SAA-C03 Design Secure Architectures Practice Test 8 — 15 Questions

Question 1

A healthcare document service must ensure that only encrypted EBS volumes can be created in the account. What is the strongest preventive control? The design must avoid adding custom operational scripts.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an SCP that denies ec2:CreateVolume when the encrypted condition is false. AWS Organizations Service Control Policies (SCPs) provide a preventive guardrail that can deny the ec2:CreateVolume API call when the encryption condition is false, ensuring that no unencrypted EBS volumes can be created in the account. This is the strongest preventive control because it blocks the action at the API level before any resource is created, and it does not require custom scripts or post-creation remediation. The condition key ec2:Encrypted must be set to true in the SCP policy to enforce encryption at creation time.

Answer

Tag encrypted volumes after creation

Answer

Enable VPC Flow Logs

Answer

Run a daily Lambda function to encrypt unencrypted volumes

Question 2

A mobile banking backend stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured? The design must avoid adding custom operational scripts.

Accepted Answer

S3 Object Lock in compliance mode with an appropriate retention period. S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This meets the compliance requirement of immutable audit logs for seven years without custom scripts. Compliance mode enforces a legal hold that cannot be removed by any user, ensuring logs are write-once-read-many (WORM) protected.

Answer

S3 server access logging

Answer

S3 lifecycle expiration after seven years

Answer

S3 versioning only

Question 3

A customer analytics portal uses CloudFront in front of an S3 origin. Which two settings help keep users from bypassing CloudFront and accessing the bucket directly? The design must avoid adding custom operational scripts.

Accepted Answer

Configure Origin Access Control for the S3 origin. Origin Access Control (OAC) is a CloudFront feature that restricts access to an S3 origin so that only the CloudFront distribution can retrieve objects. OAC uses a signed request mechanism that prevents direct S3 access, ensuring users cannot bypass CloudFront and hit the bucket directly without custom scripts.

Answer

Enable CloudFront standard logging

Answer

Enable S3 static website hosting

Question 4

A company is designing a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), an Amazon EC2 Auto Scaling group for the web tier, and an Amazon RDS for MySQL database. The security team requires that the web tier instances have no public IP addresses and that all outbound traffic to the internet is blocked, except for specific software updates from a trusted vendor. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Use a security group on the web tier instances that denies all outbound traffic except to the trusted vendor's IP range.. Placing the web tier instances in a private subnet ensures they have no public IP addresses, meeting the security requirement. Using a security group on the web tier instances to deny all outbound traffic except to the trusted vendor's IP range provides a stateful, instance-level control that blocks all other outbound internet traffic. Additionally, a network ACL on the private subnet must allow outbound traffic to the trusted vendor's IP range and to the NAT gateway, because the NAT gateway itself needs to send traffic to the vendor, and the network ACL acts as a stateless subnet-level filter that must explicitly permit this return traffic.

Answer

Configure a VPC endpoint for the trusted vendor's software update service.

Answer

Deploy the web tier instances in a public subnet and use a network ACL to block all inbound traffic from the internet.

Answer

Configure the ALB to be internet-facing and place the web tier instances in a public subnet.

Question 5

A financial services company is migrating sensitive customer data to Amazon S3. The data must be encrypted at rest using a customer-managed key stored in AWS KMS, with automatic rotation every 90 days. The company also needs to prevent any access to the data from outside the corporate network, except for approved AWS services. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Attach an S3 VPC endpoint policy that only allows access from the corporate VPC.. Enable default encryption on the S3 bucket with SSE-KMS using the customer-managed key ensures data is encrypted at rest with a key the customer controls and can rotate automatically every 90 days. Configure an S3 bucket policy that denies access unless the request is made from the corporate IP range restricts access to the corporate network. Attach an S3 VPC endpoint policy that only allows access from the corporate VPC ensures that traffic to S3 stays within the AWS network and is subject to VPC controls, preventing exposure to the public internet.

Answer

Use an S3 bucket policy to require that all requests use HTTPS.

Answer

Use an S3 bucket policy that grants access only to the root user of the account.

Answer

Enable S3 Block Public Access at the account level.

Question 6

A company is deploying a serverless application using AWS Lambda functions that process credit card transactions. The application stores data in Amazon DynamoDB and sends notifications through Amazon SNS. Compliance requirements mandate that all data in transit and at rest is encrypted, and that no AWS Lambda function can access resources in other AWS accounts. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Attach an IAM policy to the Lambda execution role that denies access to resources outside the account using a condition on aws:SourceAccount.. To meet the requirements, three steps are needed. First, configure DynamoDB to use AWS owned keys for encryption at rest (Option A). This ensures data at rest is encrypted. Second, enable encryption in transit for the Lambda function by using an ENI in a private subnet with a VPC endpoint for DynamoDB and SNS (Option E). Third, use a VPC endpoint for DynamoDB and SNS and ensure the Lambda function is configured to use the VPC (Option D). This combination enforces encryption in transit and prevents cross-account access by ensuring traffic stays within the VPC. Option B is incorrect because it uses the aws:SourceAccount condition key; the correct condition key to prevent a principal from accessing resources in other accounts is aws:ResourceAccount.

Answer

Configure DynamoDB to use AWS owned keys for encryption at rest.

Answer

Configure the Lambda function to use an IAM role that allows access to all accounts.

Answer

Use a security group to block all outbound traffic from the Lambda function to the internet.

Question 7

A company is designing a secure CI/CD pipeline on AWS. Developers push code to AWS CodeCommit, which triggers AWS CodePipeline to build and deploy applications to Amazon EC2 instances running in a VPC. The security team requires that all code is scanned for secrets and vulnerabilities before deployment, and that deployment artifacts are encrypted at rest in Amazon S3. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Add a CodeBuild step in the pipeline that runs a static code analysis tool to scan for secrets and vulnerabilities.. Adding a CodeBuild step that runs static code analysis directly addresses the requirement to scan for secrets and vulnerabilities before deployment. Using AWS Secrets Manager to store secrets and retrieve them via IAM roles ensures that sensitive credentials are not hardcoded and are securely accessed during the build. For the encryption at rest requirement, configuring the S3 bucket with default SSE-S3 encryption ensures that all objects stored in the bucket are encrypted at rest. The option to enforce HTTPS only provides encryption in transit, not at rest, and thus does not meet the requirement. CloudTrail logging addresses auditing, not encryption. Public access is insecure.

Answer

Configure the S3 bucket used for deployment artifacts to have default encryption with SSE-S3.

Answer

Enable AWS CloudTrail to log all access to the S3 bucket and CodeCommit repository.

Answer

Use an S3 bucket policy that grants full public access to the deployment artifacts for faster downloads.

Question 8

A company is hosting a web application on Amazon ECS Fargate behind an Application Load Balancer. The application needs to authenticate users using Amazon Cognito and store session data in Amazon ElastiCache for Redis. The security team mandates that all traffic between the ALB and ECS tasks must not traverse the public internet, and that session data in ElastiCache is encrypted at rest. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Use a security group on the ECS tasks that allows inbound traffic only from the ALB's security group.. Deploying ECS tasks in private subnets with an internal ALB ensures traffic between the ALB and tasks does not traverse the public internet, as internal load balancers have only private IP addresses. Enabling encryption at rest on ElastiCache for Redis with a customer-managed KMS key meets the security mandate for encrypted session data. Using a security group on ECS tasks that allows inbound traffic only from the ALB's security group provides a precise, stateful firewall rule that enforces the traffic flow restriction.

Answer

Configure the ElastiCache cluster to use in-transit encryption only.

Answer

Configure the ALB to be internal-facing and place the ECS tasks in public subnets.

Answer

Place the ECS tasks in a public subnet and use network ACLs to block inbound traffic from the internet.

Question 9

A company has a workload running on Amazon EC2 instances that need to securely communicate with an Amazon SQS queue and an Amazon DynamoDB table. The EC2 instances are in a private subnet without internet access. The security team wants to ensure that no traffic leaves the AWS network. Which three steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Create a VPC endpoint for Amazon DynamoDB and attach a policy that allows access from the EC2 instance's IAM role.. Creating VPC endpoints for Amazon SQS and DynamoDB allows EC2 instances in a private subnet to communicate with these services privately, without traversing the internet or requiring a NAT gateway. Attaching a policy that restricts access to the EC2 instance's IAM role ensures that only authorized traffic is allowed, meeting the security team's requirement that no traffic leaves the AWS network. Configuring the security group to allow outbound traffic to the VPC endpoints is necessary because security groups are stateful and control outbound connections, but the endpoints themselves are accessed via their specific prefix list IDs, not public IPs.

Answer

Configure a NAT gateway in a public subnet to route traffic to SQS and DynamoDB.

Answer

Add a route in the private subnet's route table pointing to a NAT gateway for all traffic.

Answer

Enable VPC flow logs to monitor traffic to SQS and DynamoDB.

Question 10

A company is designing a secure multi-tier web application on AWS. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in private subnets, and the EC2 instances need to access an Amazon RDS database in a separate private subnet. The company must ensure that all traffic is encrypted in transit and that only necessary access is allowed. Which of the following steps should the company take to meet these requirements? (Choose four.)

Accepted Answer

Configure the security group for the RDS database to allow inbound traffic on port 3306 (or the appropriate database port) only from the security group attached to the EC2 instances.. To meet the requirements, the company should: 1) Configure the ALB with an HTTPS listener and install a TLS certificate from ACM to encrypt client-to-ALB traffic. 2) Configure the RDS security group to allow inbound traffic on the database port only from the EC2 security group, ensuring least privilege. 3) Enable SSL/TLS for connections between EC2 instances and RDS to encrypt database traffic. The option to use an NLB with a TLS listener is unnecessary; the ALB can be configured with an HTTPS target group to encrypt traffic between the ALB and EC2 instances. Thus, the correct answers are A, C, and D.

Answer

Place the EC2 instances in a public subnet to allow direct access to the internet for security updates.

Answer

Assign a public IP address to the RDS database instance to simplify connectivity from the EC2 instances.

