Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 18

Question 170

A security team manages 200 AWS accounts with recurring WAF and network firewall compliance changes. It is comparing manual local rule edits with centralized AWS Firewall Manager. What favors central policy?

Every account will automatically share the same firewall rules by being in Organizations without any policy configuration.
A single EC2 security group in the management account becomes the firewall for all member VPCs.
Firewall Manager can coordinate supported network-security policies and compliance across organization accounts and target resources.
Use AWS Config compliance rules only to detect noncompliant WAF rules without configuring an organization-wide deployment/remediation policy.

Explanation

Correct Answer

Central administration provides consistent intended controls and visibility into out-of-policy resources, avoiding untracked account-by-account drift.

Incorrect Answers

Membership alone does not specify which resources receive the desired rules.

Security groups apply at resource interfaces, not as an automatic organization-level firewall.

Compliance reporting can identify drift but alone cannot provide the centralized managed WAF policy distribution or enforcement delivered by Firewall Manager.

Question 171

A high-traffic Lambda service retrieves a rotating RDS password from Secrets Manager. The team wants to reduce retrieval calls while avoiding stale credentials after rotation. What balance is appropriate?

Persist the first retrieved password for the lifetime of the application deployment.
Make the database publicly reachable while continuing to use the same indefinitely cached password after a managed rotation.
Use a bounded, refreshable secret cache or supported extension and verify connection recovery when secret versions change.
Disable database secret rotation permanently to simplify caching.

Explanation

Correct Answer

Caching can reduce retrieval latency and cost, but a bounded validity/refresh mechanism is needed to pick up rotated passwords.

Incorrect Answers

A permanent cache becomes stale when the credential rotates.

Network reachability cannot fix authentication with a stale credential. A bounded cache or extension must refresh the secret version during the app lifecycle.

Eliminating the approved rotation policy sacrifices required credential security.

Question 172

An external contractor needs a one-time S3 download without gaining an AWS IAM identity. Which time-bound sharing method minimizes administrative overhead while retaining controlled S3 resource access?

Create a new root account credential for every external download.
Enable public anonymous read on the entire bucket.
Grant anonymous read to the specific S3 key for an indefinite time and send only its object URL, assuming possession of the name is time-limited authentication.
Issue a short-lived S3 presigned GET URL signed by a principal authorized for the specific object.

Explanation

Correct Answer

A presigned URL delegates the intended request for a limited time, avoiding a persistent IAM user and broad bucket policy.

Incorrect Answers

Root keys are inappropriate for customer-specific object access.

Broad public access violates the single-object restricted sharing need.

A public object URI lacks SigV4 expiry and can be forwarded or reused. A presigned GET permits limited-time access without giving the recipient an IAM principal.

Question 173

An application flag affects millions of users and a mistaken rollout could break sign-in. The choice is instantaneous global change versus gradual monitored deployment. Which approach contains risk?

Use an AppConfig deployment strategy that progresses gradually, validates payloads and halts/rolls back when monitored alarms trigger.
Skip validation and deploy everywhere because configuration is less risky than executable code.
Turn off relevant alarms so an unhealthy deployment will not be interrupted.
Use a Systems Manager Parameter Store String value and update it instantly for all clients without AppConfig validation, gradual rollout or alarms.

Explanation

Correct Answer

Progressive exposure plus rollback evidence limits the fraction of users affected by a bad setting compared with an uncontrolled immediate change.

Incorrect Answers

Configuration can disrupt important application behavior and requires release controls.

Removing health feedback prevents a safety rollback decision.

A simple parameter read can supply configuration but does not automatically implement progressive rollout and automatic rollback when a flag harms sign-in.

Question 174

A platform team must patch private EC2 instances in several AZs. It wants no public inbound SSH, repeatable maintenance windows and audit outcomes. Which design is preferable?

Grant Internet-wide SSH ingress and have an engineer patch each instance manually.
Use Systems Manager managed-node/SSM Agent access with appropriate service endpoints, Patch Manager maintenance windows and logged outcomes.
Move all servers into one public subnet because Patch Manager requires public IPs.
Use EC2 user-data scripts as the weekly maintenance scheduler for already-running private instances without any SSM managed-node registration.

Explanation

Correct Answer

Systems Manager provides controlled agent-based updates without exposing remote SSH on every private host.

Incorrect Answers

That increases exposure and loses repeatability despite the private-only requirement.

SSM can operate via appropriate private service endpoints; public IPs are not inherent prerequisites.

Instance user data is a bootstrap mechanism, not a managed fleet patch maintenance service. Patch Manager requires supported agent/role/connectivity and maintenance window targets.

Question 175

A healthcare archive stores sensitive records in S3 and must control which administrators can use its encryption key and obtain key-use audit evidence. Which encryption option best satisfies that requirement?

Use SSE-S3 and assume it supplies a customer-editable KMS key policy.
Disable all at-rest encryption because S3 already uses HTTPS for uploads.
Use SSE-KMS with an appropriately managed customer managed KMS key and restricted key policy/permissions.
Enable S3 Object Lock compliance retention and assume this provides per-application cryptographic key-use access and KMS audit trails.

Explanation

Correct Answer

SSE-KMS supports key-level access controls and CloudTrail KMS request visibility; customer-managed keys permit defined key administration.

Incorrect Answers

SSE-S3 does not expose the same customer-managed KMS key authorization boundary.

Transport TLS does not satisfy encryption of stored objects.

Object Lock restricts premature deletion of versions, but is not an encryption-key policy or cryptographic event log. SSE-KMS with a customer managed key provides the specified governance.

Question 176

A team already uses S3 managed server-side encryption, but finance requires per-application key permissions and KMS key activity records. Which change addresses those additional governance needs?

Keep SSE-S3 and edit an imaginary customer key policy for its internal service-managed key.
Move the relevant objects to SSE-KMS with an authorized customer managed key and appropriate policy and lifecycle management.
Configure S3 Bucket Keys while leaving the objects on SSE-S3, then assume Bucket Keys create a customer-managed KMS policy for each application.
Apply only an S3 inventory report and assume all key usages become visible.

Explanation

Correct Answer

SSE-KMS provides independently controlled KMS key authorization and audit events; SSE-S3 encrypts data but does not offer the same customer key controls.

Incorrect Answers

An SSE-S3 internal encryption key is not a customer-managed KMS key policy.

S3 Bucket Keys are associated with SSE-KMS and reduce KMS request traffic; enabling a bucket-level optimization cannot turn SSE-S3 into a customer-managed key policy boundary.

Inventory is object metadata reporting rather than KMS audit activity.

Question 177

A data warehouse role in account B must decrypt an S3 object protected by a customer managed KMS key in account A. The S3 and IAM read grants are already correct. Which additional permissions are needed?

Grant kms:Decrypt solely in account B while leaving the key policy closed to it.
Permit the external principal for required KMS cryptographic operations in the account A key policy and in the account B role’s IAM policy, allowing grants where appropriate.
Grant the external role s3:GetObject and assume S3 passes the role through the KMS key-owner policy without requiring any decrypt rights.
Add an S3 lifecycle transition on the object instead of key permission.

Explanation

Correct Answer

Cross-account KMS operation requires authorization by the key owner and the external identity, in addition to data access.

Incorrect Answers

An external IAM allow cannot bypass the owning key policy.

An S3 object-read grant cannot override KMS key authorization. Cross-account SSE-KMS use needs the owning key policy and relevant caller identity permission.

Storage-class transitions do not grant decryption authority.

Question 178

Compliance requires regularly rotating key material for a symmetric AWS KMS customer managed key created with AWS-owned key material. Existing applications refer to its key ARN. Which behavior should they expect when automatic rotation is enabled?

Every application must immediately update its stored key ARN after automatic rotation.
AWS KMS rotates backing key material while retaining the key ARN/policy and the ability to decrypt old ciphertext using retained versions.
All previously encrypted data becomes permanently unreadable after material rotation.
Automatic rotation is a universal feature for every asymmetric or custom-key-store key type.

Explanation

Correct Answer

Automatic rotation of eligible KMS keys is transparent to callers using the same key ID and preserves prior key material for decryption.

Incorrect Answers

The key ARN and identity remain stable under supported automatic rotation.

KMS retains the material needed to decrypt earlier ciphertext.

Rotation support depends on origin and key type; some keys require manual approaches.

Question 179

An Internet-facing API behind an ALB must present a publicly trusted server certificate, handle renewal, and accept client HTTPS requests. Which AWS-managed certificate approach is appropriate?

Install an expired self-signed certificate and suppress client trust warnings in a server configuration.
Issue an AWS KMS asymmetric key pair but attach only its key ARN to the HTTPS ALB listener without creating an ACM-supported server certificate.
Use a supported AWS Certificate Manager public certificate on an ALB HTTPS listener with the correct hostname, security policy and renewal validation.
Rely on VPC security groups to supply TLS certificate chain trust.

Explanation

Correct Answer

ACM can provision trusted public certificates and integrate with ALB TLS termination; DNS/domain validation and renewal prerequisites must be met.

Incorrect Answers

Clients still cannot validate server identity and expiry.

A KMS asymmetric key ARN is not an X.509 public certificate with a trusted chain and hostname. ALB HTTPS listeners use supported ACM/imported certificates.

Network filtering cannot present a trusted server certificate to HTTPS clients.

Question 180

An RDS deployment requires encryption of database storage and associated automated backups. The team plans a Multi-AZ deployment. When must it choose the RDS encryption setting?

Create an unencrypted RDS instance and toggle encryption in place later with no replacement or restore.
Enable only the application ALB HTTPS listener and assume storage becomes encrypted.
Enable RDS encryption at creation with an appropriate KMS key and verify the encryption behavior of snapshots and replica resources.
Use only a long master database password and Multi-AZ standby deployment, assuming standby replication automatically turns unencrypted storage into SSE-KMS encrypted volumes.

Explanation

Correct Answer

RDS storage encryption is configured when creating an encrypted instance/cluster or by supported snapshot-copy-and-restore migration; it covers supported underlying storage/backups.

Incorrect Answers

An existing unencrypted DB cannot generally be encrypted through a simple in-place toggle.

Transport TLS does not change RDS at-rest encryption state.

Database credentials and Multi-AZ availability do not change the encryption state of an originally unencrypted DB. RDS encryption must be selected during creation or supported migration.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 170

Explanation

Correct Answer

Incorrect Answers

Question 171

Explanation

Correct Answer

Incorrect Answers

Question 172

Explanation

Correct Answer

Incorrect Answers

Question 173

Explanation

Correct Answer

Incorrect Answers

Question 174

Explanation

Correct Answer

Incorrect Answers

Question 175

Explanation

Correct Answer

Incorrect Answers

Question 176

Explanation

Correct Answer

Incorrect Answers

Question 177

Explanation

Correct Answer

Incorrect Answers

Question 178

Explanation

Correct Answer

Incorrect Answers

Question 179

Explanation

Correct Answer

Incorrect Answers

Question 180

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests