A company stores sensitive data in an Amazon S3 bucket. The security team wants to deny access to this bucket for all IAM principals except those explicitly allowed by a specific IAM policy. Which type of policy should be used to achieve this?

An AWS Key Management Service (AWS KMS) key policy

An AWS Organizations service control policy (SCP)

An S3 bucket policy with an explicit deny

A company wants to allow a specific IAM user to manage a customer-managed key in AWS KMS. Which type of policy should be used to grant this permission?

An IAM policy attached to the IAM user

An AWS Organizations service control policy (SCP)

A company has a web application that uses an Application Load Balancer (ALB) and an Amazon RDS database. The security team requires that all data be encrypted in transit and at rest. The ALB uses an ACM certificate for HTTPS. The RDS database is encrypted with a KMS key. What additional configuration is needed to ensure data is encrypted in transit between the ALB and the RDS database?

Enable encryption at rest on the RDS database.

Use an ACM certificate on the RDS database.

Enable SSL/TLS on the RDS database and configure the application to use SSL/TLS when connecting to the database.

Use a VPN connection between the ALB and the RDS database.

A company needs to automatically move objects from Amazon S3 Standard to S3 Glacier Instant Retrieval after 90 days and then delete them after 7 years. Which AWS feature should be used to implement this?

S3 Cross-Region Replication (CRR)

A company uses AWS Certificate Manager (ACM) to manage TLS certificates for its Application Load Balancer. What is the default behavior for certificate renewal in ACM?

ACM automatically renews certificates before they expire

Certificates must be manually renewed by the customer

Certificates expire and must be re-issued

Renewal requires a support ticket

AWSCertified Solutions Architect - Associate

Domain 1Objective 3

Task 1.3: Determine Appropriate Data Security Controls SAA-C03 Practice Questions (Page 3)

Part of the Design Secure Architectures domain, which makes up ~18% of our current practice bank. AWS does not publish an official question count, but from its 130-minute exam (~50–85 total, ~9–15 in this domain), expect 3–5 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

11concepts

Questions 11–15

11foundation · easy
A company stores sensitive data in an Amazon S3 bucket. The security team wants to deny access to this bucket for all IAM principals except those explicitly allowed by a specific IAM policy. Which type of policy should be used to achieve this?
Select an answer first
12foundation · easy
A company wants to allow a specific IAM user to manage a customer-managed key in AWS KMS. Which type of policy should be used to grant this permission?
Select an answer first
13expert · hard
A company has a web application that uses an Application Load Balancer (ALB) and an Amazon RDS database. The security team requires that all data be encrypted in transit and at rest. The ALB uses an ACM certificate for HTTPS. The RDS database is encrypted with a KMS key. What additional configuration is needed to ensure data is encrypted in transit between the ALB and the RDS database?
Select an answer first
14foundation · easy
A company needs to automatically move objects from Amazon S3 Standard to S3 Glacier Instant Retrieval after 90 days and then delete them after 7 years. Which AWS feature should be used to implement this?
Select an answer first
15foundation · easy
A company uses AWS Certificate Manager (ACM) to manage TLS certificates for its Application Load Balancer. What is the default behavior for certificate renewal in ACM?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SAA-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SAA-C03” is a trademark of its owner, used for identification only.