Design Secure Architectures — SAA-C03 Practice Quiz

Question 1

A company hosts a public web application behind an Application Load Balancer. The security team imported a third-party TLS certificate into AWS Certificate Manager (ACM) to use on the ALB. They are concerned about an unplanned outage caused by the certificate expiring without notice. What is the MOST operationally efficient way to be alerted before this imported certificate expires?

Accepted Answer

Use the ACM-provided Amazon EventBridge event and CloudWatch metric for days-to-expiry to trigger an Amazon SNS notification ahead of the expiration date.

Answer

Rely on ACM to automatically renew the imported certificate before it expires, requiring no additional configuration.

Answer

Create an AWS Lambda function that downloads the certificate from the ALB each day and parses the expiration date to send an email.

Answer

Enable AWS Config with a custom rule that periodically calls the third-party certificate authority's API to check validity.

Question 2

A financial services company runs a web application behind an Application Load Balancer (ALB) in a public subnet, with EC2 instances in private subnets. Compliance requires that all client traffic to the application be encrypted in transit using a publicly trusted certificate, and the security team wants to minimize the operational overhead of certificate renewal. Which solution meets these requirements?

Accepted Answer

Request a public certificate from AWS Certificate Manager (ACM) and attach it to an HTTPS listener on the ALB; ACM automatically renews the certificate.

Answer

Generate a self-signed certificate on each EC2 instance and configure the ALB to forward encrypted TCP traffic to the instances.

Answer

Purchase a certificate from a third-party CA, upload it to AWS Secrets Manager, and reference it from the ALB HTTPS listener.

Answer

Import a certificate into ACM from an external CA and attach it to the ALB, then manually re-import a new certificate before each expiration.

Question 3

A company runs a public e-commerce web application behind an Application Load Balancer (ALB) in a VPC. Recently, security logs revealed repeated SQL injection attempts and malicious HTTP requests targeting the application's login and search pages. The security team needs a managed solution that inspects incoming HTTP/HTTPS requests at the application layer and blocks these attack patterns before they reach the backend instances, while allowing legitimate traffic. Which approach best meets these requirements?

Accepted Answer

Associate AWS WAF with the Application Load Balancer and configure web ACL rules, including AWS managed rule groups for SQL injection and common attacks.

Answer

Enable AWS Shield Standard on the ALB to automatically detect and block SQL injection at the application layer.

Answer

Modify the security groups on the backend EC2 instances to deny requests containing SQL injection strings.

Answer

Enable Amazon GuardDuty to inspect and drop malicious HTTP requests targeting the login and search pages.

Question 4

A financial services company must retain database and file server backups in an immutable state for seven years to satisfy a regulatory requirement. Auditors demand assurance that no user — including administrators with full IAM permissions — can shorten the retention period or delete backups before they expire. The company already uses AWS Backup to centralize backups of Amazon EBS, Amazon RDS, and Amazon EFS resources. Which approach meets these requirements with the least ongoing operational effort?

Accepted Answer

Apply AWS Backup Vault Lock in compliance mode to the backup vault with a minimum and maximum retention period configured in the lock policy.

Answer

Attach an IAM policy to all administrator roles that denies the backup:DeleteRecoveryPoint action, and enable AWS CloudTrail to log any attempts.

Answer

Configure an AWS Backup vault access policy that grants delete permissions only to the root user and require MFA for those operations.

Answer

Enable AWS Backup Vault Lock in governance mode and rely on a service control policy to block deletion API calls organization-wide.

Question 5

A media company hosts static website assets and downloadable files in an Amazon S3 bucket, distributed globally through Amazon CloudFront. Security requires that the S3 bucket must NOT be publicly accessible, and objects should only be reachable through the CloudFront distribution. Which approach meets these requirements with the least ongoing management effort?

Accepted Answer

Configure CloudFront Origin Access Control (OAC) and update the S3 bucket policy to allow access only from the CloudFront distribution, while keeping Block Public Access enabled.

Answer

Make the S3 bucket objects public with a bucket policy and rely on CloudFront geo-restrictions to limit access.

Answer

Place the S3 bucket behind a Network Load Balancer and restrict inbound access using a security group that references the CloudFront IP ranges.

