The second half of the SAA-C03 security domain covers protecting data and networks: encryption at rest and in transit, private connectivity, web and DDoS protection, and services that find threats and sensitive data for you. Many questions ask for the most secure option that also adds the least operational work, so managed services usually win.
This is the third set in our SAA-C03 series (Questions 21-30). It follows SAA-C03 Questions 11-20 on identity and access. Every question is an original practice scenario mapped to the official exam guide, not a copy of a real exam item.
Choose your answer before you reveal it, and notice which layer each service protects.
Question 21: Every New Volume Must Be Encrypted
A company requires that every new Amazon EBS volume and snapshot in its account be encrypted, without relying on each engineer to tick a box when launching instances. What is the simplest way to enforce this in each Region?
A) Write a script that checks volumes every night and deletes unencrypted ones
B) Turn on EBS encryption by default for the account in each Region
C) Use instance store volumes instead of EBS
D) Encrypt files inside the operating system after launch
👁 Reveal Answer
Correct Answer: B
Explanation: EBS encryption by default is an account-level setting for each Region. Once enabled, new EBS volumes and snapshot copies are encrypted automatically with the default KMS key or a key you choose. A reacts after the fact and could destroy data. C uses temporary storage that is lost when an instance stops, which does not suit most workloads. D depends on every team doing it correctly and does not cover snapshots in the same way.
Reference: Enable Amazon EBS encryption by default
Question 22: Controlling Who Can Use an Encryption Key
A bank encrypts sensitive data with AWS KMS. It must decide exactly which roles can use the key, separate key administrators from key users, and see every use of the key in its audit logs. Which type of key should it use?
A) An AWS owned key
B) No encryption, relying on IAM policies alone
C) A key stored in a configuration file on each server
D) A customer managed KMS key with a key policy that grants administration and usage permissions to specific roles
👁 Reveal Answer
Correct Answer: D
Explanation: With a customer managed key, you control the key policy, which is the primary way to control access to a KMS key. You can grant key administration to one group and encrypt and decrypt permissions to specific roles, and AWS CloudTrail records use of the key. A is owned and managed by AWS for use across accounts, so you cannot view, manage, or audit it in your account. B does not meet the encryption requirement. C exposes key material and is not managed by KMS at all.
Reference: Examining the key policy (AWS KMS)
Question 23: HTTPS for a Load Balancer Without Certificate Chores
A company runs a website behind an Application Load Balancer. It needs a publicly trusted TLS certificate for www.example.com and does not want to track expiry dates or install renewed certificates by hand. What should it do?
A) Request a public certificate from AWS Certificate Manager (ACM) and attach it to the load balancer’s HTTPS listener
B) Generate a self-signed certificate on one EC2 instance
C) Buy a certificate each year and upload it to every EC2 instance
D) Use HTTP only and rely on security groups for protection
👁 Reveal Answer
Correct Answer: A
Explanation: ACM provides public certificates that work with integrated services such as Elastic Load Balancing and Amazon CloudFront, and ACM renews them automatically through managed renewal. Attaching the certificate to the ALB’s HTTPS listener also offloads TLS from the instances. B is not trusted by browsers. C works but adds exactly the manual work the company wants to avoid. D sends data unencrypted.
Reference: Managed certificate renewal in AWS Certificate Manager
Question 24: Software Updates for Private Instances
Application servers in private subnets across two Availability Zones need to download operating system updates from the internet. They must not be reachable from the internet, and losing one Availability Zone should not cut off internet access for the other. What should the architect deploy?
A) Public IP addresses on the application servers
B) A single NAT instance in one Availability Zone
C) A NAT gateway in a public subnet in each Availability Zone, with each private subnet routing to the NAT gateway in its own zone
D) An internet gateway route in the private subnets’ route table
👁 Reveal Answer
Correct Answer: C
Explanation: A NAT gateway lets instances in private subnets start outbound connections to the internet while blocking connections started from the internet. A NAT gateway lives in a single Availability Zone, so for resilience you create one in each zone and route each private subnet to the gateway in its own zone. A and D make the servers reachable from the internet, which turns the private subnets into public ones. B is a single point of failure and requires you to manage the instance yourself.
Reference: NAT gateway use cases
Question 25: Reaching S3 Without Touching the Internet
EC2 instances in a private subnet process files stored in Amazon S3 in the same Region. Security wants this traffic to stay on the AWS network instead of passing through a NAT gateway to the internet. What is the simplest solution?
A) An AWS Site-to-Site VPN connection
B) A second NAT gateway
C) AWS Direct Connect
D) A gateway VPC endpoint for Amazon S3, added to the private subnet’s route table
👁 Reveal Answer
Correct Answer: D
Explanation: A gateway endpoint for S3 adds a route to S3 in the subnet’s route table, so traffic from the instances to S3 stays on the AWS network without an internet gateway or NAT device. Gateway endpoints have no additional charge, and you can restrict access further with an endpoint policy or bucket policy conditions. A and C connect on-premises networks to AWS. B still sends traffic through NAT to S3’s public endpoints and adds data processing charges.
Reference: Gateway endpoints for Amazon S3
Question 26: SQL Injection Attempts Against a Public Site
An e-commerce site runs behind an Application Load Balancer. Logs show repeated SQL injection and cross-site scripting attempts in HTTP requests. The team wants to block these requests before they reach the application, with minimal custom rule writing. What should it use?
A) AWS WAF attached to the load balancer, using AWS managed rule groups for SQL injection and common exploits
B) Network ACLs that block port 443
C) Amazon Inspector
D) AWS Shield Standard
👁 Reveal Answer
Correct Answer: A
Explanation: AWS WAF inspects HTTP and HTTPS requests to resources such as Application Load Balancers, CloudFront distributions, and API Gateway APIs. AWS managed rule groups cover common threats such as SQL injection and cross-site scripting, so the team does not need to write those rules from scratch. B would block all legitimate HTTPS traffic. C scans workloads for software vulnerabilities but does not filter requests. D protects against common network and transport layer DDoS attacks, not application-layer injection.
Reference: AWS re:Post: Use AWS WAF to block SQL injection and XSS
Question 27: An Instance Talking to a Cryptocurrency Pool
A security team wants AWS to continuously analyze account and network activity and alert it if, for example, an EC2 instance starts communicating with known cryptocurrency mining servers or an API call comes from a known malicious IP address. It does not want to deploy agents or manage log pipelines for this. Which service fits?
A) AWS Config
B) Amazon GuardDuty
C) AWS Trusted Advisor
D) Amazon Macie
👁 Reveal Answer
Correct Answer: B
Explanation: GuardDuty is a threat detection service that analyzes data sources such as AWS CloudTrail events, VPC Flow Logs, and DNS logs, using threat intelligence and machine learning to produce findings like cryptocurrency mining or communication with malicious IPs. It reads these sources directly, so you do not need to enable or store the logs yourself for its foundational detection. A records configuration changes and checks rules. C gives best-practice recommendations. D discovers sensitive data in S3.
Reference: What is Amazon GuardDuty?
Question 28: A Business That Cannot Afford a DDoS Bill
A popular online ticketing site has been hit by large DDoS attacks during major sales. It wants 24/7 access to AWS DDoS experts during attacks, detailed attack visibility, and protection against the extra scaling charges that an attack can cause. What should it subscribe to?
A) AWS Shield Standard
B) Amazon GuardDuty
C) AWS Shield Advanced
D) Amazon Inspector
👁 Reveal Answer
Correct Answer: C
Explanation: Shield Standard is included automatically for all AWS customers and protects against common infrastructure-layer attacks. Shield Advanced is a paid service that adds enhanced detection and mitigation, attack visibility, access to the Shield Response Team, and cost protection for scaling charges caused by DDoS attacks on protected resources. A lacks the response team and cost protection. B detects threats but does not mitigate DDoS. D scans for vulnerabilities.
Reference: AWS Shield Advanced capabilities
Question 29: Where Is Personal Data in Our Buckets?
A company has hundreds of S3 buckets built up over years. Before a privacy audit, it must find which buckets contain personal data such as names, addresses, and credit card numbers, and which buckets are publicly accessible. Which service automates this?
A) Amazon Inspector
B) Amazon Macie
C) AWS Shield
D) Amazon CloudFront
👁 Reveal Answer
Correct Answer: B
Explanation: Amazon Macie uses machine learning and pattern matching to discover sensitive data, such as personally identifiable information and financial data, in Amazon S3. It also evaluates buckets for security and access control, for example flagging buckets that are publicly accessible. A assesses EC2, container, and Lambda workloads for software vulnerabilities. C protects against DDoS. D delivers content.
Reference: Monitoring data security and privacy with Amazon Macie
Question 30: Calling an AWS API From a Private Subnet
Lambda functions and EC2 instances in private subnets must send messages to Amazon SQS. The VPC has no NAT gateway, and security does not want to add internet access just for this. What should the architect add?
A) An interface VPC endpoint for Amazon SQS, powered by AWS PrivateLink
B) A gateway VPC endpoint for Amazon SQS
C) An internet gateway and public IP addresses
D) VPC peering with the SQS service
👁 Reveal Answer
Correct Answer: A
Explanation: Interface endpoints use AWS PrivateLink to place elastic network interfaces with private IP addresses in your subnets, so resources can reach supported AWS services such as SQS privately, without an internet gateway or NAT device. B is a trap: gateway endpoints exist only for Amazon S3 and DynamoDB. C adds the internet access security wants to avoid. D connects two VPCs; you cannot peer with an AWS service.
Reference: Gateway endpoints (Amazon VPC), which lists the services that support them
Study Tips for Data Protection and Network Security
- Encrypt by default. EBS encryption by default and S3 default encryption remove the human step.
- Customer managed keys give control. Choose them when you need your own key policy, separation of duties, or auditing.
- Private paths to AWS services. Gateway endpoints are for S3 and DynamoDB. Interface endpoints (PrivateLink) cover most other services.
- NAT gateways are zonal. Use one per Availability Zone for resilience.
- Match the threat to the service. WAF blocks web exploits, Shield handles DDoS, GuardDuty detects threats, Macie finds sensitive data, and Inspector finds software vulnerabilities.
Keep Practicing for SAA-C03
Go back to SAA-C03 Questions 11-20 for identity and access, then continue to Questions 31-40 on resilient architectures. The official SAA-C03 exam guide lists every task in scope.