AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 22
Question 210
A startup runs experimental software in the same AWS account as production healthcare data. Development admins need broad test access, but the company wants a hard policy and billing isolation boundary from production. What account layout should it use?
- Apply different cost allocation tags to the workloads and assume tag values alone prevent admin privilege crossing.
- Place development and production in separate AWS accounts with appropriately differentiated IAM and organization policies.
- Put both workloads in differently named subnets of one account and treat subnet labels as a hard IAM boundary.
- Use one shared root identity with a written promise that developers will not access production.
Explanation
Correct Answer
B:Accounts provide distinct administrative, billing attribution and authorization boundaries. They help prevent development role policies from unintentionally granting production data access.
Incorrect Answers
A:Cost tags help allocate spend but do not provide the independent account permission boundary the requirement demands.
C:Subnets provide networking separation but do not inherently isolate account-wide IAM administrators or resource policies.
D:A shared root credential offers no enforceable least-privilege boundary and creates poor individual attribution.
Question 211
A deployment team can create and update AWS Lambda functions in one account. Developers must assign only two approved, least-privilege execution roles to those functions; they must not be able to pass powerful administrative roles or configure those roles for other AWS services. What IAM authorization should the security architect enforce?
- Grant each developer sts:AssumeRole on the administrative role and assume that this automatically limits which service role Lambda receives.
- Allow iam:PassRole on every IAM role in the account without a service condition, and rely on Lambda function names as the security boundary.
- Grant iam:PassRole only on the approved Lambda execution role ARNs, constrained to lambda.amazonaws.com with iam:PassedToService; retain separate Lambda deployment permissions.
- Use a Lambda resource-based policy allowing developers to invoke functions, without any iam:PassRole control over the execution role they assign.
Explanation
Correct Answer
C:iam:PassRole is required when an authorized principal configures a service to use an IAM role. Scoping the allowed role ARNs and iam:PassedToService to Lambda limits which approved service roles can be passed; normal Lambda API and trust-policy permissions must also be satisfied.
Incorrect Answers
A:sts:AssumeRole governs sessions a caller can assume. It does not automatically constrain which execution role a developer can pass when configuring a Lambda function. Overbroad admin-role access worsens privilege risk.
B:Unrestricted iam:PassRole can allow a developer to attach overly privileged roles to supported services. Naming a function does not impose role-resource or destination-service restrictions.
D:Lambda resource-based policies decide who may invoke a function; they do not replace iam:PassRole checks when a developer configures the function execution role.
Question 212
An enterprise provisions hundreds of AWS accounts. Each account currently gets manually created baseline logging, security and governance settings, leading to drift. Which managed AWS approach best standardizes its landing zone?
- Place all accounts behind a single internet-facing NLB and assume it enforces organization-wide account policies.
- Use only a Route 53 hosted zone and identify account compliance by DNS record naming.
- Create a public S3 bucket template and let each new account copy credentials into it.
- Use AWS Control Tower landing-zone setup and account provisioning with the applicable governance controls.
Explanation
Correct Answer
D:Control Tower provides governed multi-account setup and baseline account configuration through supported mechanisms. It reduces inconsistency in account provisioning compared with repeating manual scripts.
Incorrect Answers
A:An NLB routes traffic and has no capability to provision accounts or enforce organization IAM governance across them.
B:DNS records do not configure AWS accounts, centralize their logging or enforce baseline policy guardrails.
C:Public buckets do not provide account governance and create credential exposure. They cannot replace the controlled landing-zone model.
Question 213
A security team needs to prevent a prohibited AWS API before it executes and also wants reports showing which existing S3 buckets violate a configuration rule. The architect must distinguish these two controls. Which pairing is appropriate?
- Use preventive authorization controls such as applicable SCP or IAM denies, and detective tools such as AWS Config for configuration findings.
- Create an internet gateway route rule and expect it to inspect AWS organization service authorization.
- Use only an AWS Config compliance report because a finding automatically denies the next disallowed API request.
- Use only an SCP deny because it reports every noncompliant historical bucket configuration in place of AWS Config.
Explanation
Correct Answer
A:Preventive policy evaluation can block an API operation at request time. AWS Config records and evaluates configuration state, producing detective findings and optional remediation workflows.
Incorrect Answers
B:A route table governs network forwarding, not IAM policy ceilings or historical configuration compliance reporting.
C:Config evaluation is generally detective rather than an inline IAM authorization gate. A rule result alone does not prevent the originating API operation.
D:SCPs limit allowed API actions but do not by themselves inventory and evaluate all past resource settings as a Config rule can.
Question 214
A company operates sensitive security-monitoring and application-experiment AWS accounts. The security team wants its audit evidence to remain independently controlled even if a test account is compromised. How should the account hierarchy be used?
- Make experimental account administrators owners of all audit buckets to simplify incident troubleshooting.
- Move all logs to the largest experimental EC2 instance's local disk so they're in one place.
- Use matching account tags only, leaving all environments in one account with identical administrator rights.
- Keep audit and security accounts separate from experimental workload accounts, with restricted cross-account collection and OU guardrails.
Explanation
Correct Answer
D:Separate account ownership and policy boundaries limit the ability of an application principal to modify central security evidence. The OU design can tailor governance while collection crosses account boundaries safely.
Incorrect Answers
A:Sharing audit administration with application principals defeats the intended evidence isolation if a workload account is compromised.
B:Instance-local storage is in the workload's compromise and failure domain. It is unsuitable as independent protected audit custody.
C:Tags alone do not establish a strong administrative account boundary. The requirement explicitly calls for isolation from compromised experimental administrators.
Question 215
A regulated organization wants independent trust and billing boundaries between its payment and marketing platforms. A proposal keeps both under one account root but adds project tags to resources. Which architecture is better?
- Put the two platforms in different S3 prefixes and treat a shared root identity as unable to read both.
- Use separate AWS accounts with scoped cross-account interfaces for the payment and marketing workloads.
- Enable AWS Shield Standard on the account because DDoS protection automatically separates billing and IAM identity realms.
- Use only different cost allocation tags while giving a single administrator all resources in the same account.
Explanation
Correct Answer
B:Accounts isolate root administration, many policies and billing attribution. Resource tags are useful metadata but do not replace that account-level security and governance boundary.
Incorrect Answers
A:Prefixes are logical object-key groupings, not an account-level trust barrier against a shared privileged principal.
C:Shield protects supported resources from certain DDoS risks. It does not create separate account ownership or billing boundaries.
D:Billing tags help attribute charges but cannot provide independent roots or enforce complete administrative separation.
Question 216
A customer-facing HTTP service has an internet-facing ALB and a private PostgreSQL database. A proposed subnet redesign places the database directly on public subnets to simplify access from browsers. Which topology retains public application access without unnecessarily exposing the database?
- Add a NAT gateway to the database subnet and assume NAT creates an inbound application firewall.
- Move the database into a public subnet and add a route from 0.0.0.0/0 to the internet gateway.
- Keep the public ALB in appropriately routed public subnets and database instances in private subnets with narrow application-to-database access.
- Give the ALB's public IP address to every database client and use it as the PostgreSQL endpoint.
Explanation
Correct Answer
C:A public load balancer can terminate inbound requests while its targets and data tier remain privately addressed. Security groups and private routes allow only required application flows to the database.
Incorrect Answers
A:NAT gateways provide outbound IPv4 translation for private subnets, not unsolicited public ingress or application-layer database authorization.
B:Public routing increases direct exposure of a data tier that does not need internet clients. The ALB and application can connect to the private database instead.
D:An ALB listener serving HTTP is not a native PostgreSQL endpoint or a replacement for data-tier network controls. Database clients need a supported private connection.
Question 217
A payments application runs in EC2 instances that only accept HTTPS from an internet-facing ALB. Engineers want to remove every public IPv4 address from the application instances but still allow occasional calls to external APIs. What networking design should be chosen?
- Assign elastic public IPv4 addresses to every application instance and allow TCP 443 from all internet hosts.
- Place application instances in private subnets and provide only the required outbound paths, such as NAT or supported VPC endpoints.
- Remove the subnet route tables entirely and assume the ALB routes to unaddressable targets automatically.
- Attach an internet gateway to a private subnet and treat it as an outbound-only firewall without NAT.
Explanation
Correct Answer
B:Private application addresses can receive traffic from the ALB through VPC routing without direct internet inbound access. Outbound service access can be controlled separately by NAT and endpoints.
Incorrect Answers
A:Public addresses would defeat the stated no-direct-ingress requirement and increase attack surface; the ALB already provides public entry.
C:The VPC still requires valid local routes and security-group permissions for the ALB to communicate with targets. An absent or broken route design does not create private connectivity.
D:An internet gateway alone does not give private IPv4 instances outbound internet connectivity without appropriate public addressing or a NAT-based path.
Question 218
A hospital wants a managed PostgreSQL database accessible only to an application fleet in the same VPC. A vendor suggests assigning the database a public endpoint and allowing access from an office CIDR. Which architecture better meets the isolated-data-tier requirement?
- Deploy the database in private subnets and allow only the application security group on the database listener port.
- Use a CloudFront distribution as the direct native PostgreSQL client protocol endpoint.
- Keep the database private but delete the application security group's outbound permissions and all database ingress rules.
- Enable public accessibility on the database and open its listener to 0.0.0.0/0 for easier management.
Explanation
Correct Answer
A:Private subnet placement avoids unnecessary direct internet routes, while referencing the application identity at the network layer narrows access to the intended application instances.
Incorrect Answers
B:CloudFront is an HTTP content-delivery service, not an RDS PostgreSQL proxy for arbitrary database connections. It cannot supply the needed private data connection.
C:A fully blocked network path would prevent legitimate application-to-database connections. Least privilege means allowing the required scoped flow, not blocking all functionality.
D:Unrestricted public ingress contradicts the workload's isolation requirement and exposes the database protocol to all internet clients.
Question 219
A VPC has public web, private application and database subnets, but all three currently share one route table with a default internet-gateway route. Compliance specifically requires separate route-level outbound paths per tier, while preserving authorized application-to-database traffic. What network change supports that separation?
- Keep the single shared route table, but add narrowly scoped instance security groups while retaining the existing default internet-gateway route on every tier.
- Keep one shared internet gateway default route and assume subnet names alone block outbound internet paths.
- Associate separate subnet route tables with routes appropriate for web, application and database traffic, retaining local private connectivity.
- Create different network ACLs for each tier while leaving the shared internet-gateway default route in place on all three subnet associations.
Explanation
Correct Answer
C:A subnet's associated route table determines its forwarding paths. Distinct tables let application and database tiers omit unneeded direct internet routes while the public tier retains its external entry route.
Incorrect Answers
A:Security groups govern instance traffic but do not change subnet route-table associations. The stipulated route-level isolation remains absent when each tier still follows the public default path.
B:A name such as private-app does not change forwarding behavior. Route-table associations must implement the intended tier paths.
D:Network ACLs can limit packets at subnet boundaries, but do not establish distinct tier-specific forwarding paths. The required route-level egress separation needs suitable subnet route-table associations.
Question 220
An RDS database accepts TCP 5432 from its application instances. The database security group currently allows the entire corporate 10.0.0.0/8 network, including unrelated development hosts. The architect needs an automatically maintained least-privilege ingress boundary as application instances scale. Which rule is best?
- Allow all TCP ports from 10.0.0.0/8 so the database never needs another change.
- Move the broad ingress restriction to a subnet network ACL and allow PostgreSQL from the 10.0.0.0/8 CIDR.
- Allow TCP 5432 from 0.0.0.0/0 because only valid database passwords can authenticate.
- Reference the application's security group as the source on the database security group's TCP 5432 ingress rule.
Explanation
Correct Answer
D:A security-group source reference permits members of the approved application group rather than an entire changing address range. Autoscaled application instances inherit the intended network authorization.
Incorrect Answers
A:The broad CIDR still includes unrelated hosts and services. It fails to restrict ingress to actual application-tier members.
B:A subnet NACL remains CIDR- and subnet-oriented and is stateless. It cannot dynamically authorize only EC2 interfaces carrying the application security group, so it retains the unrelated-host exposure rather than matching the scaling application fleet.
C:Database authentication is not a substitute for limiting network exposure. Worldwide ingress broadens brute-force and exploitation paths.
