SAA-C03: Design Secure Architectures
Design Secure Architectures is one of the skill areas tested on the Solutions Architect – Associate (SAA-C03) exam. Below are free SAA-C03 practice questions with worked answers and a concept diagram — each with a plain-language explanation. Practice the first 10 questions of SAA-C03 free, no signup.
The concept, in one picture
3 free SAA-C03 Design Secure Architectures questions
A freight brokerage runs a dozen AWS accounts under AWS Organizations, one per business unit. An S3 bucket in the management account holds quarterly compliance reports, and the security team wants only principals belonging to accounts in the organization to be able to read them. Business units are added and retired several times a year. What is the lowest-maintenance way to enforce this?
- Apply a tag to every IAM user who needs the reports and require a matching aws:PrincipalTag value in the bucket policy.
- Create an organizational unit for each business unit and write the bucket policy around the aws:PrincipalOrgPaths condition key.
- Monitor AWS CloudTrail for account creation, invitation, and removal events and trigger automation that rewrites the bucket policy with the current list of account IDs.
- ✓ Add a condition to the bucket policy on the aws:PrincipalOrgID global condition key that references the organization's ID.
The aws:PrincipalOrgID condition key lets a single bucket policy statement allow only callers whose account currently belongs to the named organization, and it stays accurate on its own as business units join or leave. Matching on aws:PrincipalOrgPaths reaches the same outcome but obliges you to design and maintain an organizational unit hierarchy and enumerate paths in the policy. Watching organization events in CloudTrail and rewriting the policy with account IDs is custom automation you now own, and the policy is briefly stale after every membership change. Tagging individual users means touching every new hire and grants access to anyone carrying that tag, including principals outside the organization.
A logistics company runs Amazon RDS for PostgreSQL databases in three AWS Regions. Security policy requires the database passwords to be changed every 90 days, and the same credentials must be available to applications in every Region. The platform team is small and wants to avoid writing and maintaining custom code. What should a solutions architect recommend?
- Write the credentials to an Amazon S3 bucket that uses server-side encryption with AWS KMS keys, and use an Amazon EventBridge schedule to invoke a function that overwrites the objects with new passwords.
- Save the credentials as SecureString parameters in AWS Systems Manager Parameter Store, copy the parameters into each Region, and schedule a job that updates them every 90 days.
- ✓ Store the credentials in AWS Secrets Manager, create replica secrets in each of the other Regions, and enable managed rotation against the RDS databases.
- Encrypt the credentials with an AWS KMS multi-Region key, keep the ciphertext in an Amazon DynamoDB global table, and rotate the values with a custom AWS Lambda function.
Secrets Manager is the only service here that both rotates RDS credentials for you with a built-in rotation function and keeps replica copies synchronized in other Regions, so the team writes no rotation code at all. Parameter Store SecureString values have no native rotation and no replication feature, leaving you to build and schedule the whole workflow yourself. Putting passwords in an encrypted S3 bucket and driving changes from EventBridge means owning the rotation logic and storing secrets in a service with no secret-specific access or versioning controls. A KMS multi-Region key only solves the encryption half of the problem; the DynamoDB global table plus custom Lambda still leaves all of the rotation work on the team.
A media streaming company has moved its encoding platform into a single VPC. In its former data center, a hardware appliance sat in the network path and inspected every packet entering and leaving the environment, dropping anything that matched a threat signature. The company needs the same inline inspection and blocking behavior in AWS without building its own appliance fleet. What should a solutions architect deploy?
- Enable Amazon GuardDuty for the account so it inspects packets in the VPC and drops traffic that matches known threats.
- Turn on VPC Traffic Mirroring for the workload subnets and apply mirror filters so unwanted packets are discarded.
- Use AWS Firewall Manager to author inspection and filtering rules and attach them directly to the VPC.
- ✓ Deploy AWS Network Firewall endpoints in the VPC, route subnet traffic through them, and define stateful rule groups that allow or drop traffic.
AWS Network Firewall is a managed, inline firewall: you place its endpoints in the VPC, route traffic through them, and write stateful rules that inspect and drop packets, which is exactly what the old appliance did. GuardDuty is a detection service that analyzes logs and flow metadata and produces findings; it never sits in the data path and cannot block anything. Traffic Mirroring copies packets to an out-of-band analyzer, so its filters only decide what gets copied, not what gets delivered. Firewall Manager is a central policy manager that deploys and audits firewall policies across many accounts in an organization; it performs no inspection itself and adds nothing for one VPC that has no firewall behind it.
Practice SAA-C03 free
The first 10 questions of every exam are free. No signup, no email wall.
Start practicing →Get a free SAA-C03 study plan by email
A short plan to work through SAA-C03 by skill area, plus a note when we add new questions. Optional — the practice above stays free. No spam, unsubscribe anytime.