAM role with temporary credentials (via AWS STS AssumeRole), satisfying the requirement that developers never have long-term access keys. The least-privilege policies restrict actions to ECS and Auto Scaling only, and the permission boundary explicitly denies iam:* actions, preventing developers from escalating privileges by attaching new policies to their role. This combination ensures developers can deploy ECS services but cannot modify IAM in any way.

Answer

Create an IAM user for each developer and keep the existing broad permissions, rotating keys every 90 days.

Answer

Attach a policy that allows ecs:* and autoscaling:* and rely on developers to self-review that no IAM statements are added to their roles.

Answer

Create a single shared IAM role with full administrator permissions so developers can troubleshoot faster when deployments fail.

Question 7

An administrator needs the ability to read and update infrastructure for a specific AWS account, but only when using MFA. The security team wants to eliminate long-lived administrator access keys and ensure that even if someone obtains temporary session credentials, actions are only allowed with MFA present.

Which IAM design best meets these requirements?

Accepted Answer

Create an IAM role for administration and use a permissions policy that allows only the required read/write actions. Add a condition to deny all allowed actions unless aws:MultiFactorAuthPresent is true.. Option B is correct because it uses an IAM role with a condition key `aws:MultiFactorAuthPresent` set to `true` to enforce MFA for all API calls made with temporary credentials. This eliminates long-lived access keys and ensures that even if temporary session credentials are compromised, actions are denied unless MFA was used during the session. The policy explicitly denies all allowed actions when MFA is not present, meeting the security team's requirement for MFA on every administrative action.

Answer

Create an IAM user for administrators with AdministratorAccess and require MFA only at the IAM user login.

Answer

Attach policies to an IAM user that allow read/write actions and enable MFA in the account, but do not use condition keys in IAM policies.

Answer

Use a role with the correct actions but enforce MFA only in the application by prompting users for an OTP before every API call.

Question 8

A company runs an application in private subnets (no inbound internet). The application must access Amazon S3 and AWS Secrets Manager endpoints without routing through the public internet and without exposing the instances to NAT gateways due to cost. Security requirements also state that only the required VPC traffic should be allowed to reach AWS services.

Which architecture best satisfies these requirements?

Accepted Answer

Add a VPC gateway endpoint for S3 and an interface VPC endpoint for Secrets Manager; keep instances in private subnets and configure security group rules attached to the endpoints to allow inbound traffic only from the application subnets.. Option B is correct because it uses a VPC gateway endpoint for S3 and an interface VPC endpoint for Secrets Manager, both of which allow private subnet instances to access these AWS services without traversing the public internet or requiring a NAT gateway. The security group rules attached to the interface endpoint restrict inbound traffic to only the application subnets, satisfying the security requirement of allowing only required VPC traffic. This architecture avoids NAT gateway costs and keeps instances isolated from inbound internet traffic.

Answer

Place instances in private subnets but use NAT gateways so traffic to S3 and Secrets Manager goes through the internet; restrict security groups to instance-to-instance only.

Answer

Use public subnets with instances that have no security group rules; rely on AWS services to reject unauthorized traffic.

Answer

Create an S3 bucket policy that allows requests from the application instances’ private IP addresses and enable public access to Secrets Manager via the default service endpoint.

Question 9

Based on the exhibit, the company has one shared S3 bucket for many internal teams. Security wants each team to access only its own prefix, ACLs must remain disabled, and the current bucket policy has become too large and error-prone. What is the best redesign?

Accepted Answer

Create one S3 access point per team and attach an access point policy that limits that team to its own prefix.. Option C is correct because S3 Access Points allow you to create separate access points for each team, each with its own policy that restricts access to a specific prefix (e.g., s3://shared-bucket/team-a/). This eliminates the need for a large, error-prone bucket policy while keeping ACLs disabled, meeting the security requirement for per-team prefix isolation without modifying the underlying bucket configuration.

Answer

Re-enable object ACLs and manage access by setting object-level ACLs for each team's prefix.

Answer

Split the bucket into one bucket per team and keep using a single shared bucket policy for all of them.

Answer

Make the bucket public and issue presigned URLs for team access so IAM policies are no longer needed.

Question 10

Based on the exhibit, a workload in private subnets must reach only Amazon S3 and AWS Secrets Manager. The team wants to eliminate internet exposure for those calls and reduce NAT gateway charges. What change should be made?

Accepted Answer

Create an S3 gateway endpoint and a Secrets Manager interface endpoint with private DNS, then remove NAT dependency for those service calls.. Option C is correct because VPC Gateway Endpoints (for S3) and Interface Endpoints (for Secrets Manager) allow private subnet instances to access these services over the AWS network without traversing the internet or a NAT gateway. Enabling private DNS on the interface endpoint ensures that the default Secrets Manager DNS name resolves to the endpoint's private IP, eliminating the need for a NAT gateway for those calls and reducing costs.

Answer

Move the instances into a public subnet and restrict inbound access with security groups.

Answer

Add a NAT instance and disable the managed NAT gateway to lower cost.

