1
Single choice~90s
An application running on Amazon EC2 needs to read and write objects in an Amazon S3 bucket. What is the MOST secure way to grant this access?
AWS Certified Solutions Architect – Associate
AWS_SAA_C03Ready to test yourself?
A timed, blueprint-proportional exam drawn fresh from this bank — with a per-domain score report.
🔓 Free preview: showing 10 of 289 questions. Unlock the full bank — every question, explanation, and reference.
Unlock all 289 questions →10 questions across 4 topics. Choose an answer for each question, then check it to see the correct answer and explanation.
Filter by topic
9 questions in Design Secure Architectures
SECURE
Design Secure Architectures
9 questions in topicSecure access to AWS resources, secure workloads and applications, and appropriate data security controls.
2
Single choice~110s
A company has separate AWS accounts for development and production. Developers in the dev account need temporary, auditable access to a specific S3 bucket in the production account. What is the recommended approach?
3
Single choice~90s
A regulatory requirement mandates that all data stored in an S3 bucket be encrypted at rest with keys the company can centrally manage, audit, and rotate. Which option meets this requirement?
4
Single choice~120s
A three-tier web application runs in a VPC. The database tier must not be reachable from the internet but still needs to download software patches from the internet. How should the architecture be designed?
5
Single choice~90s
A public-facing web application must be protected against common web exploits such as SQL injection and cross-site scripting at the edge. Which combination is appropriate?
6
Single choice~100s
An application connects to an Amazon RDS database using a username and password. Security requires that the credentials be stored securely and rotated automatically without code changes. Which service should the architect use?
7
Single choice~120s
A solutions architect is securing a three-tier application with security groups. Which configuration follows least-privilege segmentation between the web, application, and database tiers?
8
Single choice~90s
An Application Load Balancer must terminate HTTPS traffic for a web application, and the company wants AWS to provision and automatically renew the required public TLS certificate at no additional cost. Which service should be used?
9
Single choice~120s
Static content is served from an S3 bucket through Amazon CloudFront. The company wants users to reach the content ONLY through CloudFront and never by hitting the S3 bucket URL directly. What should the architect configure?