Design secure access to AWS resources.
98 practice questions under this official exam objective (SAA-C03), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
98 total · page 1 of 5Private S3 Upload from EC2 Without Public Internet
This SAA-C03 scenario asks how an EC2 instance can reach an Amazon S3 bucket entirely over private AWS networking while restricting upload rights to t
Minimizing Credential Overhead for EC2 and Aurora
This SAA-C03 scenario asks how an EC2-hosted application should stop storing Aurora user names and passwords in a local file while cutting credential-
Private S3 Access From EC2 Without Internet
This SAA-C03 scenario asks how an EC2 instance in a VPC can reach an Amazon S3 bucket entirely over the AWS network, with no internet gateway, NAT dev
Limit S3 Bucket Access to AWS Organization Accounts
This SAA-C03 scenario asks how to restrict an Amazon S3 bucket in the management account to principals in the same AWS Organization with the least ope
Amazon Managed Grafana VPC Connection for RDS
This question explores how to securely connect Amazon Managed Grafana to an Amazon RDS database without exposing data over the internet, focusing on P
Securing NLB with Security Groups for Minimal Change
This question tests the capability of Network Load Balancers (NLBs) to utilize security groups for access control. The correct solution leverages this
AWS Control Tower vs Organizations for Account Management
AWS Control Tower is the correct choice for centrally managing AWS accounts with automatic security guardrails and least operational overhead compared
Accessing RDS Across VPCs Without Internet Gateway
AWS PrivateLink provides private connectivity between VPCs without requiring an internet gateway, VPN, or Direct Connect. This page confirms that plac
S3 Multi-Region Access Point and Replication Strategy
This question evaluates the optimal design for global content delivery using Amazon S3, specifically balancing low-latency uploads with efficient data
API Gateway Resource Policy for IP Restriction
This page explains how to restrict access to an Amazon API Gateway HTTP API using a resource policy based on the client's source IP address, ensuring
Secure S3 Access with VPC Endpoint and IAM Conditions
This question explores securing Amazon S3 access from EC2 instances using VPC Gateway Endpoints and IAM policy conditions to restrict access to specif
Cross-Account SNS to Lambda Invocation
This question addresses configuring secure cross-account communication between Amazon SNS and AWS Lambda by establishing the necessary IAM resource po
How to Prevent EFS Dataset Modification with IAM Access Control
Amazon EFS supports IAM access control through file system resource policies that deny elasticfilesystem:ClientWrite to specific IAM roles. This page
AWS Transfer Family SFTP Internal Server and Managed Workflows
This question evaluates the design of a secure, resilient SFTP solution using AWS Transfer Family with an internal endpoint for on-premises integratio
AWS Systems Manager Default Host Configuration Management
Default Host Configuration Management in AWS Systems Manager automates the creation and attachment of an IAM role, allowing SSM to manage EC2 instance
Handling Inbound Web Traffic for Private EC2 Instances
This question addresses how to expose web servers running in private subnets to the internet securely. The correct approach involves using an internet
High Availability for Transport Layer Apps on EC2
This question tests designing high availability for applications using the transport layer (TCP). The correct solution combines a Network Load Balance
Cross-Account SQS Access via Resource Policy
This question tests how to grant cross-account access to an Amazon SQS queue without modifying the external account's permissions. The correct approac
Cost-Effective Private S3 Access via VPC Endpoint
To allow EC2 instances in a private subnet to access Amazon S3 without traversing the public internet, an S3 Gateway Endpoint is the optimal solution.
Cross-Account IAM Role Trust Policy for AWS
This question tests the correct configuration of cross-account access in AWS using IAM roles and trust policies. The solution requires creating a role