Design secure architectures
56 practice questions with explanations — 15 free to try
3 of these 56 questions are in the free 15-question taster · the full topic is part of Premium
PassNova has 56 AWS Solutions Architect (SAA-C03) practice questions on Design secure architectures, each with a clear explanation. A 15-question taster is free with no sign-up; the full bank is part of PassNova Premium. Updated for 2026.
Design secure architectures: example questions & answers
3 worked examples with answers and explanations below. Try 15 AWS Solutions Architect (SAA-C03) questions free in the browser; the full 56-question Design secure architectures bank is part of PassNova Premium.
An application running on EC2 must access an S3 bucket securely without storing long-term credentials on the instance. What is the recommended approach?
- AEmbed an IAM user's access keys in the application code
- BStore credentials in a config file on the instance
- CAttach an IAM role to the EC2 instance✓
- DUse the root account's long-term access keys on the instance
Answer: Attaching an IAM role to the EC2 instance provides temporary, automatically rotated credentials via the instance metadata service, avoiding the risk of hard-coded long-term keys.
A company needs to grant a third-party AWS account temporary access to specific resources without sharing long-term credentials. What is the BEST approach?
- ACreate an IAM user and share its access keys
- BCreate a cross-account IAM role that the third party can assume✓
- CMake the S3 bucket public
- DShare the root account password
Answer: A cross-account IAM role allows the external account to assume the role and obtain temporary credentials, following least-privilege without sharing long-term keys.
A company must encrypt data at rest in an S3 bucket and retain full control over the encryption keys, including rotation, using a managed key service. Which option meets this?
- ASSE-S3 with Amazon-managed keys
- BClient-side encryption with no key management
- CRely on bucket policies alone, without encryption
- DSSE-KMS with a customer managed key✓
Answer: SSE-KMS with a customer managed key lets the company control key policies, rotation, and auditing through AWS KMS while AWS handles the encryption operation server-side.