SAA-C03 Design Secure Architectures Practice Question
A company is building a zero-trust architecture for its internal microservices running on Amazon EKS. Which THREE steps should the solutions architect take to ensure secure, least-privilege communication between services? (Select THREE)
⚠ Common exam trap
SAA-C03 often tests the misconception that a single public subnet or disabling logging improves security or performance, when in fact zero-trust requires segmentation, encryption, and monitoring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign IAM Roles to individual Kubernetes Service Accounts (IRSA).
Option A is correct because IAM Roles for Service Accounts (IRSA) lets each Kubernetes Service Account assume a distinct IAM role via the EKS OIDC provider, so individual microservices receive only the AWS permissions they need, which is a core least-privilege control in a zero-trust model. Option B is correct because AWS App Mesh enforces mutual TLS (mTLS) between microservices, providing cryptographic identity verification and encrypted service-to-service traffic so that no service is trusted merely by network location. Option C is correct because Security Groups for Pods (using the VPC CNI and ENI trunking) applies EC2 security group rules directly to pod ENIs, enabling fine-grained, least-privilege network segmentation between specific services. Option D is not appropriate because placing all microservices in a single public subnet exposes them to the internet and removes the network segmentation that zero-trust requires. Option E is not appropriate because disabling VPC Flow Logs reduces visibility and auditability of traffic, which is essential for detecting and investigating lateral movement in a zero-trust architecture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign IAM Roles to individual Kubernetes Service Accounts (IRSA).
Why this is correct
IRSA allows you to associate an IAM role with a Kubernetes service account. This provides each pod with the minimum necessary AWS permissions to access services like S3 or DynamoDB, rather than giving permissions to the entire worker node, adhering to the principle of least privilege.
- ✓
Use AWS App Mesh to enforce Mutual TLS (mTLS) between microservices.
Why this is correct
AWS App Mesh can manage service-to-service communication and automatically handle the encryption of traffic using mTLS. This ensures that only authenticated and authorized services can communicate with each other, providing the 'verify every request' foundation required for a robust zero-trust architecture.
- ✓
Configure Security Groups for Pods to restrict network traffic between services.
Why this is correct
By using Security Groups for Pods, you can define fine-grained network firewall rules at the pod level instead of the node level. This allows you to restrict traffic to only the specific ports and protocols required for service-to-service interaction, preventing lateral movement within the cluster.
- ✗
Place all microservices in a single public subnet to simplify routing.
Why it's wrong here
Placing microservices in a public subnet exposes them to the internet, which is the opposite of zero-trust and secure architecture principles. Services should be in private subnets, and access should be strictly controlled through gateways and load balancers to minimize the available attack surface.
- ✗
Disable VPC Flow Logs to reduce latency between microservices.
Why it's wrong here
VPC Flow Logs have no impact on network latency as they are captured out-of-band. Disabling them would remove critical visibility and auditing capabilities needed to detect and investigate security incidents, which is essential for maintaining a secure and compliant zero-trust environment over time.
Visual reference
About these practice questions
This SAA-C03 question is part of Courseiva's 149-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.