Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 11

Question 100

A streaming platform sells short-lived access to video files through CloudFront. It must prevent viewers from reusing a public URL indefinitely. Which feature directly binds delivery to authorized time-limited access?

Set the distribution TTL to five seconds and allow every unsigned public request.
Apply S3 lifecycle deletion to every object five seconds after it is requested.
Use an application-generated unguessable object key with no expiry in a public origin and assume its obscurity enforces a short purchase authorization window.
Issue CloudFront signed URLs or signed cookies with verified signature and expiry, and protect the origin from direct bypass.

Explanation

Correct Answer

Signed CloudFront access tokens constrain cache delivery by expiry and optional conditions; origin restriction prevents users circumventing the signed edge path.

Incorrect Answers

Cache time-to-live affects freshness, not viewer identity or authorization.

Lifecycle is not a per-viewer access token and would destroy content rather than control viewing rights.

An opaque path can be copied and reused when the resource is public; it does not impose a cryptographic expiry or viewer authorization requirement like signed URLs/cookies.

Question 101

A CloudFront distribution serves files from an ordinary private S3 bucket. Users must not bypass CloudFront by calling a direct S3 URL, and some objects use SSE-KMS. Which origin security mechanism is appropriate?

Enable public-read on the entire bucket and rely on CloudFront signed URLs alone.
Use S3 website hosting as the CloudFront OAC bucket origin.
Attach CloudFront signed viewer URLs but leave the origin S3 bucket accessible to all anonymous GetObject callers.
Use CloudFront origin access control with signed origin requests and a bucket/key policy granting the intended distribution scoped access.

Explanation

Correct Answer

OAC authenticates CloudFront origin requests; a constrained S3 and KMS policy can keep the origin private and support SSE-KMS data access.

Incorrect Answers

A public origin can be accessed directly, bypassing signed CloudFront viewer controls.

OAC does not support an S3 website endpoint configured as a custom origin.

Viewer authorization at CloudFront is bypassable when a client can fetch objects directly from the public origin. OAC plus scoped bucket/KMS permissions protects that second path.

Question 102

A company uses CloudFront with an alternate domain name. An ACM certificate was issued in eu-central-1, but CloudFront will not accept it for the viewer HTTPS alias. What certificate location is required?

Move the CloudFront distribution to eu-central-1 so it can reference the existing certificate.
Request or import the CloudFront viewer certificate into ACM in us-east-1 and match its domain names to the distribution alias.
Use the ACM certificate already in eu-central-1 on the CloudFront viewer alias and move the ALB origin to us-east-1 instead.
Disable HTTPS on viewers because ACM supports only regional load balancers.

Explanation

Correct Answer

CloudFront viewer ACM certificates must reside in US East (N. Virginia), independent of the location of ordinary regional origins.

Incorrect Answers

CloudFront is a global service; its viewer ACM certificate region remains us-east-1.

The certificate needed by CloudFront viewer HTTPS must be in us-east-1, regardless of where an origin is hosted. Moving the origin cannot make an ACM certificate in the wrong Region eligible.

CloudFront supports HTTPS when configured with a suitable certificate in the required region.

Question 103

A mobile app needs customer sign-up, sign-in and managed JWT tokens for millions of public users; they are not IAM employees and should not receive AWS console permissions. Which native service matches?

Create one IAM user with an AWS console password for every mobile customer.
Grant all mobile clients the AWS Organizations management account root identity.
Use an Amazon Cognito user pool for customer identities and integrate the app with supported token validation and authorization.
Configure IAM Identity Center AWS account permission sets for each anonymous shopping customer and issue AWS console-role sessions as the application login token.

Explanation

Correct Answer

Cognito user pools provide managed application-user sign-in and token workflows distinct from IAM account administration.

Incorrect Answers

IAM users are intended for AWS principals, not general consumer application accounts at this scale.

Root has inappropriate administrative privileges for public application users.

IAM Identity Center permission sets govern workforce/organizational AWS account authorization, whereas Cognito user pools provide public application identity workflows and JWT claims.

Question 104

A security team needs managed detection of suspicious AWS account and EC2 activities by analyzing supported AWS telemetry. It also asks whether that service alone will automatically block every threat. Which architecture response is accurate?

Use Amazon GuardDuty for managed threat findings, and add an explicitly authorized response workflow where enforcement is required.
Use GuardDuty as a replacement for every VPC security group rule.
Assume GuardDuty findings are always proof that a compromise has been fully remediated.
Attach GuardDuty monitoring and assume the GuardDuty finding event itself revokes the IAM principal before a response rule or action is configured.

Explanation

Correct Answer

GuardDuty identifies threat findings; actions such as network isolation require configured automated or human response controls rather than assuming every finding is preventive.

Incorrect Answers

Threat detection does not replace network ingress authorization.

A detection signal identifies suspicious activity but does not establish remediation completion.

Threat findings do not automatically revoke the caller credentials. Supported containment requires a separate authorized response action, such as a guarded event-driven workflow.

Question 105

A company has thousands of S3 buckets and wants to identify likely personally identifiable data objects, beyond knowing whether the bucket is publicly accessible. Which AWS service capability fits?

Use IAM Access Analyzer external-access findings alone as complete PII content classification.
Use Amazon Macie sensitive-data discovery and findings for supported S3 datasets, then apply the approved remediation workflow.
Use S3 Inventory object-level metadata to identify every sensitive value inside a PDF, without scanning object content.
Use S3 Inventory alone and assume metadata reports every private data value in a file.

Explanation

Correct Answer

Macie classifies supported sensitive information in S3 object content; external-access analysis addresses different permissions exposure.

Incorrect Answers

Policy findings show who may access resources, not which object contents contain sensitive data.

Object inventories can expose storage metadata but do not parse supported object contents for PII. Macie discovery or another data classifier is required for content-based findings.

Inventory tracks object metadata and configuration, not semantic PII discovery inside content.

Question 106

A production application connects to RDS with a secret that must rotate automatically while consumers retrieve the current credential securely. What AWS-managed workflow fits best?

Store the database credential in AWS Secrets Manager, configure supported rotation and application retrieval, and verify connectivity after rotation.
Embed the password in every Lambda environment variable and update it once per year manually.
Store the RDS password as a Systems Manager SecureString and assume that creating it automatically changes the database password on schedule.
Replace the password with a DNS alias to the database endpoint.

Explanation

Correct Answer

Secrets Manager manages encrypted secret versions and rotation workflows; the app must retrieve a current value rather than embed a stale password.

Incorrect Answers

Static duplicated secrets do not implement timely automatic rotation and complicate revocation.

Parameter Store can protect a stored configuration value but does not automatically perform Secrets Manager-compatible database rotation merely because the type is SecureString.

Database host naming is separate from credential authentication and rotation.

Question 107

An application stores nonsecret environment configuration and a few encrypted values that do not require automatic database credential rotation. It wants hierarchical parameters and IAM-scoped reads. Which service is suitable?

Store all nonsecret configuration and encrypted database values in Secrets Manager with per-secret rotation schedules, even though automatic rotation is not needed.
Use Systems Manager Parameter Store with the appropriate parameter type, KMS protection for SecureString and scoped IAM access.
Write every environment secret into an EC2 user-data script and rely on instance termination.
Assume a Parameter Store String parameter automatically rotates an RDS password each month.

Explanation

Correct Answer

Parameter Store supplies centrally stored named parameters; encrypted SecureString can meet appropriate configuration needs without asserting Secrets Manager rotation behavior.

Incorrect Answers

Secrets Manager can securely store secrets but introduces different management and billing tradeoffs; hierarchical Parameter Store is suitable for the stated nonrotating mixed settings.

