AWS Certified Solutions Architect Associate SAA-C03 Practice Questions with Explanations

153 questions · Cloud Computing · by Study Foxy

Study these questions free

Questions

  1. A company has 30 AWS accounts. Security wants to prevent anyone, including account admins, from turning off CloudTrail in any account. What is the most effective control?

    • An SCP in AWS Organizations that denies cloudtrail:StopLogging and DeleteTrail
    • An IAM policy attached to each admin user in every account
    • A CloudWatch alarm and SNS notification that alert the security team whenever a trail is stopped
    • An AWS Config rule that reports trails that are not logging

  2. An application on EC2 must read objects from a bucket in the same account. What is the most secure way to grant access?

    • Attach an IAM role with an S3 read policy to the instance profile
    • Store an IAM user's access keys in the application config file
    • Make the bucket public and restrict access with a check on the HTTP referrer header
    • Put the access keys in EC2 user data so they load at boot

  3. A third-party monitoring vendor needs read access to resources in a customer's account. How should the customer grant access while guarding against the confused deputy problem?

    • Create a cross-account IAM role that requires an external ID in its trust policy
    • Create an IAM user for the vendor and email the access keys
    • Share the root user credentials with the vendor's support team
    • Add the vendor's AWS account ID as an allowed source in every security group in the VPC

  4. Developers can create IAM roles for their Lambda functions, but those roles must never get more access than a set baseline. What should an admin use?

    • IAM permissions boundaries
    • Service control policies on the management account
    • Session tags on every federated sign-in
    • IAM access keys with a short rotation period

  5. A mobile app needs users to sign in and then upload photos directly to S3 with temporary, scoped AWS credentials. Which combination fits?

    • Cognito user pool for sign-in and Cognito identity pool for AWS credentials
    • IAM users for each customer, with access keys stored in the app
    • IAM Identity Center for sign-in and a bucket policy that allows uploads from all users
    • A Cognito user pool alone, with the bucket made public for uploads

  6. A company wants employees to use their existing corporate identity provider to sign in to multiple AWS accounts with role-based access. What should it set up?

    • AWS IAM Identity Center connected to the corporate IdP
    • One IAM user per employee in each separate account
    • Amazon Cognito user pools in every account
    • An IAM group in the management account for all staff

  7. A team wants access to be granted automatically based on a matching Project tag on both the user's role and the resource. Which approach is this?

    • Attribute-based access control (ABAC)
    • Role-based access control with one role per project
    • Resource-based policies listing every user ARN
    • Permissions boundaries scoped to each project

  8. Which statement about how IAM evaluates policies is correct?

    • An explicit Deny in any applicable policy overrides any Allow
    • An explicit Allow in any policy overrides an SCP Deny
    • Requests are allowed by default unless some attached policy explicitly denies them
    • The most recently attached policy always takes priority

  9. Users in Account A need to read objects in a bucket owned by Account B. Besides an IAM policy in Account A, what else is required?

    • A bucket policy in Account B that allows the Account A principals
    • Nothing more; IAM policies in Account A are enough by themselves for cross-account reads
    • An SCP in Account B that allows access from Account A
    • A VPC peering connection between the two accounts

  10. A service control policy (SCP) by itself grants permissions to users in member accounts.

    True or false

  11. An administrator needs to reach EC2 instances in private subnets for troubleshooting without opening inbound ports or running a bastion host. What should be used?

    • AWS Systems Manager Session Manager
    • A NAT gateway with an SSH rule for port 22
    • An internet gateway route in the private subnet
    • An Elastic IP address assigned to each instance

  12. Which are recommended practices for securing the root user of an AWS account? (Select TWO.)

    • Enable MFA on the root user
    • Delete any root user access keys
    • Use the root user for daily admin tasks
    • Share root credentials with the security team

  13. A web tier in a public subnet must accept HTTPS from the internet. A database tier must accept traffic only from the web tier. How should the database security group be configured?

    • Allow inbound on the database port with the web tier's security group as the source
    • Allow inbound on the database port from 0.0.0.0/0 for simplicity
    • Allow all inbound traffic but deny traffic from the internet gateway
    • Allow inbound only from the VPC's internet gateway on the database port, and deny all else

  14. A company must block traffic from a specific malicious IP address range to all instances in a subnet. What should it use?

    • A network ACL deny rule on the subnet
    • A security group deny rule on each instance
    • A route table entry pointing to a blackhole
    • An IAM policy that denies the IP range

  15. An e-commerce site is getting floods of requests from a few IP addresses trying to guess passwords. Which solution limits each IP's request rate?

