SAA-C03 · AWS · Design Secure Architectures · Bank updated 2026-09-20
SAA-C03 practice questions: Design Secure Architectures
5 free questions from 22 on this area · answer and explanation for each · no sign-up
These 5 questions come from the Design Secure Architectures section of our SAA-C03 bank (22 questions on this area, which carries 30% of the real exam). Every question is original, with the correct answer explained and linked to the source it is drawn from.
1/5 · Design Secure Architectures · easy
Before a privacy audit, a company must produce an inventory of which of its 3,000 Amazon S3 buckets hold customer personally identifiable information such as names, addresses, and payment card numbers. The team has no capacity to build and maintain its own scanning pipeline. Which AWS service should the company use?
AEnable Amazon Macie for the account and review the findings that it produces for each of the buckets.
BEnable Amazon GuardDuty with S3 Protection and review the findings that it produces for each of the buckets.
CEnable AWS Config with its managed Amazon S3 rules and review the findings that it produces for each bucket.
DEnable Amazon Inspector for the account and review the findings that it produces for each of the buckets.
Show answer & explanation
A is correct. Task Statement 1.3 covers data retention and classification. The Amazon Macie User Guide describes Macie as 'a data security service that discovers sensitive data by using machine learning and pattern matching', provides an inventory of S3 general purpose buckets, and generates a finding when it detects sensitive data in an object. GuardDuty, AWS Config, and Amazon Inspector each answer a different question: threat activity, resource configuration, and software vulnerabilities.
↗ AWS SAA-C03 Exam Guide — Domain 1: Design Secure Architectures
2/5 · Design Secure Architectures
A central logging account owns an Amazon S3 bucket whose default encryption uses a customer managed AWS KMS key in that same account. Applications in 12 other accounts assume roles that already allow s3:PutObject on the bucket and kms:GenerateDataKey on the key ARN, and the bucket policy already allows those role ARNs. Every upload fails with an access denied error, and auditors require that the objects stay encrypted with that customer managed key. Which solution will meet these requirements?
AIn the logging account, create an identity-based policy that allows kms:GenerateDataKey and kms:Decrypt on the key and attach it to the 12 application roles.
BIn the logging account, update the KMS key policy to allow the 12 application role ARNs to call kms:GenerateDataKey and kms:Decrypt on that key.
CChange the bucket's default encryption to server-side encryption with Amazon S3 managed keys and keep the existing bucket policy for the 12 application roles.
DHave each of the 12 application accounts call the AWS KMS CreateGrant operation on the logging account's key for the data key permissions their roles need.
Show answer & explanation
B is correct. Task Statement 1.1 covers determining the appropriate use of resource policies for AWS services. The AWS KMS Developer Guide section on key policies states that every KMS key must have exactly one key policy and that IAM policies alone cannot allow access to a KMS key unless the key policy permits it. Cross-account use of an SSE-KMS bucket therefore needs the key policy in the key's account to name the external principals, in addition to their own identity-based policies.
↗ AWS SAA-C03 Exam Guide — Domain 1: Design Secure Architectures
3/5 · Design Secure Architectures
A hospital copies about 400 GB of imaging studies from its data center into AWS every night inside a four-hour window. A pilot that sent the data over the existing AWS Site-to-Site VPN missed the window on most nights because throughput varied with internet conditions. The hospital requires a connection that does not traverse the public internet and delivers consistent bandwidth every night. Which solution will meet these requirements?
ACreate several AWS Site-to-Site VPN connections to an AWS Transit Gateway and spread the nightly copy over the tunnels with equal-cost multi-path routing.
BAsk an AWS Direct Connect Partner to provision a 100 Mbps hosted connection from the hospital's data center to the Region and send the nightly copy over it.
COrder a 1 Gbps dedicated AWS Direct Connect connection between the hospital's data center and the Region, and keep the Site-to-Site VPN configured as a backup path.
DEnable Amazon S3 Transfer Acceleration on the destination bucket and upload the studies to it each night from the data center.
Show answer & explanation
C is correct. Task Statement 1.2 covers securing external network connections to and from the AWS Cloud with VPN and AWS Direct Connect. The AWS Direct Connect User Guide topic on dedicated and hosted connections defines a dedicated connection as 'A physical Ethernet connection associated with a single customer' and a hosted connection as 'A physical Ethernet connection that an AWS Direct Connect Partner provisions on behalf of a customer', with hosted port speeds of '50 Mbps, 100 Mbps, 200 Mbps, 300 Mbps, 400 Mbps, 500 Mbps, 1 Gbps, 2 Gbps, 5 Gbps, 10 Gbps, and 25 Gbps'. Direct Connect bypasses internet service providers in the network path; Site-to-Site VPN establishes IPsec tunnels over the internet. Sizing is the second half of the decision: the link has to carry the nightly volume inside the window.
↗ AWS SAA-C03 Exam Guide — Domain 1: Design Secure Architectures
4/5 · Design Secure Architectures
After an incident in which a developer made a bucket world-readable, a company must guarantee that no Amazon S3 bucket in any of its 45 member accounts can be exposed publicly, including buckets created next month and including changes that an account administrator attempts. Which solution will meet these requirements?
ARun a scheduled script that enumerates every bucket in every account each week and applies the four S3 Block Public Access settings to any bucket where they are missing.
BAttach a bucket policy to every bucket that denies all Amazon S3 actions when the aws:PrincipalOrgID condition key does not match the organization ID.
CTurn on account-level S3 Block Public Access in every member account and attach a service control policy that denies the API calls that change those settings.
DDeploy an AWS Config managed rule for public bucket access in each account together with an automatic remediation action for the buckets it evaluates.
Show answer & explanation
C is correct. Task Statement 1.3 covers implementing policies for data access and protection. The Amazon S3 User Guide states that users can modify bucket policies or object permissions to allow public access and that 'S3 Block Public Access settings override these policies and permissions', and that the settings can be managed at the organization, account, bucket, and access point levels. Pairing the account setting with an SCP prevents a member account administrator from removing it.
↗ AWS SAA-C03 Exam Guide — Domain 1: Design Secure Architectures
5/5 · Design Secure Architectures · hard
Engineers reach Amazon EC2 instances in private subnets by first connecting over SSH to a bastion host in a public subnet whose security group allows the corporate address range. The team patches and monitors that host and stores its SSH keys in a password manager. Security wants to remove the internet-facing host while preserving interactive shell access to the private instances and an auditable record of who connected. Which solution will meet these requirements with the LEAST operational overhead?
AGive the private instances a Systems Manager instance profile and interface VPC endpoints for Systems Manager, use Session Manager for shell access, and delete the bastion host.
BMove the bastion host into a private subnet, reach it through an AWS Site-to-Site VPN from the corporate network, and store its SSH host keys in AWS Secrets Manager.
CDelete the bastion host, deploy a NAT gateway in the public subnets, and allow inbound SSH from the corporate address range in the private instances' security groups.
DPlace the bastion host behind an internet-facing Network Load Balancer, restrict the listener with a network ACL on the public subnets, and rotate the host's SSH keys weekly.
Show answer & explanation
A is correct. Task Statement 1.2 covers network segmentation strategies and secure application access. AWS Systems Manager Session Manager provides browser-based or CLI shell access to managed instances without opening inbound ports or running bastion hosts, and interface VPC endpoints for the ssm, ssmmessages, and ec2messages services let instances in private subnets reach Systems Manager without a NAT device. Session history is recorded through CloudTrail and optional session logging.
↗ AWS SAA-C03 Exam Guide — Domain 1: Design Secure Architectures
Other SAA-C03 areas
The same kind of free sample for every other section of the SAA-C03 bank:
Study Design Secure Architectures with instant feedback
6 free questions · filter study mode by area and difficulty · error log with spaced repetition · no card, no dumps, no ads.
Create your free account →
ExamDeck is an independent study tool, not affiliated with, endorsed by, or sponsored by AWS. SAA-C03 and related marks are trademarks of their respective owners, used for identification only. Exam facts checked against official AWS materials (as of September 2026); always confirm current details with the vendor before booking.