Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 12

Question 110

An organization runs AWS WAF and security groups in hundreds of accounts. It wants an approved central security administrator to manage and audit consistent organizational firewall policy rather than edit every account manually. Which service should be considered?

Use IAM Identity Center permission sets alone as a replacement for WAF rules.
Put every application behind one S3 static website bucket and avoid firewall enforcement.
Use AWS Firewall Manager with the appropriate AWS Organizations integration, administrative scope, and supported policy types.
Use AWS Config recording to inventory security group and WAF settings but do not create centralized Firewall Manager policies for enforcement.

Explanation

Correct Answer

Firewall Manager coordinates supported protections across resources/accounts and helps detect drift relative to central policy.

Incorrect Answers

SSO controls workforce authorization, not organization-wide HTTP filtering configuration.

Static website hosting does not create policy management for diverse services.

Config can evaluate and inventory compliant resources, but merely recording configurations does not deploy or remediate the consistent WAF and network security policies required across accounts.

Question 111

A Lambda function reads an RDS password from an environment variable copied into deployment templates. Security wants reduced exposure and managed credential rotation without redeploying function code. Which design fits?

Store the credential in Secrets Manager, allow the function role scoped retrieval, and cache/refresh it safely rather than embedding the password in a template.
Use a CloudWatch log group as the source of the password.
Put the DB password in a Lambda function environment variable encrypted by KMS and assume it updates automatically on every Secrets Manager rotation.
Put a hard-coded root database password in an S3 public URL for easy refresh.

Explanation

Correct Answer

Secrets Manager supports protected central credentials and rotation; the function retrieves the current authorized version during its lifecycle.

Incorrect Answers

Logs are not protected secret storage and can increase disclosure.

Lambda environment-variable encryption protects the deployment value but does not synchronize that value with subsequently rotated database credentials. Consumers need current secret retrieval or refresh.

Public distribution and root credentials violate least privilege and secure rotation.

Question 112

A service needs to give a customer temporary permission to upload one file to a private S3 bucket, without giving the customer AWS credentials. Which mechanism can the service issue?

Generate a narrowly scoped S3 presigned URL with the intended operation, object key, expiration and signing-principal permissions.
Enable public PutObject on the entire bucket for the intended hour.
Send the IAM role secret access key to the customer and ask them to remove it later.
Issue an S3 bucket policy allowing anonymous PutObject for the designated key for one hour, assuming the policy will revoke itself after the first upload.

Explanation

Correct Answer

A presigned request delegates a specific authorized S3 API operation for a limited period without creating an IAM user for the recipient.

Incorrect Answers

Public bucket writes expose unrelated key names and lack the intended request-specific scope.

Sharing persistent credentials grants far broader access and compromises the signer identity.

A public policy can potentially permit more callers or repeated writes during its lifetime and does not give a recipient-specific one-operation signed request. Presigned URLs carry explicit signing scope and expiry.

Question 113

A distributed app changes feature flags weekly. Operations wants a staged rollout, validation and an automatic rollback trigger when error-rate alarms rise. Which AWS-managed configuration approach fits?

Use AWS AppConfig with configuration validation, a staged deployment strategy and monitored rollback alarms.
Write the flag in an EC2 AMI and replace every fleet instance without a staged plan.
Use Secrets Manager rotation schedules to roll out a nonsecret feature flag in stages and automatically revert on configured CloudWatch application alarms.
Disable health alarms so the deployment can finish without interruption.

Explanation

Correct Answer

AppConfig separates runtime configuration from code releases and can deploy changes progressively while watching configured health alarms.

Incorrect Answers

AMI replacement is not a managed progressive feature configuration rollout with validation.

Secret rotation concerns credential version changes and does not supply AppConfig staged configuration deployment with validation and monitored rollback behavior.

Suppressing alarms removes the safety signal required for rollback.

Question 114

A fleet of private EC2 instances must install approved OS patches without opening inbound SSH from corporate networks. Instances have a supported SSM Agent and IAM role. Which control plane should be used?

