Exam SAA-C03
Design Secure Architectures

Choose a Question Set

Each set contains 20 questions from Design Secure Architectures.
Rotate through sets to cover the entire domain question pool.

1
Set 1
20 questions
20Q 25 min
Start Set 1
2
Set 2
20 questions
20Q 25 min
Start Set 2
3
Set 3
20 questions
20Q 25 min
Start Set 3
4
Set 4
20 questions
20Q 25 min
Start Set 4
5
Set 5
20 questions
20Q 25 min
Start Set 5
6
Set 6
20 questions
20Q 25 min
Start Set 6
7
Set 7
20 questions
20Q 25 min
Start Set 7
8
Set 8
20 questions
20Q 25 min
Start Set 8
9
Set 9
20 questions
20Q 25 min
Start Set 9
10
Set 10
20 questions
20Q 25 min
Start Set 10
11
Set 11
20 questions
20Q 25 min
Start Set 11
12
Set 12
20 questions
20Q 25 min
Start Set 12
13
Set 13
20 questions
20Q 25 min
Start Set 13
14
Set 14
20 questions
20Q 25 min
Start Set 14
15
Set 15
20 questions
20Q 25 min
Start Set 15
All Questions
300 questions
300Q Flexible
Start All
Quick Drill
15 questions
15Q 15 min
Quick Drill

Sample SAA-C03 Design Secure Architectures questions with explanations

Use these examples to check how the topics are tested. Read the explanation for every option you were unsure about, then start a scored practice set above.

Question 1 Domain 1: Design Secure Architectures

How can you secure an application's permissions to access AWS services without embedding credentials?

  • ✓ Use IAM roles for AWS resources.
  • ○ Use IAM users with access keys.
  • ○ Use AWS KMS to encrypt credentials.
  • ○ Use AWS Secrets Manager to store credentials.
Answer: A. Use IAM roles for AWS resources.
IAM roles allow AWS resources to assume temporary credentials, eliminating the need to embed static credentials. IAM users with access keys (B) require embedding. KMS (C) and Secrets Manager (D) manage credentials but do not eliminate the need for initial credentials.
Question 2 Domain 1: Design Secure Architectures

To control inbound and outbound traffic for Amazon EC2 instances in a VPC, which security feature should be used?

  • ○ Network Access Control Lists (NACLs)
  • ○ Security groups
  • ✓ Both security groups and NACLs
  • ○ AWS WAF rules
Answer: C. Both security groups and NACLs
Security groups act as stateful firewalls at the instance level, while NACLs are stateless firewalls at the subnet level; both are used together for layered security. AWS WAF is for web applications, not EC2 instance traffic control.
Question 3 Domain 1: Design Secure Architectures

A business requires a centralized solution to manage backups across AWS services like Amazon EBS, RDS, and DynamoDB. Which service should they use?

  • ✓ AWS Backup
  • ○ AWS Snapshots
  • ○ AWS CloudFormation
  • ○ AWS Systems Manager
Answer: A. AWS Backup
AWS Backup provides a centralized service to manage backups across multiple AWS services. Snapshots (B) are service-specific. CloudFormation (C) is for infrastructure as code. Systems Manager (D) is for management.
Question 4 Domain 1: Design Secure Architectures

For compliance, data archived in Glacier must be immutable for a fixed period. Which feature enforces this?

  • ✓ Glacier vault lock policies
  • ○ S3 Object Lock
  • ○ AWS Backup vault lock
  • ○ AWS KMS key policies
Answer: A. Glacier vault lock policies
Glacier vault lock allows setting immutable retention policies for archives. Option B is for S3 objects. Option C is for AWS Backup. Option D is for key management.
Question 5 Domain 1: Design Secure Architectures

A company wants to detect potentially unauthorized or malicious activity in their AWS accounts. Which service provides intelligent threat detection?

  • ○ AWS Config
  • ✓ Amazon GuardDuty
  • ○ AWS CloudTrail
  • ○ AWS Trusted Advisor
Answer: B. Amazon GuardDuty
Amazon GuardDuty uses machine learning to analyze CloudTrail logs, VPC flow logs, and DNS logs for threat detection. AWS Config monitors configuration changes. CloudTrail logs API calls but does not analyze for threats. Trusted Advisor gives optimization recommendations.

Open the full SAA-C03 Design Secure Architectures question-and-answer guide