1
AWS Certified Solutions Architect
– Associate (SAA-C03) – Advanced
Practice Exam v2.0 150 Multiple-
Choice Questions with Detailed
Rationales a well detailed one
written and graded
A+ upgraded
Domain 1: Design Secure Architectures (30% of Exam)
Question 1
A company is building a serverless application using AWS Lambda that needs to access secrets
stored in AWS Secrets Manager. The security team requires that the Lambda function have the
least privilege necessary and that access be auditable. What should a solutions architect do to
securely grant access?
, 2
A. Hardcode the secret ARN in the Lambda function code
B. Attach an IAM role to the Lambda function with a policy
granting secretsmanager:GetSecretValue for the specific secret
C. Store the secret in environment variables and encrypt them with KMS
D. Use AWS Systems Manager Parameter Store instead of Secrets Manager
-” detailed answer 100 % correct :-”B
Rationale: IAM roles with least privilege policies are the AWS best practice for granting Lambda
functions access to secrets. Hardcoding credentials (A) is insecure. Environment variables with
KMS (C) are less secure than Secrets Manager. Parameter Store (D) is an alternative but does not
address the requirement for least privilege auditing.
Question 2
A solutions architect is designing a VPC with public, private, and isolated subnets. The private
subnets host application servers that need to call Amazon S3 and Amazon DynamoDB APIs. The
company does not want any traffic to traverse the internet. What should the architect use to
enable this connectivity?
A. NAT Gateway in the public subnet
B. VPC gateway endpoints for S3 and DynamoDB
C. VPC interface endpoints for S3 and DynamoDB
D. Internet Gateway with route table entries
-” detailed answer 100 % correct :-”B
Rationale: VPC gateway endpoints provide private connectivity to S3 and DynamoDB without
traversing the internet. NAT Gateway (A) would route traffic through the internet. Interface
endpoints (C) are available but gateway endpoints are more cost-effective for S3 and
DynamoDB. Internet Gateway (D) would expose the VPC.
Question 3
A company uses AWS Organizations to manage multiple accounts. The security team wants to
enforce that all IAM users in the organization must have MFA enabled. Which approach should a
solutions architect recommend?
A. Create a service control policy (SCP) that denies IAM actions when MFA is not present
B. Create an IAM policy in each account requiring MFA
, 3
C. Use AWS Config to detect non-compliant users
D. Use AWS Trusted Advisor to check for MFA compliance
-” detailed answer 100 % correct :-”A
Rationale: SCPs in AWS Organizations can enforce MFA requirements across all member
accounts by denying actions when MFA is not present. IAM policies in each account (B) are
decentralized. AWS Config (C) detects issues but does not prevent them. Trusted Advisor (D)
only provides recommendations.
Question 4
A solutions architect is designing a system where EC2 instances in a private subnet need to
download security patches from the internet. The instances must not be accessible from the
internet. What should the architect configure?
A. An Internet Gateway attached to the VPC with a route table entry for the private subnet
B. A NAT Gateway in a public subnet with route table entries pointing to it for the private
subnets
C. An Elastic IP assigned to each EC2 instance
D. A VPC endpoint for the patch repository
-” detailed answer 100 % correct :-”B
Rationale: A NAT Gateway in a public subnet allows private instances to initiate outbound
internet connections while preventing inbound access. Internet Gateway (A) would expose
instances if attached to private subnets. Elastic IPs (C) would make instances publicly accessible.
VPC endpoints (D) only work for AWS services, not third-party patch repositories.
Question 5
A company wants to encrypt data stored in Amazon S3 using customer-provided encryption
keys. The keys must not be stored in AWS and must be provided with each API request. Which
S3 encryption option should a solutions architect recommend?
A. SSE-S3
B. SSE-KMS
C. SSE-C
D. Client-side encryption
, 4
-” detailed answer 100 % correct :-”C
Rationale: SSE-C allows customers to provide encryption keys with each request. Keys are not
stored in AWS. SSE-S3 (A) uses AWS-managed keys. SSE-KMS (B) uses keys stored in AWS KMS.
Client-side encryption (D) is performed before upload but does not use S3's server-side
encryption.
Question 6
A solutions architect is designing a system that uses Amazon RDS. The company requires that
database backups be encrypted at rest and be available for point-in-time recovery for 35 days.
What should the architect configure?
A. Enable automated backups with encryption enabled on the RDS instance
B. Enable manual snapshots with encryption
C. Use AWS Backup with continuous backups
D. Enable automated backups with default encryption
-” detailed answer 100 % correct :-”A
Rationale: RDS automated backups provide point-in-time recovery for up to 35 days. Encryption
must be enabled at the time of instance creation. Manual snapshots (B) do not provide point-in-
time recovery. AWS Backup (C) is a valid alternative but automated backups are the native RDS
solution. Default encryption (D) ensures encryption at rest.
Question 7
A company has a multi-account AWS environment and wants to centrally manage AWS WAF
rules across all accounts. Which AWS service should a solutions architect use?
A. AWS WAF
B. AWS Firewall Manager
C. AWS Shield Advanced
D. AWS Config
-” detailed answer 100 % correct :-”B
Rationale: AWS Firewall Manager centrally configures and manages AWS WAF rules across
accounts in AWS Organizations. AWS WAF (A) is for individual account management. Shield
Advanced (C) provides DDoS protection. Config (D) is for compliance monitoring.
AWS Certified Solutions Architect
– Associate (SAA-C03) – Advanced
Practice Exam v2.0 150 Multiple-
Choice Questions with Detailed
Rationales a well detailed one
written and graded
A+ upgraded
Domain 1: Design Secure Architectures (30% of Exam)
Question 1
A company is building a serverless application using AWS Lambda that needs to access secrets
stored in AWS Secrets Manager. The security team requires that the Lambda function have the
least privilege necessary and that access be auditable. What should a solutions architect do to
securely grant access?
, 2
A. Hardcode the secret ARN in the Lambda function code
B. Attach an IAM role to the Lambda function with a policy
granting secretsmanager:GetSecretValue for the specific secret
C. Store the secret in environment variables and encrypt them with KMS
D. Use AWS Systems Manager Parameter Store instead of Secrets Manager
-” detailed answer 100 % correct :-”B
Rationale: IAM roles with least privilege policies are the AWS best practice for granting Lambda
functions access to secrets. Hardcoding credentials (A) is insecure. Environment variables with
KMS (C) are less secure than Secrets Manager. Parameter Store (D) is an alternative but does not
address the requirement for least privilege auditing.
Question 2
A solutions architect is designing a VPC with public, private, and isolated subnets. The private
subnets host application servers that need to call Amazon S3 and Amazon DynamoDB APIs. The
company does not want any traffic to traverse the internet. What should the architect use to
enable this connectivity?
A. NAT Gateway in the public subnet
B. VPC gateway endpoints for S3 and DynamoDB
C. VPC interface endpoints for S3 and DynamoDB
D. Internet Gateway with route table entries
-” detailed answer 100 % correct :-”B
Rationale: VPC gateway endpoints provide private connectivity to S3 and DynamoDB without
traversing the internet. NAT Gateway (A) would route traffic through the internet. Interface
endpoints (C) are available but gateway endpoints are more cost-effective for S3 and
DynamoDB. Internet Gateway (D) would expose the VPC.
Question 3
A company uses AWS Organizations to manage multiple accounts. The security team wants to
enforce that all IAM users in the organization must have MFA enabled. Which approach should a
solutions architect recommend?
A. Create a service control policy (SCP) that denies IAM actions when MFA is not present
B. Create an IAM policy in each account requiring MFA
, 3
C. Use AWS Config to detect non-compliant users
D. Use AWS Trusted Advisor to check for MFA compliance
-” detailed answer 100 % correct :-”A
Rationale: SCPs in AWS Organizations can enforce MFA requirements across all member
accounts by denying actions when MFA is not present. IAM policies in each account (B) are
decentralized. AWS Config (C) detects issues but does not prevent them. Trusted Advisor (D)
only provides recommendations.
Question 4
A solutions architect is designing a system where EC2 instances in a private subnet need to
download security patches from the internet. The instances must not be accessible from the
internet. What should the architect configure?
A. An Internet Gateway attached to the VPC with a route table entry for the private subnet
B. A NAT Gateway in a public subnet with route table entries pointing to it for the private
subnets
C. An Elastic IP assigned to each EC2 instance
D. A VPC endpoint for the patch repository
-” detailed answer 100 % correct :-”B
Rationale: A NAT Gateway in a public subnet allows private instances to initiate outbound
internet connections while preventing inbound access. Internet Gateway (A) would expose
instances if attached to private subnets. Elastic IPs (C) would make instances publicly accessible.
VPC endpoints (D) only work for AWS services, not third-party patch repositories.
Question 5
A company wants to encrypt data stored in Amazon S3 using customer-provided encryption
keys. The keys must not be stored in AWS and must be provided with each API request. Which
S3 encryption option should a solutions architect recommend?
A. SSE-S3
B. SSE-KMS
C. SSE-C
D. Client-side encryption
, 4
-” detailed answer 100 % correct :-”C
Rationale: SSE-C allows customers to provide encryption keys with each request. Keys are not
stored in AWS. SSE-S3 (A) uses AWS-managed keys. SSE-KMS (B) uses keys stored in AWS KMS.
Client-side encryption (D) is performed before upload but does not use S3's server-side
encryption.
Question 6
A solutions architect is designing a system that uses Amazon RDS. The company requires that
database backups be encrypted at rest and be available for point-in-time recovery for 35 days.
What should the architect configure?
A. Enable automated backups with encryption enabled on the RDS instance
B. Enable manual snapshots with encryption
C. Use AWS Backup with continuous backups
D. Enable automated backups with default encryption
-” detailed answer 100 % correct :-”A
Rationale: RDS automated backups provide point-in-time recovery for up to 35 days. Encryption
must be enabled at the time of instance creation. Manual snapshots (B) do not provide point-in-
time recovery. AWS Backup (C) is a valid alternative but automated backups are the native RDS
solution. Default encryption (D) ensures encryption at rest.
Question 7
A company has a multi-account AWS environment and wants to centrally manage AWS WAF
rules across all accounts. Which AWS service should a solutions architect use?
A. AWS WAF
B. AWS Firewall Manager
C. AWS Shield Advanced
D. AWS Config
-” detailed answer 100 % correct :-”B
Rationale: AWS Firewall Manager centrally configures and manages AWS WAF rules across
accounts in AWS Organizations. AWS WAF (A) is for individual account management. Shield
Advanced (C) provides DDoS protection. Config (D) is for compliance monitoring.
