Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 21

Question 200

After AWS KMS automatically rotates symmetric key material, an application can still decrypt a ciphertext created months earlier. The team thinks rotation should destroy old key versions. Why does it still work?

KMS retains historical key material for the same key and selects the version needed to decrypt old ciphertext.
All KMS rotation immediately rewrites every existing S3 object with the new material.
The application must have disabled KMS to make old ciphertext readable.
Re-encrypt every encrypted object through an S3 Batch job after automatic KMS rotation, assuming older ciphertext cannot use retained material.

Explanation

Correct Answer

Automatic rotation introduces new material for future encryption without changing the key identity or intentionally losing access to earlier ciphertext.

Incorrect Answers

Rotation of backing key material is not equivalent to re-encrypting stored objects.

Supported decrypt uses retained KMS material while respecting permissions.

Bulk re-encryption may be a separate business decision but is not required simply because KMS rotates backing material. KMS uses retained previous key versions to decrypt old ciphertext.

Question 201

Clients reject HTTPS from an ALB even though its security group allows TCP/443. The attached certificate is expired or not valid for the host. Which layer explains the failure?

A TCP/443 security group rule guarantees a trusted X.509 certificate.
Renew the ALB certificate in a different AWS Region and leave the expired certificate attached to the listener, assuming any account-level ACM renewal changes the served chain.
TLS certificate trust, hostname and validity are separate from TCP port reachability.
Route 53 DNS TTL alone fixes an expired certificate.

Explanation

Correct Answer

Network rules can permit the handshake packets while client certificate validation still fails for the presented server identity.

Incorrect Answers

Packet admission cannot establish certificate validity or chain trust.

The HTTPS listener must serve a valid matching certificate in the applicable Region. Updating an unrelated ACM resource does not fix the expired certificate actually presented to clients.

DNS caching does not replace a certificate past its validity date.

Question 202

A company created an unencrypted RDS instance. An administrator attempts to click an in-place encryption toggle but cannot find one. What constraint applies?

Existing unencrypted RDS databases automatically encrypt when a role assumes an IAM session.
The RDS DB must be publicly accessible to enable KMS encryption.
Migrating an existing unencrypted RDS database to encrypted storage generally requires a supported snapshot copy with encryption and restore to a new encrypted instance.
Enable TLS on an application load balancer in front of the RDS clients and assume this turns an existing unencrypted RDS storage volume into encrypted storage.

Explanation

Correct Answer

RDS storage encryption is not normally changed by simply toggling an existing unencrypted database in place.

Incorrect Answers

IAM identity transitions do not change data storage encryption.

Network exposure is unrelated to the encryption migration method.

TLS protects a network hop and cannot change RDS data-at-rest encryption. Supported snapshot-copy/restore migration is needed for an existing unencrypted DB.

Question 203

A bucket ACL inadvertently grants public read, but the account has enforced S3 Block Public Access settings. A tester cannot read the objects anonymously. Why is the exposure blocked?

S3 objects can never be public under any configuration.
Object Lock itself always blocks anonymous reads.
Effective account/bucket Block Public Access protections can override supported public ACL or policy grants.
Enable S3 bucket versioning and assume versioning revokes any public-read ACL even when Block Public Access is not enforced.

Explanation

Correct Answer

S3 Block Public Access is designed to prevent public exposure despite a conflicting accidental public permission.

Incorrect Answers

Public access is technically possible when not blocked and appropriately allowed.

Object retention does not determine ordinary read permissions.

Versioning tracks object changes and does not determine public-resource grant admission. Block Public Access evaluates and blocks supported public ACL/policy grants.

Question 204

An administrator tries to delete a versioned S3 object protected by active Object Lock compliance-mode retention. Their administrative IAM permissions allow deletion, but S3 rejects it. Why?

Compliance-mode retention cannot be overridden by ordinary privileged identities before the retained version’s protect-until date.
Administrators can always shorten compliance retention using root access.
S3 versioning alone permanently prevents deleting all versions.
Set a short lifecycle expiration on the compliance-retained version and expect S3 to delete it even though its retain-until date is in the future.

Explanation

Correct Answer

Object Lock WORM protection is a separate deletion boundary from IAM DeleteObjectVersion authorization.

Incorrect Answers

Root cannot bypass compliance-mode retention before expiry.

Versioning supports historical copies but not compliance-grade immutability by itself.

S3 lifecycle operations honor Object Lock compliance retention; storage lifecycle does not supersede the retention service constraint.

Question 205

A lifecycle expiration rule attempts to delete an S3 object version under legal hold. The job leaves the version intact. What is the controlling constraint?

Lifecycle rules always bypass legal holds when they use a shorter date.
An active S3 Object Lock legal hold prevents protected object-version deletion until the hold is removed by an authorized action.
Disable server access logging on the bucket and assume the change permits a lifecycle rule to remove legally held object versions.
The storage class must be moved to One Zone-IA before legal hold can apply.

Explanation

Correct Answer

Lifecycle expiration is subordinate to the applicable Object Lock retention/hold restrictions.

Incorrect Answers

Object Lock hold protects versions even when lifecycle eligibility is met.

Audit logging and legal hold are separate controls. An active legal hold blocks deletion regardless of whether request logging is enabled.

Legal hold is not dependent on that storage tier.

Question 206

An S3 replication rule copies ordinary objects but not SSE-KMS encrypted ones. The team granted S3 PutObject at the destination but never configured KMS decrypt/encrypt permissions. What is the missing dependency?

Enable S3 Transfer Acceleration for the replication rule but keep the SSE-KMS encrypted-object selector and destination key permissions absent.
Encrypted objects can never be replicated across S3 buckets.
Changing the object owner’s IAM username automatically re-encrypts destinations.
Explicit SSE-KMS replication handling and the necessary replication role permissions on source and destination KMS keys.

Explanation

Correct Answer

Cross-Region replication of KMS-protected content uses its own key and role configuration beyond ordinary object replication.

Incorrect Answers

Transfer Acceleration optimizes eligible client upload paths; it does not opt in SSE-KMS objects for S3 replication or grant replication-role KMS decrypt/encrypt rights.

SSE-KMS replication is supported when configured.

Username labels do not provide replication cryptographic rights.

Question 207

A backup vault is locked in governance mode. A sufficiently authorized security administrator can still remove the lock. Compliance requires deletion protection even against that administrator after a review period. What mode difference matters?

Governance mode is always stricter than compliance mode for administrators.
Move the backups to a colder AWS Backup storage lifecycle tier and assume storage cost tiering prevents an authorized administrator from removing a governance-mode vault lock.
An IAM policy Allow:DeleteBackupVaultLockConfiguration defeats compliance mode after the grace period.
Compliance mode becomes immutable after its configured grace period, whereas governance mode permits authorized lock removal.

Explanation

Correct Answer

Vault Lock’s modes differ in who can modify retention enforcement after configuration; compliance has stronger irreversible behavior.

Incorrect Answers

Governance retains a privileged removal path.

Backup lifecycle storage choices do not change the Vault Lock mode. Governance permits authorized removal; compliance mode becomes immutable after its grace period.

The service enforces compliance immutability even against privileged IAM grants.

Question 208

Secrets Manager rotates a password and immediately promotes the newly generated value without successfully logging in to the database. Production requests fail. Which rotation step was skipped?

Rotation must turn off all application authentication indefinitely.
Validate the candidate credential against its database target before completing the secret-version promotion.
Read the new secret string from AWSPENDING and mark it AWSCURRENT without testing authentication against the actual database.
A role can infer password correctness from the secret string length.

Explanation

Correct Answer

Supported rotation workflows should test the pending value and activate it only after it demonstrably works with the backend.

Incorrect Answers

The goal is updated secure credentials with maintained connectivity.

Staging version data does not prove the database accepted the password change. The rotation testSecret phase should validate working access before finishSecret promotes AWSCURRENT.

String length is no proof of successful DB authentication.

Question 209

A bucket policy has a Deny when aws:SecureTransport=false. A client sends an HTTP GetObject even though the role has s3:GetObject. Why is the operation denied?

The request fails the TLS requirement and an applicable explicit bucket-policy Deny overrides the role’s Allow.
An IAM s3:GetObject Allow always overrides resource-policy transport conditions.
Any HTTP request automatically upgrades to HTTPS before policy evaluation.
Object versioning disables TLS conditions.

Explanation

Correct Answer

S3 request-context transport security is a separate condition from principal identity permission.

Incorrect Answers

An explicit bucket denial remains effective.

A client can send cleartext requests unless its endpoint/policy prevents them.

Versioning does not alter aws:SecureTransport evaluation.

Question 210

A KMS decrypt succeeds for context AppID=payments but fails when the app omits AppID. IAM KMS Decrypt is otherwise allowed. What causes the difference?

Configure only the role IAM Allow for kms:Decrypt and omit the AppID encryption-context attribute from requests, assuming an action Allow overrides an applicable key-policy condition.
The KMS key/identity permission policy requires the matching encryption context, which the second request does not supply.
An encryption context automatically becomes optional whenever the role has AdministratorAccess.
The S3 bucket name changes every time the context is omitted.

Explanation

Correct Answer

Encryption-context condition keys evaluate authenticated extra data for the cryptographic operation, independent of broad action allowance.

Incorrect Answers

A KMS policy can require the expected encryption context independently of an identity action Allow. Missing authenticated context prevents the request from matching the authorization condition.

A restrictive key condition can limit decrypt requests despite broad identity permission.

Missing additional authenticated data does not change bucket identity.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 200

Explanation

Correct Answer

Incorrect Answers

Question 201

Explanation

Correct Answer

Incorrect Answers

Question 202

Explanation

Correct Answer

Incorrect Answers

Question 203

Explanation

Correct Answer

Incorrect Answers

Question 204

Explanation

Correct Answer

Incorrect Answers

Question 205

Explanation

Correct Answer

Incorrect Answers

Question 206

Explanation

Correct Answer

Incorrect Answers

Question 207

Explanation

Correct Answer

Incorrect Answers

Question 208

Explanation

Correct Answer

Incorrect Answers

Question 209

Explanation

Correct Answer

Incorrect Answers

Question 210

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests