SAA-C03 Design Secure Architectures Practice Test 9 — 15 Questions

Question 1

A healthcare company stores patient records in an Amazon S3 bucket. The security team requires that all access to the bucket be logged, and that any changes to the bucket's logging configuration be detected and alerted on within 5 minutes. The company uses AWS CloudTrail and Amazon CloudWatch. Which solution meets these requirements with the LEAST operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable AWS CloudTrail management events and S3 data events for the bucket, and create a CloudWatch alarm on a metric filter for PutBucketLogging in the CloudTrail log group.. The correct solution is to enable CloudTrail management events and S3 data events for the bucket, and create a CloudWatch alarm on a metric filter for PutBucketLogging in the CloudTrail log group. This provides comprehensive logging of both object access and configuration changes, and enables timely alerting. CloudTrail data events capture object-level operations, while management events capture bucket-level configuration changes. The CloudWatch alarm ensures detection within 5 minutes.

Answer

Enable S3 server access logging on the bucket, and create a CloudWatch Logs metric filter on the CloudTrail log group for PutBucketLogging events.

Answer

Enable S3 server access logging and S3 Event Notifications for PutBucketLogging, and send notifications to Amazon SNS.

Answer

Enable AWS CloudTrail data events for the S3 bucket, and create a CloudWatch Events rule to trigger an SNS notification when PutBucketLogging is called.

Question 2

A media company stores millions of video files in an Amazon S3 bucket. The security team wants to ensure that all objects are encrypted with SSE-KMS using a specific customer managed key, and that any attempt to upload an object without that encryption is denied. The team also wants to prevent any principal, including the bucket owner, from deleting the bucket policy. Which two actions should be taken to meet these requirements? (Choose two.)

Accepted Answer

Add a bucket policy statement that denies s3:DeleteBucketPolicy to all principals, including the bucket owner.. Enforcing encryption on every upload requires an explicit deny in the bucket policy that checks the encryption headers, because default encryption does not reject uploads with different settings. Protecting the policy from deletion requires an explicit deny on s3:DeleteBucketPolicy, which overrides any allow, including for the bucket owner. Together, these two statements meet both the encryption and policy-protection requirements.

Answer

Attach a resource-based policy to the KMS key that allows only the S3 service to use it for encryption and decryption.

Answer

Enable S3 default encryption with SSE-KMS using the customer managed key and rely on it to reject unencrypted uploads.

Answer

Enable S3 Object Lock in compliance mode on the bucket to prevent deletion of the bucket policy.

Question 3

A financial services firm stores sensitive customer records in an Amazon S3 bucket. The security team wants to ensure that only requests made through a specific VPC endpoint are allowed, and that any request not originating from that endpoint is explicitly denied. The bucket is accessed by EC2 instances in a single VPC. Which combination of steps should be taken to meet these requirements?

Accepted Answer

Create a gateway VPC endpoint for S3, attach a bucket policy with a Deny statement for requests where aws:SourceVpce does not equal the endpoint ID, and block public access.. To restrict S3 access to a specific VPC endpoint, use a gateway VPC endpoint and a bucket policy with an explicit Deny when aws:SourceVpce does not match the endpoint ID. Block Public Access adds defense in depth. This ensures only endpoint-originated requests are allowed and all others are denied.

Answer

Create a gateway VPC endpoint for S3, use a network ACL on the subnet to deny all traffic except to the S3 prefix list, and enable S3 Block Public Access.

Answer

Create a gateway VPC endpoint for S3, attach a bucket policy that allows only requests where aws:SourceVpce equals the endpoint ID, and block public access.

Answer

Create an interface VPC endpoint for S3, attach a bucket policy that denies requests unless aws:SourceVpce matches the endpoint ID, and remove any public access.

Question 4

A healthcare company runs a patient-records API on Amazon EC2 instances behind an Application Load Balancer. The API must accept TLS 1.2 or higher from clients, and the security team wants to centrally manage the certificate and rotate it without touching the instances. The company already uses AWS Certificate Manager (ACM). Which configuration meets these requirements with the LEAST operational effort?

Accepted Answer

Import the certificate into ACM, attach it to the ALB's HTTPS listener, and enable TLS 1.2 as the minimum policy on the listener.. Terminating TLS at the Application Load Balancer with an ACM certificate is the standard, low-effort pattern for central certificate management and rotation. Setting the listener's security policy to a TLS 1.2 minimum enforces the protocol floor while keeping certificate lifecycle operations out of the instances. Instance-level certificates and Global Accelerator do not provide equivalent central management or protocol enforcement.

