AWS Certified Solutions Architect –
Associate (SAA-C03) – 2026/2027 –
Questions & Verified Answers with
Rationales – Grade A+
Chapter 1: Design Secure Architectures (Questions 1–60)
Question 1
A company stores sensitive customer data in an Amazon S3 bucket. The security
team requires that the company manage its own encryption keys and that all data
be encrypted at rest and in transit. Which solution meets these requirements?
A. Use S3 with SSE-S3 and enforce HTTPS.
B. Use S3 with SSE-KMS using customer-managed keys and enforce HTTPS.
C. Use S3 with SSE-C and allow HTTP for internal traffic.
D. Use client-side encryption only and store keys in the application.
Correct Answer: B
Rationale: SSE-KMS with customer-managed keys (CMKs) allows the
company to control key rotation, policies, and audit trails via AWS KMS, satisfying
the requirement to manage its own keys. HTTPS enforces encryption in transit.
SSE-S3 uses AWS-managed keys, so the company does not manage them. SSE-C
requires the customer to provide keys on every request and does not address
transit encryption. Client-side encryption alone does not cover transit.
Question 2
An application running on Amazon EC2 instances needs to access an Amazon
DynamoDB table. The security team mandates that no long-term credentials be
stored on the instances. Which approach should a solutions architect
recommend?
,A. Store IAM access keys in environment variables on each instance.
B. Attach an IAM role to the EC2 instances with permissions to the DynamoDB
table.
C. Store credentials in AWS Secrets Manager and retrieve them at startup.
D. Embed credentials in the application code and rotate them weekly.
Correct Answer: B
Rationale: IAM roles for EC2 provide temporary credentials that
automatically rotate through the instance metadata service (IMDS). This is the
AWS best practice for granting AWS service permissions to EC2 workloads.
Environment variables, Secrets Manager, and embedded code all involve
long-term credentials or additional management overhead that the security team
wants to avoid.
Question 3
A company wants to allow its employees to access AWS resources using their
existing corporate Active Directory credentials. Different AD groups should map
to different AWS permission sets. Which solution meets these requirements with
the LEAST operational overhead?
A. Create IAM users for each employee and assign permissions manually.
B. Use AWS IAM Identity Center with Active Directory integration.
C. Share IAM access keys with AD administrators.
D. Use Amazon Cognito User Pools for employee federation.
Correct Answer: B
Rationale: AWS IAM Identity Center (formerly AWS SSO) integrates with
Active Directory (via AD Connector or AWS Directory Service) and allows mapping
AD groups to AWS permission sets. This eliminates the need to create and
manage individual IAM users. Cognito is designed for customer-facing identity,
not employee federation. Sharing access keys is a security anti-pattern.
Question 4
A web application behind an Application Load Balancer (ALB) must be protected
,against SQL injection and cross-site scripting (XSS). Which AWS service should be
deployed?
A. Security Groups with restrictive inbound rules.
B. AWS WAF with managed rule groups attached to the ALB.
C. AWS Shield Standard.
D. Network ACLs with deny rules for malicious IPs.
Correct Answer: B
Rationale: AWS WAF operates at Layer 7 and can inspect HTTP/HTTPS
requests for SQL injection, XSS, and other application-layer attacks. Managed rule
groups provide pre-configured protections. Security Groups and NACLs operate at
Layers 3/4 and cannot inspect application payloads. Shield protects against DDoS,
not application-layer exploits.
Question 5
A solutions architect needs to design a strategy for storing database credentials
used by an application running on Amazon EC2. The credentials must be
automatically rotated every 30 days. Which service should be used?
A. AWS Systems Manager Parameter Store (Standard).
B. AWS Secrets Manager.
C. IAM role attached to the EC2 instance.
D. Encrypted environment variables in the launch template.
Correct Answer: B
Rationale: AWS Secrets Manager natively supports automatic rotation of
database credentials using Lambda rotation functions. Parameter Store
(Standard) does not provide built-in rotation. An IAM role provides temporary
credentials for AWS APIs but does not store database passwords. Encrypted
environment variables are static and not rotated automatically.
Question 6 (SATA)
A company is designing a multi-account AWS environment. Which two measures
, should be implemented to enforce security guardrails across all accounts? (Select
TWO.)
A. Enable AWS CloudTrail in every account and aggregate logs to a central S3
bucket.
B. Use Service Control Policies (SCPs) in AWS Organizations.
C. Configure individual IAM users in each account with administrator access.
D. Use AWS Config rules to detect non-compliant resources.
E. Store root account credentials in a shared password manager.
Correct Answers: B, D
Rationale: SCPs provide permission guardrails that apply to all accounts in
an organization, preventing actions that violate security policy. AWS Config rules
continuously assess resource compliance and can trigger remediation. CloudTrail
is for auditing, not enforcement. Individual admin users violate least privilege.
Sharing root credentials is unsafe.
Question 7
An application must encrypt data at rest in Amazon EBS volumes. The security
team requires that the encryption keys be rotated annually and that key usage be
auditable. Which solution meets these requirements?
A. Use EBS encryption with the default AWS-managed key.
B. Use EBS encryption with a customer-managed KMS key with automatic rotation
enabled.
C. Use application-level encryption before writing to EBS.
D. Use EBS encryption with a custom key stored on the instance.
Correct Answer: B
Rationale: Customer-managed KMS keys support automatic annual
rotation and provide CloudTrail audit logs for key usage. AWS-managed keys
rotate automatically but cannot be audited or controlled by the customer.
Application-level encryption does not encrypt the entire volume. Storing keys on
the instance is insecure.
Associate (SAA-C03) – 2026/2027 –
Questions & Verified Answers with
Rationales – Grade A+
Chapter 1: Design Secure Architectures (Questions 1–60)
Question 1
A company stores sensitive customer data in an Amazon S3 bucket. The security
team requires that the company manage its own encryption keys and that all data
be encrypted at rest and in transit. Which solution meets these requirements?
A. Use S3 with SSE-S3 and enforce HTTPS.
B. Use S3 with SSE-KMS using customer-managed keys and enforce HTTPS.
C. Use S3 with SSE-C and allow HTTP for internal traffic.
D. Use client-side encryption only and store keys in the application.
Correct Answer: B
Rationale: SSE-KMS with customer-managed keys (CMKs) allows the
company to control key rotation, policies, and audit trails via AWS KMS, satisfying
the requirement to manage its own keys. HTTPS enforces encryption in transit.
SSE-S3 uses AWS-managed keys, so the company does not manage them. SSE-C
requires the customer to provide keys on every request and does not address
transit encryption. Client-side encryption alone does not cover transit.
Question 2
An application running on Amazon EC2 instances needs to access an Amazon
DynamoDB table. The security team mandates that no long-term credentials be
stored on the instances. Which approach should a solutions architect
recommend?
,A. Store IAM access keys in environment variables on each instance.
B. Attach an IAM role to the EC2 instances with permissions to the DynamoDB
table.
C. Store credentials in AWS Secrets Manager and retrieve them at startup.
D. Embed credentials in the application code and rotate them weekly.
Correct Answer: B
Rationale: IAM roles for EC2 provide temporary credentials that
automatically rotate through the instance metadata service (IMDS). This is the
AWS best practice for granting AWS service permissions to EC2 workloads.
Environment variables, Secrets Manager, and embedded code all involve
long-term credentials or additional management overhead that the security team
wants to avoid.
Question 3
A company wants to allow its employees to access AWS resources using their
existing corporate Active Directory credentials. Different AD groups should map
to different AWS permission sets. Which solution meets these requirements with
the LEAST operational overhead?
A. Create IAM users for each employee and assign permissions manually.
B. Use AWS IAM Identity Center with Active Directory integration.
C. Share IAM access keys with AD administrators.
D. Use Amazon Cognito User Pools for employee federation.
Correct Answer: B
Rationale: AWS IAM Identity Center (formerly AWS SSO) integrates with
Active Directory (via AD Connector or AWS Directory Service) and allows mapping
AD groups to AWS permission sets. This eliminates the need to create and
manage individual IAM users. Cognito is designed for customer-facing identity,
not employee federation. Sharing access keys is a security anti-pattern.
Question 4
A web application behind an Application Load Balancer (ALB) must be protected
,against SQL injection and cross-site scripting (XSS). Which AWS service should be
deployed?
A. Security Groups with restrictive inbound rules.
B. AWS WAF with managed rule groups attached to the ALB.
C. AWS Shield Standard.
D. Network ACLs with deny rules for malicious IPs.
Correct Answer: B
Rationale: AWS WAF operates at Layer 7 and can inspect HTTP/HTTPS
requests for SQL injection, XSS, and other application-layer attacks. Managed rule
groups provide pre-configured protections. Security Groups and NACLs operate at
Layers 3/4 and cannot inspect application payloads. Shield protects against DDoS,
not application-layer exploits.
Question 5
A solutions architect needs to design a strategy for storing database credentials
used by an application running on Amazon EC2. The credentials must be
automatically rotated every 30 days. Which service should be used?
A. AWS Systems Manager Parameter Store (Standard).
B. AWS Secrets Manager.
C. IAM role attached to the EC2 instance.
D. Encrypted environment variables in the launch template.
Correct Answer: B
Rationale: AWS Secrets Manager natively supports automatic rotation of
database credentials using Lambda rotation functions. Parameter Store
(Standard) does not provide built-in rotation. An IAM role provides temporary
credentials for AWS APIs but does not store database passwords. Encrypted
environment variables are static and not rotated automatically.
Question 6 (SATA)
A company is designing a multi-account AWS environment. Which two measures
, should be implemented to enforce security guardrails across all accounts? (Select
TWO.)
A. Enable AWS CloudTrail in every account and aggregate logs to a central S3
bucket.
B. Use Service Control Policies (SCPs) in AWS Organizations.
C. Configure individual IAM users in each account with administrator access.
D. Use AWS Config rules to detect non-compliant resources.
E. Store root account credentials in a shared password manager.
Correct Answers: B, D
Rationale: SCPs provide permission guardrails that apply to all accounts in
an organization, preventing actions that violate security policy. AWS Config rules
continuously assess resource compliance and can trigger remediation. CloudTrail
is for auditing, not enforcement. Individual admin users violate least privilege.
Sharing root credentials is unsafe.
Question 7
An application must encrypt data at rest in Amazon EBS volumes. The security
team requires that the encryption keys be rotated annually and that key usage be
auditable. Which solution meets these requirements?
A. Use EBS encryption with the default AWS-managed key.
B. Use EBS encryption with a customer-managed KMS key with automatic rotation
enabled.
C. Use application-level encryption before writing to EBS.
D. Use EBS encryption with a custom key stored on the instance.
Correct Answer: B
Rationale: Customer-managed KMS keys support automatic annual
rotation and provide CloudTrail audit logs for key usage. AWS-managed keys
rotate automatically but cannot be audited or controlled by the customer.
Application-level encryption does not encrypt the entire volume. Storing keys on
the instance is insecure.
