Design secure access to AWS resources.
98 practice questions under this official exam objective (SAA-C03), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
98 total · page 3 of 5S3 Access Points for Granular Prefix-Based Access
This question tests the use of Amazon S3 Access Points to enforce granular, prefix-specific access controls for multiple applications sharing a single
AWS Lambda S3 Access Without Internet Traversal
This question addresses how to enable AWS Lambda functions in private subnets to access Amazon S3 privately, avoiding internet traversal and NAT bottl
Amazon Cognito User Pools for API Gateway Authentication
This question addresses the most operationally efficient way to authenticate users for RESTful APIs using Amazon Cognito User Pools and API Gateway.
IRSA for EKS: IAM Role and OIDC Trust Setup
This question examines the configuration of IAM Roles for Service Accounts (IRSA) in Amazon EKS to grant granular AWS permissions to Kubernetes worklo
Secure External Access to EC2 via Systems Manager
This question explores the most secure method for granting external support engineers console and OS-level access to private Amazon Linux instances, h
S3 Multi-Region Access Points for Low-Latency Global Storage
This question evaluates the use of Amazon S3 Multi-Region Access Points (MRAP) to provide a single global endpoint that routes traffic to the nearest
How Can EC2 Reach Amazon S3 Without Using the Public Internet?
A gateway VPC endpoint for Amazon S3, plus a route-table entry pointing S3 traffic to that endpoint, lets EC2 instances in a VPC read and write object
How to Minimize EC2-to-S3 Data Transfer Costs from Private Subnets?
Amazon EC2 instances in private subnets can reach Amazon S3 without a NAT gateway by using an S3 gateway VPC endpoint, which keeps traffic on the AWS
AWS IAM Identity Center with On-Premises AD Trust
This question tests integrating AWS IAM Identity Center with an existing on-premises Microsoft Active Directory using a two-way forest trust via AWS M
Amazon Cognito Adaptive Authentication for Scalable User Auth
This question addresses designing secure access to AWS resources using Amazon Cognito user pools with risk-based adaptive authentication. It establish
Cross-Account EFS Access for Lambda via VPC Peering
This question examines the most cost-effective method for a Lambda function in one AWS account to access an Amazon EFS file system located in another
Root User MFA Backup Strategy for AWS
This question tests the best practice for securing an AWS root user account while ensuring recovery from lost hardware MFA devices. The correct approa
AWS Application Discovery Service for On-Premises Migration Planning
This question tests the correct AWS tool for collecting on-premises server usage and configuration data during migration planning. The page establishe
Cross-Account IAM Role Delegation for Vendors
This question tests secure cross-account access using IAM roles to allow an external vendor to assume permissions without direct credentials.
Automated Compliance for Security Groups with AWS Config
This question addresses automated compliance monitoring for AWS security groups to prevent unauthorized SSH access from 0.0.0.0/0. It establishes that
AWS IAM Identity Center Permission Sets for Least Overhead
This question addresses the most efficient method to manage granular permissions across multiple AWS accounts using AWS IAM Identity Center. The corre
Which ALB Security Group Rules Enable HTTPS and Port 8443 Health Checks?
An internet-facing Application Load Balancer needs security group rules that accept public HTTPS on port 443 and send HTTPS to EC2 targets on both 443
AWS Site-to-Site VPN for Encrypted On-Premises Connectivity
This question tests the selection of a secure hybrid connectivity solution that provides encryption at both the network and session layers. The correc
Granting CloudFormation Access to Private S3 Templates
This question addresses secure access design for AWS CloudFormation when templates are stored in private Amazon S3 buckets. It establishes that presig
Least Overhead Identity Integration with On-Prem AD
This question evaluates the optimal method for integrating on-premises Active Directory with AWS Organizations to provide centralized identity managem