Security, Compliance, and Governance (25%)

SAP-C03 · 75 questions

• A SaaS startup runs a React web app and mobile clients that sign in with Google and corporate SAML IdP. The API on API Gateway and Lambda needs per-user JWT claims for authorization, plus temporary AWS credentials for direct S3 uploads. Which authentication design provides both user-directory federation and scoped AWS access?
• A regional hospital group with 1,200 clinicians uses Microsoft Entra ID as its HR-backed identity source. Doctors need short-term AWS console and CLI access scoped to their department, with joiner and leaver updates applied automatically and no long-lived IAM users to manage. What identity design meets this requirement?
• A financial holding company runs 60 AWS accounts in AWS Organizations with separate OUs for prod and sandbox. Auditors require that no member account can leave the organization and S3 buckets cannot grant access to principals outside the organization, even if developers allow it. Which SCP and RCP combination enforces both identity and resource-based guardrails?
• A fintech runs 300 AWS accounts under Organizations with EC2 and ECR workloads subject to PCI DSS. It needs continuous vulnerability scanning, automated patching on a schedule, and centralized compliance reporting without installing third-party agents. Which solution meets these multi-account governance requirements?
• A financial services firm runs 60 AWS accounts under AWS Organizations with new accounts added monthly. Auditors require continuous checks for public S3 buckets, unencrypted volumes, and open security groups, with central findings and automatic evaluation in every Region. Which governance design provides automated multi-account compliance monitoring?
• A platform team lets three vendor accounts deploy to a central production account, but auditors found long-lived access keys and overly broad PowerUser access with no scoping by project. Vendors must get short-lived project-scoped access with a controllable maximum. Which least-privilege cross-account design enforces temporary project-scoped vendor access?
• A healthcare company with 40 accounts under AWS Control Tower must automatically detect unencrypted S3 buckets, public security groups, and drift, then show a unified compliance score to auditors with auto-remediation for critical findings. Which automated compliance monitoring design provides continuous detection and centralized posture visibility?
• A healthcare startup stores PHI in S3 and RDS, must enforce least privilege, encrypt data at rest and in transit, and prove who accessed which patient record and when for HIPAA audits. Developers use federated SSO and auditors need immutable evidence. Which architecture meets these data protection requirements?
• A fitness SaaS with 200,000 mobile users needs social sign-in, MFA, and fine-grained access where premium subscribers can stream videos from S3 while free users cannot. The mobile app calls API Gateway and Lambda, and IoT scales must upload directly to S3 with temporary credentials. What auth design fits?
• A healthcare company stores PHI in S3 and shares APIs via VPC endpoints, but leaders fear data exfiltration to external accounts and overly permissive endpoint access. They need to validate that no bucket or endpoint allows unintended external principals. Which data perimeter validation design detects unintended external access?
• A SaaS company manages 800 EC2 instances and container images across production and staging accounts. Security requires continuous vulnerability detection for OS and images plus scheduled OS patching with approval windows and centralized compliance reporting. Which design provides automated scanning and patch management?
• A logistics firm hosts shipment data in a central account and hires an analytics vendor using its own AWS account for quarterly reporting. The vendor must access only the s3://shipments/partner/ prefix for 4 hours at a time, vendor sessions must be confined even if the role policy grows, and confused-deputy access must be blocked. Which temporary-credential design enforces least-privilege cross-account access for this vendor?
• A logistics enterprise runs 800 EC2 instances and 200 ECR images across prod and dev, facing audit pressure to continuously scan OS and container vulnerabilities and auto-patch missing updates within maintenance windows without manual SSH. Which automated scanning and patching design closes findings end-to-end?
• A healthcare startup stores patient records in S3 and RDS containing PHI across two Regions. HIPAA requires encryption at rest and in transit, least-privilege access with separation of duties, and immutable audit trails of every data access and key use. Which architecture meets these data protection requirements?
• A European bank must keep customer PII within eu-central-1, prevent cross-border replication, allow EU-only administrators to manage keys and logs, and demonstrate residency to regulators during audits. Applications run on S3, RDS, and KMS. Which solution enforces data sovereignty controls?
• A bank runs payment workers on premises and in another cloud that must call S3 and SQS without storing long-lived AWS keys, with short-lived credentials and centralized trust rotation. Security forbids exporting service account passwords to AWS. Which workload identity design grants hybrid workers secure temporary AWS access?
• A regional bank hires three audit firms that all need short-lived read-only access to transaction logs in the bank's AWS account. Compliance requires prevention of confused-deputy access, a hard cap on maximum permissions, and no long-term keys. What access design meets these needs with least privilege?
• A healthcare SaaS stores PHI in S3 and shares analytics via cross-account roles, but auditors found a VPC endpoint allowed S3 access from outside the organization and external principals accessed a bucket. Strict data perimeter and least privilege are required. Which data perimeter design validates external access and restricts egress?
• A bank launches a Bedrock assistant that summarizes loan files, and regulators require an immutable audit trail linking every prompt, model version, and approver action for seven years with fast SQL investigations. Which audit trail management design for regulated AI workloads satisfies retention and investigation needs?
• A fintech startup stores loan applications in S3 and Aurora PostgreSQL. Regulators require customer-managed encryption at rest, department-based least-privilege access to files and rows, and an auditable trail of who accessed sensitive objects. Which data protection design satisfies encryption, access control, and audit logging requirements?
• A healthcare SaaS stores PHI in S3 and EBS for 200 clinics and must enforce customer managed keys per tenant, with annual rotation without re-encrypting data and centralized audit of key use. Which encryption-at-rest design with automatic rotation satisfies the tenant isolation requirement?
• A manufacturer runs signing servers in on-premises data centers and in another cloud, needing short-lived AWS credentials to upload telemetry to S3 without storing long-lived keys or opening inbound firewall ports. Rotation and audit are required. Which workload identity design grants hybrid servers secure AWS access?
• A German health startup must process patient data only inside Germany to satisfy regulators, blocking accidental replication or admin access from other Regions. Architects use eu-central-1 but fear a future setting enables cross-Region copies. Which architecture enforces German data sovereignty for regulated storage and keys?
• A biotech enterprise stores genomic data in S3 and must prove no external network path or permissive policy allows exfiltration, while partners access dashboards through identity-aware private entry. Which combination enforces this data perimeter?
• A bank uses Amazon Bedrock and Lambda for loan summaries and must prove to auditors who accessed which customer record, prompt, and model response with tamper-proof retention. Current app logs omit identity and model IDs. Which audit-trail design satisfies regulated AI workload traceability?
• A telehealth startup must secure browser-to-ALB and microservice-to-microservice traffic, enforce modern TLS, automate public certificate renewal, and issue private certs for internal mTLS. Which certificate management design using TLS 1.3 and AWS issuance best meets the in-transit encryption need?
• A European bank must keep customer ledgers inside the EU, prevent any cross-border replication, prove residency to regulators, and still allow EU-based analytics. Architects propose eu-central-1 with backups and support access from abroad. Which solution best meets these data sovereignty control requirements?
• A Bahrain-based payments fintech must store transaction records and backups solely in me-south-1 to satisfy national regulation, prevent any cross-Region copies or replication, and provide regulators with continuous evidence of residency. Workloads run on Amazon EC2, RDS and S3 under AWS Organizations. Which architecture enforces Region-specific deployment and transfer restrictions for data residency compliance?
• A bank must encrypt S3, EBS, and RDS with distinct department keys, enforce least-privilege use, audit every decryption, and rotate keys automatically without re-encrypting all data manually. Which encryption design meets centralized key control?
• A manufacturer runs Kubernetes on-premises and in another cloud that must call S3 and SQS without storing AWS keys, with short-lived credentials tied to existing enterprise identities. Which workload identity design is correct?
• A pharmaceutical firm runs a regulated research assistant on Amazon Bedrock in two accounts, must retain every API action and every model prompt for 7 years immutably, and must prove no log tampering to auditors. Which audit trail design satisfies regulated AI logging requirements?
• A regulated bank runs 40 accounts under AWS Organizations with centralized CloudTrail and Config. Auditors demand quarterly SOC 2 and PCI evidence, tamper-evident resource history, and self-service access to AWS compliance reports. Which evidence-collection design satisfies centralized audit reporting and compliance documentation needs?
• A healthcare SaaS must keep German patient records in eu-central-1 only, while serving global users from nearby Regions without replicating PHI. Legal requires blocking cross-border transfers of stored data. Which data residency control using Region-specific deployments and transfer restrictions satisfies German storage isolation?
• A bank must support FIPS 140-3 Level 3 protection for payment-card key operations, requires single-tenant hardware with exclusive customer control of keys, needs to offload OpenSSL operations from EC2, and must retain audit logs for regulators. Which key management solution satisfies this dedicated hardware requirement?
• A healthcare company stores PHI in S3 and RDS and faces an audit requiring customer-controlled encryption at rest with annual key rotation and centralized key audit trails. AWS managed keys are no longer sufficient. Which encryption at rest design using customer managed keys and rotation should the architect implement?
• A healthcare startup runs internal microservices behind an Application Load Balancer and must encrypt all service-to-service traffic with TLS 1.3 using short-lived certificates and automated renewal. Private trust is required without public domain validation. Which certificate-based encryption in transit design meets these requirements?
• A public fintech that already uses AWS Audit Manager and AWS Config must prove PCI DSS and SOC compliance quarterly to enterprise buyers, showing current AWS certifications and its own control activity. Security wants centralized evidence without manual screenshots. Which compliance evidence collection and reporting solution using AWS Artifact and audit services meets buyer due diligence?
• A health startup is launching a patient portal on AWS with PHI in RDS, public APIs via API Gateway, and CI/CD with broad IAM roles. Leadership wants structured threat identification and prioritized mitigations before launch. Which risk assessment solution best delivers threat modeling and mitigation planning?
• A public-sector SaaS provider must retain Canadian citizen case files only in ca-central-1, block cross-Region copies of S3 objects and backups, and demonstrate containment during audits. Operations teams work in multiple Regions for other workloads. Which data residency design enforces and proves regional containment for citizen data?
• A bank operates internal APIs on private subnets across three regions, requiring TLS 1.3 for all east-west traffic, automated private certificate issuance and renewal, and centralized private trust without public domains. Manual CSR handling caused outages. Which encryption in transit design using certificate management should the architect deploy?
• A payment processor must meet PCI DSS and banking regulations requiring single-tenant cryptographic hardware, exclusive key control, and FIPS 140-2 Level 3 validation. Shared multi-tenant key services are prohibited by auditors. Which dedicated hardware security module design satisfies regulatory compliance?
• A healthcare SaaS must prepare document-signing keys for quantum-safe requirements, needs FIPS-approved digital signatures with centralized key lifecycle, requires AWS-managed HSM backing, and must use standardized Module-Lattice algorithms without building custom crypto. Which post-quantum key management design meets these signing needs?
• A tutoring company launches a Bedrock chatbot for K-12 students needing blocked self-harm content, redacted PII, and grounded answers with citation enforcement. Parents require logged policy actions. Which generative AI control design enforces content filtering and compliance logging?
• A fintech startup that already uses AWS Audit Manager in its Organizations management account must furnish SOC 2 evidence quarterly, needs tamper-evident collection across 12 accounts plus on-demand auditor access to AWS compliance reports. Which compliance evidence collection design streamlines reporting with Artifact?
• A startup launching an AI photo app on S3, Lambda and DynamoDB needs structured threat modeling before launch, prioritizing spoofing and data exfiltration mitigations. Leadership wants documented risks and controls. Which risk assessment solution for cloud architectures using threat modeling and mitigation strategies fits early design?
• A fintech launches a Bedrock chat assistant for investment education in two regions. Regulators require blocking disallowed advice topics, filtering hate and violence, and redacting SSNs and account numbers before logging. Prompts alone have leaked PII in testing. Which Bedrock Guardrails design enforces content filtering and compliance controls?
• A regulated bank is migrating payment processing to AWS. Auditors require single-tenant hardware key storage, customer-exclusive control of key material, and FIPS 140-3 Level 3 validated modules. Shared multi-tenant key services are prohibited. Which key management design meets the dedicated hardware requirement?
• A regulated bank is consolidating 80 AWS accounts after acquisitions, needs consistent guardrails that block risky actions, a standard landing zone for new business units, and self-service account provisioning with approvals. Which organizational design provides automated guardrails, landing zones, and account provisioning?
• A federal contractor stores 7-year signed regulatory filings in S3 and must keep classical ECDSA verification working while adding quantum-resistant signatures for new filings with centralized key control and audit. Which post-quantum cryptography strategy using AWS KMS meets both requirements?
• A fintech company is migrating payment APIs to AWS across three accounts and must show regulators a formal risk assessment with prioritized mitigations before launch. Threats include spoofed partner callbacks and tampered queue messages. Which risk assessment approach best identifies and mitigates these architecture-level threats?
• A bank builds a Bedrock support agent that calls payments APIs on behalf of users, must prove each agent action uses a short-lived scoped identity, enforce per-user consent, and audit which credential accessed each tool. Which access control design secures generative AI tool use?
• A healthcare company in three Regions and 40 accounts must retain audit trails of management actions, Bedrock model prompts and outputs, and configuration drift with centralized security findings. Which centralized logging design captures organization activity, AI invocations, and configuration compliance?
• A logistics company lets a Bedrock agent automatically reroute shipments, must pause before costly reroutes for manager approval via email with timeout and full audit trail, then resume or cancel safely. Which human oversight workflow enforces approval for AI operations?
• A healthcare holding company with 40 AWS accounts needs separate dev, test, and prod OUs, preventive guardrails on regions and encryption, and self-service account creation with approved baselines. Which organizational structure design meets these governance needs?
• A travel company launches a Bedrock chatbot that drafts itineraries and must block self-harm advice, mask passport numbers, and refuse restricted travel-document forgery topics with auditable interventions. Which generative AI compliance control design best enforces this content filtering requirement?
• A healthcare SaaS must prepare document signing and key exchange for quantum resistance. Policy requires NIST-approved lattices for signatures and key establishment, centrally managed keys, and crypto agility without self-built libraries. Which post-quantum cryptography strategy in AWS meets both uses?
• A company builds an agentic assistant that reads calendars, files tickets, and queries HR data on behalf of 5,000 employees. A shared service role with broad access failed least-privilege review and long-lived keys were found in code. Which access control design for agentic AI apps using AgentCore Identity enforces secure delegation?
• A fintech on AWS Organizations uses Bedrock models and needs centralized tamper-evident audit of management events, AI prompts and responses, plus aggregated misconfiguration detection across all accounts. Which centralized logging and configuration design meets these needs?
• An enterprise builds agentic AI support assistants that call CRM and billing APIs on behalf of users, requiring per-user scoping, short-lived credentials, and audit trails of agent actions. Which access control design best secures these agentic AI tool invocations?
• A media group with separate network and workload accounts must share a central VPC subnet, Route 53 zones, and transit connectivity without duplicating infrastructure. Which cross-account resource sharing design enables secure centralized networking?
• A growing enterprise now has 80 AWS accounts created manually with inconsistent baselines, no preventive guardrails, and slow procurement. Security demands centrally managed structure, policy enforcement, and fast compliant account vending. Which organizational design provides governed landing zone provisioning?
• A bank uses generative AI to draft commercial loan decisions, but regulators require a licensed officer to review and explicitly approve any adverse action before notification. Reviews must time out safely, retain audit trails, and prevent autonomous sending. Which human oversight workflow provides approval mechanisms for AI operations with AWS Step Functions?
• A 2,000-employee retailer uses Entra ID for corporate logins and Workday as HR source, and must give AWS console and CLI access with automatic joiner-mover-leaver provisioning and no long-term IAM users. Which identity federation design using standard protocols centralizes workforce access and lifecycle?
• A travel startup builds a mobile app with social sign-in, needs JWTs for APIs plus temporary scoped credentials for direct S3 photo uploads, and runs order jobs on EKS needing AWS API access without stored keys. Which application authentication design using Cognito and Pod Identity meets these needs?
• A 4,000-employee manufacturer uses Microsoft Entra ID as its identity source and operates 60 AWS accounts in Organizations. HR requires new hires to gain AWS access automatically, leavers to be deprovisioned within hours, and users to sign in once with existing credentials. Which identity federation design using standard protocols meets these lifecycle needs?
• A financial organization with 60 AWS accounts uses Amazon Bedrock and must centrally audit management events, Config changes, and Bedrock model invocations for regulators. It needs an organization-wide immutable trail with aggregated compliance views. Which governance control centralizes logging for this AI audit requirement?
• A retail organization uses AWS Organizations with 40 workload accounts and a shared services account hosting a central Transit Gateway and inspection VPC. Workload VPCs must use centralized egress and share a common product image catalog without copying AMIs. Which cross-account resource sharing design centralizes networking and catalog access?
• A bank deploys a Bedrock agent that drafts loan decisions from customer documents, but regulators require a licensed officer to review and approve any denial before notification. Reviews must pause automation, log decisions, and allow rework. Which human oversight workflow enforces approval for AI operations?
• A holding company with 60 AWS accounts must block S3 public access and unapproved Regions even when account owners grant access, including attempts by root. Developers still need flexibility within allowed guardrails. Which policy enforcement design correctly applies SCPs with RCPs for preventive governance?
• A platform team must let 12 member accounts use a central Transit Gateway and shared application subnets without creating VPC peering meshes or duplicating gateways. It must preserve centralized routing with least-privilege access. Which control enables governed cross-account sharing for this network?
• A manufacturing enterprise uses AWS Organizations with separate OUs for engineering, finance, and sandbox, and auditors require that no account can leave the organization, EC2 instances cannot reach the internet directly, and developers cannot launch unapproved regions even via resource policies. Which policy enforcement combination satisfies these guardrails across accounts?
• A fitness startup builds mobile and web apps requiring email and social sign-in, MFA, and temporary access to S3 photos plus personalized API calls. Backend services run on EKS and need scoped AWS permissions without static keys. Which application authentication design meets these needs?
• A bank operates 45 accounts under Organizations with strict CIS benchmarks. Auditors require continuous evidence of noncompliant S3, IAM, and KMS configurations with centralized findings and auto-remediation for public buckets. Which governance design provides automated compliance monitoring with Config and Security Hub?
• A freight company with 8,000 staff uses Okta for workforce login and just acquired a carrier using Microsoft Entra ID. Both groups need SSO to 40 AWS accounts with joiner-mover-leaver provisioning without managing IAM users. Which identity federation design centralizes AWS access with automated lifecycle management?
• A SaaS vendor needs temporary cross-account access to a client's audit bucket scoped to project Atlas, with MFA, no static keys, automatic expiry, and per-project isolation enforced by tags. Which least-privilege design using roles and conditions best meets these constraints?