Assign a public IPv4 address and allow TCP/22 from 0.0.0.0/0 to every instance.
Use AWS Systems Manager Patch Manager/Run Command or maintenance windows with permitted outbound/private endpoints and scoped instance permissions.
Rely on EC2 user-data bootstrap to patch already-running instances through a weekly Systems Manager maintenance window, without registering them as managed nodes.
Use only a CloudFront distribution to remotely execute OS patch commands.

Explanation

Correct Answer

Systems Manager can patch managed nodes through its service channel without accepting public inbound SSH to each server.

Incorrect Answers

Public unrestricted SSH contradicts the management isolation requirement.

User data runs during startup as configured and does not replace managed-node registration, SSM Agent reachability or scheduled patch execution on existing hosts.

CloudFront delivers HTTP content and is not Systems Manager remote patch orchestration.

Question 115

The networking team must determine which ENI traffic was allowed or rejected by VPC-layer controls during a connectivity incident. It does not need application request bodies. Which native log should it enable?

Enable only CloudTrail management events and expect each TCP SYN packet in them.
Inspect Route 53 hosted-zone TXT records because they record security group decisions.
Use the ALB HTTP access log and assume it covers all denied network flows on unrelated ENIs across the VPC.
Enable VPC Flow Logs for the relevant VPC, subnet or network interface and inspect records including source/destination, ports and ACCEPT/REJECT action.

Explanation

Correct Answer

Flow Logs capture network flow metadata and dispositions for supported IP traffic, without being application payload or IAM management activity logs.

Incorrect Answers

CloudTrail tracks AWS API activity, not packet-by-packet traffic metadata.

DNS records are configuration, not ENI flow acceptance evidence.

ALB access logs describe requests reaching the load balancer, not general traffic that security groups or NACLs reject at arbitrary VPC ENIs. VPC Flow Logs give flow-level dispositions.

Question 116

A private VPC interface endpoint exists for an AWS API, but audit policy says only one role may invoke a subset of service operations through it. Which additional security layer helps scope that access?

Set every endpoint policy to Allow * and assume the private ENI guarantees least privilege.
Attach a supported VPC endpoint policy restricting the permitted principals, actions and resources, alongside ordinary IAM and service resource policies.
Replace IAM grants with an EC2 inbound security group rule on TCP/443.
Specify the allowed IAM role and actions only in an IAM identity policy, leaving the interface endpoint policy wide open to every service action.

Explanation

Correct Answer

Endpoint policies provide a service-path authorization filter, but do not replace identity/resource permissions and service-specific endpoint support checks.

Incorrect Answers

Private routing alone does not distinguish API operations or authorized principals.

A security group controls connections but cannot grant the requested AWS service action.

An identity policy can narrow that role’s permissions, but cannot impose an endpoint-path restriction across all callers using the endpoint. The requested endpoint policy must constrain supported principals/actions/resources.

Question 117

A public web service receives URL parameters that include common SQL injection payloads. It needs managed application-layer request filtering before requests reach its ALB targets. Which control is appropriate?

Add only an EC2 inbound rule for TCP/443 and expect it to parse SQL expressions.
Attach a suitable AWS WAF managed rule group and tuned SQL injection protections to an ALB/CloudFront web ACL.
Set a security group rule that permits TCP/443 only from application client CIDR blocks and assume it detects SQL injection strings on that HTTPS port.
Use DynamoDB on-demand throughput capacity to block injected SQL strings.

Explanation

Correct Answer

AWS WAF can inspect HTTP request components for known malicious patterns before forwarding to backend application code.

Incorrect Answers

Security group rules allow transport ports but cannot detect SQL injection payload structure.

Source/port filtering may reduce exposure but cannot inspect HTTP request arguments or distinguish injection patterns within otherwise authorized TLS sessions.

Database capacity scaling does not provide a web request filtering rule.