Answer

Install the certificate directly on each EC2 instance and configure the web server to require TLS 1.2, then terminate TLS on the instances.

Answer

Use an AWS Global Accelerator endpoint with a self-signed certificate and forward TLS traffic to the ALB over port 443.

Answer

Create an ACM certificate in a different Region and associate it with the ALB listener using cross-Region certificate references.

Question 5

A financial services company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must be accessible only from specific IP addresses and must use HTTPS. The security team wants to implement a solution that minimizes management overhead and integrates with AWS WAF. Which solution should a solutions architect recommend?

Accepted Answer

Configure the ALB with an HTTPS listener, import an SSL certificate into AWS Certificate Manager (ACM), and attach an AWS WAF web ACL to the ALB.. An ALB with an HTTPS listener using an ACM certificate provides TLS termination and simplifies certificate management. Associating an AWS WAF web ACL with the ALB allows filtering based on IP addresses, satisfying the access restriction requirement. This combination is the most integrated and low-overhead solution.

Answer

Place the EC2 instances in a private subnet and use an Amazon CloudFront distribution with an AWS WAF web ACL, restricting access to specific IP addresses using a geo restriction.

Answer

Configure the ALB with an HTTP listener and use AWS WAF to redirect HTTP to HTTPS.

Answer

Use a Network Load Balancer (NLB) with a TLS listener and configure security groups to allow only specific IP addresses.

Question 6

A company hosts a multi-tenant SaaS application on AWS. Each tenant has a dedicated Amazon S3 prefix in a shared bucket. The security team wants to ensure that a compromised tenant's IAM role cannot access another tenant's prefix, even if the role's policy is accidentally modified to allow it. The team wants a defense-in-depth control that is evaluated independently of the IAM policy. Which solution meets this requirement?

Accepted Answer

Add a bucket policy statement that denies s3:GetObject and s3:PutObject for any role whose aws:PrincipalTag/tenant does not match the tenant prefix in the resource ARN.. An explicit deny in the S3 bucket policy that compares the principal's tenant tag with the resource prefix enforces isolation at the bucket level. Because explicit denies override allows, a compromised or modified IAM role policy cannot bypass this control. This provides an independent, defense-in-depth mechanism that does not rely solely on the IAM policy, meeting the requirement.

Answer

Configure AWS Lake Formation to manage access to the S3 prefix and grant each tenant role permission only to its own prefix.

Answer

Enable S3 Block Public Access on the bucket and require all tenants to use presigned URLs generated by a central service.

Answer

Use S3 Access Points for each tenant and configure an access point policy that allows only that tenant's role to access the corresponding prefix.

Question 7

A healthcare analytics team runs an Amazon Aurora MySQL cluster in a private subnet group. A separate AWS account hosts a reporting application that must query the cluster directly over the network. Compliance requires that credentials for the database are never stored in the reporting application's code or environment, and that access is limited to a single database user with a defined maximum session length. Which two actions should a solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

Create an IAM role in the database account with a trust policy allowing the reporting account, and grant that role rds-db:connect for the specific database user and cluster resource ID.. IAM database authentication replaces stored passwords with a token derived from IAM credentials, and the token expires after 15 minutes, which satisfies both the no-stored-credentials and bounded-session rules. The rds-db:connect permission scoped to one db-user and the cluster resource ID keeps access least-privileged, while a cross-account trust policy lets the reporting account assume the role without duplicating database users.

Answer

Attach an interface VPC endpoint for Amazon RDS Data API to the reporting account's VPC and call the Data API with the reporting account's IAM credentials.

Answer

Configure the cluster's security group to allow the reporting account's CIDR on port 3306 and distribute a shared read-only user password through AWS Systems Manager Parameter Store.

Answer

Store the Aurora master user password in AWS Secrets Manager with automatic rotation and grant the reporting account permission to read the secret.

Question 8

A company runs a critical application on Amazon EC2 instances in a private subnet. The application retrieves database credentials from AWS Secrets Manager at startup. The security team wants to ensure that if the credentials are compromised, they can be revoked immediately and that the application can continue to function without redeploying. The application currently caches credentials in memory and refreshes them every 24 hours. What should a solutions architect recommend to improve security?

Accepted Answer

Enable automatic rotation of the secret in Secrets Manager and configure the application to use the Secrets Manager caching library with a short TTL.. Secrets Manager automatic rotation combined with a caching library that has a short TTL allows the application to pick up new credentials quickly without a restart. When rotation occurs, the old credentials are invalidated, satisfying the immediate revocation requirement. The application continues to function by refreshing from the cache after the TTL expires, so no redeployment is needed.

Answer

Enable automatic rotation of the secret in Secrets Manager and configure the application to retrieve the secret each time it connects to the database.

Answer

Store the credentials in an encrypted Amazon S3 object and have the application download the object at each startup.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString and have the application read them at startup.

Question 9

A company is designing a secure architecture for a new application that will run on Amazon EC2 instances in a VPC. The security team wants to ensure that the instances can access an Amazon DynamoDB table without traversing the public internet, and that access is limited to only the required DynamoDB actions on that table. (Choose two.)

Accepted Answer

Attach an IAM policy to the EC2 instance role that allows only the specific DynamoDB actions needed on the target table's ARN.. A VPC gateway endpoint for DynamoDB keeps traffic private and off the internet, and an IAM policy on the instance role enforces least privilege by allowing only the necessary actions on the specific table. Together, these satisfy both the network isolation and access restriction requirements.

Answer

Configure a NAT gateway in a public subnet and update the instances' route table to direct DynamoDB traffic through it.

Answer

Create an interface VPC endpoint for DynamoDB and enable private DNS name resolution for the endpoint.

Answer

Attach a resource-based policy to the DynamoDB table that allows access only from the VPC's CIDR range.

Question 10

A logistics company uses AWS IAM Identity Center (successor to AWS Single Sign-On) to give employees access to multiple AWS accounts. The security team wants to require multi-factor authentication for all workforce sign-ins and ensure that users cannot bypass MFA by creating long-lived access keys for programmatic access. Which combination of settings achieves this?

Accepted Answer

Enforce MFA in the IAM Identity Center authentication settings and attach a permissions boundary that denies iam:CreateAccessKey to the permission sets.. Preventing MFA bypass requires both an authentication control and an authorization guardrail. IAM Identity Center MFA enforcement secures interactive sign-in, while a permissions boundary that denies iam:CreateAccessKey stops users from creating long-lived credentials that would not require MFA. Detection-only or default-policy approaches leave the bypass open, and reverting to IAM users weakens central governance.

Answer

Enable MFA in IAM Identity Center and rely on the default AWS managed policies attached to permission sets.

Answer

Require MFA at sign-in and enable AWS CloudTrail to alert on iam:CreateAccessKey calls.

Answer

Create an IAM user for each employee with an MFA policy and disable IAM Identity Center.

Question 11

A company uses AWS Lambda functions to process sensitive data. The security team requires that the functions retrieve database credentials at runtime without storing them in environment variables or code, and that the credentials are automatically rotated every 90 days. The credentials must be encrypted with a customer managed KMS key. Which two actions should be taken to meet these requirements? (Choose two.)

Accepted Answer

Encrypt the secrets using a customer managed KMS key and grant the Lambda execution role permissions to decrypt with that key.. AWS Secrets Manager natively supports automatic rotation with a Lambda rotation function and a configurable interval, and it encrypts secrets with KMS. Using a customer managed KMS key and granting the Lambda execution role decrypt permissions ensures the credentials are encrypted with a customer-controlled key and accessible at runtime without hardcoding.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString parameter and enable automatic rotation.

Answer

Use AWS KMS to generate a new data key every 90 days and use it to encrypt the credentials stored in Amazon S3.

Answer

Store the credentials in environment variables encrypted with a customer managed KMS key and rotate them manually every 90 days.

Question 12

A company stores customer statements in an Amazon S3 bucket and must prove to regulators that objects cannot be altered or removed for five years once written. The compliance officer wants a control that even the account's own administrators cannot override, and wants to be able to verify that the retention is in force. Which combination of features meets these requirements?

Accepted Answer

Enable S3 Object Lock in compliance mode with a five-year retention period, and configure AWS CloudTrail data events plus S3 Object Lock legal hold reporting to confirm retention status.. S3 Object Lock in compliance mode enforces a retention period that no principal, including the root user, can shorten or remove, which is the only option that survives an administrator trying to override it. Pairing it with CloudTrail data events and inspection of each object's retain-until date and lock mode gives the verifiable evidence the compliance officer needs.

Answer

Enable S3 Versioning with MFA delete and a lifecycle rule that transitions objects to S3 Glacier Deep Archive after 30 days with a five-year expiration.

Answer

Enable S3 Versioning and a bucket policy that denies s3:DeleteObject and s3:PutObject to all principals except a dedicated writer role.

Answer

Enable S3 Object Lock in governance mode with a five-year retention period and grant s3:BypassGovernanceRetention only to the compliance officer's role.

Question 13

A healthcare company stores protected health information (PHI) in an Amazon S3 bucket. The security team wants to ensure that all objects are encrypted with a customer managed AWS KMS key (CMK) and that any attempt to upload an unencrypted object is denied. They also want to audit all KMS key usage. Which combination of actions should a solutions architect take to meet these requirements with the LEAST operational overhead?

Accepted Answer

Enable default encryption on the S3 bucket using the CMK, and add a bucket policy that denies s3:PutObject requests where the s3:x-amz-server-side-encryption header is not aws:kms. Enable AWS CloudTrail to log KMS API calls.. The most operationally efficient solution combines S3 default encryption with a bucket policy that denies uploads lacking the aws:kms header. This enforces encryption before the object is written. CloudTrail captures KMS API calls for auditing. Together, these native features provide preventive and detective controls without custom code, meeting the security and compliance requirements.

Answer

Configure an S3 Lifecycle rule to encrypt objects after upload using the CMK, and enable AWS CloudTrail to log S3 data events. Use Amazon Macie to detect unencrypted objects.

Answer

Use AWS CloudFormation to deploy a custom Lambda function that inspects every S3 PutObject event and deletes objects that are not encrypted with the CMK. Enable AWS Config rules to monitor encryption status.

Answer

Create an IAM policy that denies s3:PutObject unless the request includes the aws:kms encryption header, and attach it to all IAM users. Enable S3 server access logging for auditing.

Question 14

A retail company stores product images in an Amazon S3 bucket that must be readable by a public website but writable only by an internal upload service running on Amazon EC2. The security team wants to avoid making the bucket fully public. Which two actions should be taken to meet these requirements? (Choose two.)

Accepted Answer

Attach a bucket policy that allows s3:GetObject to everyone (Principal "*") for the objects prefix used by the website.. The public website needs anonymous read access limited to the website's objects, which a scoped bucket policy granting s3:GetObject to everyone provides without exposing the whole bucket. The upload service needs write access, which an IAM role attached to the EC2 instance supplies using temporary credentials. Together these two controls deliver public read and private write, while avoiding account-wide public access and static keys.

Answer

Generate an IAM user access key and secret key and store them in the upload service's configuration file on the instances.

Answer

Enable S3 Transfer Acceleration on the bucket to allow the public website to read objects faster.

Answer

Disable S3 Block Public Access at the account level so the bucket policy can take effect.

Question 15

A company needs to grant a third-party auditor read-only access to a specific Amazon S3 bucket for a limited period. The auditor has an AWS account and will use their own IAM credentials. The company wants to avoid creating IAM users and wants the access to expire automatically after 7 days. Which solution meets these requirements?

Accepted Answer

Create an IAM role with a trust policy allowing the auditor's account to assume it, attach a policy granting s3:GetObject and s3:ListBucket on the bucket, and configure the role's maximum session duration to 12 hours. Instruct the auditor to assume the role daily.. The correct approach is to create an IAM role that the auditor's AWS account can assume, granting read-only S3 permissions. Because the maximum session duration is 12 hours, the auditor assumes the role daily. This eliminates the need for IAM users and provides temporary credentials. Access can be revoked after 7 days by removing the role or trust policy.

Answer

Create an IAM user with programmatic access, attach a policy granting read-only access to the bucket, and rotate the access keys after 7 days.

Answer

Create an IAM role in the company's account with a trust policy that allows the auditor's AWS account to assume it, and attach a policy granting s3:GetObject and s3:ListBucket on the bucket. Set the maximum session duration to 7 days.

Answer

Generate a presigned URL for each object in the bucket with an expiration of 7 days, and provide the URLs to the auditor.