Design secure access to AWS resources.
98 practice questions under this official exam objective (SAA-C03), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
98 total · page 4 of 5Enforcing EC2 Tag Presence and Values in AWS Organizations
This guide explains how to enforce tag presence using Service Control Policies (SCPs) and tag value compliance using AWS Organizations Tag Policies fo
IAM Identity Center vs IAM Roles for Least Privilege
This question evaluates the optimal method for managing secure access to AWS resources while minimizing operational overhead. It establishes that IAM
EMR Runtime Roles for Scoped Access and IMDSv2
This question tests the use of Amazon EMR runtime roles to enforce least-privilege access for big data workloads while disabling Instance Metadata Ser
Secure Credential Management for RDS with Minimal Effort
This question addresses how to securely manage embedded database credentials in an Amazon RDS application while minimizing programming effort using AW
AWS PrivateLink for Secure SaaS Connectivity
This question tests the use of AWS PrivateLink to establish private connectivity between a VPC and third-party SaaS APIs without public internet expos
AWS Multi-Protocol Storage with FSx for NetApp ONTAP
Amazon FSx for NetApp ONTAP is the managed AWS storage service that supports simultaneous SMB and NFS access within a single file system. This solutio
Amazon EKS Custom Subnet for Pods Configuration
This question addresses how to configure Amazon EKS pods to use custom VPC subnets while ensuring secure intra-VPC communication. The correct solution
AWS Shield Advanced for DDoS Protection
This question evaluates the correct managed service for proactive DDoS detection and mitigation in AWS. The page establishes that AWS Shield Advanced
AWS Transfer Family for SFTP to S3 Migration
This question addresses migrating on-premises SFTP workflows to AWS using AWS Transfer Family, a fully managed service that enables legacy application
How to Secure the AWS Account Root User
Securing the AWS account root user is a critical first step in a newly provisioned account. This page establishes that creating IAM users for daily ta
How to Configure NAT Gateways for Internet Access from Private Subnets
To allow EC2 instances in private subnets to access the public internet, a public NAT gateway must be deployed in a public subnet within the same VPC.
Cross-Account CloudWatch Observability with AWS Organizations
This question tests the correct method for querying and visualizing observability data across multiple AWS accounts using Amazon CloudWatch. The solut
Ensuring Private Traffic to Amazon S3 with VPC Endpoints
This question tests the correct method for accessing Amazon S3 privately from an EC2 instance within a VPC without using the public internet. The corr
On-Premises Access to S3 via IAM Roles Anywhere
IAM Roles Anywhere enables on-premises applications to assume AWS IAM roles for temporary, secure access to S3 buckets without managing long-term cred
Real-time Gaming Leaderboard with ElastiCache Persistence
This question evaluates the selection of an in-memory data store for low-latency gaming leaderboards that requires disk persistence. The correct solut
Amazon Security Lake for Centralized Security Data
Amazon Security Lake is the AWS service designed to automatically centralize security data from multiple sources into a purpose-built data lake in Ama
AWS SMB Storage Solution Least Overhead
This question identifies Amazon FSx for Windows File Server as the optimal solution for SMB-based shared storage on AWS, minimizing administrative ove
Three-Tier Web App Security Group Rules
This question tests the design of secure access for a three-tier web application using stateful security groups in AWS. The correct configuration reli
Prevent EC2 Instance Launches with Least Overhead
This question tests how to centrally restrict AWS service actions across multiple accounts using AWS Organizations. The correct approach leverages Ser
Serverless AuthZ/AuthN with Lambda@Edge and CloudFront
This question addresses the design of a globally accessible, serverless web application using Amazon Cognito for authentication and Lambda@Edge for au