1.0 Design Secure Architectures SAA-C03 Practice Quiz

• A. Secure access to AWS resources means designing identity, authorization, and account controls that allow required access while reducing unnecessary permissions and exposure.
• B. IAM users are long-term identities in an AWS account that can be assigned credentials and permissions for specific access needs.
• C. IAM groups collect IAM users so permissions can be assigned consistently to multiple users.
• D. IAM roles provide temporary credentials and permissions that can be assumed by AWS services, users, or accounts.

Secure access to AWS resources means designing identity, authorization, and account controls that allow required access while reducing unnecessary permissions and exposure. This is the correct answer.

• A. Role switching lets a user or identity assume another IAM role to receive temporary permissions for a task.
• B. IAM users are long-term identities in an AWS account that can be assigned credentials and permissions for specific access needs.
• C. Secure access to AWS resources means designing identity, authorization, and account controls that allow required access while reducing unnecessary permissions and exposure.
• D. Cross-account access allows identities in one AWS account to access resources in another account through roles or resource policies.

IAM users are long-term identities in an AWS account that can be assigned credentials and permissions for specific access needs. This is the correct answer.

• A. Service control policies is the best fit when the secure AWS architecture requires this design behavior: Service control policies set maximum permission boundaries across accounts in AWS Organizations.
• B. Secure access to AWS resources is the best fit when the secure AWS architecture requires this design behavior: Secure access to AWS resources means designing identity, authorization, and account controls that allow required access while reducing unnecessary permissions and exposure.
• C. Resource policies is the best fit when the secure AWS architecture requires this design behavior: Resource policies are attached to resources and define which principals can access those resources and under what conditions.
• D. Federated access is the best fit when the secure AWS architecture requires this design behavior: Federated access allows users from an external identity provider or directory to access AWS using temporary credentials or roles.

Secure access to AWS resources means designing identity, authorization, and account controls that allow required access while reducing unnecessary permissions and exposure. This matches the secure architecture scenario without confusing identity access, network protection, application security, threat detection, encryption, backup, or data governance. This is the correct answer.

• A. Private subnets is the best fit when the secure AWS architecture requires this design behavior: Private subnets contain resources that should not be directly reachable from the internet.
• B. Security groups is the best fit when the secure AWS architecture requires this design behavior: Security groups are stateful virtual firewalls that control inbound and outbound traffic for supported AWS resources.
• C. IAM users is the best fit when the secure AWS architecture requires this design behavior: IAM users are long-term identities in an AWS account that can be assigned credentials and permissions for specific access needs.
• D. Network ACLs is the best fit when the secure AWS architecture requires this design behavior: Network ACLs are stateless subnet-level traffic filters that evaluate inbound and outbound traffic separately.

IAM users are long-term identities in an AWS account that can be assigned credentials and permissions for specific access needs. This matches the secure architecture scenario without confusing identity access, network protection, application security, threat detection, encryption, backup, or data governance. This is the correct answer.

• A. VPN connectivity is the best fit when the secure AWS architecture requires this design behavior: VPN connectivity secures network traffic between AWS and another network over encrypted tunnels.
• B. AWS Direct Connect security is the best fit when the secure AWS architecture requires this design behavior: AWS Direct Connect security uses private dedicated connectivity and often additional encryption designs when needed for sensitive hybrid traffic.
• C. AWS Secrets Manager is the best fit when the secure AWS architecture requires this design behavior: AWS Secrets Manager stores, rotates, and manages secrets such as database credentials, API keys, and passwords.
• D. IAM groups is the best fit when the secure AWS architecture requires this design behavior: IAM groups collect IAM users so permissions can be assigned consistently to multiple users.

IAM groups collect IAM users so permissions can be assigned consistently to multiple users. This matches the secure architecture scenario without confusing identity access, network protection, application security, threat detection, encryption, backup, or data governance. This is the correct answer.

• A. A design points to Route tables when the security requirement depends on this architectural distinction: Route tables determine where subnet or gateway traffic is directed within a VPC architecture.
• B. A design points to VPC endpoints when the security requirement depends on this architectural distinction: VPC endpoints provide private connectivity from a VPC to supported AWS services without requiring public internet routing.
• C. A design points to Secure access to AWS resources when the security requirement depends on this architectural distinction: Secure access to AWS resources means designing identity, authorization, and account controls that allow required access while reducing unnecessary permissions and exposure.
• D. A design points to AWS PrivateLink when the security requirement depends on this architectural distinction: AWS PrivateLink provides private connectivity to supported services through private IP addresses in a VPC.

Secure access to AWS resources means designing identity, authorization, and account controls that allow required access while reducing unnecessary permissions and exposure. This distinction matters because choosing a nearby concept would lead to the wrong access model, network boundary, credential design, encryption control, or data protection strategy. This is the correct answer.

• A. A design points to Amazon Cognito when the security requirement depends on this architectural distinction: Amazon Cognito provides user sign-up, sign-in, and access control for web and mobile applications.
• B. A design points to AWS WAF when the security requirement depends on this architectural distinction: AWS WAF protects web applications by filtering HTTP and HTTPS requests based on configurable rules.
• C. A design points to AWS Shield when the security requirement depends on this architectural distinction: AWS Shield provides managed protection against distributed denial-of-service attacks.
• D. A design points to IAM users when the security requirement depends on this architectural distinction: IAM users are long-term identities in an AWS account that can be assigned credentials and permissions for specific access needs.

IAM users are long-term identities in an AWS account that can be assigned credentials and permissions for specific access needs. This distinction matters because choosing a nearby concept would lead to the wrong access model, network boundary, credential design, encryption control, or data protection strategy. This is the correct answer.

• A. Amazon Macie is the correct architecture choice when the secure access, workload protection, or data security decision depends on this exact meaning: Amazon Macie discovers and helps protect sensitive data such as personally identifiable information in Amazon S3.
• B. Security segmentation is the correct architecture choice when the secure access, workload protection, or data security decision depends on this exact meaning: Security segmentation separates workloads or tiers by subnet, route, security group, network ACL, account, or service boundary to reduce blast radius.
• C. Data security controls is the correct architecture choice when the secure access, workload protection, or data security decision depends on this exact meaning: Data security controls protect data access, classification, encryption, retention, backup, replication, and recovery according to business and compliance requirements.
• D. Secure access to AWS resources is the correct architecture choice when the secure access, workload protection, or data security decision depends on this exact meaning: Secure access to AWS resources means designing identity, authorization, and account controls that allow required access while reducing unnecessary permissions and exposure.

Secure access to AWS resources means designing identity, authorization, and account controls that allow required access while reducing unnecessary permissions and exposure. This applies the concept at the point where a solutions architect must choose the secure design that meets business requirements while reducing risk and unnecessary access. This is the correct answer.