An application needs to allow users to sign in using their existing corporate credentials. Which AWS service enables this without creating IAM users for each employee?

AWS Identity and Access Management (IAM)

AWS IAM Identity Center (successor to AWS SSO)

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access Amazon S3 and Amazon DynamoDB. The security team wants to minimize data transfer costs and ensure that traffic does not leave the AWS network. The company also wants to avoid using a NAT gateway. Which solution should the solutions architect implement?

Create a gateway VPC endpoint for S3 and a gateway VPC endpoint for DynamoDB, and add routes to the private subnet's route table for both endpoints.

Create a NAT gateway in a public subnet and route traffic to S3 and DynamoDB through it.

Create an interface VPC endpoint for S3 and a gateway VPC endpoint for DynamoDB.

Create a VPC peering connection to a VPC that has a gateway endpoint for S3 and DynamoDB.

A company needs to securely store database credentials and automatically rotate them. Which AWS service is designed for this purpose?

AWS Systems Manager Parameter Store

AWS Identity and Access Management (IAM)

AWS Key Management Service (KMS)

A company operates a public-facing web application that accepts user input through a search form. The security team has identified that the application is vulnerable to SQL injection attacks. Which combination of services should the solutions architect use to mitigate this threat?

AWS WAF with a managed rule set that includes SQL injection rules, placed in front of the Application Load Balancer.

Amazon GuardDuty with threat detection and automated remediation.

AWS Network Firewall with a stateful rule that inspects HTTP traffic.

AWS Shield Advanced with automatic DDoS protection and a web ACL.

AWSCertified Solutions Architect - Associate

Domain 1Objective 2

Task 1.2: Design Secure Workloads and Applications SAA-C03 Practice Questions (Page 1)

Part of the Design Secure Architectures domain, which makes up ~18% of our current practice bank. AWS does not publish an official question count, but from its 130-minute exam (~50–85 total, ~9–15 in this domain), expect 3–5 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

10concepts

Questions 1–5

1foundation · easy
An application needs to allow users to sign in using their existing corporate credentials. Which AWS service enables this without creating IAM users for each employee?
Select an answer first
2expert · hard
A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access Amazon S3 and Amazon DynamoDB. The security team wants to minimize data transfer costs and ensure that traffic does not leave the AWS network. The company also wants to avoid using a NAT gateway. Which solution should the solutions architect implement?
Select an answer first
3foundation · easy
A company needs to securely store database credentials and automatically rotate them. Which AWS service is designed for this purpose?
Select an answer first
4foundation · easy
A company wants to detect and alert on suspicious activity in their AWS account, such as unusual API calls or compromised credentials. Which AWS service is designed for continuous threat detection?
Select an answer first
5application · medium
A company operates a public-facing web application that accepts user input through a search form. The security team has identified that the application is vulnerable to SQL injection attacks. Which combination of services should the solutions architect use to mitigate this threat?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SAA-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SAA-C03” is a trademark of its owner, used for identification only.

Task 1.2: Design Secure Workloads and Applications SAA-C03 Practice Questions (Page 1)

Questions 1–5

An application needs to allow users to sign in using their existing corporate credentials. Which AWS service enables this without creating IAM users for each employee?

A company needs to securely store database credentials and automatically rotate them. Which AWS service is designed for this purpose?

A company wants to detect and alert on suspicious activity in their AWS account, such as unusual API calls or compromised credentials. Which AWS service is designed for continuous threat detection?

A company operates a public-facing web application that accepts user input through a search form. The security team has identified that the application is vulnerable to SQL injection attacks. Which combination of services should the solutions architect use to mitigate this threat?

Keep studying — Design Secure Architectures