Answer

Generate S3 presigned URLs for every object and embed them in the CloudFront distribution configuration.

Question 6

A company is launching a mobile application that must allow users to sign up and sign in using their email address, and also offer the option to sign in with their existing Google or Facebook accounts. After authentication, the app calls a backend API fronted by Amazon API Gateway. The solutions architect must implement user authentication and secure the API with the least operational overhead. Which approach should the architect recommend?

Accepted Answer

Create an Amazon Cognito user pool with hosted UI, configure Google and Facebook as identity providers, and use a Cognito authorizer on API Gateway to validate the tokens.

Answer

Create an Amazon Cognito identity pool only, generate temporary IAM credentials for each user, and sign every API Gateway request with SigV4.

Answer

Store user credentials in Amazon RDS, build a custom authentication service on EC2 behind an Application Load Balancer, and issue custom JWTs validated by a Lambda authorizer.

Answer

Use AWS IAM Identity Center to create user accounts and federate Google and Facebook, then attach IAM policies granting each user access to the API Gateway endpoint.

Question 7

A financial services company is expanding its AWS footprint and expects to onboard dozens of new accounts over the next year for different project teams. The security team wants every new account to automatically have a standardized baseline: centralized logging to a dedicated account, mandatory encryption configurations, and preventive controls that block non-compliant actions. They also want a dashboard showing which accounts drift from the required baseline. Which approach best meets these requirements with the least ongoing operational effort?

Accepted Answer

Deploy AWS Control Tower to establish a landing zone with an account factory, and apply mandatory and detective guardrails across the organizational units.

Answer

Manually create each account under AWS Organizations and attach a large service control policy to the root that enforces all required controls.

Answer

Write a custom AWS Lambda function triggered by CloudTrail that inspects new accounts and applies IAM policies and logging configurations.

Answer

Use AWS Config in each account individually with conformance packs, and have administrators review compliance reports weekly.

Question 8

A company hires a third-party SaaS monitoring vendor that needs read-only access to CloudWatch metrics in the company's AWS account. The vendor will access the account programmatically from their own AWS account. The security team wants to grant this access without creating long-term IAM user credentials and wants to protect against the 'confused deputy' problem where the vendor could be tricked into accessing the wrong customer's account. What is the MOST secure way to configure this access?

Accepted Answer

Create an IAM role in the company account that trusts the vendor's AWS account, and require an external ID condition in the role's trust policy that the vendor must supply when assuming the role.

Answer

Create an IAM user in the company account, generate access keys, and email the keys securely to the vendor for programmatic access.

Answer

Create an IAM role in the company account that trusts the vendor's AWS account with no additional conditions, relying on the account ID alone for security.

Answer

Add the vendor's AWS account as a principal in a resource-based policy on CloudWatch and enable MFA for the vendor's federated users.

Question 9

A company runs a data analytics platform in a dedicated Analytics AWS account. Data is stored in an S3 bucket in a separate Data account. The analytics application runs on EC2 instances in the Analytics account and must read objects from the Data account bucket. The security team requires that no long-term access keys be stored on the EC2 instances and that access follow the principle of least privilege. Which approach meets these requirements?

Accepted Answer

Create an IAM role in the Data account with a policy allowing read access to the bucket and a trust policy allowing the Analytics account's EC2 instance role to assume it; the instance role calls STS AssumeRole to obtain temporary credentials.

Answer

Generate IAM user access keys in the Data account, store them in a file on the EC2 instances, and reference them from the application when calling S3.

Answer

Enable public read access on the S3 bucket and restrict it with a bucket policy that references the Analytics account ID.

Answer

Create an IAM user in the Analytics account and attach an identity policy granting s3:GetObject on the Data account bucket ARN, then use that user's credentials on the instances.

Question 10

A financial services company has established a 10 Gbps AWS Direct Connect dedicated connection between its on-premises data center and AWS. A new compliance requirement mandates that all data traversing the physical connection be encrypted at Layer 2. The security team wants the lowest-latency solution that meets this requirement without adding an overlay tunnel. What should the solutions architect recommend?

