A company has a mobile application that uses Amazon API Gateway and AWS Lambda. The application needs to authenticate users and allow them to sign in with social identity providers like Facebook and Google. The security team wants to avoid managing user credentials and wants to use a managed service. Which solution should the solutions architect implement?

Use Amazon Cognito user pools with social identity providers enabled.

Store user credentials in AWS Secrets Manager and validate them in Lambda.

Create IAM users for each application user and use the IAM API for authentication.

Use AWS IAM Identity Center with SAML 2.0 federation for social identity providers.

A developer is writing code for an EC2 instance that needs to access an Amazon S3 bucket. What is the recommended way to provide credentials to the application without embedding them in code?

Embed the access key and secret key directly in the application source code

Use the root user credentials of the AWS account for the application

Store the access key and secret key in a configuration file on the instance

Use an IAM role attached to the EC2 instance and retrieve temporary credentials from the instance metadata

AWSCertified Solutions Architect - Associate

Domain 1Objective 2

Task 1.2: Design Secure Workloads and Applications SAA-C03 Practice Questions (Page 4)

Part of the Design Secure Architectures domain, which makes up ~18% of our current practice bank. AWS does not publish an official question count, but from its 130-minute exam (~50–85 total, ~9–15 in this domain), expect 3–5 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

10concepts

Questions 16–20

16expert · hard
A company has a mobile application that uses Amazon API Gateway and AWS Lambda. The application needs to authenticate users and allow them to sign in with social identity providers like Facebook and Google. The security team wants to avoid managing user credentials and wants to use a managed service. Which solution should the solutions architect implement?
Select an answer first
17foundation · easy
An application running on an EC2 instance in a private subnet needs to access an S3 bucket. Which endpoint type allows this without traversing the internet?
Select an answer first
18foundation · easy
A developer is writing code for an EC2 instance that needs to access an Amazon S3 bucket. What is the recommended way to provide credentials to the application without embedding them in code?
Select an answer first
19foundation · easy
Which type of AWS service endpoint is accessible only from within a specific VPC and uses private IP addresses?
Select an answer first
20foundation · easy
In a VPC, which subnet type has a route to an internet gateway and is typically used for resources that need to be directly accessible from the internet?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SAA-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SAA-C03” is a trademark of its owner, used for identification only.

Task 1.2: Design Secure Workloads and Applications SAA-C03 Practice Questions (Page 4)

Questions 16–20

An application running on an EC2 instance in a private subnet needs to access an S3 bucket. Which endpoint type allows this without traversing the internet?

A developer is writing code for an EC2 instance that needs to access an Amazon S3 bucket. What is the recommended way to provide credentials to the application without embedding them in code?

Which type of AWS service endpoint is accessible only from within a specific VPC and uses private IP addresses?

In a VPC, which subnet type has a route to an internet gateway and is typically used for resources that need to be directly accessible from the internet?

Keep studying — Design Secure Architectures