AWS SAA-C03 Practice Test

SAA-C03 practice test: what's covered

• SAA-C03

Free SAA-C03 sample questions

1. An application running on EC2 needs to read objects from an S3 bucket. A solutions architect must grant access following AWS security best practices. Which approach should be used?

   • A. Create an IAM user, generate access keys, and store them in the application's configuration file on the instance
   • B. Attach an IAM role with an S3 read policy to the EC2 instance so the SDK obtains temporary credentials automatically
   • C. Make the S3 bucket public and restrict access using a security group on the bucket
   • D. Embed the AWS account root access keys as environment variables in the EC2 user data
   Show answer

   Correct: B. An instance profile (IAM role) delivers automatically rotated temporary credentials via the metadata service, so no long-lived keys are stored. Static access keys in config files are incorrect because they can leak and do not rotate. A public bucket is unsafe and security groups do not apply to S3. Root keys must never be used for applications.

2. A company stores database credentials that must be rotated automatically every 30 days without code changes. Which AWS service best meets this requirement?

   • A. AWS Systems Manager Parameter Store standard parameters
   • B. AWS Secrets Manager with rotation enabled for the RDS database
   • C. Amazon S3 with server-side encryption using SSE-KMS
   • D. AWS Key Management Service customer-managed keys
   Show answer

   Correct: B. Secrets Manager natively rotates RDS credentials on a schedule using a Lambda rotation function, and applications retrieve them at runtime without redeployment. Parameter Store standard parameters do not rotate automatically, so that is incorrect. S3 and KMS store data and keys but do not manage or rotate database secrets, unlike Secrets Manager.

3. A security team wants layered network controls in a VPC. Which statements accurately describe security groups versus network ACLs? (Choose TWO)

   • A. Security groups are stateful, so return traffic is automatically allowed regardless of inbound rules
   • B. Network ACLs are stateless and evaluate separate inbound and outbound rules per subnet
   • C. Security groups support explicit deny rules that override allow rules within the group
   • D. Network ACLs operate at the elastic network interface level attached to an instance
   • E. Security groups are evaluated before the request even reaches the subnet boundary
   Show answer

   Correct: A and B. Security groups are stateful at the instance ENI level, so allowed inbound flows automatically permit their return traffic. Network ACLs are stateless subnet-level filters needing explicit inbound and outbound rules. Security groups support only allow rules, not deny, so that option is incorrect. NACLs apply at the subnet, not the ENI, and the evaluation-order claim is not accurate.

4. An application in Account A must read objects from an S3 bucket owned by Account B without sharing long-term credentials. What is the most secure design?

   • A. Generate access keys in Account B and email them securely to the Account A team
   • B. Configure a bucket policy in Account B plus an IAM role in Account A assumed via sts:AssumeRole
   • C. Enable public read access on the Account B bucket and restrict it by source IP only
   • D. Copy all objects nightly into an Account A bucket using an unauthenticated sync job
   Show answer

   Correct: B. Cross-account IAM role assumption with sts:AssumeRole grants temporary, least-privilege access and avoids shared keys. Emailing access keys is insecure and unrotatable, so it is incorrect. Public access is unsafe even with IP filtering, and nightly unauthenticated copies are not a secure access pattern and duplicate storage cost.

5. An organization wants to ensure that member accounts can never disable AWS CloudTrail, even if an account admin has full IAM permissions. Which control enforces this?

   • A. A Service Control Policy in AWS Organizations denying cloudtrail:StopLogging
   • B. An IAM permissions boundary applied to every user in the member account
   • C. A resource-based policy attached to the CloudTrail trail in each account
   • D. A security group rule that blocks CloudTrail management API endpoints
   Show answer

   Correct: A. SCPs are organization-wide guardrails that cap the maximum permissions of member accounts; a deny on cloudtrail:StopLogging cannot be overridden by local IAM admins. Permissions boundaries limit individual identities but an admin could remove them, so that is incorrect. CloudTrail has no resource policy for this, and security groups do not govern AWS API actions.

Last updated: 2026-10-19

SAA-C03 practice test FAQ

Related practice tests

• CLF-C02 practice test
• DVA-C02 practice test
• SAP-C02 practice test
• SOA-C02 practice test
• SCS-C02 practice test
• AZ-104 practice test