Accepted Answer

Enable MACsec (802.1AE) encryption on the Direct Connect dedicated connection

Answer

Configure an AWS Site-to-Site VPN running over the Direct Connect public virtual interface

Answer

Enable a Direct Connect gateway and attach it to a transit gateway with IPsec

Answer

Use AWS Transit Gateway Connect with GRE tunnels to encrypt the traffic

Question 11

A financial services company stores customer records on encrypted Amazon EBS volumes in the us-east-1 Region, using a customer managed AWS KMS key. To meet disaster recovery requirements, the company must maintain encrypted copies of these EBS snapshots in the eu-west-1 Region. During testing, engineers find that snapshots copied to eu-west-1 cannot be used to launch volumes. What is the MOST likely cause and correct solution?

Accepted Answer

KMS keys are Region-specific; the copy operation must re-encrypt the snapshot with a KMS key that exists in eu-west-1 by specifying a destination key during the CopySnapshot operation.

Answer

EBS snapshots cannot be encrypted with customer managed keys; convert the volumes to use the AWS managed aws/ebs key before copying.

Answer

The company must first decrypt the snapshots in us-east-1, copy them as unencrypted snapshots, then re-encrypt them after they arrive in eu-west-1.

Answer

KMS keys are global resources, so the failure is caused by a missing IAM permission; attach a policy granting kms:Decrypt on the source key and retry the copy.

Question 12

A company runs a three-tier web application in a VPC. Application servers run on EC2 instances in a private subnet, and they must connect to an Amazon RDS for PostgreSQL instance in a separate private subnet on port 5432. The security team requires that database access be restricted to only the application servers, and the solution must continue to work automatically as the Auto Scaling group adds or removes EC2 instances. Which configuration meets these requirements?

Accepted Answer

Configure the RDS security group inbound rule to allow port 5432 with a source of the application servers' security group ID.

Answer

Configure the RDS security group inbound rule to allow port 5432 from the CIDR block of the application subnet.

Answer

Add a network ACL rule on the database subnet allowing port 5432 from the current list of EC2 instance private IP addresses.

Answer

Configure the RDS security group inbound rule to allow port 5432 from 0.0.0.0/0 and rely on the private subnet for isolation.

Question 13

A development team has deployed a Python application on an Amazon EC2 instance. The application needs to read and write objects in an Amazon S3 bucket. Currently, the developers have embedded long-term IAM user access keys in the application's configuration file. A security review flagged this as a violation of AWS security best practices. Which solution should the solutions architect recommend to provide the application secure access to S3 while following the principle of least privilege?

Accepted Answer

Create an IAM role with a policy granting the required S3 permissions, attach it to the EC2 instance as an instance profile, and remove the hardcoded keys.

Answer

Store the IAM user access keys in AWS Systems Manager Parameter Store and have the application retrieve them at runtime.

Answer

Rotate the embedded IAM user access keys every 30 days using a scheduled AWS Lambda function.

Answer

Configure a bucket policy that allows anonymous access from the EC2 instance's public IP address so the application no longer needs credentials.

Question 14

A financial services company runs an application on EC2 instances in a private subnet. The instances access an S3 bucket named 'audit-logs-prod' through a VPC gateway endpoint to keep traffic off the public internet. The security team is concerned that a compromised instance could use the endpoint to exfiltrate data to other S3 buckets in different AWS accounts. Which action MOST effectively limits the endpoint so it can only be used to reach the approved bucket?

Accepted Answer

Attach a VPC endpoint policy to the gateway endpoint that allows S3 actions only on the 'audit-logs-prod' bucket ARN and denies all others

Answer

Add an outbound security group rule on the EC2 instances that permits HTTPS traffic only to the S3 prefix list

Answer

Configure the S3 bucket policy to allow access only from the VPC CIDR range

Answer

Modify the route table to send only the 'audit-logs-prod' bucket's IP addresses through the gateway endpoint

Question 15

A company runs a fleet of EC2 instances in a production VPC. The security team wants a managed service that continuously analyzes VPC Flow Logs, DNS logs, and CloudTrail events to detect threats such as compromised instances communicating with known cryptocurrency-mining domains or command-and-control servers. The solution must require minimal setup and must not require deploying agents on the instances. Which AWS service should the team enable?

Accepted Answer

Amazon GuardDuty

Answer

Amazon Macie

Answer

AWS WAF

Answer

AWS Config

Question 16

A company has grown to 40 AWS accounts managed under AWS Organizations. Employees currently have separate IAM users in several accounts, and administrators are struggling to manage credentials and enforce consistent permissions. The company already uses an external Microsoft Active Directory as its corporate identity source and wants employees to sign in once with their existing corporate credentials, then access only the accounts and roles appropriate to their job function. Which approach best meets these requirements with the least ongoing administrative effort?

Accepted Answer

Enable AWS IAM Identity Center, connect it to the corporate Active Directory as the identity source, and assign permission sets to groups across the organization's accounts.

Answer

Create identical IAM users and groups in each account and instruct employees to memorize a different password per account.

Answer

Configure a SAML 2.0 identity provider directly in each of the 40 accounts and manually create IAM roles trusting that provider in every account.

Answer

Create a single shared IAM user with programmatic access keys stored in AWS Secrets Manager and distribute the keys to all employees.

Question 17

A financial services company wants to let its development team create their own IAM roles for Lambda functions without opening a ticket each time. Security requires that any role the developers create can never grant more than read/write access to a specific set of DynamoDB tables and S3 buckets, even if the developers attach broader policies. Which approach meets these requirements with the least ongoing administrative effort?

Accepted Answer

Create an IAM permissions boundary that defines the maximum allowed permissions, and give developers a policy that only allows creating roles which have that permissions boundary attached.

Answer

Grant developers iam:CreateRole permission and require the security team to review every new role during a weekly audit.

Answer

Attach a service control policy (SCP) to the developers' IAM users limiting them to DynamoDB and S3 actions.

Answer

Provide developers a set of pre-built roles managed by the security team and deny all iam:CreateRole actions.

Question 18

A financial services company encrypts data at rest in Amazon S3 using a customer managed AWS KMS key. A new compliance policy requires that the cryptographic key material be rotated at least once every 12 months, and the audit team wants the process to be automatic with no application changes and no re-encryption of existing objects. What should the solutions architect do?

Accepted Answer

Enable automatic key rotation on the customer managed KMS key so AWS generates new key material annually while retaining older material to decrypt existing data.

Answer

Create a new KMS key each year, re-encrypt all existing S3 objects with the new key, and update the bucket's default encryption setting.

Answer

Switch the bucket to use an AWS managed KMS key (aws/s3), which rotates key material every 90 days automatically.

Answer

Import external key material into the KMS key and schedule a Lambda function to replace the imported material every 12 months.

Question 19

A company runs a data-processing Lambda function that must temporarily decrypt objects using a customer managed KMS key owned by a separate analytics team. The analytics team wants to allow the Lambda's execution role to decrypt for the duration of a batch job without permanently editing the KMS key policy, and they want the ability to revoke the permission programmatically when the job completes. Which approach best meets these requirements?

Accepted Answer

Create a KMS grant that gives the Lambda execution role the Decrypt operation, and retire or revoke the grant when the batch job finishes.

Answer

Add the Lambda execution role as a principal in the KMS key policy with kms:Decrypt, then remove it from the policy after the job.

Answer

Attach an IAM identity policy to the Lambda execution role allowing kms:Decrypt on the key, and detach it after the job.

Answer

Enable automatic key rotation on the KMS key so the Lambda can decrypt only during the rotation window.

Question 20

A company stores sensitive reports in an S3 bucket in Account A, encrypted with a customer managed AWS KMS key. A partner team operating in Account B needs to read and decrypt these objects using an IAM role. The S3 bucket policy and the IAM role in Account B have both been configured to allow the required S3 and KMS actions, but the partner still receives an AccessDenied error when downloading objects. What must the solutions architect do to resolve the issue while following least-privilege principles?

Accepted Answer

Update the KMS key policy in Account A to grant the Account B role permission to call kms:Decrypt on the key.

Answer

Enable automatic key rotation on the customer managed key so the partner role can access the new key material.

Answer

Attach an SCP to Account B that allows kms:Decrypt on all keys in the organization.

Answer

Recreate the objects using SSE-S3 encryption so that no KMS permissions are required.

More SAA-C03 practice