Question 11

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must meet strict security and compliance requirements. The company needs to ensure that all data stored in DynamoDB is encrypted at rest using a customer-managed key, that the Lambda function can only access the specific DynamoDB table it needs, and that API requests are authenticated and authorized. Which of the following actions should the company take? (Choose four.)

Accepted Answer

Create an AWS KMS customer managed key and configure DynamoDB to use it for encryption at rest.. Creating an AWS KMS customer managed key and configuring DynamoDB to use it for encryption at rest ensures that the data is encrypted using a key that the company controls, meeting strict compliance requirements. Attaching an IAM role to the Lambda function with a policy that grants only the necessary DynamoDB actions on the specific table ARN follows the principle of least privilege. Configuring API Gateway to use an IAM authorizer ensures that only authenticated AWS users or roles can invoke the API, providing authentication and authorization. Using AWS KMS grants in the Lambda function's IAM policy allows the function to use the customer managed key for encryption operations, which is necessary for encrypting and decrypting data in DynamoDB when using client-side encryption or when the key is used for other cryptographic operations.

Answer

Store the customer managed key directly in the Lambda function's environment variables for easy access.

Answer

Enable DynamoDB Streams and configure the Lambda function to process stream records without any additional security configuration.

Question 12

Arrange the steps to create an encrypted Amazon EBS volume from scratch in the correct order.

Accepted Answer

Step 1: Create a KMS key; Step 2: Create an encrypted EBS volume; Step 3: Attach the volume to an instance; Step 4: Format and mount the volume; Step 5: Verify encryption.. Encryption requires a KMS key first, then volume creation with encryption, attach, format/mount, and verification.

Answer

Step 1: Create an encrypted EBS volume; Step 2: Attach the volume; Step 3: Create a KMS key; Step 4: Format and mount; Step 5: Verify encryption.

Answer

Step 1: Create a KMS key; Step 2: Create an encrypted EBS volume; Step 3: Format and mount; Step 4: Attach the volume; Step 5: Verify encryption.

Answer

Step 1: Attach the volume; Step 2: Create a KMS key; Step 3: Create an encrypted EBS volume; Step 4: Format and mount; Step 5: Verify encryption.

Question 13

Arrange the steps for a cross-region Amazon S3 replication configuration.

Accepted Answer

Step 1: Enable versioning on both buckets, Step 2: Create IAM role, Step 3: Add replication rules, Step 4: Configure destination settings, Step 5: Verify replication. Versioning must be enabled first, then IAM role, replication rules, destination config, and verification.

Answer

Step 1: Create IAM role, Step 2: Enable versioning on both buckets, Step 3: Add replication rules, Step 4: Configure destination settings, Step 5: Verify replication

Answer

Step 1: Enable versioning on both buckets, Step 2: Add replication rules, Step 3: Create IAM role, Step 4: Configure destination settings, Step 5: Verify replication

Answer

Step 1: Enable versioning on both buckets, Step 2: Create IAM role, Step 3: Configure destination settings, Step 4: Add replication rules, Step 5: Verify replication

Question 14

Arrange the steps to implement a disaster recovery plan using AWS Elastic Disaster Recovery (DRS).

Accepted Answer

Install the AWS Replication Agent on the source server, Configure replication settings, Launch recovery instances, Test disaster recovery, Perform failback. Agent installation, replication config, launch recovery instance, test, and failback.

Answer

Install the AWS Replication Agent on the source server, Launch recovery instances, Configure replication settings, Test disaster recovery, Perform failback

Answer

Test disaster recovery, Install the AWS Replication Agent on the source server, Configure replication settings, Launch recovery instances, Perform failback

Answer

Configure replication settings, Install the AWS Replication Agent on the source server, Launch recovery instances, Test disaster recovery, Perform failback

Question 15

A financial services company runs a three-tier web application on AWS. The security team wants to ensure that if an EC2 instance in the application tier is compromised, the attacker cannot use the instance's IAM role credentials to delete objects from the company's S3 bucket that stores transaction records. The S3 bucket is encrypted with an AWS KMS customer managed key. The company already uses IAM roles for EC2. Which combination of actions will BEST meet this requirement? (Choose two.)

Accepted Answer

Use an S3 bucket policy that explicitly denies s3:DeleteObject for the instance role, and ensure the KMS key policy does not grant the instance role kms:Decrypt.. The best combination is to use an S3 bucket policy that explicitly denies s3:DeleteObject for the instance role and to ensure the KMS key policy does not grant kms:Decrypt to that role. This provides both prevention of deletion and restriction of data access. An explicit deny in the bucket policy overrides any IAM allow, and removing decrypt permissions ensures the instance cannot access the encrypted data even if it obtains the objects.

Answer

Modify the KMS key policy to deny kms:Decrypt for the instance role, and grant decrypt only to authorized roles.

Answer

Attach an IAM policy to the instance role that denies s3:DeleteObject on the bucket.

Answer

Enable S3 Object Lock in governance mode on the bucket, and grant the instance role s3:BypassGovernanceRetention.