User data can expose secrets and cannot provide centrally controlled parameter retrieval.

Ordinary Parameter Store entries do not provide Secrets Manager-style automatic rotation as a default.

Question 108

A finance office connects to AWS over an existing private dedicated circuit but compliance now requires that all application packets be encrypted in transit. The team assumes the circuit is encrypted by default. Which design choice closes the gap?

Trust the physical Direct Connect circuit alone as an end-to-end encryption protocol.
Layer an appropriately configured encrypted VPN or supported encryption solution over the hybrid connectivity as required.
Enable private virtual interface routing for Direct Connect but continue sending sensitive traffic in cleartext, treating the private VIF as cryptographic encryption.
Disable TLS on all application sessions to avoid encryption overhead.

Explanation

Correct Answer

AWS Direct Connect provides dedicated transport but does not automatically imply payload encryption; an IPsec VPN or compatible supported solution can provide encryption.

Incorrect Answers

Dedicated paths do not automatically encrypt the application data in transit.

Direct Connect private virtual interfaces provide routed private connectivity, not automatic payload encryption. VPN overlay, supported MACsec or application TLS must satisfy the specified transit control.

Removing TLS worsens rather than satisfies the transport confidentiality requirement.

Question 109

A central AWS VPC routes regulated east-west traffic through a stateful third-party inspection pattern. The security team needs AWS-managed network firewall filtering with explicit symmetric routing and correct subnet attachment. What should the architect evaluate?

Deploy AWS Network Firewall in the appropriate inspection VPC/subnets and configure route tables so forward and return flows traverse the firewall endpoints.
Deploy Network Firewall but leave all east-west routes to bypass its endpoints.
Apply EC2 security-group rules to each workload but route regulated inter-VPC traffic directly between attachments without traversing Network Firewall.
Attach IAM billing policies to the VPC and expect packet-level filtering.

Explanation

Correct Answer

Stateful inspection needs both traffic directions to follow the firewall path; security group rules alone do not create centralized inspection routing.

Incorrect Answers

A firewall that traffic never traverses cannot enforce inspection rules.

Instance security groups limit local reachability but cannot give a centralized Network Firewall a stateful view of traffic that bypasses its endpoints and routing path.

IAM authorizes API operations, not every packet crossing a subnet boundary.

Question 110

An organization runs AWS WAF and security groups in hundreds of accounts. It wants an approved central security administrator to manage and audit consistent organizational firewall policy rather than edit every account manually. Which service should be considered?

Use IAM Identity Center permission sets alone as a replacement for WAF rules.
Put every application behind one S3 static website bucket and avoid firewall enforcement.
Use AWS Firewall Manager with the appropriate AWS Organizations integration, administrative scope, and supported policy types.
Use AWS Config recording to inventory security group and WAF settings but do not create centralized Firewall Manager policies for enforcement.

Explanation

Correct Answer

Firewall Manager coordinates supported protections across resources/accounts and helps detect drift relative to central policy.

Incorrect Answers

SSO controls workforce authorization, not organization-wide HTTP filtering configuration.

Static website hosting does not create policy management for diverse services.

Config can evaluate and inventory compliant resources, but merely recording configurations does not deploy or remediate the consistent WAF and network security policies required across accounts.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 100

Explanation

Correct Answer

Incorrect Answers

Question 101

Explanation

Correct Answer

Incorrect Answers

Question 102

Explanation

Correct Answer

Incorrect Answers

Question 103

Explanation

Correct Answer

Incorrect Answers

Question 104

Explanation

Correct Answer

Incorrect Answers

Question 105

Explanation

Correct Answer

Incorrect Answers

Question 106

Explanation

Correct Answer

Incorrect Answers

Question 107

Explanation

Correct Answer

Incorrect Answers

Question 108

Explanation

Correct Answer

Incorrect Answers

Question 109

Explanation

Correct Answer

Incorrect Answers

Question 110

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests