Free Amazon SAA-C03 Exam Questions

Question 1

A company stores data for multiple business units in a single Amazon S3 bucket that is in the company'spayer AWS account. To maintain data isolation, the business units store data in separate prefixes in the S3bucket by using an S3 bucket policy.The company plans to add a large number of dynamic prefixes. The company does not want to rely on asingle S3 bucket policy to manage data access at scale. The company wants to develop a secure accessmanagement solution in addition to the bucket policy to enforce prefix-level data isolation.

A : Configure the S3 bucket policy to deny s3:GetObject permissions for all users. Configure the bucket policy to allow s3:* access to individual business units.

B : Enable default encryption on the S3 bucket by using server-side encryption with Amazon S3 managed keys (SSE-S3).

C : Configure resource-based permissions on the S3 bucket by creating an S3 access point for each business unit.

D : Use pre-signed URLs to provide access to the S3 bucket.

Answer: C

Question 2

A company runs a web application on Amazon EC2 instances in an Auto Scaling group that has a targetgroup. The company designed the application to work with session affinity (sticky sessions) for a better userexperience.The application must be available publicly over the internet as an endpoint. A WAF must be applied to theendpoint for additional security. Session affinity (sticky sessions) must be configured on the endpoint.

A : Create a public Network Load Balancer. Specify the application target group.

B : Create a Gateway Load Balancer. Specify the application target group

C : Create a public Application Load Balancer. Specify the application target group.

D : Create a second target group. Add Elastic IP addresses to the EC2 instances.

E : Create a web ACL in AWS WAF. Associate the web ACL with the endpoint.

Answer: C,E

Question 3

A company receives data transfers from a small number of external clients that use SFTP software on an Amazon EC2 instance. The clients use an SFTP client to upload data. The clients use SSH keys for authentication. Every hour, an automated script transfers new uploads to an Amazon S3 bucket for processing. The company wants to move the transfer process to an AWS managed service and to reduce the time required to start data processing. The company wants to retain the existing user management and SSH key generation process. The solution must not require clients to make significant changes to their existing processes. Which solution will meet these requirements?

A : Reconfigure the script that runs on the EC2 instance to run every 15 minutes. Create an S3 Event Notifications rule for all new object creation events. Set an Amazon Simple Notification Service (Amazon SNS) topic as the destination.

B : Create an AWS Transfer Family SFTP server that uses the existing S3 bucket as a target. Use servicemanaged users to enable authentication.

C : Require clients to add the AWS DataSync agent into their local environments. Create an IAM user for each client that has permission to upload data to the target S3 bucket.

D : Create an AWS Transfer Family SFTP connector that has permission to access the target S3 bucket for each client. Store credentials in AWS Systems Manager. Create an IAM role to allow the SFTP connector to securely use the credentials.

Answer: B

Question 4

A company is using Amazon S3 to store frequently accessed data. The S3 bucket is shared with external users that will upload files regularly. A Solutions Architect needs to implement a solution that will grant the bucket owner full access to all uploaded objects in the S3 bucket.

What action should be done to achieve this task?

A : eate a CORS configuration in the S3 bucket.

B : able the Requester Pays feature in the Amazon S3 bucket.

C : able server access logging and set up an IAM policy that will require the users to set the object's ACL to bucket-owner-full-control.

D : eate a bucket policy that will require the users to set the object's ACL to bucket-owner-full-control.

Answer: D

Question 5

A company has an e-commerce site. The site is designed as a distributed web application hosted in multipleAWS accounts under one AWS Organizations organization. The web application is comprised of multiplemicroservices. All microservices expose their AWS services either through Amazon CloudFront distributionsor public Application Load Balancers (ALBs). The company wants to protect public endpoints from maliciousattacks and monitor security configurations. Which solution will meet these requirements with the LEASToperational overhead?

A : Use AWS WAF to protect the public endpoints. Use AWS Firewall Manager from a dedicated securityaccount to manage rules in AWS WAF. Use AWS Config rules to monitor the Regional and globalWAF configurations.

B : Use AWS WAF to protect the public endpoints. Apply AWS WAF rules in each account. Use AWSConfig rules and AWS Security Hub to monitor the WAF configurations of the ALBs and theCloudFront distributions.

C : Use AWS WAF to protect the public endpoints. Use AWS Firewall Manager from a dedicated securityaccount to manage the rules in AWS WAF. Use Amazon Inspector and AWS Security Hub to monitorthe WAF configurations of the ALBs and the CloudFront distributions.

D : Use AWS Shield Advanced to protect the public endpoints. Use AWS Config rules to monitor theShield Advanced configuration for each account.

Answer: A