SAA-C03 · AWS · Design Secure Architectures · Bank updated 2026-11-04
SAA-C03 practice questions: Design Secure Architectures
5 free questions from 47 on this area · answer and explanation for each · no sign-up
These 5 questions come from the Design Secure Architectures section of our SAA-C03 bank (47 questions on this area, which carries 30% of the real exam). Every question is original, with the correct answer explained and linked to the source it is drawn from.
Free: 6 questions in study mode, no card. All 47 Design Secure Architectures questions and the full SAA-C03 bank: $15 one-time.
1/5 · Design Secure Architectures · easy
Before a privacy audit, a company must produce an inventory of which of its 3,000 Amazon S3 buckets hold customer personally identifiable information such as names, addresses, and payment card numbers. The team has no capacity to build and maintain its own scanning pipeline. Which AWS service should the company use?
AEnable Amazon Macie for the account and review the findings that it produces for each of the buckets.
BEnable Amazon GuardDuty with S3 Protection and review the findings that it produces for each of the buckets.
CEnable AWS Config with its managed Amazon S3 rules and review the findings that it produces for each bucket.
DEnable Amazon Inspector for the account and review the findings that it produces for each of the buckets.
Answer: A. Task Statement 1.3 covers data retention and classification. The Amazon Macie User Guide describes Macie as 'a data security service that discovers sensitive data by using machine learning and pattern matching', provides an inventory of S3 general purpose buckets, and generates a finding when it detects sensitive data in an object. GuardDuty, AWS Config, and Amazon Inspector each answer a different question: threat activity, resource configuration, and software vulnerabilities.
Source: AWS SAA-C03 Exam Guide - Domain 1: Design Secure Architectures
2/5 · Design Secure Architectures
An auditor requires evidence that the key material protecting objects in an Amazon S3 bucket is rotated on a yearly cycle. The bucket uses server-side encryption with a customer managed symmetric AWS KMS key, it holds several petabytes of objects, and the team must not re-encrypt existing objects or change the applications that read them. Which solution will meet these requirements?
ACreate a new customer managed key once a year and run an S3 Batch Operations copy job to re-encrypt the objects.
BImport new key material into the existing KMS key once a year and delete the previous key material from the key.
CChange the bucket's default encryption to dual-layer server-side encryption with AWS KMS keys for new objects.
DEnable automatic rotation on the existing customer managed KMS key and keep the default yearly rotation period.
Answer: D. Task Statement 1.3 names rotating encryption keys. The AWS KMS Developer Guide states that key rotation 'changes only the current key material', that AWS KMS 'uses the key material that was used to encrypt it' when decrypting, and that the KMS key 'is the same logical resource, regardless of whether or how many times its key material changes', so rotated keys work in applications and AWS services without code changes. The default rotation period is 365 days.
Source: AWS SAA-C03 Exam Guide - Domain 1: Design Secure Architectures
3/5 · Design Secure Architectures · hard
A company protects Amazon RDS databases and Amazon EBS volumes in a production account that belongs to an organization in AWS Organizations. Its threat model now includes an attacker who obtains administrative credentials and tries to destroy the backups before encrypting the live data. Recovery points must survive that scenario, and no principal in the organization may shorten their retention or delete them before it expires. Which solution will meet these requirements?
AUse AWS Backup to copy the recovery points into a backup vault in a separate account in the organization, and apply AWS Backup Vault Lock in compliance mode to that vault.
BUse AWS Backup to copy the recovery points into a backup vault in a separate account in the organization, and apply AWS Backup Vault Lock in governance mode to that vault.
CUse AWS Backup in the production account to copy the recovery points into a backup vault in a second AWS Region, and attach a policy to that vault that denies delete actions to the account's principals.
DExport the database contents and the volume contents nightly to an Amazon S3 bucket in the production account that has versioning turned on and a lifecycle rule that retains noncurrent versions.
Answer: A. Task Statement 1.3 covers implementing data backups and replications and data recovery. The AWS Backup Developer Guide states that AWS Backup Vault Lock enforces a write-once-read-many model, that 'A vault locked in Governance mode can be managed or deleted by users who have the appropriate' permissions while 'A vault lock in Compliance mode cannot be altered or deleted by any user or by AWS', and that recovery points can be copied to other accounts inside an AWS Organizations structure. Both halves of the answer matter: the copy leaves the compromised account, and the lock mode decides whether an administrator elsewhere can still undo the retention.
Source: AWS SAA-C03 Exam Guide - Domain 1: Design Secure Architectures
4/5 · Design Secure Architectures
A data lake writes and reads hundreds of millions of objects a month in a bucket whose default encryption is server-side encryption with a customer managed AWS KMS key. The AWS KMS request charge now exceeds the Amazon S3 storage charge for that bucket. A compliance rule keeps the customer managed key in place. Which change should the team make?
ATurn on an S3 Bucket Key for the whole bucket
BSwitch the bucket's default encryption to SSE-S3
CRequest a higher AWS KMS request rate quota
DCreate one customer managed key for each prefix
Answer: A. Task Statement 1.3 covers encrypting data at rest with AWS KMS and encryption key management. The Amazon S3 User Guide's S3 Bucket Keys topic states that bucket keys 'reduce the cost of Amazon S3 server-side encryption with AWS Key Management Service (AWS KMS) keys (SSE-KMS)' and that 'using a bucket-level key for SSE-KMS can reduce AWS KMS request costs by up to 99 percent by decreasing the request traffic from Amazon S3 to AWS KMS'. It describes the mechanism: without a bucket key 'Amazon S3 uses an individual AWS KMS data key for every object' and 'makes a call to AWS KMS every time a request is made against a KMS-encrypted object', whereas with one 'AWS generates a short-lived bucket-level key from AWS KMS' that 'will create data keys for new objects during its lifecycle'. The page also notes that objects already in the bucket do not use the bucket key until they are copied.
Source: AWS SAA-C03 Exam Guide - Domain 1: Design Secure Architectures
5/5 · Design Secure Architectures · hard
In a single AWS account, an Amazon S3 bucket policy names the ARN of the IAM user dev-sam as principal and allows s3:GetObject on the bucket. dev-sam has no identity-based policy that mentions S3. A permissions boundary is attached to dev-sam that allows only Amazon EC2 actions and contains no explicit deny. What is the result when dev-sam requests an object from the bucket?
AThe request succeeds on the strength of the bucket policy grant
BThe request is denied until the boundary allows s3:GetObject
CThe request is denied until an identity-based policy allows it
DThe request is denied because the boundary caps the bucket policy grant too
Answer: A. A permissions boundary sets the maximum that identity-based policies can grant, but it does not limit what a resource-based policy grants. For a user named as principal in a resource-based policy, no explicit allow in the boundary is needed (a role ARN would be different). Only an explicit deny would stop the request. Same-account access also needs no identity-based policy.
Source: Amazon Web Services documentation (docs.aws.amazon.com), CC BY-SA 4.0, IAM permissions boundaries, p. 1
Source: AWS SAA-C03 Exam Guide - Domain 1: Design Secure Architectures
Other SAA-C03 areas
The same kind of free sample for every other section of the SAA-C03 bank:
Practise SAA-C03 with instant feedback
6 free questions in study mode · no card · full SAA-C03 bank with area filters and the error log: $15 one-time · no dumps, no ads.
Start SAA-C03 free →
ExamDeck is an independent study tool, not affiliated with, endorsed by, or sponsored by AWS. SAA-C03 and related marks are trademarks of their respective owners, used for identification only. Exam facts checked against official AWS materials (as of November 2026); always confirm current details with the vendor before booking.