Design Secure Architectures

SAA-C03 · 90 questions

• A county IT board wants separate AWS accounts for parks, finance, and shared services, plus a guardrail so no account can disable CloudTrail. Which design best meets that requirement?
• A city clerk still signs in with the AWS account root user for everyday console work. What should the architect recommend for day-to-day access while protecting root?
• A municipal open-data portal application must write objects to an S3 bucket without embedding long-lived access keys in the app. Which approach should the architect design?
• A township finance team and parks team share one AWS account and keep colliding on permissions when both use shared admin users. How should the architect structure authorization?
• A regional emergency-services consortium needs staff from county A to administer resources in county B’s AWS account for a joint CAD reporting app. Which design provides that access without sharing passwords?
• A city directory already runs Active Directory on-premises and wants employees to use existing identities for the AWS Management Console. What should the architect recommend?
• A parks mobile app needs citizen (external) sign-in, while city staff continue to use corporate SSO for the AWS Console. How should the architect separate these identity needs?
• A county wants developers to deploy into a sandbox account but must prevent creation of IAM users that attach AdministratorAccess. Which multi-account control best enforces that guardrail?
• A library consortium attaches an S3 bucket policy that allows public GetObject for open catalogs while denying deletes except to a dedicated backup role. What does this illustrate about secure access design?
• A municipal auditor asks who patches the guest operating system on Amazon EC2 instances versus who secures the AWS data centers. Which statement correctly applies the shared responsibility model?
• A city security policy requires MFA for every human console session, including break-glass access. Which recommendation aligns with AWS MFA best practices?
• A multi-county water authority wants a landing-zone style baseline with a dedicated logging account, a security tooling account, and separate workload accounts. Which approach fits Associate-level multi-account security strategy?
• A permit portal AWS Lambda function must read and write items in DynamoDB in the same account without embedding access keys. What should the architect attach?
• A finance department insists on separate AWS accounts so the parks department cannot read tax databases. Why is account isolation an appropriate access-control choice?
• A city maps Active Directory groups to AWS IAM Identity Center permission sets for Management Console access across multiple accounts. What is the main advantage of this design?
• A contractor needs time-limited read-only access to a staging AWS account. Which design best matches temporary, conditional access?
• A municipal CI job running in account A must deploy CloudFormation stacks into account B. How should cross-account automation authenticate?
• A county wants to prevent anyone—including account administrators—from disabling Amazon GuardDuty in member accounts. Which control achieves that preventive goal?
• A parks GIS tool must call AWS APIs while respecting data residency expectations for a specific Region. How should the architect think about Regions in secure access and residency design?
• City Hall helpdesk staff keep creating IAM users with AdministratorAccess “temporarily.” How should the architect remediate this least-privilege anti-pattern?
• A school district wants teachers and staff to use Google Workspace identities for AWS Management Console access. Which approach is appropriate?
• A police evidence vault AWS account must deny broad access from outside a dedicated security organizational unit. Which Organizations design supports that containment?
• A municipal API architecture uses a resource-based policy on an Amazon SQS queue so only a named Lambda execution role can consume messages. What principle does this apply?
• A county separates production and nonproduction AWS accounts so developers do not hold production IAM permissions by default. How should production access work when needed?
• A city must prove who changed IAM policies last quarter as part of access governance. Which design element supports that accountability without replacing least privilege?
• A regional transit authority wants one login portal so staff across subsidiaries can reach multiple AWS accounts with workforce single sign-on. Which service should the architect designate as the central workforce SSO hub?
• A township accidentally committed AWS access keys to a public Git repository. Which remediation architecture best removes the reliance on long-lived keys for compute while containing the leak?
• A municipal data lake account must share a Glue Data Catalog with analytics accounts so analysts can query curated tables without copying datasets or handing out access keys. Which design best provides least-privilege cross-account data access?
• A city council policy requires separating billing owners from workload administrators so the same person cannot both pay invoices and change production IAM. Which architecture best enforces that separation of duties?
• A parks department application in a private subnet must call Amazon S3 without sending traffic across the public internet. Which design combines private connectivity with secure access controls?
• A citizen permit portal sits behind an internet-facing Application Load Balancer. How should the architect place the application servers and security groups?
• A county GIS VPC needs instances to download OS patches from the internet without giving those instances public IP addresses. Which design meets the requirement?
• A city wants to block entire subnet CIDR ranges from reaching a database subnet even if a security group rule is later misconfigured. Which control should the architect add at the subnet boundary?
• A public library website faces elevated DDoS risk during contentious community meetings. Which architecture best improves edge DDoS resilience?
• A municipal web form that accepts free-text comments has been hit with SQL injection attempts. Which control should the architect place on the public entry point?
• A parks reservation API currently stores database passwords in plaintext environment variables on its hosts. Which design best improves credential security?
• A city wants continuous detection of anomalous API activity and potentially compromised instances across accounts. Which service should the architect enable as the intelligent threat-detection control?
• A finance S3 bucket may contain Social Security numbers inside uploaded spreadsheets. Which service should the architect add to discover and classify that sensitive data?
• Citizens need email or social sign-in for a recreation registration app, while city staff will continue using corporate SSO for AWS consoles. Which service should authenticate the citizen end users of the application?
• A county must connect on-premises computer-aided dispatch (CAD) servers to a VPC for hybrid lookups without exposing CAD RDP to the open internet. Which connectivity approach should the architect choose?
• A municipal API must be reachable only from a partner VPC and must not be exposed on the public internet. Which pattern should the architect use?
• A city placed Amazon RDS in a public subnet and enabled public accessibility "for easier admin." Which redesign best hardens the database tier?
• A permit system needs TLS certificates for custom domains on an Application Load Balancer, CloudFront, and API Gateway. Which service should provision and renew those certificates?
• A township wants administrators to reach EC2 instances only through AWS Systems Manager Session Manager, with no inbound SSH from the internet. Which design change is required?
• A city must inspect and filter VPC egress to the internet with controls deeper than security groups alone. Which service should the architect evaluate for centralized egress filtering?
• An internet-facing Amazon API Gateway stage must not remain open to anonymous callers. Which approach best secures application access at the API layer?
• A county shares a Transit Gateway across departments and needs consistent firewall policies in many accounts and VPCs. Which service helps centrally manage those firewall policies?
• A city open-data static site is stored in Amazon S3 and must be delivered publicly through Amazon CloudFront without leaving the bucket widely open to direct public access. Which design should the architect use?
• A municipal microservices mesh must encrypt service-to-service calls inside the VPC and limit which tiers may talk to each other. Which controls should the architect emphasize?
• A city enables Amazon GuardDuty, Amazon Inspector, and Amazon Macie and wants one place to aggregate and prioritize those security findings. Which service provides that posture aggregation?
• A parks department streams fire-hydrant pressure readings into AWS and must keep the ingestion path off the public internet. The architecture should use a private streaming or API endpoint secured with IAM—not an out-of-scope IoT specialty service. Which design best meets that requirement?
• A county security office wants VPC Flow Logs and AWS CloudTrail delivered into a dedicated central log-archive account where investigators can read history but application teams cannot alter or delete the archives. Which approach best designs that secure logging architecture?
• A city development team committed API keys into a public GitOps repository used for a citizen-services app. Leadership wants a redesign so configuration secrets are not stored in source control. Which solution best remediates that risk?
• A municipal partner organization needs HTTPS access to an application behind a private Application Load Balancer in the city’s VPC. The city must not open the ALB security group to 0.0.0.0/0. Which connectivity approach best meets the requirement?
• A township wants continuous vulnerability assessment of EC2 instances and container images in Amazon ECR as part of its secure workload posture. Which AWS service should the architect select for that scanning use case?
• A city requires that traffic leaving private application subnets be inspected and limited to approved destinations and ports. Default routes that send private-tier traffic directly to an Internet Gateway are not allowed. Which design best enforces that egress control?
• A recreation department booking website must present only HTTPS to citizens and redirect any HTTP requests to HTTPS. Which design best implements that control on AWS?
• GuardDuty reports cryptocurrency mining activity on a county EC2 instance. Leadership wants an architecture that can automatically start containment when that finding type appears. Which design best supports detection-to-response automation?
• A municipal Windows server fleet must domain-join to a managed directory so file shares and line-of-business apps can use Active Directory identities with least-privilege admin groups. Which AWS service should anchor that design?
• A city wants an internal management API to be reachable only from inside its VPCs using Interface VPC endpoints and private DNS, with no public service endpoint exposure. Which approach best matches that requirement?
• A county records archive in Amazon S3 must be encrypted at rest with customer managed KMS keys, and key usage must be auditable. Which design best satisfies those controls?
• A citizen portal must enforce TLS 1.2 or higher for all public HTTPS entry points. Which design best provides encryption in transit with managed certificates on AWS?
• A finance team requires that only a dedicated key-admin role may schedule deletion of a customer managed KMS key used by tax systems, while application roles may only encrypt and decrypt data. Which design best enforces that separation?
• A police evidence bucket is encrypted with a customer managed KMS key. Policy requires automatic annual rotation of that CMK, and TLS certificates for related portals must stay current. Which approach best addresses key rotation for the CMK?
• A city classifies datasets as Public, Internal, or Confidential and must map that classification to S3 buckets, encryption, and access controls. Which design best uses classification to drive data security controls?
• Closed council session recordings must remain retained for 7 years and then be deleted, with strong protection against early tampering where policy requires immutability. Which Amazon S3–centric design best meets retention and protection needs?
• A municipal database backup must be copyable to a second AWS Region for disaster recovery while remaining encrypted throughout. Which approach best meets that requirement at Associate depth?
• A county must show auditors HIPAA- and CJIS-aligned control evidence for workloads on AWS, including access to official compliance reports, while the architecture itself uses encryption and tight access controls. Which combination best aligns technologies to that compliance-evidence need?
• A parks photo bucket should allow public read access to thumbnail objects but must deny public write so citizens cannot upload or overwrite objects anonymously. Which S3 data-access design best encodes that policy?
• A city wants governed, centralized backup policies covering Amazon EBS volumes, Amazon RDS databases, and Amazon EFS file systems rather than relying only on ad-hoc manual snapshots. Which service should the architect select?
• Amazon Macie reports PAN-like strings in a shared-drive style S3 bucket used by multiple departments. Which response design best remediates access after sensitive data discovery?
• A township container task must retrieve database credentials at runtime. The credentials must be encrypted at rest with KMS and readable only by the task role. Which design best meets that requirement?
• A municipal Amazon OpenSearch Service domain stores citizen feedback and must enable encryption at rest and node-to-node encryption. Which action best applies those data security controls on the service?
• A county policy requires highly sensitive case files to be encrypted on the client before any upload to Amazon S3, so plaintext never reaches S3 unencrypted even prior to server-side encryption. Which approach correctly distinguishes that requirement?
• EBS volumes that back a computer-aided dispatch (CAD) database must be encrypted at rest, and the account should prefer encryption by default for new volumes. Which design best enforces encrypted block storage for that sensitive workload?
• A city IT team shares an encrypted AMI from the production account to a disaster-recovery account so operators can launch recovery instances. The AMI copy uses a customer managed KMS key. What must the architect grant so the DR account can launch instances from that shared AMI?
• A county tax system will store sensitive assessment data in Amazon RDS. Leadership requires encryption at rest and notes that RDS encryption cannot be turned on later for an already unencrypted instance. When should the architect enable encryption?
• A library consortium must keep contested digital records immutable for a court-mandated retention period, including protection against privileged deletion. Which S3 control best meets a WORM-style legal hold requirement?
• A municipal CRM must export nightly files to partners through AWS Transfer Family. Policy requires encryption in transit for every transfer. Which design choice satisfies that requirement?
• Auditors ask a city whether it needs dedicated HSM appliances under its exclusive control for a small set of regulated keys, while most application encryption can stay on managed CMKs. How should the architect decide between AWS CloudHSM and AWS KMS?
• A city open-data portal stores non-sensitive public datasets beside confidential case files in separate S3 buckets. Security wants default encryption that matches classification. Which approach is appropriate?
• A county compliance office wants continuous collection of evidence mapped to a controls framework instead of last-minute screenshot hunts before audits. Which AWS service should the architect include for automated evidence gathering?
• A county DR runbook restores encrypted Amazon RDS snapshots into a second Region. What must the architect validate so recovery actually succeeds?
• A parks registration app must protect date-of-birth fields with application-level encryption while still using AWS KMS for key custody. Which pattern should the architect design?
• Internal Application Load Balancers for a municipal intranet only need trust from city-managed devices, not from public browsers on the internet. Which certificate approach fits?
• A municipal data lake on S3 serves many departments. Coarse IAM on whole buckets is too blunt for table- and column-level access. Which service should the architect use for fine-grained lake permissions?
• Security policy states that EBS snapshots containing municipal data must never be shareable publicly. Which control direction should the architect enforce?
• A city application stores Amazon RDS credentials that must change every 30 days without manual ticket chaos. Which design implements that credential security control?
• A utility analytics warehouse on Amazon Redshift must protect data at rest and require encrypted client connections. What should the architect enable?
• A county publishes a meter-data retention schedule: keep objects online for three years, then move them to Glacier storage classes, then expire them. How should the architect enforce that policy automatically in S3?