A company wants to protect its web application from common web exploits and DDoS attacks. Which combination of AWS services should be used together for this purpose?

AWS Network Firewall and AWS Secrets Manager

Amazon GuardDuty and AWS Config

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket to read and write data. The security team wants to ensure that the traffic does not traverse the internet and that the instance does not have a public IP address. Which solution should the solutions architect implement?

Create a gateway VPC endpoint for S3 and add a route to the private subnet's route table pointing to the endpoint.

Create an interface VPC endpoint for S3 and associate it with the private subnet's security group.

Assign a public IP address to the instance and use an internet gateway for S3 access.

Set up a NAT gateway in the public subnet and update the private subnet's route table to send S3 traffic to the NAT gateway.

Which type of attack involves overwhelming a web application with a flood of traffic to make it unavailable to legitimate users?

Distributed denial of service (DDoS)

AWSCertified Solutions Architect - Associate

Domain 1Objective 2

Task 1.2: Design Secure Workloads and Applications SAA-C03 Practice Questions (Page 5)

Part of the Design Secure Architectures domain, which makes up ~18% of our current practice bank. AWS does not publish an official question count, but from its 130-minute exam (~50–85 total, ~9–15 in this domain), expect 3–5 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

10concepts

Questions 21–25

21foundation · easy
A company wants to protect its web application from common web exploits and DDoS attacks. Which combination of AWS services should be used together for this purpose?
Select an answer first
22foundation · easy
In a VPC, which component determines how traffic is directed between subnets and to external networks?
Select an answer first
23expert · hard
A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket to read and write data. The security team wants to ensure that the traffic does not traverse the internet and that the instance does not have a public IP address. Which solution should the solutions architect implement?
Select an answer first
24foundation · easy
Which type of attack involves overwhelming a web application with a flood of traffic to make it unavailable to legitimate users?
Select an answer first
25application · medium
A company is deploying a public-facing web application on AWS. The application is expected to receive traffic from a large number of users, and the security team is concerned about DDoS attacks. The company wants a cost-effective solution that provides automatic protection against common DDoS attacks. Which service should the solutions architect use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SAA-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SAA-C03” is a trademark of its owner, used for identification only.

Task 1.2: Design Secure Workloads and Applications SAA-C03 Practice Questions (Page 5)

Questions 21–25

A company wants to protect its web application from common web exploits and DDoS attacks. Which combination of AWS services should be used together for this purpose?

In a VPC, which component determines how traffic is directed between subnets and to external networks?

Which type of attack involves overwhelming a web application with a flood of traffic to make it unavailable to legitimate users?

Keep studying — Design Secure Architectures