Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 22

Question 210

A KMS decrypt succeeds for context AppID=payments but fails when the app omits AppID. IAM KMS Decrypt is otherwise allowed. What causes the difference?

Configure only the role IAM Allow for kms:Decrypt and omit the AppID encryption-context attribute from requests, assuming an action Allow overrides an applicable key-policy condition.
The KMS key/identity permission policy requires the matching encryption context, which the second request does not supply.
An encryption context automatically becomes optional whenever the role has AdministratorAccess.
The S3 bucket name changes every time the context is omitted.

Explanation

Correct Answer

Encryption-context condition keys evaluate authenticated extra data for the cryptographic operation, independent of broad action allowance.

Incorrect Answers

A KMS policy can require the expected encryption context independently of an identity action Allow. Missing authenticated context prevents the request from matching the authorization condition.

A restrictive key condition can limit decrypt requests despite broad identity permission.

Missing additional authenticated data does not change bucket identity.

Question 211

An application is configured to use an S3 Access Point but its policy grants the team all objects in the underlying bucket. The security review flags overbroad team scope. What was not limited?

S3 Access Points automatically block all access to data outside the team prefix regardless of policy.
The team’s access point and effective bucket/IAM permissions to the intended subset of objects/principals/network conditions.
Configure a team access point but retain unrestricted s3:GetObject on the underlying bucket to the same team outside the access-point path.
Using an access point eliminates IAM authorization of the caller.

Explanation

Correct Answer

An access point is a policy endpoint; simply creating it does not override broad effective grants elsewhere.

Incorrect Answers

Policies must actually define and enforce the scoped resource permissions.

A dedicated access point does not revoke other effective IAM/resource grants automatically. Review both the access point policy and bucket/identity paths for the intended restriction.

Access point requests remain subject to applicable IAM and S3 policies.

Question 212

An auditor reads CloudTrail event history and sees bucket CreateBucket, but no prior GetObject calls. The trail never enabled S3 data events. Why are the object reads missing?

GetObject is never recorded by CloudTrail under any configuration.
S3 access is always invisible whenever SSE-KMS is enabled.
Enable S3 server access logging and assume its access-log object is automatically inserted into the CloudTrail management event history as a GetObject event.
S3 object-level GetObject is a data event and is not normally included unless the trail or event data store selects it.

Explanation

Correct Answer

CloudTrail management events are a different category from S3 object operations; data-event selectors determine capture.

Incorrect Answers

S3 object data-event logging can record the operation when enabled.

Encryption does not make object API operations inherently unloggable.

S3 server access logs and CloudTrail management events are different recording paths. Object-level CloudTrail data event selection is needed for GetObject caller attribution.

Question 213

An encrypted EBS snapshot in us-west-2 is needed for recovery in us-east-1. The team sees only the original snapshot when listing destination-region snapshots. What was omitted?

An explicit cross-Region snapshot copy and destination encryption/key access configuration.
A security group with unrestricted inbound TCP/443 makes EBS snapshots global.
The source volume must be attached simultaneously to EC2 instances in both Regions.
Change the destination region of an EC2 Auto Scaling group but leave the source-region EBS snapshot uncopied and assume the recovery instances can attach it.

Explanation

Correct Answer

EBS snapshots are regional artifacts; they are not automatically visible or restorable in every Region without copying.

Incorrect Answers

Network ingress rules cannot replicate regional snapshots.

Cross-Region snapshot copy does not require a volume spanning regions.

ASG deployment cannot transform a regional EBS snapshot into a destination-region artifact. Copy the encrypted snapshot with a destination key and restore compatible volumes.

Question 214

A team enables CloudTrail but still cannot automatically flag newly created unencrypted EBS volumes against a compliance rule. Which service capability was omitted?

An API event log is identical to an encryption compliance evaluation result.
AWS Config configuration-rule evaluation of the resource encryption state, with findings and remediation procedures.
Use an IAM SCP to require encryption on new volume operations but never continuously evaluate whether existing volumes meet the resource configuration policy.
A Route 53 health check can infer KMS key usage on every EBS volume.

Explanation

Correct Answer

CloudTrail logs requests; Config evaluates observed resource configuration against compliance requirements.

Incorrect Answers

The former records activity, the latter tests actual resource state.

An SCP can constrain certain creation actions but is not a resource-state compliance auditor. AWS Config evaluates actual EBS encryption posture over time.

DNS availability does not establish at-rest encryption compliance.

Question 215

An operator restores a DynamoDB PITR backup expecting the existing production table to roll back in place. The console instead creates a new table. Why?

PITR cannot restore any data newer than the earliest saved on-demand snapshot.
DynamoDB restores always modify the original table without a recovery target.
Enable DynamoDB global tables with a replica in another Region and expect its replication mechanism to restore a selected old state over the existing production table.
DynamoDB PITR recovery creates a new table that can be validated and incorporated through an explicit application cutover.

Explanation

Correct Answer

Restore operations intentionally preserve the source table while reconstituting data at a selected point into another table.

Incorrect Answers

PITR maintains a continuous recoverable time window independently of manual snapshot timing.

The restore target is a new DynamoDB table.

Global table replication propagates current changes, including mistakes; it is not point-in-time recovery. PITR restores a selected time into a new table for validation/cutover.

Question 216

A private CA issues a certificate for an internal appliance, but the appliance never picks up the renewed certificate from ACM. The team assumed automatic integration for all devices. What was missing?

A supported certificate deployment/renewal integration and updated trust chain on that external appliance.
All private certificates automatically replace themselves on every appliance regardless of connection.
An IAM root user password can be sent as a substitute server certificate.
Configure an ACM managed renewal rule for integrated ALBs, then assume the same managed deployment step automatically updates an unrelated external TLS appliance.

Explanation

Correct Answer

ACM management of certificate records does not mean arbitrary third-party endpoints automatically install renewed private certificates.

Incorrect Answers

Endpoint integration is necessary for a new cert to be served.

Passwords are not valid X.509 TLS identities.

An ACM-integrated load balancer may renew deployed certificates automatically, but third-party devices need compatible installation/renewal automation and trust distribution.

Question 217

An organization has an S3 Inventory report listing object keys and encryption states but no detection of PII within PDF bodies. What capability is absent?

Inventory already parses all object contents and marks every PII string.
An ALB target group must be added to every bucket before PII can be found.
Content-level sensitive-data discovery, such as Amazon Macie classification for supported S3 object formats.
Add CloudTrail S3 object data event selectors and assume access-activity logs classify sensitive values inside every stored PDF.

Explanation

Correct Answer

Inventory provides metadata, not substantive inspection of all object bytes for regulated personal identifiers.

Incorrect Answers

It does not provide general semantic content classification.

Load balancing is unrelated to S3 content scanning.

Object access events record request principals and API actions, not PII content. A supported content discovery job such as Macie is required for sensitive-data classification.

Question 218

An uploader targets an S3 bucket configured with Object Ownership = Bucket owner enforced. The client team believes that every PutObject request containing any ACL header must fail. Which statement correctly describes uploads that are authorized by the bucket policy?

All cross-account uploads to a bucket with disabled ACLs are rejected, even when the bucket policy grants PutObject.
PutObject can succeed without an ACL header or with the bucket-owner-full-control canned ACL; other unsupported ACL grants are rejected.
A client-supplied public-read ACL remains an independent permission grant even though the bucket has ACLs disabled.
Uploading objects through a CloudFront distribution is mandatory whenever Bucket owner enforced is configured.

Explanation

Correct Answer

The documented allowed cases include no ACL header and bucket-owner-full-control; ACLs do not grant access under this setting, and incompatible ACL grants fail.

Incorrect Answers

With Bucket owner enforced, the bucket owner controls uploaded objects through policy; authorization can permit cross-account uploads regardless of ACL disablement.

An unsupported public-read ACL is rejected and cannot independently make an object public in a bucket whose ACLs are disabled.

S3 PutObject operations can be performed directly through authorized S3 requests without requiring CloudFront as an upload middleman.

Question 219

An AWS KMS key policy lists a security-operations role as a key administrator but does NOT grant that role cryptographic key-use actions. A developer assumes the administrator can run kms:Decrypt directly on protected application data. Which distinction should the architect explain?

Key administration and cryptographic key use can be separated: a role with management actions is not automatically granted kms:Decrypt simply because it administers the KMS key.
Anyone allowed to change a KMS key description automatically receives all cryptographic permissions regardless of key policy.
Any AWS Organizations SCP Allow statement grants the KMS administrator immediate Decrypt authorization.
Customer managed keys never support separate key users; administrators and decrypting application roles must always be the same principal.

Explanation

Correct Answer

KMS key policies can name distinct administrators and key users, although admins who can modify policies may be able to grant themselves new rights; ordinary cryptographic use is still a separate permission decision.

Incorrect Answers

An administrative action such as updating a description is not the same permission as decrypting data under KMS policy evaluation.

SCPs restrict a member-account permissions ceiling and do not directly grant data-use permissions to IAM roles.

KMS explicitly supports separately configured key administrators and key users and cautions about the administrative ability to change grants/policies.

Question 220

An S3 application has low complexity and only needs server-side encryption, but a second workload needs separate per-key IAM controls. How should the architect distinguish SSE-S3 and SSE-KMS?

Use SSE-KMS solely because it makes all encrypted objects publicly readable.
Use SSE-S3 when S3-managed encryption meets requirements; choose SSE-KMS for workloads needing KMS-specific key policy, audit and rotation governance.
Use SSE-S3 and assume it supports customer disabling a separate KMS key at will.
Use SSE-KMS solely to allow customers with broader KMS permissions to bypass otherwise restrictive S3 bucket policies.

Explanation

Correct Answer

Both protect stored objects, but the additional KMS control and associated cost are justified only by actual governance requirements.

Incorrect Answers

KMS encryption is not a public-access permission.

SSE-S3 keys are not exposed as customer-managed key resources.

At-rest encryption does not replace bucket IAM/resource authorization. The data caller must pass S3 access checks, and SSE-KMS adds an independent key-use boundary.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 210

Explanation

Correct Answer

Incorrect Answers

Question 211

Explanation

Correct Answer

Incorrect Answers

Question 212

Explanation

Correct Answer

Incorrect Answers

Question 213

Explanation

Correct Answer

Incorrect Answers

Question 214

Explanation

Correct Answer

Incorrect Answers

Question 215

Explanation

Correct Answer

Incorrect Answers

Question 216

Explanation

Correct Answer

Incorrect Answers

Question 217

Explanation

Correct Answer

Incorrect Answers

Question 218

Explanation

Correct Answer

Incorrect Answers

Question 219

Explanation

Correct Answer

Incorrect Answers

Question 220

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests