Design secure access to AWS resources.
98 practice questions under this official exam objective (SAA-C03), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
98 total · page 2 of 5Direct Connect Public VIF vs S3 Interface Endpoint for Cost
This question analyzes the most cost-effective method to access Amazon S3 from an on-premises network with no internet access using AWS Direct Connect
Route 53 Resolver for Hybrid DNS Resolution
This question addresses secure hybrid cloud DNS resolution using Amazon Route 53 Resolver to forward queries from VPCs to on-premises servers. It esta
CloudFront Custom Domain SSL and S3 Origin Access
This page explains how to configure Amazon CloudFront with a custom domain name for an S3 origin, focusing on the strict requirement for ACM certifica
AWS PrivateLink and AppFlow for Secure Salesforce Data
This page explains how to securely transfer data from Salesforce to Amazon Redshift without using the public internet, identifying AWS PrivateLink and
AWS Control Tower and Security Hub for Centralized Audit
This question evaluates the use of AWS Control Tower combined with AWS Security Hub to achieve centralized auditing and compliance monitoring across a
Custom Identity Broker for Non-SAML LDAP to AWS Console
This page explains how to authenticate on-premises LDAP users to the AWS Management Console when the directory is not SAML-compatible, identifying the
IAM AdministratorAccess Identity-Based Policy for Full Access
This question tests the correct application of AWS IAM managed policies for granting full administrative access. The solution requires attaching an id
AWS Shield Advanced for DDoS Protection
AWS Shield Advanced is the correct solution for mitigating DDoS attacks with minimal configuration and audit trails. It provides managed protection ag
Mitigating DDoS with AWS WAF and Global Accelerator
This question addresses the integration of AWS WAF with AWS services to mitigate DDoS attacks, specifically clarifying that AWS WAF cannot be attached
Least Overhead Secure Storage for Lambda Secrets
This question addresses the secure storage and automatic rotation of sensitive information for AWS Lambda functions with minimal operational overhead.
IAM Roles for Least Privilege Access Control
This question evaluates the correct method for granting secure, fine-grained access to AWS resources using IAM roles and the principle of least privil
AWS Account Root User Email and Alternate Contacts Security
This question tests the secure management of AWS account notifications by configuring root user email aliases and dedicated alternate contact distribu
Encrypting Data in Transit for Amazon RDS MySQL
To encrypt data in transit for an Amazon RDS MySQL instance, you must configure connections to use SSL/TLS by providing the AWS-provided root certific
Enabling Public Access for Amazon MSK with Operational Efficiency
This question explores how to securely expose an Amazon MSK cluster to the internet while maintaining data encryption. The correct approach leverages
AWS SCP Deployment for Selective Account Restrictions
This page explains how to correctly deploy an AWS Service Control Policy (SCP) to restrict EC2 instance types in specific nonproduction accounts while
EKS IRSA Pod Access Control with IAM Roles
This question tests the implementation of fine-grained access control for Amazon EKS pods using IAM Roles for Service Accounts (IRSA). It establishes
Route 53 ALB Listener Rule for Dev Instance Access
This question addresses how to route specific traffic to a development environment using an Application Load Balancer and Route 53. It establishes tha
Secure Web App with VPN and Internet Access
This question tests securing an internal web application accessible via Site-to-Site VPN while allowing outbound patch downloads using NAT gateways.
Sharing KMS Encrypted AMIs with AWS Organizations OUs
This question explores the dual requirements for sharing Amazon Machine Images (AMIs) encrypted with AWS KMS across organizational units in AWS Organi
AWS Systems Manager Session Manager for EC2 Access
This question evaluates the secure and cost-effective management of SSH access to private EC2 instances using AWS Systems Manager Session Manager. The