AWS CERTIFIED SOLUTIONS ARCHITECT – ASSOCIATE (SAA-C03) –
EXAM QUESTIONS AND CORRECT ANSWERS (VERIFIED ANSWERS)
PLUS RATIONALE | 2027 Q&A | INSTANT DOWNLOAD PDF
1. A company is designing its first AWS environment and wants to ensure that the
AWS account root user cannot be used without an additional authentication
factor. Which security control should be implemented?
A. Create an IAM user with AdministratorAccess
B. Enable multi-factor authentication (MFA) for the root user
C. Create an Amazon Cognito user pool
D. Configure an S3 bucket policy requiring encryption
Rationale: MFA adds an additional authentication factor to the root user and is a fundamental
AWS security control. IAM users, Cognito, and S3 policies address different security
requirements and do not replace MFA protection for the root account.
2. A company has several AWS accounts under AWS Organizations. The security
team wants to prevent member accounts from disabling certain security services,
even if an administrator in a member account attempts to do so. Which
mechanism should the architect consider?
A. IAM user groups
B. Amazon Cognito
C. Service control policies (SCPs)
D. S3 bucket ACLs
Rationale: SCPs establish permission guardrails across accounts in AWS Organizations. They
do not grant permissions by themselves, but they can limit the maximum permissions available to
identities in member accounts.
3. An application running on Amazon EC2 needs to read objects from a specific S3
bucket. The organization does not want long-term AWS access keys stored on
the server.
A. Attach an IAM role to the EC2 instance
B. Store an IAM access key in the application's source code
C. Create a root-user access key
D. Store permanent credentials in an S3 object
Rationale: An IAM role provides temporary credentials to applications running on EC2 through
the instance metadata service. This avoids distributing long-term access keys and supports least-
privilege permissions.
, 4. A company wants employees to access multiple AWS accounts using their
existing corporate identities. Employees should not need separate IAM users in
each AWS account.
A. Create identical IAM users in every account
B. Create one root user for all employees
C. Use S3 bucket policies for authentication
D. Use AWS IAM Identity Center with federated identities
Rationale: IAM Identity Center supports centralized workforce access and can integrate with an
organization's identity provider. Users can receive appropriate access to multiple AWS accounts
without maintaining separate IAM users in every account.
5. A developer needs permission to read objects only from finance-reports in
Amazon S3. The developer does not need access to other S3 buckets.
A. Attach AdministratorAccess
B. Create a policy granting only the required S3 read actions on the required resources
C. Grant AmazonS3FullAccess
D. Use the AWS account root user
Rationale: Least privilege requires granting only the permissions and resources necessary for
the task. Broad administrative or full S3 permissions exceed the stated requirement.
6. An application stores database credentials in configuration files on several EC2
instances. The security team wants centralized management of these credentials
and the ability to rotate them.
A. Amazon CloudFront
B. Amazon SQS
C. AWS Secrets Manager
D. Amazon Route 53
Rationale: AWS Secrets Manager is designed to securely store, retrieve, and manage sensitive
credentials and supports automated secret rotation for supported services.
7. A public web application is experiencing malicious HTTP requests containing
common SQL injection patterns. The company wants to filter these requests
before they reach the application.
A. AWS CloudTrail
B. Amazon GuardDuty
C. AWS Config
D. AWS WAF
, Rationale: AWS WAF evaluates web requests against configured rules and can help block
common web exploits such as SQL injection. CloudTrail and Config provide governance and
auditing functions rather than web request filtering.
8. An organization wants to detect potentially malicious activity across AWS
accounts, including suspicious API behavior and unusual access patterns.
A. Amazon GuardDuty
B. Amazon GuardDuty
C. Amazon Inspector
D. AWS Artifact
Rationale: Amazon GuardDuty is a threat detection service that analyzes relevant AWS activity
and data sources to identify potential security threats. Amazon Inspector focuses primarily on
vulnerability management, while Artifact provides compliance-related documents.
9. A company needs to encrypt sensitive data stored in Amazon S3 and wants
centralized control over encryption keys and key policies.
A. Amazon Route 53
B. AWS Shield
C. AWS Key Management Service (AWS KMS)
D. Amazon CloudFront
Rationale: AWS KMS provides managed cryptographic keys and access policies that can be
integrated with services such as Amazon S3. It enables centralized control over encryption key
usage.
10. A company needs to ensure that data transferred between users and its HTTPS
application is encrypted in transit. The company wants AWS-managed certificate
provisioning and renewal.
A. AWS KMS
B. AWS Secrets Manager
C. Amazon Macie
D. AWS Certificate Manager (ACM)
Rationale: AWS Certificate Manager can provision and manage TLS certificates for supported
AWS services. TLS certificates protect data transmitted over HTTPS.
11. A company has a three-tier application. The web servers must be reachable from
the internet, but the application servers should not accept direct internet traffic.
The database should also remain inaccessible from the internet.
A. Place all servers in one public subnet
B. Use public subnets for the web tier and private subnets for the application and database
EXAM QUESTIONS AND CORRECT ANSWERS (VERIFIED ANSWERS)
PLUS RATIONALE | 2027 Q&A | INSTANT DOWNLOAD PDF
1. A company is designing its first AWS environment and wants to ensure that the
AWS account root user cannot be used without an additional authentication
factor. Which security control should be implemented?
A. Create an IAM user with AdministratorAccess
B. Enable multi-factor authentication (MFA) for the root user
C. Create an Amazon Cognito user pool
D. Configure an S3 bucket policy requiring encryption
Rationale: MFA adds an additional authentication factor to the root user and is a fundamental
AWS security control. IAM users, Cognito, and S3 policies address different security
requirements and do not replace MFA protection for the root account.
2. A company has several AWS accounts under AWS Organizations. The security
team wants to prevent member accounts from disabling certain security services,
even if an administrator in a member account attempts to do so. Which
mechanism should the architect consider?
A. IAM user groups
B. Amazon Cognito
C. Service control policies (SCPs)
D. S3 bucket ACLs
Rationale: SCPs establish permission guardrails across accounts in AWS Organizations. They
do not grant permissions by themselves, but they can limit the maximum permissions available to
identities in member accounts.
3. An application running on Amazon EC2 needs to read objects from a specific S3
bucket. The organization does not want long-term AWS access keys stored on
the server.
A. Attach an IAM role to the EC2 instance
B. Store an IAM access key in the application's source code
C. Create a root-user access key
D. Store permanent credentials in an S3 object
Rationale: An IAM role provides temporary credentials to applications running on EC2 through
the instance metadata service. This avoids distributing long-term access keys and supports least-
privilege permissions.
, 4. A company wants employees to access multiple AWS accounts using their
existing corporate identities. Employees should not need separate IAM users in
each AWS account.
A. Create identical IAM users in every account
B. Create one root user for all employees
C. Use S3 bucket policies for authentication
D. Use AWS IAM Identity Center with federated identities
Rationale: IAM Identity Center supports centralized workforce access and can integrate with an
organization's identity provider. Users can receive appropriate access to multiple AWS accounts
without maintaining separate IAM users in every account.
5. A developer needs permission to read objects only from finance-reports in
Amazon S3. The developer does not need access to other S3 buckets.
A. Attach AdministratorAccess
B. Create a policy granting only the required S3 read actions on the required resources
C. Grant AmazonS3FullAccess
D. Use the AWS account root user
Rationale: Least privilege requires granting only the permissions and resources necessary for
the task. Broad administrative or full S3 permissions exceed the stated requirement.
6. An application stores database credentials in configuration files on several EC2
instances. The security team wants centralized management of these credentials
and the ability to rotate them.
A. Amazon CloudFront
B. Amazon SQS
C. AWS Secrets Manager
D. Amazon Route 53
Rationale: AWS Secrets Manager is designed to securely store, retrieve, and manage sensitive
credentials and supports automated secret rotation for supported services.
7. A public web application is experiencing malicious HTTP requests containing
common SQL injection patterns. The company wants to filter these requests
before they reach the application.
A. AWS CloudTrail
B. Amazon GuardDuty
C. AWS Config
D. AWS WAF
, Rationale: AWS WAF evaluates web requests against configured rules and can help block
common web exploits such as SQL injection. CloudTrail and Config provide governance and
auditing functions rather than web request filtering.
8. An organization wants to detect potentially malicious activity across AWS
accounts, including suspicious API behavior and unusual access patterns.
A. Amazon GuardDuty
B. Amazon GuardDuty
C. Amazon Inspector
D. AWS Artifact
Rationale: Amazon GuardDuty is a threat detection service that analyzes relevant AWS activity
and data sources to identify potential security threats. Amazon Inspector focuses primarily on
vulnerability management, while Artifact provides compliance-related documents.
9. A company needs to encrypt sensitive data stored in Amazon S3 and wants
centralized control over encryption keys and key policies.
A. Amazon Route 53
B. AWS Shield
C. AWS Key Management Service (AWS KMS)
D. Amazon CloudFront
Rationale: AWS KMS provides managed cryptographic keys and access policies that can be
integrated with services such as Amazon S3. It enables centralized control over encryption key
usage.
10. A company needs to ensure that data transferred between users and its HTTPS
application is encrypted in transit. The company wants AWS-managed certificate
provisioning and renewal.
A. AWS KMS
B. AWS Secrets Manager
C. Amazon Macie
D. AWS Certificate Manager (ACM)
Rationale: AWS Certificate Manager can provision and manage TLS certificates for supported
AWS services. TLS certificates protect data transmitted over HTTPS.
11. A company has a three-tier application. The web servers must be reachable from
the internet, but the application servers should not accept direct internet traffic.
The database should also remain inaccessible from the internet.
A. Place all servers in one public subnet
B. Use public subnets for the web tier and private subnets for the application and database
