A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to make outbound HTTPS requests to the internet. The security team wants to ensure that only the specific instance can make these requests and that the traffic is encrypted. Which solution should the solutions architect implement?

Assign a public IP address to the instance and update the private subnet's route table to point to an internet gateway.

Use a VPC endpoint for HTTPS and route the traffic through it.

Place a NAT gateway in the public subnet, update the private subnet's route table to point to the NAT gateway, and configure the instance's security group to allow outbound HTTPS traffic.

Configure a proxy server on an EC2 instance in the public subnet and have the private instance route traffic through it.

AWSCertified Solutions Architect - Associate

Domain 1Objective 2

Task 1.2: Design Secure Workloads and Applications SAA-C03 Practice Questions (Page 2)

Part of the Design Secure Architectures domain, which makes up ~18% of our current practice bank. AWS does not publish an official question count, but from its 130-minute exam (~50–85 total, ~9–15 in this domain), expect 3–5 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

10concepts

Questions 6–10

6foundation · easy
Which type of IAM policy is attached directly to an AWS resource, such as an S3 bucket, to grant permissions to other AWS accounts or principals?
Select an answer first
7foundation · easy
Which AWS service provides a private, dedicated network connection from an on-premises data center to AWS, bypassing the public internet?
Select an answer first
8foundation · easy
A company needs to connect its on-premises network to AWS using an encrypted connection over the public internet. Which AWS service should be used?
Select an answer first
9expert · hard
A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to make outbound HTTPS requests to the internet. The security team wants to ensure that only the specific instance can make these requests and that the traffic is encrypted. Which solution should the solutions architect implement?
Select an answer first
10foundation · easy
Which AWS component acts as a stateful virtual firewall for an EC2 instance, controlling inbound and outbound traffic at the instance level?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SAA-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SAA-C03” is a trademark of its owner, used for identification only.

Task 1.2: Design Secure Workloads and Applications SAA-C03 Practice Questions (Page 2)

Questions 6–10

Which type of IAM policy is attached directly to an AWS resource, such as an S3 bucket, to grant permissions to other AWS accounts or principals?

Which AWS service provides a private, dedicated network connection from an on-premises data center to AWS, bypassing the public internet?

A company needs to connect its on-premises network to AWS using an encrypted connection over the public internet. Which AWS service should be used?

Which AWS component acts as a stateful virtual firewall for an EC2 instance, controlling inbound and outbound traffic at the instance level?

Keep studying — Design Secure Architectures