Hard — SAA-C03 Practice Quiz

Question 1

A company hires a third-party SaaS monitoring vendor that needs read-only access to CloudWatch metrics in the company's AWS account. The vendor will access the account programmatically from their own AWS account. The security team wants to grant this access without creating long-term IAM user credentials and wants to protect against the 'confused deputy' problem where the vendor could be tricked into accessing the wrong customer's account. What is the MOST secure way to configure this access?

Accepted Answer

Create an IAM role in the company account that trusts the vendor's AWS account, and require an external ID condition in the role's trust policy that the vendor must supply when assuming the role.

Answer

Create an IAM user in the company account, generate access keys, and email the keys securely to the vendor for programmatic access.

Answer

Create an IAM role in the company account that trusts the vendor's AWS account with no additional conditions, relying on the account ID alone for security.

Answer

Add the vendor's AWS account as a principal in a resource-based policy on CloudWatch and enable MFA for the vendor's federated users.

Question 2

A company runs a chatty microservices application on EC2 across three Availability Zones in a single Region. The services exchange large volumes of traffic with each other continuously. The finance team notices a large and growing line item for inter-AZ data transfer on the monthly bill. The architecture must remain highly available, but the team wants to reduce these data transfer costs. Which approach best reduces the inter-AZ transfer charges while preserving availability?

Accepted Answer

Use placement groups and topology-aware routing so that most service-to-service traffic stays within the same Availability Zone, while keeping instances spread across AZs for failover.

Answer

Consolidate all microservices instances into a single Availability Zone to eliminate all inter-AZ data transfer charges.

Answer

Route all inter-service traffic through a NAT gateway so the traffic is billed at the lower NAT processing rate.

Answer

Enable VPC peering between the subnets in each Availability Zone to remove data transfer charges for intra-Region traffic.

Question 3

A financial services company has established a 10 Gbps AWS Direct Connect dedicated connection between its on-premises data center and AWS. A new compliance requirement mandates that all data traversing the physical connection be encrypted at Layer 2. The security team wants the lowest-latency solution that meets this requirement without adding an overlay tunnel. What should the solutions architect recommend?

Accepted Answer

Enable MACsec (802.1AE) encryption on the Direct Connect dedicated connection

Answer

Configure an AWS Site-to-Site VPN running over the Direct Connect public virtual interface

Answer

Enable a Direct Connect gateway and attach it to a transit gateway with IPsec

Answer

Use AWS Transit Gateway Connect with GRE tunnels to encrypt the traffic

Question 4

A financial services company wants to let its development team create their own IAM roles for Lambda functions without opening a ticket each time. Security requires that any role the developers create can never grant more than read/write access to a specific set of DynamoDB tables and S3 buckets, even if the developers attach broader policies. Which approach meets these requirements with the least ongoing administrative effort?

Accepted Answer

Create an IAM permissions boundary that defines the maximum allowed permissions, and give developers a policy that only allows creating roles which have that permissions boundary attached.

Answer

Grant developers iam:CreateRole permission and require the security team to review every new role during a weekly audit.

Answer

Attach a service control policy (SCP) to the developers' IAM users limiting them to DynamoDB and S3 actions.

Answer

Provide developers a set of pre-built roles managed by the security team and deny all iam:CreateRole actions.

Question 5

A company runs a data-processing Lambda function that must temporarily decrypt objects using a customer managed KMS key owned by a separate analytics team. The analytics team wants to allow the Lambda's execution role to decrypt for the duration of a batch job without permanently editing the KMS key policy, and they want the ability to revoke the permission programmatically when the job completes. Which approach best meets these requirements?

Accepted Answer

Create a KMS grant that gives the Lambda execution role the Decrypt operation, and retire or revoke the grant when the batch job finishes.

Answer

Add the Lambda execution role as a principal in the KMS key policy with kms:Decrypt, then remove it from the policy after the job.

Answer

Attach an IAM identity policy to the Lambda execution role allowing kms:Decrypt on the key, and detach it after the job.

Answer

Enable automatic key rotation on the KMS key so the Lambda can decrypt only during the rotation window.

Question 6

A financial services company runs a fleet of EC2 instances in private subnets that must reach the internet through a NAT gateway to download OS patches. Compliance rules require that outbound traffic be restricted so instances can only communicate with a specific allowlist of external domains (such as the OS vendor's update repositories) and all other outbound traffic must be blocked and logged for auditing. Which solution best meets these requirements?

Accepted Answer

Deploy AWS Network Firewall in the VPC with a stateful rule group that uses domain-name filtering to allow only the approved domains, and enable flow logging to capture denied traffic.

Answer

Configure security group outbound rules that reference the IP addresses of the approved update repositories and remove the default allow-all egress rule.

Answer

Use network ACLs on the private subnets to deny all outbound traffic except to the IP ranges of the approved domains and enable VPC Flow Logs.

Answer

Attach AWS WAF to the NAT gateway with a rule set that allows requests to the approved domains and blocks all others.

Question 7

A financial services company uses AWS Organizations with 40 member accounts. The security team must ensure that a tamper-resistant, centralized audit trail of all API activity across every account is retained for 7 years, and that member account administrators cannot disable or delete the logging configuration. Which approach best meets these requirements?

Accepted Answer

Enable an organization trail from the management account, deliver logs to a central S3 bucket with Object Lock in compliance mode, and use an SCP to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail in member accounts

Answer

Instruct each member account administrator to enable a local CloudTrail trail and periodically export the logs to a shared S3 bucket in the security account

Answer

Enable an organization trail and rely on IAM policies in each member account to prevent administrators from modifying the trail configuration

Answer

Enable AWS Config across all accounts and use Config snapshots stored in S3 as the 7-year audit record of API activity

Question 8

A company runs a fleet of EC2 instances in private subnets that make frequent API calls to Amazon DynamoDB, Amazon SQS, and AWS Systems Manager. All outbound traffic currently routes through a NAT gateway to reach these AWS service public endpoints. The finance team reports that NAT gateway data-processing charges have become a significant portion of the monthly bill. A solutions architect wants to reduce these costs while keeping traffic on the AWS network. Which approach is the MOST cost-effective?

Accepted Answer

Use a gateway VPC endpoint for DynamoDB and interface VPC endpoints for SQS and Systems Manager so that traffic bypasses the NAT gateway.

Answer

Replace the NAT gateway with a NAT instance on a smaller instance type to lower per-GB processing charges.

Answer

Create interface VPC endpoints for DynamoDB, SQS, and Systems Manager to remove all NAT gateway usage.

Answer

Move the EC2 instances to public subnets and assign Elastic IPs so they reach the AWS service endpoints directly.