Question 118

An application exposes HTTPS on an ALB and receives confidential health data. The ALB forwards unencrypted HTTP to private targets, but policy now requires encryption for every hop. What change meets the new requirement?

Retain HTTP to targets because an ALB certificate encrypts all subsequent packets automatically.
Disable all target health checks and assume that forces TLS to targets.
Keep the ALB target group protocol HTTP and change the ALB listener’s ACM certificate to a different key size, assuming this encrypts the target hop.
Configure the target group/listeners for supported HTTPS on the backend and install valid target TLS configuration in addition to viewer-side TLS.

Explanation

Correct Answer

TLS terminated at the ALB protects only the viewer edge; a separate secure ALB-to-target connection is needed to encrypt the backend hop.

Incorrect Answers

ALB front-end TLS termination does not automatically encrypt traffic from the load balancer to HTTP targets.

Health-check configuration is not the mechanism selecting target-group protocol.

Viewer certificate settings determine the client-facing TLS association; the ALB-to-target protocol remains HTTP until target group/backend HTTPS is configured.

Question 119

An internet egress workload opens tens of thousands of concurrent connections through one public NAT gateway to the SAME partner HTTPS IP and TCP port. The gateway is available, its AZ is healthy, but CloudWatch ErrorPortAllocation rises and clients cannot create new TCP connections. Which NAT capacity issue should be addressed?

The gateway may exhaust source-port mappings per IPv4 address for the hot destination; inspect ErrorPortAllocation and use permitted secondary NAT IP addresses or distribute connections/destinations.
Deploy an S3 Cross-Region Replication rule and assume it increases TCP source-port capacity on the existing NAT gateway.
Enable only longer DNS TTL values for the partner hostname, because DNS caching automatically adds more NAT gateway source ports.
Increase the NAT gateway subnet route-table CIDR block to /0 a second time; duplicate default routes create additional TCP connections.

Explanation

Correct Answer

A public NAT gateway has per-address simultaneous connection capacity to each unique remote IP/port/protocol combination; additional supported public/private address mappings or workload distribution can relieve port exhaustion.

Incorrect Answers

S3 object replication cannot allocate NAT source ports or resolve ErrorPortAllocation on an outbound TCP path.

DNS caching can reduce lookup work but not extend the gateway’s source-port mappings for one hot destination.

The route-table default route selects the egress next hop; duplicating it does not create more NAT translation ports.

Question 120

A company wants employees to access an internal browser-based app without a traditional VPN. Access decisions must evaluate user identity and device security posture for each session and be centrally enforceable. Which AWS service is relevant?

Publish the application directly to 0.0.0.0/0 and rely only on a private DNS name.
Use AWS Client VPN with broad network membership as the only application access rule, without adding identity and device-condition checks to the app path.
Use an EC2 key pair as the only trust signal for every employee browser session.
Use AWS Verified Access with a supported trust provider and device/user context policy for the private application.

Explanation

Correct Answer

Verified Access provides identity-aware access to applications based on configured trust-provider signals instead of relying only on membership of a network tunnel.

Incorrect Answers

A private-looking DNS record is not identity-aware access enforcement for an Internet-exposed app.

An authenticated network tunnel alone does not deliver the specified per-request device posture and user-context policy; AWS Verified Access evaluates configured trust signals for application requests.

An SSH key pair is not a general per-session web identity and device posture policy.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 110

Explanation

Correct Answer

Incorrect Answers

Question 111

Explanation

Correct Answer

Incorrect Answers

Question 112

Explanation

Correct Answer

Incorrect Answers

Question 113

Explanation

Correct Answer

Incorrect Answers

Question 114

Explanation

Correct Answer

Incorrect Answers

Question 115

Explanation

Correct Answer

Incorrect Answers

Question 116

Explanation

Correct Answer

Incorrect Answers

Question 117

Explanation

Correct Answer

Incorrect Answers

Question 118

Explanation

Correct Answer

Incorrect Answers

Question 119

Explanation

Correct Answer

Incorrect Answers

Question 120

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests