SAA-C03 Design Secure Architectures Practice Test 9 — 15 Questions

Question 1

Your company uses an OIDC identity provider to let users assume an IAM role without long-term AWS credentials. In the IAM role trust policy, which STS action must be allowed to support this type of federation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

sts:AssumeRoleWithWebIdentity. Sts:AssumeRoleWithWebIdentity is the STS API action specifically designed for federated users authenticated by an OIDC or SAML identity provider. This action returns temporary security credentials without requiring long-term AWS access keys, enabling the OIDC-based federation described in the question.

Answer

sts:AssumeRole

Answer

sts:GetCallerIdentity

Answer

sts:TagSession

Question 2

A public API is served through an Application Load Balancer and protected by AWS WAF. The team wants AWS to automatically block clients that send too many requests from the same IP address within a short time window. Which AWS WAF feature is the best fit?

Accepted Answer

Use a rate-based rule in AWS WAF to block when requests per IP exceed a configured threshold over the WAF rate-based evaluation window.. A rate-based rule in AWS WAF is specifically designed to automatically block clients when the number of requests from a single IP address exceeds a configured threshold within a rolling evaluation window (typically 5 minutes). This feature directly addresses the requirement to mitigate high request rates from the same IP, making it the best fit for the described use case.

Answer

Use an AWS IAM policy on the ALB listener to deny requests when request count exceeds a threshold.

Answer

Enable S3 server access logs for the bucket that stores API responses and alert on high log volume.

Answer

Configure an AWS Lambda authorizer to reject requests after the Nth request from an IP address.

Question 3

An S3 bucket uses a customer-managed KMS key as the default for SSE-KMS encryption. A service role will upload objects using s3:PutObject. Assuming the role already has permission to write to the bucket, which KMS permission is most directly required for the role to let S3 encrypt the object during upload?

Accepted Answer

kms:GenerateDataKey (and optionally kms:DescribeKey). When S3 uses SSE-KMS with a customer-managed KMS key, the service calls KMS to generate a data key for encrypting the object. The s3:PutObject operation requires the caller to have kms:GenerateDataKey permission on the KMS key so that S3 can obtain the plaintext and encrypted versions of the data key. Optionally, kms:DescribeKey may be needed for S3 to verify the key exists, but kms:GenerateDataKey is the most directly required permission.

Answer

kms:Decrypt only

Answer

kms:CreateAlias and kms:UpdateAlias only

Answer

kms:ScheduleKeyDeletion and kms:CancelKeyDeletion only

Question 4

A containerized service needs to read exactly one secret value from AWS Secrets Manager. The secret’s ARN is already known, and the secret is encrypted with the AWS-managed KMS key for Secrets Manager, so no separate KMS permissions are needed for this question. The service does not need to list secrets, create secrets, rotate them, or write updates. What is the most least-privilege IAM permission statement to grant the service role?

Accepted Answer

Allow secretsmanager:GetSecretValue on the specific secret ARN only.. The service only needs to read a single secret value, and the least-privilege permission is to allow only the `secretsmanager:GetSecretValue` action on that specific secret's ARN. This grants exactly the required read access without any additional capabilities, adhering to the principle of least privilege. Since the secret is encrypted with the AWS-managed KMS key for Secrets Manager, no separate KMS permissions are needed, as the key policy automatically grants access to the Secrets Manager service.

Answer

Allow secretsmanager:* on all resources in the account.

Answer

Allow secretsmanager:ListSecrets so the service can discover the secret ARN at runtime.

Answer

Allow secretsmanager:PutSecretValue so the service can retrieve and update the secret value.

Question 5

A security team needs an audit trail to investigate suspicious API activity across multiple AWS accounts. Which AWS approach best provides centralized visibility into who did what, when, for service API calls?

Accepted Answer

Create an AWS CloudTrail organization trail that delivers logs to a centralized, access-controlled S3 bucket.. AWS CloudTrail organization trail is the correct approach because it captures all management and data events across multiple AWS accounts within an AWS Organizations structure, delivering them to a single, centralized S3 bucket. This provides a unified, immutable audit trail of who performed which API call, when, and from which source IP, enabling the security team to investigate suspicious activity with full visibility. The centralized bucket can be access-controlled with S3 bucket policies and IAM to ensure only authorized personnel can view the logs.

Answer

Enable AWS Config only for EC2 security groups and rely on it for API call auditing.

Answer

Turn on S3 server access logging for every bucket and assume it covers all AWS services.

Answer

Use only Amazon CloudWatch alarms with no logging destination to reduce storage costs.

Question 6

An internal web application must require encrypted client connections. The company currently has an ALB listener on port 80 (HTTP), and users can access the application over plain HTTP. What is the best change to ensure all client traffic uses HTTPS?

Accepted Answer

Configure an HTTPS (port 443) listener using an ACM certificate and update the port 80 listener to redirect to HTTPS (or to block plain HTTP requests).. It uses an HTTPS listener on port 443 with an ACM certificate to enforce encrypted client connections, and redirecting HTTP (port 80) traffic to HTTPS ensures all traffic is encrypted in transit. This is the standard AWS best practice for enforcing HTTPS on an ALB, as it directly controls the listener behavior at the load balancer level without requiring application changes.

Answer

Enable S3 default encryption so HTTP requests are automatically encrypted in transit.

Answer

Set the application to encrypt data only after it is received by the ALB.

Answer

Rely on WAF alone to encrypt HTTP traffic.

Question 7

Based on the exhibit, an EC2 application runs in private subnets with no NAT gateway and must retrieve a secret from AWS Secrets Manager. The secret uses a customer managed KMS key. Which change will allow the application to reach the service while keeping traffic off the internet?

Accepted Answer

Create an interface VPC endpoint for Secrets Manager and another interface VPC endpoint for KMS, and enable private DNS for both.. It creates interface VPC endpoints for both Secrets Manager and KMS, which allows the EC2 instance in the private subnet to securely access these services over the AWS network without traversing the internet. Enabling private DNS ensures that the standard service endpoints resolve to the private IP addresses of the VPC endpoints, eliminating the need for a NAT gateway or internet gateway.

Answer

Create an S3 gateway endpoint for Secrets Manager and use the existing S3 gateway endpoint for both secret retrieval and KMS decryption.

Answer

Add a NAT gateway in a public subnet and route 0.0.0.0/0 from the private subnets to the NAT gateway.

Answer

Move the application into a public subnet so it can call the public Secrets Manager endpoint directly.

Question 8

Based on the exhibit, a batch platform in Account B must assume a role in Account A. Only the specific role arn:aws:iam::222233334444:role/BatchRunner should be allowed to assume it, and the design must prevent any other role in Account B from reusing the same external ID. Which change best meets the requirement?

Accepted Answer

Change the trust policy principal from account root to arn:aws:iam::222233334444:role/BatchRunner and keep the ExternalId condition.. The trust policy on the target role in Account A must restrict the principal to the exact BatchRunner role ARN (arn:aws:iam::222233334444:role/BatchRunner) rather than the entire Account B root. This ensures that only that specific role can assume the target role. Keeping the ExternalId condition adds an additional layer of security by requiring a unique identifier that only BatchRunner knows, preventing any other role in Account B from reusing the same external ID.

Answer

Add an identity-based policy to the BatchRunner role that allows sts:AssumeRole on the target role.

Answer

Replace the ExternalId condition with a role session name condition so only BatchRunner sessions are accepted.

Answer

Attach an SCP to Account B that denies sts:AssumeRole unless the request comes from BatchRunner.

Question 9

Based on the exhibit, an application in the same AWS account can upload and read objects in an S3 bucket encrypted with a customer managed KMS key, but GetObject fails with an AccessDenied error from AWS KMS. The IAM role already has s3:GetObject, s3:PutObject, kms:Decrypt, and kms:GenerateDataKey permissions. What change most directly fixes the issue while preserving least privilege?

Accepted Answer

Update the KMS key policy to allow the application role to use the key, ideally with a kms:ViaService condition for S3.. The error is an AccessDenied from AWS KMS, not from S3, which means the IAM role has the required S3 permissions (s3:GetObject) and KMS API permissions (kms:Decrypt), but the KMS key policy does not explicitly grant the role access to the key. Since customer managed KMS keys require a key policy to grant IAM principals permission to use the key (IAM policies alone are insufficient unless the key policy delegates such authority), updating the key policy to allow the role with a kms:ViaService condition for S3 directly resolves the KMS-side denial while preserving least privilege.

Answer

Add an S3 bucket ACL that grants the application role full control over objects.

Answer

Replace the customer managed key with the AWS managed S3 key so IAM permissions become sufficient.

Answer

Add an S3 bucket policy that grants s3:GetObject and s3:PutObject to the role for all objects.

Question 10

Based on the exhibit, an application runs in private subnets without a NAT gateway and must retrieve a secret from AWS Secrets Manager. Security requires the traffic to stay on the AWS network and not traverse the public internet. What is the best solution?

Accepted Answer

Create an interface VPC endpoint for Secrets Manager and enable private DNS for the endpoint.. An interface VPC endpoint for Secrets Manager allows the application in the private subnet to securely access Secrets Manager over the AWS network using private IP addresses, without needing a NAT gateway or internet gateway. Enabling private DNS ensures that the default Secrets Manager DNS name resolves to the endpoint's private IP addresses, keeping all traffic within the AWS backbone and satisfying the security requirement.

Answer

Add a NAT gateway to the private subnet route table and keep using the public Secrets Manager endpoint.

Answer

Create a gateway VPC endpoint for Secrets Manager and point the route table to it.

Answer

Use VPC peering to connect the application subnet to another VPC that already has internet access.

Question 11

Based on the exhibit, a company stores sensitive PDFs in S3 and serves them through CloudFront. Direct requests to the S3 object URL must fail, but CloudFront should still be able to fetch the files securely. Which solution best satisfies the requirement?

Accepted Answer

Configure CloudFront Origin Access Control for the S3 origin and update the bucket policy to allow only that distribution.. CloudFront Origin Access Control (OAC) allows CloudFront to authenticate requests to an S3 origin using a specific identity, and the bucket policy can be configured to grant access only to that CloudFront distribution. This ensures that direct S3 object URL requests fail (since they lack the CloudFront signature), while CloudFront can still fetch the files securely using the OAC mechanism.

Answer

Leave the bucket public but require CloudFront signed cookies for all users.

Answer

Use an S3 access point and give it a public policy so CloudFront can reach the objects.

Answer

Use S3 object ACLs to grant read access only to users behind CloudFront.

Question 12

Based on the exhibit, the security team wants centralized detection and alerting for both successful and failed attempts to change S3 bucket policies and KMS key policies across multiple accounts. Which approach best meets the requirement?

Accepted Answer

Create an organization CloudTrail trail for management events and add EventBridge rules in the security account to alert on PutBucketPolicy and PutKeyPolicy events, including failed calls.. An organization CloudTrail trail captures management events (including PutBucketPolicy and PutKeyPolicy) across all accounts in the organization, and EventBridge rules in the security account can filter for both successful and failed API calls (using the `errorCode` field) to trigger centralized alerts. This provides the required centralized detection and alerting for policy changes across multiple accounts.

Answer

Enable S3 server access logging on each bucket and archive the logs in the security account.

Answer

Use AWS Config rules only, because Config records every successful and failed API call automatically.

Answer

Enable GuardDuty in every account and use its findings as the main source for policy change notifications.

Question 13

Based on the exhibit, a development team in member accounts can create IAM roles, but one team created a role without the required permissions boundary. Security wants to ensure that no future role in the organization can exceed the approved boundary, even if a developer has broad IAM permissions. What is the best control to add?

Accepted Answer

Add an SCP that denies iam:CreateRole and iam:PutRolePermissionsBoundary unless the request specifies the ApprovedAppBoundary ARN.. A Service Control Policy (SCP) at the organization root or in the member account's OU can deny IAM actions unless the required permissions boundary (ApprovedAppBoundary) is specified. This prevents any role creation or modification that would bypass the boundary, even if the developer has full IAM permissions in their account. SCPs are the only control that can enforce this across all principals in an account, including the account root user.

Answer

Add a permission boundary to the developer role that points to ApprovedAppBoundary.

Answer

Use an S3 bucket policy to block policy documents that grant AdministratorAccess.

Answer

Require team members to use STS session policies when they create new roles.

Question 14

Based on the exhibit, a central deployment role in Account A is assumed by several CI/CD pipelines from Account B. The role must remain reusable, but the team wants the TeamA pipeline to upload artifacts only to s3://artifact-bucket/teamA/prod/ without creating a separate IAM role. What is the best approach?

Accepted Answer

Pass an STS session policy when TeamA assumes the role to further restrict the temporary credentials to the teamA/prod prefix.. When the TeamA pipeline assumes the central IAM role in Account A, it can pass an STS session policy that further restricts the temporary credentials to only allow actions on the s3://artifact-bucket/teamA/prod/ prefix. This approach keeps the role reusable for other pipelines while enforcing a narrower permission scope at the session level, without requiring a separate IAM role.

Answer

Use an IAM user in Account B and hard-code the narrower S3 path in its access key policy.

Answer

Add a bucket ACL that grants write access only to the TeamA pipeline session name.

Answer

Attach a permissions boundary to the central role so every pipeline session inherits the narrower prefix automatically.

Question 15

A microservice runs on an EC2 instance using an instance role. It must retrieve exactly one secret value from AWS Secrets Manager. The secret ARN is arn:aws:secretsmanager:us-east-1:111122223333:secret:prod/dbPassword-AbCdEf. The secret is encrypted with the default AWS-managed Secrets Manager KMS key (alias/aws/secretsmanager). Which IAM policy statement provides the best least-privilege access?

Accepted Answer

Allow secretsmanager:GetSecretValue only for the specific secret ARN: Resource "arn:aws:secretsmanager:us-east-1:111122223333:secret:prod/dbPassword-AbCdEf".. It grants the least-privilege access by restricting the secretsmanager:GetSecretValue action to the exact secret ARN required. Since the secret is encrypted with the default AWS-managed KMS key (alias/aws/secretsmanager), no additional kms:Decrypt permission is needed because Secrets Manager automatically handles decryption with the default key when using GetSecretValue. This policy ensures the microservice can retrieve only the intended secret and no others.

Answer

Allow secretsmanager:GetSecretValue on all secrets: Resource "*".

Answer

Allow secretsmanager:DescribeSecret on the secret ARN, but not secretsmanager:GetSecretValue.

Answer

Allow secretsmanager:GetSecretValue on all secrets with the prefix: Resource "arn:aws:secretsmanager:us-east-1:111122223333:secret:prod/*".