AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 39
Question 380
A Lambda workload only needs permission to decrypt encrypted payloads with one KMS key. Its role also has kms:ScheduleKeyDeletion and full key-policy editing rights. What least-privilege redesign should be used?
- Grant the role unrestricted kms:* on all keys so missing key-policy statements never block API calls.
- Rotate the KMS key material monthly while leaving the Lambda role authorized for kms:ScheduleKeyDeletion and unrestricted key-policy administration.
- Keep ScheduleKeyDeletion because Lambda must be able to delete a key before every Decrypt invocation.
- Remove lifecycle administration from the workload role and grant narrowly scoped cryptographic usage to that key.
Explanation
Correct Answer
D:Applications that decrypt data do not need authority to destroy or reconfigure the key. Separating KMS administration from usage limits a compromised workload's blast radius.
Incorrect Answers
A:Account-wide cryptographic administration is unnecessary for one permitted decrypt and increases damaging operations.
B:Cryptographic key rotation does not restrict which principals can schedule key deletion or administer policies. Those administrative permissions must be separated from the function’s required decrypt usage.
C:Key destruction is not part of decryption and would endanger the data the function is supposed to process.
Question 381
A web team's TLS private key is currently stored in a world-readable S3 folder and included in a deployment tarball. The workload needs authenticated HTTPS on an AWS-managed endpoint that supports ACM. What improves private-key custody?
- Create an EC2 Auto Scaling launch template with the same plaintext key pasted into user data for all instances.
- Continue publishing the private key to S3 because public certificates imply their private keys should be downloadable by everyone.
- Put the PEM key into a Route 53 TXT record so TLS clients can verify it before connection.
- Use a supported managed certificate arrangement, such as ACM on the endpoint, rather than distributing plaintext PEM private keys.
Explanation
Correct Answer
D:ACM-integrated endpoints can manage certificate bindings and protected key material without every operator or deployment package receiving copies of the private key.
Incorrect Answers
A:Distributing a shared key in startup data broadly multiplies credential exposure and does not solve protected custody.
B:The certificate is public, but the associated private key must remain secret to prevent endpoint impersonation.
C:Public DNS records cannot securely hold a private key and are not a managed endpoint certificate custody service.
Question 382
An organization imports externally issued certificates for certain services and also issues some exportable certificates. A security review discovers that deployment operators can export private-key material without oversight. What rule is needed?
- Restrict access to private-key export for exportable certificate types and protect any legitimately exported material.
- Assume no ACM-related private key can ever be exported, so no monitoring or export permissions need review.
- Make certificate private keys public so clients can independently verify server identity without CA chains.
- Use an SQS dead-letter queue as the sole preventive control for exporting TLS private keys.
Explanation
Correct Answer
A:Not all certificate private keys have identical custody properties. Some AWS-issued ACM public certificates support exportable forms, so authorization must reflect the specific certificate type and lifecycle.
Incorrect Answers
B:Exportability varies by certificate type and offering; blanket assumptions can leave a privileged extraction path uncontrolled.
C:Publishing a private key enables impersonation rather than contributing legitimate server-authentication evidence.
D:Dead-letter queues handle failed message processing and do not authorize or deny certificate key-material export.
Question 383
A TLS private key used by a public service is discovered in an exposed repository. Developers want only to repoint DNS to a new hostname while continuing to serve the same compromised certificate. Which response is appropriate?
- Import the leaked private key into AWS Certificate Manager with a replacement hostname, then attach it to the public listener.
- Replace the compromised certificate and key, update endpoint associations and revoke the old certificate where applicable.
- Tighten the Application Load Balancer TLS security policy while continuing to use the exposed certificate private key.
- Renew the certificate while retaining the previously exposed private key and leave the original certificate unrevoked.
Explanation
Correct Answer
B:Changing DNS does not undo exposure of the signing private key. New key material and proper certificate lifecycle cleanup mitigate impersonation risk.
Incorrect Answers
A:Moving the same compromised private key to a different certificate name or service does not restore confidentiality of the signing key.
C:A stricter protocol/cipher policy can improve transport negotiation but does not undo theft of the private key used for endpoint identity.
D:A certificate renewal that reuses compromised key material still lets an attacker with that key impersonate the protected endpoint where trusted.
Question 384
A team imports its own TLS certificate into ACM for a service endpoint. The certificate is due to expire next month, and an engineer expects it to renew automatically like an eligible ACM-issued public certificate. What operating process is needed?
- Disable all TLS client certificate checks so expired imported certificates remain valid indefinitely.
- Assume every ACM certificate, including imported ones, always receives automatic issuer renewal without intervention.
- Monitor expiration and replace or renew imported certificates through the external issuer and AWS association workflow.
- Rotate an unrelated KMS key to extend the imported X.509 certificate NotAfter timestamp.
Explanation
Correct Answer
C:Imported certificates are not automatically renewed by ACM. Operators must track expiry and complete renewal and endpoint updates explicitly.
Incorrect Answers
A:Bypassing validation creates security exposure and does not properly renew or replace an expiring endpoint identity.
B:Managed renewal eligibility differs from imported certificate handling; the external issuer and upload lifecycle still matter.
D:KMS encryption-key rotation does not alter a certificate's signed validity period or create a renewed chain.
Question 385
A marketing archive has versioned S3 objects that must be permanently deleted after an approved retention period. Noncurrent versions are currently accumulating forever. Which lifecycle control should be considered?
- Configure S3 lifecycle expiration for current and noncurrent object versions according to the approved retention and legal constraints.
- Rely exclusively on a current-version transition to Standard-IA, which permanently deletes all historical versions.
- Enable Amazon Macie, which deletes every object at its retention deadline without any lifecycle rule.
- Enable MFA Delete on the versioned bucket but configure no expiration rule for noncurrent object versions.
Explanation
Correct Answer
A:Versioned buckets may keep older object revisions when the current version expires. Rules for noncurrent versions and delete markers need deliberate management.
Incorrect Answers
B:Storage-class transitions alter cost tiers; they are not automatic deletion of noncurrent version history.
C:Macie discovers sensitive S3 content; it does not enforce per-version object expiration by itself.
D:MFA Delete adds protection for certain version-related actions but does not schedule noncurrent version removal after the required retention period. Explicit lifecycle rules remain necessary to prevent indefinite buildup.
Question 386
An S3 object version is subject to an active legal hold under Object Lock. A standard lifecycle expiration rule would normally remove ordinary versions after ninety days. How should the held version behave?
- Change the storage class to Glacier Instant Retrieval, which silently removes the legal hold on the version.
- Make the bucket public-read so the lifecycle expiration worker obtains enough permissions to delete protected versions.
- The protected version must remain until its legal hold or applicable retention restriction is cleared; lifecycle cannot bypass the hold.
- Delete the protected object version immediately because lifecycle expiration always overrides Object Lock controls.
Explanation
Correct Answer
C:S3 Object Lock retention and legal hold protect specified object versions from deletion even when ordinary lifecycle policies would otherwise expire data.
Incorrect Answers
A:Storage-tier transitions do not release a legal hold or change mandatory immutability restrictions.
B:Public read access neither supplies authority to bypass legal holds nor reduces retention requirements.
D:Object Lock protection exists specifically to resist unauthorized version deletion until its conditions permit it.
Question 387
A data governance account owns a DynamoDB table. A Lambda execution role in a separate AWS account must call GetItem and Query directly on the table without assuming a role in the owner account or copying records. Both accounts are under approved management, and the security team wants narrow principal and action scope. Which permission arrangement is suitable?
- Create only an IAM Allow policy on a role in the table-owning account, without authorizing the caller in the other account or the table resource policy.
- Grant the external Lambda role the needed DynamoDB actions in its identity policy and permit that principal and those actions in a DynamoDB table resource-based policy.
- Create a global secondary index and assume its existence automatically lets every other AWS account read projected attributes.
- Set an AWS Organizations SCP Allow in the caller account and treat that as a complete table permission grant across both accounts.
Explanation
Correct Answer
B:DynamoDB supports resource-based policies on tables and streams. Direct cross-account access requires an appropriate Allow on the resource and the external principal’s identity side, with neither side otherwise denying the request.
Incorrect Answers
A:A policy attached to an unrelated role in the owner account does not authorize requests made directly as the external Lambda role. Cross-account resource and caller-side authorization must be arranged.
C:A global secondary index changes supported table query access patterns; it is not a cross-account authorization grant and cannot replace IAM/resource policy evaluation.
D:An SCP establishes a permission ceiling for member accounts rather than granting permissions to the external IAM role or the owning DynamoDB table. Additional explicit authorization is required.
Question 388
A privacy request requires deletion of a customer record. The live DynamoDB item is removed, but periodic backups and exported analytics datasets still contain the customer's information. Which governance response is required?
- Assume deleting the live row cryptographically erases every backup and derived dataset that ever referenced it.
- Enable DynamoDB TTL on the deleted item and claim it immediately purges every previously exported S3 object.
- Increase database read capacity so every customer copy is automatically located and removed across services.
- Plan deletion and verification across live data, derived copies and backup retention within the applicable legal and recovery constraints.
Explanation
Correct Answer
D:Deletion of one live row does not automatically erase historical backups, event streams or exported copies. An end-to-end data lifecycle policy is needed.
Incorrect Answers
A:Backups and copied datasets are separate artifacts and need their own retention, disposal and lawful-preservation rules.
B:TTL operates asynchronously on table items and does not revoke unrelated persisted copies in downstream services.
C:Provisioned throughput changes request capacity, not data inventory or cross-service deletion governance.
Question 389
An ecommerce API produces 20,000 thumbnail jobs in a minute, but its image processors can finish only 2,000 jobs per minute. The API must accept work quickly without waiting for each conversion. Which architecture best decouples these rates?
- Place the jobs in Amazon SQS and let independently scaled workers consume them.
- Publish the jobs only to a CloudWatch metric without storing job payloads anywhere.
- Write every pending job only to each web instance's memory and scale the web tier horizontally.
- Call each image processor synchronously and increase API Gateway request timeouts to wait for all jobs.
Explanation
Correct Answer
A:SQS durably buffers work between the bursty producer and slower worker fleet. The service can accept jobs while processing capacity catches up.
Incorrect Answers
B:Metrics track activity but do not act as a durable queue with receive and delete semantics for processing.
C:Instance-local memory can disappear with a scale-in event and does not provide a shared reliable work backlog.
D:Long synchronous requests tie client responsiveness to processor throughput and cannot sustainably absorb the burst.
Question 390
An SQS consumer spends up to ninety seconds processing an order, but the queue visibility timeout is thirty seconds. Another worker sometimes receives and processes the same still-running order. What setting should the architect address?
- Change the queue from Standard to FIFO and ignore job duration because FIFO disables visibility timeout entirely.
- Set a suitable visibility timeout or extend message visibility during long processing.
- Reduce the visibility timeout to five seconds to guarantee no duplicate processing.
- Increase only message retention from four to fourteen days, leaving visibility unchanged.
Explanation
Correct Answer
B:Visibility controls how long a received message is hidden before retry. It should accommodate the job duration and failure recovery design.
Incorrect Answers
A:FIFO queues still use visibility controls and application failure/retry semantics; queue type alone does not fix timing.
C:Shorter invisibility causes messages to become available sooner, increasing concurrent duplicate-processing risk.
D:Retention governs queue lifetime, not how quickly an in-flight message can reappear to competing consumers.
