SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create an AWS WAF web ACL using managed rule sets and associate it with the CloudFront distribution.

  Why this is correct

  AWS WAF examines incoming HTTP/HTTPS requests at the edge (when associated to CloudFront) and applies rule logic to detect common exploit patterns. Managed rule sets provide pre-built protections for threats like SQL injection and XSS before requests reach your origin.

• ✗

  Add inbound rules to the security group so that only port 443 is open from the internet.

  Why it's wrong here

  A security group acts as a stateful, instance-level firewall that filters traffic by IP addresses, ports, and protocols; it has no logic to examine the payload inside allowed port 443 traffic. Opening only port 443 still permits SQL injection and XSS because those attacks are delivered through HTTPS requests that are perfectly valid at the network layer. Web application attacks occur after the TLS connection is established and the request content is parsed, so security groups are indifferent to the actual HTTP body, headers, or parameters carrying the exploit.

  When this WOULD be correct

  If the question asked for 'restricting inbound traffic to only HTTPS from the internet to an EC2 instance' without mentioning web exploits, then adding inbound rules to the security group for port 443 would be appropriate.

• ✗

  Enable AWS Shield Advanced to block SQL injection and XSS.

  Why it's wrong here

  AWS Shield Advanced defends against Distributed Denial of Service (DDoS) attacks by absorbing volumetric, resource-exhaustion, and some Layer 7 events such as floods; it does not inspect request content for application exploit signatures like SQL injection or cross-site scripting. While Shield Advanced can be combined with AWS WAF for a layered DDoS strategy, its protection focuses on ensuring availability, not on detecting or blocking malicious payloads embedded in legitimate-looking HTTP(S) traffic. SQLi and XSS require rule-based evaluation of request fields, which is the explicit job of AWS WAF.

  When this WOULD be correct

  When the question asks for the best service to protect against large-scale DDoS attacks (e.g., volumetric or state-exhaustion attacks) targeting an application behind CloudFront, and the requirement is for enhanced DDoS mitigation with 24/7 support and cost protection.

• ✗

  Restrict IAM permissions for the application’s EC2 instances so that SQL injection payloads cannot be executed.

  Why it's wrong here

  IAM permissions govern which AWS APIs and resources an instance can call (for example, whether it can read an S3 bucket or invoke a Lambda function); they have no visibility into the HTTP request body or query string that a web application receives. SQL injection arises when application code concatenates unvalidated user input into a SQL statement — that is entirely independent of the IAM identity used by the EC2 instance. Even a least-privilege instance profile would still allow the application to execute malicious SQL against its database, because IAM does not filter application-layer payloads.

  When this WOULD be correct

  This option would be correct in a question about limiting the blast radius of a compromised application, such as: 'How can you ensure that an EC2 instance running a web application cannot delete S3 buckets if it is compromised via SQL injection?'

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question