Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 23

Question 220

An S3 application has low complexity and only needs server-side encryption, but a second workload needs separate per-key IAM controls. How should the architect distinguish SSE-S3 and SSE-KMS?

Use SSE-KMS solely because it makes all encrypted objects publicly readable.
Use SSE-S3 when S3-managed encryption meets requirements; choose SSE-KMS for workloads needing KMS-specific key policy, audit and rotation governance.
Use SSE-S3 and assume it supports customer disabling a separate KMS key at will.
Use SSE-KMS solely to allow customers with broader KMS permissions to bypass otherwise restrictive S3 bucket policies.

Explanation

Correct Answer

Both protect stored objects, but the additional KMS control and associated cost are justified only by actual governance requirements.

Incorrect Answers

KMS encryption is not a public-access permission.

SSE-S3 keys are not exposed as customer-managed key resources.

At-rest encryption does not replace bucket IAM/resource authorization. The data caller must pass S3 access checks, and SSE-KMS adds an independent key-use boundary.

Question 221

A data team must decrypt a customer-managed KMS key from an approved cross-account role without granting an entire partner account all key management actions. What policy design minimizes blast radius?

Specify the intended role and required cryptographic actions in the key-owner policy, plus matching IAM permission on that external role.
Grant kms:* to the external account root and leave delegation unrestricted.
Grant only s3:GetObject in the external role and presume it includes KMS.
Publish the KMS key ARN to the partner but omit a key-policy grant and expect knowledge of the key identifier to authorize Decrypt.

Explanation

Correct Answer

Cross-account key access needs both sides, but scope can be restricted to particular external principals and operations.

Incorrect Answers

A broad cryptographic and administrative grant exceeds the report-read workload.

S3 object authorization cannot independently grant key decrypt access.

The key ARN identifies a resource and is not a capability token. Key-owner policy and caller IAM permission must allow cryptographic usage, scoped to the intended partner role.

Question 222

A security team rotates KMS encryption keys periodically but cannot afford to re-encrypt petabytes each time. For an eligible symmetric customer managed key, what does automatic rotation accomplish without rewriting data?

Automatically re-encrypt every existing S3 object using the newest material.
Rotate backing key material under a stable KMS key identity; KMS uses retained versions for old ciphertext decryption.
Delete all old key material so archived objects become unreadable.
Disable the current KMS key and recreate a different key with the same alias after each rotation, assuming an alias makes previously encrypted data decryptable under unrelated key material.

Explanation

Correct Answer

Automatic rotation changes current material for future encrypts but preserves the key ARN/policy and decrypt compatibility for prior ciphertext.

Incorrect Answers

Rotating material is not a bulk object re-encryption job.

KMS retains prior required material for old ciphertext.

Aliases are pointers rather than cryptographic material. Decrypting old ciphertext requires the original authorized KMS key and retained material; automatic rotation keeps that identity stable.

Question 223

A regulated HTTPS service has regional ALB endpoints and needs maintained public certificates with minimal manual certificate installation. Which AWS integration reduces renewal overhead?

Use an asymmetric KMS key ARN as the browser-facing TLS certificate by itself.
Use an ACM certificate issued for a different hostname but keep the ALB public DNS alias unchanged, assuming an IAM user password proves the intended TLS identity.
Turn off HTTPS because private subnet hosting guarantees browser confidentiality.
Use ACM certificates with the supported regional ALB HTTPS listener and maintain DNS/validation prerequisites for renewal.

Explanation

Correct Answer

ACM integrates with supported load balancers and can manage renewal when validation is maintained.

Incorrect Answers

A cryptographic KMS key identifier is not a signed X.509 server certificate.

Browser TLS validates the certificate subject/chain against the requested hostname. An unrelated account credential cannot make a mismatched or untrusted certificate appropriate.

Network location does not substitute for encrypted client sessions.

Question 224

A production RDS fleet must use encrypted storage, encrypted snapshots and predictable maintenance. An operator wants to create the DB unencrypted and add encryption later without migration. What design decision avoids that limitation?

Use only a longer database user password as the at-rest encryption mechanism.
Select KMS-backed RDS encryption at creation or plan a supported encrypted-snapshot copy-and-restore migration.
Turn on HTTPS from the app to the database and assume RDS storage and snapshots become encrypted without an encrypted resource migration.
Give every database client IAM AdministratorAccess to enable storage encryption automatically.

Explanation

Correct Answer

RDS encryption is a resource-creation/migration choice; it is not a harmless in-place toggle on every unencrypted DB.

Incorrect Answers

Authentication does not encrypt database storage blocks.

Connection TLS addresses encryption in transit only. Existing unencrypted RDS storage normally needs supported encrypted-snapshot copy and restore to migrate.

Broad IAM privilege does not change storage encryption without the supported operation.

Question 225

A company with hundreds of S3 buckets wants to reduce accidental public-read exposure but still allow controlled internal sharing. Which guardrail is more maintainable than inspecting every ACL manually?

Enable public read on every bucket and rely on employee awareness training.
Use S3 Inventory alone as the automated blocking mechanism.
Use account-level and bucket-level S3 Block Public Access with monitored exceptions and ordinary scoped internal policies.
Enable S3 default bucket encryption but leave accidental public ACL/policy grants unrestricted, treating ciphertext as equivalent to an access-control Deny.

Explanation

Correct Answer

Central public-access blocking reduces accidental broad resource grants without making internal authorized access impossible.

Incorrect Answers

Training is not a technical prevention for accidental exposure.

Inventory reports metadata and does not enforce access policy.

