AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 19
Question 180
A central CloudTrail log bucket is writable by application teams, and those same teams can delete audit objects that describe their own privileged changes. What hardening best protects the forensic record?
- Turn off CloudTrail event delivery during high-change periods to reduce storage bills.
- Enable CloudTrail log-file integrity validation but continue allowing application teams unrestricted deletion of log objects from the central bucket.
- Grant every application administrator s3:DeleteObject on the audit bucket for convenient housekeeping.
- Restrict log bucket modification and deletion, enable suitable log integrity validation and retention controls, and separate audit administrators from workload owners.
Explanation
Correct Answer
D:Protected centralized storage and CloudTrail integrity mechanisms reduce opportunities to erase or alter relevant evidence. Access to the audit destination must be independently controlled.
Incorrect Answers
A:Stopping delivery creates gaps exactly when privileged changes occur. It undermines incident reconstruction and audit completeness.
B:Digest validation can help detect manipulation, but it does not stop the same administrators from deleting the evidentiary log objects. Access separation and protected retention are also needed.
C:This would allow potentially compromised workloads to destroy the evidence of their own actions. Audit retention must be protected from the actors it monitors.
Question 181
A software enterprise stores vulnerability reports and centralized authentication logs in the same AWS accounts as internet-facing experimental applications. A compromised application administrator could disable logging and delete evidence. Which account structure reduces this blast radius?
- Use dedicated security tooling and audit log accounts with tightly controlled cross-account access from workload accounts.
- Deliver CloudTrail logs into a bucket managed by each application account's administrators, preserving their ability to delete logs during incident response.
- Give every application account administrator full access to the security account to simplify troubleshooting.
- Move application audit messages from instance-store files to CloudWatch Logs in the same workload accounts, leaving broad log-group deletion privileges intact.
Explanation
Correct Answer
A:Separating security and log ownership gives incident responders independent control when a workload account is compromised. Cross-account collection can still centralize visibility without sharing broad administration rights.
Incorrect Answers
B:A trail can collect API events, but keeping the evidence under the compromised workload account's administrators leaves deletion and disabling within the same failure and trust domain.
C:Such broad cross-account permission destroys the intended isolation and permits a compromised workload principal to manipulate security evidence.
D:CloudWatch Logs improves operational collection and persistence, but unchanged local administrator permissions allow an account compromise to disable delivery or remove logs. Separation of ownership and protected central retention is needed.
Question 182
A company has thirty AWS workload accounts. Each uses a separate S3 log bucket administered by its application team, and security investigations require manual searches across all buckets. What redesign improves consistency and tamper resistance?
- Give each application team permission to edit the other teams' local log buckets so they can share findings.
- Configure organization-wide audit delivery to a centrally controlled security logging destination with dedicated access and integrity safeguards.
- Disable log delivery after each team's monthly review, then delete all older objects immediately.
- Migrate every workload to one EC2 instance in a single account so there is only one log source.
Explanation
Correct Answer
B:Organization-level trails or managed log aggregation can consolidate audit records from multiple accounts. Central ownership protects logs from routine workload administrators and makes investigation more efficient.
Incorrect Answers
A:Broad cross-team write and delete access expands the number of principals able to tamper with evidence and does not establish central governance.
C:Stopping collection or deleting records removes investigation history and can violate retention requirements. Central protected retention is the goal.
D:Collapsing workloads into one instance sacrifices resilience and isolation. It is not required to centralize audit data securely.
Question 183
During an incident in a subsidiary workload account, central investigators need temporary access to EC2 metadata and CloudTrail evidence. The business will not share account root credentials or give the security team permanent administrator access. Which access design fits?
- Make all workload bucket objects public-read during incidents to avoid cross-account authorization.
- Allow the security account's IP address through the workload database's NACL and treat that as global AWS API permission.
- Establish narrowly scoped incident-response roles trusted by the security account and issue time-bounded STS sessions for investigations.
- Send the workload account root password to the security team so they can inspect everything without creating roles.
Explanation
Correct Answer
C:Cross-account roles can limit investigators to necessary read and response actions while preserving session-level audit evidence. Trust and permission policy remain under the account owners' governance.
Incorrect Answers
A:Public exposure is not an acceptable investigation access method and can leak sensitive customer or audit data to unauthenticated users.
B:A subnet NACL controls packets, not IAM actions. Investigators still need authorized cross-account principals for AWS APIs.
D:Root sharing removes least-privilege boundaries and individual attribution and grants far more authority than routine investigation needs.
Question 184
An enterprise groups AWS accounts into development, regulated production and security OUs. A team argues OU placement alone creates private IP isolation among accounts' VPCs and removes the need for network design. Which assessment is correct?
- Put all production accounts in the management OU and share the root identity to obtain network segmentation.
- Assume two accounts in the same OU share a private VPC route table by default.
- Replace every member-account security group with an OU name and expect packet filtering to inherit SCP rules.
- Use OUs for organizational policy and account management, while designing VPC routing, endpoints and network access separately.
Explanation
Correct Answer
D:AWS Organizations OUs group accounts for governance such as SCP application. They do not automatically create VPC connectivity or enforce packet-level isolation between independently configured networks.
Incorrect Answers
A:Root access and OU placement cannot create network isolation and would undermine identity separation. Governance and networking must be controlled independently.
B:OU membership does not merge VPC route tables or create implicit private connectivity. Network peering, transit attachments or other routing are explicit architecture choices.
C:Security groups and SCPs operate at different layers. OU hierarchy cannot directly act as an ENI network firewall.
Question 185
A company migrates a custom Windows application from its on-premises VM to an Amazon EC2 instance. Operations assumes AWS now patches the Windows guest every month because AWS manages the physical servers. Who owns that patching task?
- AWS automatically accepts responsibility for every Windows guest patch because the instance runs in an AWS Region.
- The Windows patch obligation moves to Amazon Route 53 because the application has a public DNS name.
- The customer must manage guest operating-system patches for its EC2 instance using its own processes or appropriate automation.
- Only the physical data center owner can approve OS changes, so the customer is forbidden to patch an EC2 guest.
Explanation
Correct Answer
C:AWS maintains the underlying host and hypervisor infrastructure, but guest OS and installed software management on EC2 generally remains the customer's responsibility under the shared-responsibility model.
Incorrect Answers
A:EC2 is infrastructure as a service, not a fully managed guest OS maintenance promise. A customer still must plan and verify guest patch compliance.
B:Route 53 manages DNS resolution and routing policies. It does not update software inside a customer-controlled EC2 guest.
D:AWS physical-facility responsibility does not remove the customer's control over its VM operating system. The customer can apply approved updates.
Question 186
A retailer runs a managed RDS PostgreSQL database. Its legal team asks whether AWS owning the database hosts also means AWS configures application users, grants access to customer records and approves schema changes. Which shared-responsibility assessment is correct?
- AWS operates underlying RDS infrastructure; the customer remains responsible for database identities, schemas and application data controls.
- IAM security-group settings alone automatically enforce every table-level row authorization rule.
- Every RDS database must be publicly accessible so AWS administrators can perform backups.
- AWS owns every database user permission as soon as a database is moved to RDS.
Explanation
Correct Answer
A:Managed RDS reduces infrastructure work but does not own the customer's data classification, SQL permissions or application authorization. These are part of customer security and governance.
Incorrect Answers
B:Network and AWS principal controls do not replace database-engine object permissions and application business rules over rows.
C:RDS managed operations do not require exposing the database to arbitrary internet clients. Private subnet and access controls remain appropriate.
D:RDS service management does not automatically implement customer-specific SQL grants or row access policies. Those must be configured by the customer.
Question 187
A company uploads confidential contracts to Amazon S3. It believes AWS service durability implies AWS will select its allowed readers and data retention rules automatically. Which ownership assignment should the solutions architect explain?
- Customers must maintain the physical disks and host operating systems that implement the managed S3 service.
- AWS automatically knows every approved business partner and grants S3 object permissions without customer policy.
- A bucket's Region replaces encryption and privacy controls because durability guarantees confidentiality.
- AWS operates the S3 storage service, while the customer must configure bucket/object access and the correct handling of its data.
Explanation
Correct Answer
D:The S3 shared-responsibility model includes AWS infrastructure security and durability, but customer-defined data permissions and governance controls remain necessary.
Incorrect Answers
A:Physical storage and managed service infrastructure are AWS responsibilities. The customer focuses on its data permissions and usage requirements.
B:S3 cannot infer an organization's contractual access list. Access authorization must be implemented through suitable IAM and resource policies.
C:A Region choice concerns placement, not whether principals may retrieve protected data. Durability is not a substitute for access controls.
Question 188
A team plans to replace self-managed EC2 databases with Amazon RDS to reduce patching work. A reviewer claims this change eliminates the need to manage database users and data classification. What should the architect advise?
- Move the database to RDS and delete all access-review processes because AWS now owns its data consumers.
- Adopt the managed service for applicable infrastructure duties while retaining customer responsibility for data, identities and access configuration.
- Stay on EC2 solely because managed services are prohibited from providing encryption or backup features.
- Make the RDS instance publicly accessible because that is required to shift maintenance responsibility to AWS.
Explanation
Correct Answer
B:Managed services can transfer engine installation, maintenance and some availability operations to AWS. They do not replace the customer's authority over application identities or the sensitivity of records.
Incorrect Answers
A:RDS cannot determine which business users should access customer tables. Access review and data governance remain customer tasks.
C:RDS supports managed security and backup capabilities. Its value should be assessed against operational needs, not an incorrect assumption that it lacks protections.
D:Public endpoint exposure is not a prerequisite for managed database operations. It would expand attack surface without changing the shared-responsibility boundary.
Question 189
A SaaS analytics provider uses one IAM role for different enterprise customers. A customer wants access decisions based on the project and tenant attributes of each temporary session without maintaining thousands of separate per-object policies. Which mechanism fits?
- Pass authorized session tags in supported STS role assumptions and use those tags in correctly scoped ABAC policies.
- Store tenant identity only in an S3 object's ETag and treat the ETag as an AWS IAM principal.
- Give all tenant sessions the same AdministratorAccess policy and use CloudFront caching as their sole separation.
- Let every tenant supply arbitrary privileged session tags with no restrictions or validation.
Explanation
Correct Answer
A:Session tags can provide temporary principal attributes that IAM compares with resource tags or policy conditions. This scales tenant-specific access when tag assignment and trust are tightly controlled.
Incorrect Answers
B:ETags are object metadata associated with object content, not authenticated principal attributes. They cannot safely determine which STS session may read resources.
C:A shared administrator policy eliminates IAM tenant isolation; content caching cannot replace authorization for AWS API access.
D:Untrusted attributes allow callers to impersonate another tenant's labels. Session-tag values must be authorized before ABAC may rely on them.
Question 190
A multi-tenant API assumes an IAM role with caller-provided session tags. Its developers allow sts:TagSession for every label and an attacker tags their session as department=security. Which permission change prevents this identity spoofing?
- Use an S3 lifecycle policy to remove objects whose names contain the word security.
- Restrict who may pass session tags and which keys and values are accepted in the role's trust and caller permissions.
- Keep arbitrary session tagging because temporary credentials cannot influence IAM authorization.
- Increase the Lambda function timeout so IAM checks can inspect all supplied tags for longer.
Explanation
Correct Answer
B:STS session tags become principal attributes for IAM policy evaluation. Allowing arbitrary privileged labels can bypass ABAC, so tag-passing permission and conditions must be controlled.
Incorrect Answers
A:Object age rules do not validate STS principal attributes and risk destroying data without addressing session-tag spoofing.
C:Session tags can be evaluated by ABAC policies and therefore do influence effective permissions. Unrestricted values create a real escalation path.
D:Function duration does not determine trust policy conditions or allowable STS session tags. Authorization must reject disallowed attributes.