Answer

Use VPC peering to a shared services VPC and route all AWS service traffic through that VPC.

Question 11

A data lake stores raw files in a single Amazon S3 bucket that is shared by three internal analytics teams. Each team should access only its own prefix, and the company wants to eliminate ACL management because objects come from multiple producers. Which three changes should the architect make? Select three.

Accepted Answer

Create a separate S3 access point for each team and scope it to that team’s prefix.. Option A is correct because S3 Access Points allow you to create separate access points scoped to specific prefixes within a shared bucket, enabling each analytics team to access only its own prefix without managing ACLs. This simplifies access control by using access point policies that restrict access to the allowed principals and prefixes, aligning with the requirement to eliminate ACL management.

Answer

Leave ACLs enabled so each producer can grant permissions directly on uploaded objects.

Answer

Make the bucket public and rely on application-layer authorization for data protection.

Question 12

A workload runs in private subnets and must reach Amazon S3 and AWS Secrets Manager without using the internet or a NAT gateway. The team wants to keep the traffic on AWS private networking and avoid public IPs. Which two changes should the architect make? Select two.

Accepted Answer

Create an S3 gateway VPC endpoint and update the route tables for the private subnets.. Option A is correct because an S3 gateway VPC endpoint allows private subnet instances to access S3 via AWS's private network without needing internet access or a NAT gateway. The endpoint uses route table entries to direct S3 traffic through the gateway, which is a horizontally scaled, redundant component that does not require public IPs.

Answer

Place a NAT gateway in the public subnet so the private instances can reach AWS services.

Answer

Assign public IPv4 addresses to the instances and restrict them with security groups.

Answer

Use VPC peering to the AWS service endpoints instead of VPC endpoints.

Question 13

Company A stores encrypted log files in its S3 bucket using SSE-KMS with a customer-managed KMS key. A partner application in Company B uploads objects into Company A's bucket using an IAM role in Company B. Uploads fail with an error indicating KMS access is denied (kms:Encrypt not authorized). Neither the partner IAM policy nor the S3 bucket policy currently mentions KMS.

What is the most secure and correct change to allow cross-account uploads to succeed?

Accepted Answer

In Company A's KMS key policy, allow Company B's partner role principal to use the key for kms:Encrypt, kms:GenerateDataKey, and kms:DescribeKey, and also add a matching IAM policy in Company B that grants the partner role those same KMS actions on Company A's key ARN, constrained to the target S3 bucket context when possible.. Option A is correct because cross-account SSE-KMS uploads require both the KMS key policy in Company A to explicitly grant the partner role principal the necessary KMS actions (kms:Encrypt, kms:GenerateDataKey, kms:DescribeKey) and an IAM policy in Company B that allows the partner role to call those actions on Company A's key ARN. The bucket policy alone cannot authorize KMS operations; KMS key policies act as the primary access control for customer-managed keys, and without the key policy grant, the partner role's IAM permissions are insufficient. Constraining the IAM policy to the target S3 bucket context (using kms:ViaService or kms:EncryptionContext conditions) adds a security best practice by limiting the key's use to only that specific S3 bucket.

Answer

In Company B's IAM policy, allow kms:Encrypt on Company A's KMS key ARN, without changing Company A's key policy.

Answer

Create a new KMS key in Company B and configure Company A's S3 bucket to use that key for SSE-KMS.

Answer

Disable key policy restrictions by setting the KMS key to enabled and removing all policy statements so that encryption automatically works for any principal.

Question 14

A containerized service on Amazon ECS connects to a database with a password that must never be stored in plaintext or hardcoded in the image. The application reads the password at startup and occasionally reconnects later, so it needs to retrieve the current secret when needed. Which three actions should the architect take? Select three.

Accepted Answer

Store the database password in AWS Secrets Manager.. AWS Secrets Manager is the correct service for storing sensitive data like database passwords because it provides encryption at rest (using AWS KMS) and automatic rotation capabilities. By storing the password in Secrets Manager, the architect ensures it is never exposed in plaintext or hardcoded in the container image, meeting the security requirement.

Answer

Store the password in a plain environment variable and update it manually during maintenance windows.

Answer

Use an IAM user access key inside the container so the database password can be embedded in code.

Question 15

A startup runs an API on Amazon EC2. The instance must read items from one DynamoDB table and upload logs to one S3 bucket. Platform engineers also need a way to create new application roles, but those roles must never exceed a predefined set of permissions. Which three actions should the architect take? Select three.

Accepted Answer

Attach an IAM role to the EC2 instance profile and remove long-lived access keys from the server.. Option A is correct because attaching an IAM role to the EC2 instance profile allows the instance to obtain temporary credentials via the instance metadata service (IMDS), eliminating the need to store long-lived access keys on the server. This follows the AWS security best practice of using IAM roles for EC2 to securely access DynamoDB and S3 without managing static credentials.

Answer

Give the EC2 instance an IAM user with administrator access for simplicity.

Answer

Store the access keys in the application configuration file and rotate them later.