SAA_C03_AND_SAA_C01_COMPREHENSIVE_EXAMINATION_TEST_2026_VERIFIED

SAA C03 AND SAA C01 COMPREHENSIVE
EXAMINATION TEST 2026 VERIFIED
QUESTIONS AND ANSWERS GRADED A+

●● Network Firewall. Answer: Placement Level: Subnet Level
(Endpoints)
Layers 3-7: protocols, IPs, Ports


Associated Resources:
VPC Subnets: You create a dedicated "Firewall Subnet" and place a
Firewall Endpoint inside it. You then update your VPC Route Tables to
force traffic through that endpoint.


This is a managed VPC-level firewall. It is designed to inspect traffic
moving "East-West" (between subnets) or "North-South"
(entering/leaving the VPC)


●● NACL (firewall). Answer: Placement Level: Subnet
Layer 4: IP and Port Only


Associated Resources:

, Subnets: A NACL is associated with one or more subnets within a VPC.
Any resource (EC2, RDS, Lambda) living in that subnet is subject to the
NACL rules.


NACLs are the "guard at the gate" for a network segment. They are
stateless, meaning they don't remember connection context.


●● Security Groups (firewall). Answer: Placement Level:
Resource/Instance Level via ENI
Layer 4: IP and Port Only


Associated Resources:
EC2 Instances
RDS Databases
Lambda Functions (when configured for VPC access)
Elastic Load Balancers (ALB/NLB)
Redshift Clusters


Security Groups are "virtual firewalls" that act at the Resource/Network
Interface (ENI) level. They are stateful (if you allow inbound, outbound
is automatically allowed).


●● Shield Standard (DDOS protection service). Answer: Placement
Level: Edge and Network levels (background)