Encryption at rest does not invalidate public policy authorization. Block Public Access provides prevention of supported public grants independent of ciphertext storage.

Question 226

A compliance archive needs a defensible choice between simple S3 versioning and Object Lock compliance mode. A privileged user must be unable to delete protected data for seven years. Which feature meets that stronger requirement?

Use versioning alone because all older versions are immutable by default.
Use a short S3 lifecycle expiration on all old versions.
Grant an IAM role explicit Deny on current object deletion but allow privileged administrators to remove that role policy and delete protected object versions.
Use versioning with Object Lock compliance-mode retention on the required object versions.

Explanation

Correct Answer

Versioning enables version histories; compliance retention adds enforced WORM protection even against privileged early deletion.

Incorrect Answers

Authorized identities may delete older versions without retention protection.

Automatic deletion conflicts with mandatory seven-year retention.

Identity-policy controls can be modified by sufficiently privileged principals and are not the compliance-grade irreversible protection of Object Lock retained versions.

Question 227

An archive contains some expired records eligible for deletion and other records under legal hold. Operations wants storage cost control without violating retention. What should the lifecycle design do?

Apply lifecycle expiration to every object regardless of Object Lock state and assume it overrides hold.
Expire only versions that are not protected by active legal holds or retention obligations and audit the disposition.
Remove all Object Lock configuration to guarantee lowest storage cost.
Enable a CloudTrail trail only for object deletion and assume this prevents eligible or held versions from being removed by an S3 lifecycle job.

Explanation

Correct Answer

S3 lifecycle cleanup must respect Object Lock state; eligible and held records have different deletion boundaries.

Incorrect Answers

Retention and legal holds prevent premature deletion.

Unapproved removal undermines regulatory requirements and may be impossible in compliance mode.

Logging can detect actions but does not enforce retention. Lifecycle must respect current Object Lock legal holds and retention eligibility for each version.

Question 228

A team enables an AWS KMS multi-Region key for its source S3 bucket and assumes encrypted objects will replicate automatically to the destination Region because the key has a replica there. However, only unencrypted objects replicate. What misconception must the architect correct?

S3 treats multi-Region KMS keys as single-Region keys for S3 operations; SSE-KMS replication still requires explicit selection criteria, a destination KMS key in the replication configuration, and appropriate cryptographic grants.
Multi-Region KMS keys convert every S3 encrypted object into SSE-S3 data, which S3 replication intentionally blocks.
Replicate the KMS multi-Region key into the target Region but omit SSE-KMS SourceSelectionCriteria and replication role KMS permissions on the S3 rule.
All SSE-KMS objects replicate by default; the only possible failure is an undersized EC2 Auto Scaling group.

Explanation

Correct Answer

S3 does not automatically use KMS multi-Region key replication to replicate encrypted objects; S3 replication opt-in and KMS permissions are still required.

Incorrect Answers

SSE-KMS and SSE-S3 are separate server-side encryption modes; S3 does not silently change the object encryption mode by key design.

A KMS multi-Region replica shares key material but S3 still treats keys regionally for these operations; encrypted-object opt-in and role permission configuration are separate requirements.

SSE-KMS replication is not enabled by default and does not depend on an unrelated EC2 fleet size.

Question 229

A backup retention policy requires protection against deletion even by the account owner after a grace interval. Which AWS Backup mode is appropriate despite reduced flexibility?

Use governance mode because authorized administrators can remove it freely.
Use Vault Lock compliance mode after carefully validating retention periods and completing the required grace interval.
Turn off all backup creation so nothing can be deleted.
Rely on a vault’s governance-mode lock but grant the administrator a Backup policy that can remove that lock after retention is configured.

Explanation

Correct Answer

After compliance lock becomes effective, privileged operators cannot remove it or delete retained recovery points early.

Incorrect Answers

Governance is less restrictive than the specified immutability requirement.

This removes recovery capability rather than protecting existing points.

Governance mode retains an authorized lock-removal path. Compliance mode becomes effectively immutable after the grace period, meeting the stronger administrator-resistant requirement.

Question 230

A secret rotation process serves a critical database and occasional password changes break applications. What is the essential availability tradeoff of a well-designed rotation workflow?

Skip validation and promote any generated secret to current as soon as it exists.
Test the AWSPENDING credential against the database, promote it to AWSCURRENT only after success, and ensure clients subsequently refresh their cached secret.
Disable IAM read permissions for all applications after every rotation.
Move the password into an unencrypted user-data script to avoid rotation outages.

Explanation

Correct Answer

A supported rotation tests the pending password against the target before finishSecret promotes its staging label. Production consumers must refresh cached values as AWSCURRENT changes, with retriable connection handling to reduce rotation-related outages.

Incorrect Answers

An incorrect new secret could immediately stop production connections.

Consumers still need authorized access to the valid current secret.

Static secret exposure is not a secure availability solution.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 220

Explanation

Correct Answer

Incorrect Answers

Question 221

Explanation

Correct Answer

Incorrect Answers

Question 222

Explanation

Correct Answer

Incorrect Answers

Question 223

Explanation

Correct Answer

Incorrect Answers

Question 224

Explanation

Correct Answer

Incorrect Answers

Question 225

Explanation

Correct Answer

Incorrect Answers

Question 226

Explanation

Correct Answer

Incorrect Answers

Question 227

Explanation

Correct Answer

Incorrect Answers

Question 228

Explanation

Correct Answer

Incorrect Answers

Question 229

Explanation

Correct Answer

Incorrect Answers

Question 230

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests