SAA-C03 Design Secure Architectures practice questions

Design Secure Architectures is 30% of the AWS Certified Solutions Architect – Associate (SAA-C03) exam, the heaviest of its 4 domains: roughly 15 of the 50 scored questions, and every 10% of accuracy here moves your scaled score about 30 points. Below are 7 free questions from this domain only, each with the answer explained and why every wrong option misses. Last updated 2026-07-03.

Every question is verified against official AWS documentation, linked below each answer.

  1. Question 1Design Secure Architectures

    A company runs a web application that uses Amazon Cognito User Pools. A security team wants to automatically block sign-ins from users whose credentials appear in a known compromised password database, without writing custom Lambda code. Which Cognito feature addresses this?

    Reveal answer & explanation

    Answer: A. Cognito advanced security features with compromised credentials detection enabled

    Cognito's advanced security features include compromised credentials detection, which checks passwords against a database of known compromised credentials during sign-in and sign-up and can block or flag those attempts natively, with no Lambda code required.

    Go deeper: Why is a native feature preferable here to writing custom Lambda logic that does something similar? What's the difference between blocking a bad IP and blocking a bad credential?

    Source: official AWS documentation · verified 2026-07-03

  2. Question 2Design Secure Architectures

    A company wants to enforce that IAM users can only perform AWS actions from a specific geographic region (us-east-1) and must deny all actions attempted from any other region. Which IAM condition key should be used to enforce this in an SCP or IAM policy?

    Reveal answer & explanation

    Answer: A. aws:RequestedRegion with a StringNotEquals condition

    aws:RequestedRegion is the condition key that restricts which AWS region an API call targets. Using StringNotEquals with a list of allowed regions cleanly denies calls aimed at any other region.

    Go deeper: Why does the region an API call targets need its own condition key, separate from the caller's identity or location? What's unreliable about trying to infer a caller's region from their source IP?

    Source: official AWS documentation · verified 2026-07-03

  3. Question 3Design Secure Architectures

    A company wants to receive an alert any time someone creates, modifies, or deletes a security group in their AWS account. Which is the simplest combination of services to achieve this?

    Reveal answer & explanation

    Answer: A. Enable AWS CloudTrail, create an Amazon EventBridge rule matching EC2 security group API events, and trigger an SNS notification

    CloudTrail captures all EC2 API calls, including security group modifications. An EventBridge rule can match specific events — like AuthorizeSecurityGroupIngress, CreateSecurityGroup, or DeleteSecurityGroup — and route them straight to SNS for near-real-time alerts, with no custom code.

    Go deeper: Why does routing CloudTrail events through EventBridge avoid the need for custom polling code? What's the tradeoff between a polling-based detection approach and an event-driven one?

    Source: official AWS documentation · verified 2026-07-03

  4. Question 4Design Secure Architectures

    A security engineer is auditing IAM policies and finds a role with the following condition on an S3 policy: 'aws:MultiFactorAuthPresent': 'true'. The role is used by an EC2 instance via an instance profile. Will EC2 instance calls to S3 succeed? Explain the issue.

    Reveal answer & explanation

    Answer: B. No, EC2 instance profile calls never set aws:MultiFactorAuthPresent to true, so the condition will always deny access

    The aws:MultiFactorAuthPresent condition key evaluates to false (or is absent) for calls made with temporary credentials from an EC2 instance profile, because no interactive MFA step occurs when the EC2 service assumes the role. A policy requiring this condition to be true will therefore always deny calls made through the instance profile, breaking the application.

    Go deeper: Why can't a machine identity like an EC2 instance ever satisfy an interactive MFA condition? What would you need to change in the policy to let instance-profile calls succeed?

    Source: official AWS documentation · verified 2026-07-03

  5. Question 5Design Secure Architectures

    A company's security policy requires that all API Gateway REST API endpoints be accessible only to applications running inside the company's VPC. Requests originating from the public internet must be rejected. What is the correct configuration?

    Reveal answer & explanation

    Answer: B. Deploy the API as a Private endpoint type, create a VPC endpoint for API Gateway, and attach a resource policy that denies access from outside the VPC endpoint

    Private API Gateway endpoints are specifically designed to be reachable only from within a VPC, via an interface VPC endpoint using AWS PrivateLink. Adding a resource policy that denies access outside the VPC endpoint's source VPC condition ensures no public access is possible.

    Go deeper: Why is a Private endpoint type a stronger control than a public endpoint plus a WAF rule? What role does the VPC endpoint's source-VPC condition play in the resource policy?

    Source: official AWS documentation · verified 2026-07-03

  6. Question 6Design Secure Architectures

    A company wants to ensure that Amazon S3 server access logs for a bucket named 'app-data' are stored securely and that the logging configuration cannot be disabled by any team member except the security team. Which combination of controls achieves this?

    Reveal answer & explanation

    Answer: A. Enable S3 server access logging and use an S3 bucket policy that denies s3:PutBucketLogging except for the security team's IAM role

    Enabling S3 server access logging and adding a bucket policy that denies s3:PutBucketLogging to everyone except the security team's role ensures only that team can modify or disable logging — a preventive control targeted exactly at the right people.

    Go deeper: Why does an org-wide SCP block go too far compared to a targeted bucket policy? What's the difference between a preventive control and a detective control here?

    Source: official AWS documentation · verified 2026-07-03

  7. Question 7Design Secure Architectures

    A company uses AWS Organizations with SCPs. A member account has an SCP attached that allows only s3:* and ec2:* actions. An IAM administrator in the member account creates an IAM policy granting iam:CreateUser and attaches it to a developer's IAM user. The developer attempts to call iam:CreateUser. What is the outcome?

    Reveal answer & explanation

    Answer: B. The call fails because the SCP does not include iam:CreateUser, and SCPs act as a maximum permissions boundary for the account

    SCPs set the maximum permissions available in a member account. Even though the IAM policy explicitly grants iam:CreateUser, the attached SCP only allows s3:* and ec2:* — since iam:CreateUser falls outside that boundary, the call is denied regardless of what the IAM policy says.

    Go deeper: Why does an SCP override an explicit Allow in an IAM policy? What would need to change in the SCP for this call to succeed?

    Source: official AWS documentation · verified 2026-07-03

More SAA-C03 practice