    • An AWS WAF rate-based rule on the ALB
    • A larger instance size behind the ALB
    • An Amazon Inspector assessment on the web servers
    • A network ACL allow rule for the login page

  16. A company must allow its website only for users in certain countries. Which feature can enforce this at the edge?

    • CloudFront geographic restrictions or a WAF geo match rule
    • Route 53 latency-based routing to the nearest AWS Region for each user
    • A security group that filters by country of origin
    • An S3 bucket policy with a country condition key

  17. EC2 instances in a private subnet must call the S3 API without traffic leaving the AWS network or going through a NAT gateway. What should be added?

    • A gateway VPC endpoint for S3
    • An internet gateway attached to the VPC
    • An AWS Direct Connect connection
    • A public IP address on each instance

  18. A SaaS provider wants to expose an internal service to hundreds of customer VPCs without VPC peering and without exposing it to the internet. What should it use?

    • AWS PrivateLink with a Network Load Balancer endpoint service
    • VPC peering from the provider VPC to each customer VPC, with routes for each CIDR
    • A public Application Load Balancer with IP allowlists
    • A Site-to-Site VPN from every customer to the provider

  19. Which service continuously analyzes CloudTrail, VPC Flow Logs, and DNS logs to detect compromised instances and unusual API activity?

    • Amazon GuardDuty
    • Amazon Inspector
    • Amazon Macie
    • AWS Config

  20. A company runs a public API that must stay online during large DDoS attacks, with access to AWS DDoS experts and protection from scaling charges. What should it add?

    • AWS Shield Advanced
    • AWS Shield Standard
    • Amazon Inspector
    • AWS Firewall Manager alone

  21. Database credentials are hardcoded in Lambda code. The team wants them stored securely and rotated automatically every 30 days. What should it use?

    • AWS Secrets Manager with automatic rotation
    • Lambda environment variables encrypted with the default key
    • An S3 object encrypted with SSE-S3
    • AWS Certificate Manager with automatic renewal

  22. Users must reach a web app only through CloudFront, not directly through the S3 bucket that hosts the content. What should be configured?

    • Origin access control (OAC) with a bucket policy allowing only the distribution
    • S3 Transfer Acceleration on the bucket
    • A public bucket with S3 Block Public Access disabled
    • Cross-Region Replication to a second private bucket

  23. Which service inspects traffic entering and leaving a VPC with stateful rules and intrusion prevention, including domain-based filtering?

    • AWS Network Firewall
    • Security groups on each instance
    • AWS Shield Standard
    • Amazon GuardDuty

  24. Which service automatically scans EC2 instances, container images in ECR, and Lambda functions for known software vulnerabilities?

    • Amazon Inspector
    • Amazon GuardDuty
    • Amazon Detective
    • AWS Trusted Advisor

  25. Security groups are stateful, so return traffic for an allowed inbound request is automatically allowed out.

    True or false

  26. A network ACL allows inbound HTTPS on port 443, but clients get no responses. Security groups are correct. What is the most likely cause?

    • The network ACL is missing an outbound rule for ephemeral ports
    • Security groups need an explicit outbound deny rule
    • The route table lacks a route to a VPC endpoint
    • Port 443 must also be opened in the IAM policy

  27. A company must encrypt S3 data at rest with keys it controls, and auditors need a CloudTrail record every time a key is used. Which option fits?

    • SSE-KMS with a customer managed key
    • SSE-S3 with Amazon S3 managed keys
    • Client-side encryption with keys in source code
    • S3 Object Lock in governance mode

  28. Regulators require that financial records cannot be deleted or overwritten by anyone, including the root user, for 7 years. Which S3 feature meets this?

    • S3 Object Lock in compliance mode
    • S3 Object Lock in governance mode
    • S3 Versioning with lifecycle rules
    • An S3 bucket policy denying DeleteObject

  29. A team wants to protect S3 objects from accidental overwrites and deletes so earlier copies can be restored. What should it turn on?

    • S3 Versioning
    • S3 Transfer Acceleration
    • S3 Requester Pays
    • Server access logging

  30. A bucket must reject any upload that isn't sent over HTTPS. What should be added to the bucket policy?

    • A Deny statement with the condition aws:SecureTransport set to false
    • An Allow statement for s3:PutObject from all principals
    • A Deny statement for requests without a Referer header
    • A condition requiring s3:x-amz-acl to be public-read

  31. A security team wants to find any S3 objects that contain credit card numbers or other personal data across hundreds of buckets. What should it use?

    • Amazon Macie
    • Amazon GuardDuty
    • AWS Config
    • Amazon Inspector

  32. An organization needs to make sure no bucket in an account can ever be made public, even if someone edits a bucket policy. What should it enable?

    • S3 Block Public Access at the account level
    • S3 Versioning on every bucket
    • Default encryption with SSE-KMS
    • S3 Intelligent-Tiering

  33. An existing unencrypted Amazon RDS instance must now be encrypted at rest. What is the correct approach?

    • Snapshot it, copy the snapshot with encryption, and restore a new instance
    • Turn on encryption in the instance settings while the database keeps running normally
    • Enable encryption on its read replica, then promote it
    • Add an SSE-KMS bucket policy to the RDS storage

  34. A company needs encryption keys stored in single-tenant hardware security modules under its exclusive control to meet FIPS 140 Level 3 requirements. Which service fits?

    • AWS CloudHSM
    • AWS KMS with AWS managed keys
    • AWS Secrets Manager
    • AWS Certificate Manager

  35. Developers need to send a private S3 object to a customer for 24 hours without making the bucket public. What should they use?

    • A presigned URL that expires after 24 hours
    • A bucket policy that allows public read for one day
    • Cross-Region Replication to the customer's bucket
    • An IAM user created for the customer with full S3 access

  36. A company wants HTTPS on its Application Load Balancer with certificates that renew automatically. What should it use?

    • AWS Certificate Manager public certificates
    • Self-signed certificates stored in Amazon S3
    • AWS CloudHSM generated keys on each target
    • Certificates stored in Secrets Manager

  37. EBS volumes created in an account must always be encrypted, even if a user forgets to select encryption. What should be configured?

    • EBS encryption by default for the Region
    • A lifecycle policy in Data Lifecycle Manager
    • Amazon Macie scanning of EBS volumes
    • Encryption on the instance store volumes

  38. Enabling MFA Delete on an S3 bucket requires the bucket to have versioning enabled.

    True or false

  39. A company must keep a full audit trail of API calls across all accounts in its organization in one tamper-resistant location. What is the best solution?

    • An organization trail in CloudTrail delivering to a central S3 bucket with log file validation
    • A separate CloudWatch dashboard created in every member account
    • AWS Config rules in each account with no central aggregation
    • VPC Flow Logs stored in each account's own S3 bucket

  40. An order service sometimes receives more orders than the processing tier can handle, and orders are lost. What change best prevents this?

    • Put an Amazon SQS queue between the two tiers
    • Move the processing tier to a larger EC2 instance
    • Call the processing tier synchronously with retries
    • Run both tiers on one instance to avoid network hops

  41. A bank's transactions must be processed exactly once and in the order they were sent. Which queue type fits?

    • SQS FIFO queue
    • SQS standard queue
    • SNS standard topic
    • SQS standard queue with a dead-letter queue

  42. Messages in an SQS queue are being processed twice because consumers take longer than expected. Which setting should be increased?

    • The visibility timeout
    • The message retention period
    • The delivery delay
    • The maximum message size

  43. A few malformed messages keep failing and being retried forever, blocking the queue. What should be configured?

    • A dead-letter queue with a maximum receive count
    • A shorter message retention period
    • A delay queue of 15 minutes
    • Short polling on the consumers

  44. Consumers polling an SQS queue are making many empty requests, which raises cost. What reduces this?

    • Enable long polling by setting a receive wait time
    • Switch the queue to FIFO
    • Increase the visibility timeout
    • Lower the message retention period

  45. One uploaded image must trigger three independent processes: thumbnailing, tagging, and archiving. Each must get its own copy. What pattern fits?

    • SNS topic fanning out to three SQS queues
    • One SQS queue read by all three consumers
    • Three Lambda functions polling one S3 bucket
    • A single Step Functions task that runs them serially

  46. A company wants to route events from its own apps and from a SaaS partner to different targets based on event content, without writing glue code. Which service fits?

    • Amazon EventBridge
    • Amazon SQS
    • Amazon Kinesis Data Streams
    • AWS Step Functions

  47. An order workflow has several steps with retries, a human approval, and error handling. Which service coordinates it with the least custom code?

    • AWS Step Functions
    • Amazon SQS with polling consumers
    • Amazon SNS with email subscriptions
    • Amazon EventBridge Scheduler alone

  48. A company is migrating an application that uses ActiveMQ with the AMQP and MQTT protocols. It wants a managed broker without rewriting the code. Which service fits?

    • Amazon MQ
    • Amazon SQS
    • Amazon SNS
    • Amazon EventBridge

  49. A web app stores user sessions on each EC2 instance, so users are logged out when Auto Scaling removes an instance. What is the best fix?

    • Store session data in Amazon ElastiCache or DynamoDB
    • Turn on sticky sessions and stop scaling in
    • Store sessions on each instance's EBS volume
    • Use a larger instance type so fewer instances are needed during peaks

  50. A web app's traffic doubles every weekday at 9 a.m. and drops at 6 p.m. Which Auto Scaling approach handles this most cleanly?

    • Scheduled scaling actions
    • Manual scaling by an operator
    • Step scaling on disk usage
    • A fixed fleet sized for peak

Showing 50 of 153. Open the quiz to study them all.