AWS SAA-C03 Design Secure Architectures Practice Questions

Free SAA-C03 Design Secure Architectures practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main AWS SAA-C03 page. Sign up free to practice the full set.

1. Question 1Design Secure Architectures

   A company has deployed a three-tier web application in a VPC. The application tier runs on EC2 instances in private subnets and must download software patches from the internet, but the instances must not be directly reachable from the internet. The company also wants to avoid managing NAT infrastructure. Which solution satisfies these requirements with the LEAST operational overhead?

   • ADeploy a NAT instance in a public subnet and configure the private subnet route table to route internet traffic through it
   • BAttach an Elastic IP address to each EC2 instance in the private subnet
   • CDeploy a NAT gateway in a public subnet and configure the private subnet route table to route internet traffic through itCorrect
   • DMove the application-tier instances to a public subnet and use security groups to block all inbound traffic from the internet
   ✓ Correct answer: C

   A NAT gateway provides highly available, managed outbound internet access for instances in private subnets without requiring the company to manage NAT infrastructure. It automatically handles the network address translation and offers better performance and reliability than a NAT instance. The NAT gateway is deployed in a public subnet and the private subnet's route table is configured to direct 0.0.0.0/0 traffic through it, allowing EC2 instances to initiate outbound connections while remaining unreachable from the internet.

   Why the other options are wrong

   • ADeploy a NAT instance in a public subnet and configure the private subnet route table to route internet traffic through it is incorrect because NAT instances require manual management, patching, and capacity planning, which increases operational overhead.
   • BAttach an Elastic IP address to each EC2 instance in the private subnet is incorrect because Elastic IPs cannot be directly assigned to private instances and this would expose them to the internet, violating the requirement that they not be directly reachable.
   • DMove the application-tier instances to a public subnet and use security groups to block all inbound traffic from the internet is incorrect because this does not prevent the instances from being potentially reachable via other vectors and doesn't follow the required architecture of separating tiers into public and private subnets.
2. Question 2Design Secure Architectures

   A solutions architect is designing a microservices application where multiple AWS Lambda functions need to access database credentials stored securely. The credentials must be automatically rotated every 30 days without application downtime. Which approach should the architect recommend?

   • AStore credentials in AWS Secrets Manager with automatic rotation enabled using a Lambda rotation function.Correct
   • BStore credentials in AWS Systems Manager Parameter Store as a SecureString and create an EventBridge rule to trigger rotation.
   • CStore credentials in an encrypted Amazon S3 object and configure an S3 event to trigger credential rotation.
   • DStore credentials in environment variables encrypted with an AWS KMS key and manually update them every 30 days.
   ✓ Correct answer: A

   AWS Secrets Manager is purpose-built for storing and rotating secrets. When automatic rotation is enabled, Secrets Manager calls a Lambda rotation function on a schedule (every 30 days in this case). The rotation function updates the credentials in the database and in Secrets Manager. Applications retrieve credentials from Secrets Manager at runtime rather than caching them, so they automatically get the rotated credentials without downtime or code changes.

   Why the other options are wrong

   • BStore credentials in AWS Systems Manager Parameter Store as a SecureString and create an EventBridge rule to trigger rotation is incorrect because Parameter Store is not designed for automatic secret rotation and requires custom Lambda function creation.
   • CStore credentials in an encrypted Amazon S3 object and configure an S3 event to trigger credential rotation is incorrect because S3 is not designed for secret management and rotation.
   • DStore credentials in environment variables encrypted with an AWS KMS key and manually update them every 30 days is incorrect because manual updates are not automatic and require operational overhead.
3. Question 3Design Secure Architectures

   A company has deployed an Amazon CloudFront distribution to serve a static website hosted in Amazon S3. The company wants to ensure that users cannot bypass CloudFront and access the S3 bucket directly. Which solution should the architect implement?

   • AConfigure the S3 bucket with CORS headers that only allow the CloudFront domain.
   • BEnable S3 Transfer Acceleration on the bucket to route all requests through CloudFront.
   • CConfigure the S3 bucket as a public website endpoint and add a bucket policy allowing access only from CloudFront IP ranges.
   • DCreate a CloudFront origin access control (OAC) and update the S3 bucket policy to allow access only from the OAC.Correct
   ✓ Correct answer: D

   Origin Access Control is a special AWS principal that CloudFront uses to access the S3 bucket. When you configure an OAC on the distribution and update the bucket policy to allow access only from that OAC, direct S3 URL requests are denied because users don't have the OAC credentials. CloudFront can still access the bucket, but the S3 URL becomes inaccessible to the public.

   Why the other options are wrong

   • AConfigure the S3 bucket with CORS headers that only allow the CloudFront domain is incorrect because CORS headers control what domains can make cross-origin requests from browsers; they don't prevent direct S3 access.
   • BEnable S3 Transfer Acceleration on the bucket to route all requests through CloudFront is incorrect because Transfer Acceleration improves upload speeds; it doesn't restrict bucket access.
   • CConfigure the S3 bucket as a public website endpoint and add a bucket policy allowing access only from CloudFront IP ranges is incorrect because using IP ranges is less secure than using OAC.
4. Question 4Design Secure Architectures

   A solutions architect needs to allow an on-premises application to securely assume an IAM role in AWS to access S3 buckets. The on-premises application does not run on AWS infrastructure. Which authentication method should be used?

   • AAmazon Cognito user pools to federate the application's identity and issue AWS credentials
   • BEC2 key pairs distributed to the on-premises hosts for authentication to AWS
   • CAn IAM instance profile referenced by the on-premises application at startup
   • DAWS STS AssumeRoleWithSAML using an identity provider federationCorrect
   ✓ Correct answer: D

   For an on-premises application without AWS infrastructure, you can use AWS STS AssumeRoleWithSAML to allow SAML-authenticated users from your identity provider (on-premises) to assume an IAM role in AWS. The on-premises identity provider issues a SAML assertion, which the application exchanges for temporary AWS credentials using STS. This enables secure cross-platform federation.

   Why the other options are wrong

   • ACognito user pools are designed for end-user sign-in in web and mobile apps, not for federating an on-premises corporate identity provider to assume an IAM role for backend S3 access.
   • BEC2 key pairs are SSH credentials for logging into instances; they play no role in authenticating an application to IAM or granting it AWS API permissions.
   • CAn instance profile only supplies credentials to workloads running on EC2, so it cannot be used by an application running outside AWS on on-premises infrastructure.
5. Question 5Design Secure Architectures

   A security team must ensure that developers can never grant permissions beyond a defined maximum, even when they create IAM roles for their own applications. The solution must set the ceiling of allowed permissions for those roles. Which IAM feature should be used?

   • AAn IAM permissions boundary on the roles.Correct
   • BAn inline policy attached to each user.
   • CA resource-based policy on every service.
   • DAn IAM access analyzer archive rule.
   ✓ Correct answer: A

   A permissions boundary is a managed policy that defines the maximum permissions an identity-based policy can grant to an IAM role or user. Even if a developer attaches a broad policy, effective permissions are the intersection of that policy and the boundary, so the boundary enforces the ceiling the security team requires.

   Why the other options are wrong

   • BAn inline policy grants permissions to a single user but does not cap the permissions of roles the developer creates.
   • CResource-based policies control access on specific resources and do not set a permissions ceiling for an IAM role.
   • DIAM Access Analyzer identifies unintended external access but does not enforce a maximum-permissions limit.
6. Question 6Design Secure Architectures

   An application stores a third-party API credential that must be encrypted, retrieved by the application at runtime, and rotated automatically on a schedule without redeploying code. The company also wants a full history of secret versions. Which AWS service best satisfies these requirements?

   • AAWS Secrets ManagerCorrect
   • BSystems Manager Parameter Store standard parameters
   • CAn encrypted Amazon S3 object accessed with a bucket policy
   • DAWS Key Management Service keys
   ✓ Correct answer: A

   Secrets Manager encrypts the credential with KMS and exposes it to the application through an API call at runtime. It provides native scheduled rotation using a Lambda rotation function, so credentials change without code redeployment. It also retains version history of each secret value.

   Why the other options are wrong

   • BStandard Parameter Store parameters lack built-in managed rotation, which is a core requirement here.
   • CAn encrypted S3 object provides no automatic rotation or secret-versioning workflow.
   • DKMS manages encryption keys, not application secrets, and offers no runtime secret retrieval or rotation of arbitrary credentials.
7. Question 7Design Secure Architectures

   A company stores application secrets in AWS Secrets Manager. Security policy requires that the database password be rotated automatically every 30 days without any application downtime and without storing the new password anywhere outside Secrets Manager. Which approach satisfies these requirements with the least operational effort?

   • AEnable Secrets Manager automatic rotation using a Lambda rotation function and have the application retrieve the secret at runtimeCorrect
   • BStore the password in an encrypted SSM Parameter Store SecureString and rotate it manually each month
   • CUse a Secrets Manager secret without rotation and have an EventBridge scheduled rule email an operator to change it every 30 days
   • DStore the secret in Secrets Manager but bake its value into an EC2 launch template consumed at instance boot
   ✓ Correct answer: A

   Secrets Manager supports built-in automatic rotation for supported databases using a managed Lambda rotation function, which updates both the secret and the database credential. Applications retrieve the current secret at runtime via the API, so rotation occurs without downtime and the password never leaves Secrets Manager.

   Why the other options are wrong

   • BParameter Store SecureString does not provide native automatic rotation, so manual monthly rotation adds operational effort and risk.
   • CA scheduled email prompting a manual change is not automatic rotation and depends on an operator acting on time.
   • DBaking the value into a launch template freezes it at boot, so rotated values are not picked up without relaunching instances and the value is copied outside Secrets Manager.
8. Question 8Design Secure Architectures

   A solutions architect must protect a public web application from common exploits such as SQL injection and cross-site scripting, and from HTTP floods, while the application runs behind an Application Load Balancer. Which service should be deployed?

   • AAWS Shield Standard network-layer DDoS protection only
   • BAWS WAF with managed rule groups associated to the ALBCorrect
   • CAmazon GuardDuty with custom IP threat lists enabled
   • DNetwork ACLs configured to block the offending ports
   ✓ Correct answer: B

   AWS WAF integrates directly with Application Load Balancers and lets you apply AWS Managed Rules (such as the SQLi and Core rule sets) plus rate-based rules to mitigate HTTP floods. This provides layer-7 protection tailored to application exploits.

   Why the other options are wrong

   • AShield Standard mitigates network/transport-layer DDoS, not layer-7 SQLi/XSS request inspection.
   • CGuardDuty detects threats from logs but does not inline-block malicious HTTP requests.
   • DNACLs filter by IP/port at the network layer and cannot inspect HTTP payloads for SQLi or XSS.

How Design Secure Architectures is tested

This domain holds 202 of the 675 questions in the SAA-C03 bank, about 30%. The mix is 172 single-answer multiple choice, 28 multiple-response, 1 hotspot and 1 yes/no scenario, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Design Secure Architectures on its own rather than re-running full-length mocks.

Other SAA-C03 exam domains

• Design Resilient Architectures176 questions
• Design High-Performing Architectures159 questions
• Design Cost-Optimized Architectures138 questions
• All SAA-C03 practice questions675 total
• Design Secure Architectures study notesKey concepts
• AWS practice examsAll AWS

SAA-C03 Design Secure Architectures FAQ