Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 19

Question 180

An RDS deployment requires encryption of database storage and associated automated backups. The team plans a Multi-AZ deployment. When must it choose the RDS encryption setting?

Create an unencrypted RDS instance and toggle encryption in place later with no replacement or restore.
Enable only the application ALB HTTPS listener and assume storage becomes encrypted.
Enable RDS encryption at creation with an appropriate KMS key and verify the encryption behavior of snapshots and replica resources.
Use only a long master database password and Multi-AZ standby deployment, assuming standby replication automatically turns unencrypted storage into SSE-KMS encrypted volumes.

Explanation

Correct Answer

RDS storage encryption is configured when creating an encrypted instance/cluster or by supported snapshot-copy-and-restore migration; it covers supported underlying storage/backups.

Incorrect Answers

An existing unencrypted DB cannot generally be encrypted through a simple in-place toggle.

Transport TLS does not change RDS at-rest encryption state.

Database credentials and Multi-AZ availability do not change the encryption state of an originally unencrypted DB. RDS encryption must be selected during creation or supported migration.

Question 181

A company wants a guardrail that prevents new bucket policies and ACLs from unintentionally exposing S3 objects publicly. Which S3 feature should it enable at the appropriate account/bucket scope?

Configure S3 Block Public Access settings at appropriate account and bucket levels and test the intended authorized internal access.
Enable S3 versioning and assume every public bucket policy is ignored.
Use IAM Identity Center as the only S3 public-policy blocking feature.
Configure S3 server-side encryption but leave account-level Block Public Access disabled and assume encryption automatically rejects every anonymous GetObject.

Explanation

Correct Answer

Block Public Access blocks supported public grants even when an accidental bucket ACL or policy is otherwise permissive.

Incorrect Answers

Versioning retains object histories but does not automatically deny public requests.

Workforce SSO does not override every anonymous/public S3 resource grant.

Object encryption does not by itself make S3 bucket/public access policy grants impossible. Block Public Access acts directly against supported public ACL and resource policies.

Question 182

A regulated archive must prevent deletion or shortening of retained S3 object versions for a mandatory retention interval—even by privileged administrators. Which feature provides this stronger immutable mode?

Use only standard S3 versioning and assume administrators cannot delete any historical version.
Use S3 Object Lock in compliance mode on versioned objects with correctly validated retention periods and legal-hold processes.
Use a lifecycle expiration rule to remove all versions early.
Use S3 versioning and a bucket policy that only current administrators are permitted to modify, without S3 Object Lock retention on the object versions.

Explanation

Correct Answer

Compliance retention protects object versions until their retain-until date, and approved legal holds can independently prevent version deletion.

Incorrect Answers

Versioning supports recovery but does not inherently prevent an authorized deletion of a version.

Expiration undermines required retention rather than enforcing immutability.

A privileged administrator who can change the policy or delete versions can bypass ordinary permission controls. Object Lock compliance-mode retention enforces the WORM limit against that role.

Question 183

A legal team has placed a hold on documents under an S3 retention policy. Operations proposes a lifecycle expiration rule to remove the objects after 30 days. What must the design do?

Configure lifecycle expiration with higher priority to bypass legal hold.
Temporarily relax the S3 bucket-policy permissions for lifecycle service operations and assume this bypasses existing legal holds.
Honor applicable Object Lock legal holds and retention periods; use lifecycle cleanup only when protected object versions become eligible.
Grant the storage operator root access as an automatic compliance-mode retention override.

Explanation

Correct Answer

A hold or compliance retention prevents deletion until protection is removed or expires under its rules, even when an ordinary lifecycle rule would otherwise expire data.

Incorrect Answers

Lifecycle policy priority cannot override an active Object Lock legal hold.

Changing permission grants cannot override Object Lock legal-hold or compliance retention semantics; the protected versions remain ineligible for deletion until the hold is appropriately removed or retention expires.

Root privilege cannot bypass supported compliance retention before expiry.

Question 184

A bucket replicates SSE-KMS encrypted objects into a second Region. Ordinary unencrypted objects replicate, but encrypted objects are skipped. What additional replication setup is required?

Enable S3 Replication Time Control alone but leave the encrypted-object source-selection option and KMS role permissions absent.
Set the destination bucket to anonymous public write.
Change the source object’s storage class only to make encryption replication automatic.
Enable supported SSE-KMS object replication configuration and grant the replication role necessary source decrypt and destination key encryption rights.

Explanation

Correct Answer

SSE-KMS replication needs explicit opt-in and key/role access across source and destination; baseline replication configuration is not sufficient.

Incorrect Answers

Replication Time Control adds replication timeliness expectations but does not itself enable SSE-KMS replication; explicit opt-in and source/destination key permissions remain necessary.

Public access neither supplies key rights nor safely configures replication.

Storage-class change does not grant cross-Region KMS operations.

Question 185

A backup administrator must prevent even privileged users from deleting AWS Backup recovery points before a legally mandated retention period. Which lock configuration fits once irreversibility has been approved?

Use governance mode and assume privileged administrators cannot ever remove the lock.
Use AWS Backup Vault Lock in compliance mode with an approved grace period and retention settings, then validate recovery and deletion controls.
Disable automated backups and keep only manual snapshots on laptops.
Use an S3 CloudFront cookie as the vault deletion policy.

Explanation

Correct Answer

After grace ends, compliance-mode vault lock cannot be altered or removed and prevents early recovery-point deletion by privileged principals.

Incorrect Answers

Governance mode may allow authorized privileged users to remove the vault lock.

This removes centralized immutable retention and increases loss risk.

Signed content delivery tokens are not AWS Backup vault retention controls.

Question 186

A credential stored in Secrets Manager rotates automatically. The new password should be verified against the target RDS database before applications rely on it. Which part of the rotation workflow matters?

Publish AWSPENDING as current before testing database login.
Disable all database connections permanently after the rotation event.
Use the supported rotation workflow’s credential test and finish stages, and validate application retrieval of the current version.
Rely on the EC2 instance type name to prove the password was changed.

Explanation

Correct Answer

A successful rotation should demonstrate the pending credential works before promoting it to current, rather than merely generating an arbitrary new string.

Incorrect Answers

Unverified credential promotion can break production authentication.

Rotation must preserve authorized app connectivity through validated secret versions.

Compute hardware metadata cannot test database authentication.

Question 187

An S3 bucket should reject object operations performed over cleartext HTTP even from otherwise authorized IAM roles. Which resource-policy pattern enforces this request transport requirement?

Use only S3 Object Lock retention to enforce TLS on reads.
Enable the bucket default encryption setting and assume it automatically denies all HTTP GetObject requests from authorized principals.
Add a bucket policy Deny for requests where aws:SecureTransport is false, accounting for appropriate AWS service-principal exceptions when required.
Change the IAM role name to include HTTPS.

Explanation

Correct Answer

aws:SecureTransport indicates TLS use in supported requests; an explicit deny prevents a plain HTTP operation regardless of other allows.

Incorrect Answers

Object Lock concerns deletion/retention, not transport security.

Server-side encryption controls data at rest, not whether a caller uses TLS for an API request. An aws:SecureTransport conditional explicit Deny enforces transport.

Identity naming does not control the protocol used by S3 API requests.

Question 188

A KMS key encrypts objects for multiple business applications. Policy must limit one role to decrypting data only when the expected application identifier is present in the cryptographic request context. Which mechanism should be considered?

Write the application identifier into the KMS alias only and expect per-request authorization.
Apply a supported KMS encryption-context condition such as kms:EncryptionContext:AppID in the key/identity policy and supply the matching context.
Put the identifier in an unrelated S3 object tag without any KMS condition.
Allow kms:Decrypt for the IAM role but try to enforce AppID only through an S3 bucket name prefix without a KMS encryption-context policy condition.

Explanation

Correct Answer

Encryption context is authenticated additional data for symmetric KMS operations and can be used as a condition to scope approved cryptographic requests.

Incorrect Answers

An alias name does not evaluate the encryption context of individual decrypt requests.

Object tags alone do not restrict KMS cryptographic context.

An S3 name convention cannot restrict standalone KMS cryptographic requests. Use supported kms:EncryptionContext conditions and matching authenticated context in the actual KMS request.

Question 189

A large data lake has teams that need differently scoped S3 prefixes and network controls without creating many separate buckets. Which S3 capability can present dedicated governed entry points?

Assign one root credential to every team so bucket prefixes no longer need access policy.
Use an S3 lifecycle rule for each team and assume it authorizes object requests.
Grant team-specific s3:GetObject identity policies but keep every team on the same unrestricted public bucket endpoint without any access-point-level or network scope.
Create S3 Access Points with team-specific policies and, where appropriate, VPC-only access, while preserving bucket-level restrictions.

Explanation

Correct Answer

Access Points provide named S3 access endpoints and access policies to simplify managing multiple applications’ access to a shared bucket.

Incorrect Answers

Root sharing expands authority and prevents scoped dataset governance.

Lifecycle rules manage object retention/tiering, not who can read a prefix.

Identity permissions may restrict certain calls, but do not implement the dedicated governed access endpoints and independent policy/network boundaries the S3 Access Points design provides.

Question 190

A security auditor needs to know which role used GetObject against individual S3 objects last week. The default CloudTrail management event log shows bucket configuration changes but not object reads. Which additional event collection is needed?

Configure CloudTrail S3 object-level data events for the intended bucket/object scope and verify the recorded caller identity and operation.
Enable only management events again and expect them to include all object reads.
Turn on S3 server access logging only and assume it records the full CloudTrail IAM session caller, role issuer and API parameters for every individual GetObject.
Change the object storage class to Standard-IA and assume read events appear automatically.

Explanation

Correct Answer

GetObject is a data-plane operation; CloudTrail data events are not generally logged by default and must be explicitly selected and priced.

Incorrect Answers

Management events concern control-plane actions and do not replace S3 object data event selection.

S3 server access logs differ from CloudTrail S3 data-event records and may not provide the full request principal/event context required. Explicit CloudTrail object data events support the requested API attribution.

Storage classes determine price and retrieval behavior, not CloudTrail event configuration.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 180

Explanation

Correct Answer

Incorrect Answers

Question 181

Explanation

Correct Answer

Incorrect Answers

Question 182

Explanation

Correct Answer

Incorrect Answers

Question 183

Explanation

Correct Answer

Incorrect Answers

Question 184

Explanation

Correct Answer

Incorrect Answers

Question 185

Explanation

Correct Answer

Incorrect Answers

Question 186

Explanation

Correct Answer

Incorrect Answers

Question 187

Explanation

Correct Answer

Incorrect Answers

Question 188

Explanation

Correct Answer

Incorrect Answers

Question 189

Explanation

Correct Answer

Incorrect Answers

Question 190

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests