AWS Solutions Architect – Professional (SAP-C03): 5 Practice Questions on Security, Compliance, and Governance
Practice Security, Compliance, and Governance for the AWS Solutions Architect – Professional (new) (SAP-C03) exam with the 5 questions below. It makes up about 25% of the exam. Every option is explained, so a wrong pick still teaches something.
AWS Solutions Architect – Professional (new) (SAP-C03) · Security, Compliance, and Governance · 5 questions with answers and explanations
📊 About this set
Exam: SAP-C03 · 75 questions · 180 minutes · passing score 720
This set: 4 advanced, 1 applied · 2 trade-off, 1 concept check, 1 scenario, 1 troubleshooting · 1 with more than one answer
Topics: Amazon Bedrock, Amazon S3, AWS KMS, AWS CloudTrail, S3 Batch Operations, AWS Config, Conformance packs, AWS Organizations, IAM Roles Anywhere, AWS IAM, Amazon Bedrock Guardrails, Amazon CloudWatch
🧭 What these questions look for
Security design at the professional level is about controls that work across many accounts and leave evidence behind. Scenarios ask how to record what an AI model was asked, encrypt data that already exists, push one rule set to a whole organization, cut off a single compromised identity, or stop sensitive text in generated answers. The best option acts precisely and at scale; broad switches that also hit healthy users are the usual traps.
Tips for this set
• Separate the questions an audit asks. Who called a service is an API record; what a model received and returned needs its own invocation logging, stored somewhere tamper-resistant.
• A new default setting usually applies only to new data. When existing objects must change, look for a bulk rewrite, and for a way to keep the per-request key cost down.
• Revoking one identity should not take everyone else down. Prefer a narrow revocation, such as an updated certificate list plus a deny on that identity's sessions, over disabling a shared trust anchor or role.
Question 1 of 5
A bank uses Amazon Bedrock in two Regions for a customer-facing assistant. Regulators require that the bank retain, for seven years and in tamper-resistant storage, the full text of every prompt sent to a model and every response returned, encrypted with a bank-managed key, along with who invoked the model. The bank already has an organization trail in AWS CloudTrail. What additional configuration meets the requirement?
Show answer
✅ Answer: B
Difficulty: advanced · Topic: Amazon Bedrock, Amazon S3, AWS KMS, AWS CloudTrail
Two different audit records for generative AI
• AWS CloudTrail records API activity: who called InvokeModel or Converse, when, from where, and with which model ID. These calls are logged as management events, so the existing trail already has them; CloudTrail data events exist for some other Bedrock resources (such as agents and knowledge bases), but no CloudTrail event contains the body of the request (the prompt) or the model's response.
• Amazon Bedrock model invocation logging records the invocation itself, including input and output data (text, and optionally image and embedding data) plus metadata such as the model and the caller's identity. It is off by default and is configured per account and per Region, with Amazon S3 and/or Amazon CloudWatch Logs as destinations.
Making the log fit a regulated workload
• Use an S3 bucket encrypted with SSE-KMS and a customer managed key so key use is controlled and logged.
• Make the records tamper-resistant with S3 Object Lock and a seven-year retention period (compliance mode if no one may shorten it). A common pattern keeps the bucket that Bedrock writes to simple and uses S3 Replication to copy every new log object into an Object Lock bucket, for example in a log archive account; S3 Replication supports Object Lock-enabled destination buckets.
• Restrict read access tightly: prompts and responses often contain personal data.
• Keep the CloudTrail trail as well: it shows who changed the logging configuration (PutModelInvocationLoggingConfiguration) and complements the invocation records.
Why each option works or fails
• ✗ A. CloudTrail data events for Bedrock: model invocations are already recorded as management events, and no CloudTrail event carries the prompt and response payloads, so the trail cannot satisfy the full-text requirement.
• ✓ B. Model invocation logging replicated to an Object Lock bucket (correct): it captures the full prompts and responses with caller identity, is enabled in each Region the bank uses, and the customer managed key plus the Object Lock copy meet the encryption and seven-year tamper-resistance requirements.
• ✗ C. Guardrails trace to CloudWatch Logs: guardrail traces describe which policies were evaluated and what was blocked; they are not a complete record of every prompt and response, and CloudWatch Logs retention alone is not tamper-resistant storage.
• ✗ D. Application logging with data protection: it depends on application code logging every call correctly, and CloudWatch Logs data protection masks sensitive data, which would remove the very content the regulator wants retained.
Question 2 of 5
A company stores 2 PB of objects in a set of S3 buckets encrypted with SSE-S3. A new compliance requirement demands SSE-KMS with a customer managed key so that key use is logged in CloudTrail and access can be revoked. The workload issues hundreds of millions of requests a month, and the finance team is concerned about AWS KMS request costs. Which approach meets the requirement with the LOWEST ongoing KMS cost?
Show answer
✅ Answer: C
Difficulty: advanced · Topic: Amazon S3, AWS KMS, S3 Batch Operations
SSE-KMS and request costs
With SSE-KMS, S3 calls AWS KMS for each object to generate data keys or decrypt, and those calls are billed and count toward KMS request quotas.
• S3 Bucket Keys let S3 use a bucket-level key derived from your KMS key for a time-limited period, cutting KMS requests by up to about 99 percent. KMS key use is still logged in CloudTrail, but at the bucket level rather than per object.
• Changing default encryption affects only objects written afterward. Existing objects keep their old encryption until they are rewritten, for example with a copy through S3 Batch Operations.
Why each option works or fails
• ✗ A. Default only, converting on read: reads do not re-encrypt objects, so existing data remains SSE-S3 and the requirement is unmet; also without Bucket Keys costs are higher.
• ✗ B. Client-side encryption with per-object data keys: it adds a KMS call per object, changes every application, and loses S3-side management, so it is more costly and not needed.
• ✓ C. Default SSE-KMS with Bucket Keys plus Batch Operations Copy (correct): new writes use Bucket Keys, existing 2 PB is re-encrypted by a managed job, and KMS request cost stays low.
• ✗ D. Key per prefix with lifecycle re-encryption: lifecycle transitions do not change encryption, and multiple keys increase KMS management without a request cost benefit.
Question 3 of 5
A compliance team must deploy the same versioned set of 30 AWS Config rules with remediation to 50 accounts, including accounts added later, and report one compliance score per account for that set. Which AWS Config feature fits BEST?
Show answer
✅ Answer: A
Difficulty: advanced · Topic: AWS Config, Conformance packs, AWS Organizations
Conformance packs
A conformance pack is a collection of AWS Config rules and remediation actions defined in one YAML template and deployed and updated as a single unit. Sample templates exist for frameworks such as CIS or operational best practices, and you can write your own.
• Organization conformance packs are deployed from the management account or a Config delegated administrator (for example an audit account) with PutOrganizationConformancePack. They are applied to all member accounts, and to accounts that join the organization later.
• Updating the template updates every account, so the rule set stays versioned and identical.
• Config reports a compliance score per conformance pack per account: the percentage of rule and resource combinations that are compliant.
Example
A 30-rule "Baseline-v3" pack deployed to 50 accounts shows scores like 96 percent for one account and 71 percent for another, and a new account gets the same pack automatically.
Why each option works or fails
• ✓ A. (correct): Organization conformance pack from the delegated administrator: it deploys the same versioned set of rules and remediations to all current and future accounts and gives a native compliance score per account for that pack.
• ✗ B. StackSets plus a spreadsheet: deploys rules, but they are not tracked as one package, and computing scores by hand adds work and has no native per-pack score.
• ✗ C. Firewall Manager security group policies: these manage and audit security groups across accounts; they do not deploy arbitrary Config rules with remediation or produce a pack compliance score.
• ✗ D. Config aggregator pushing rules: aggregators only collect configuration and compliance data from source accounts; they cannot deploy rules.
Question 4 of 5
Servers in an on-premises factory use IAM Roles Anywhere with certificates from the company's own CA, which publishes a certificate revocation list. Each server's certificate has a unique subject CN. One server is stolen, and its certificate, valid for another 11 months, has just been revoked at the CA. The stolen server must not obtain new credentials or keep using existing ones, while the 400 other servers that use the same trust anchor and role must keep working. Which actions meet these requirements? (Select TWO)
Show answer
✅ Answer: D, E
Difficulty: advanced · Topic: IAM Roles Anywhere, AWS IAM
Revocation in IAM Roles Anywhere
IAM Roles Anywhere validates the certificate chain against the trust anchor on every CreateSession call. It does not fetch CRLs or query OCSP on its own. To make it honor revocation, you import a certificate revocation list (CRL) with the ImportCrl API and associate it with the trust anchor; you then update it whenever the CA publishes a new list. After that, CreateSession with a revoked certificate fails.
Credentials already issued
Revocation stops new sessions only. Temporary credentials that were already issued stay valid until they expire (one hour by default, configurable on the profile). Roles Anywhere maps certificate fields to session tags, such as x509Subject/CN, so a deny statement on the role with the condition aws:PrincipalTag/x509Subject/CN equal to the stolen server's CN blocks only that server's existing sessions.
The IAM Revoke active sessions action is a blunter tool: it denies every session of the role issued before now, so all 400 servers would get access-denied errors until their SDKs or the credential helper fetch new credentials.
Blast radius
Disabling a trust anchor or deleting a role stops every workload that depends on it, which is a much larger outage than one stolen device.
Why each option works or fails
• ✗ A. Disable the trust anchor: it blocks all 400 servers, not just the stolen one, for up to 11 months, which violates the requirement to keep the other servers running.
• ✗ B. Delete and recreate the role: without an imported CRL, Roles Anywhere still accepts the stolen certificate, so the server can assume the new role through the same trust anchor and profile, and the change disrupts all servers.
• ✗ C. OCSP checking on the trust anchor: IAM Roles Anywhere does not query OCSP responders; revocation is enforced only through CRLs that you import.
• ✓ D. Import the updated CRL (correct): once the CRL that lists the stolen certificate is attached to the trust anchor, Roles Anywhere rejects any new session request signed with that certificate, while other certificates keep validating.
• ✓ E. Deny on the CN session tag (correct): the session tag identifies the stolen server's sessions, so its credentials that are still valid are denied every action while the other 400 servers are untouched.
Question 5 of 5
A healthcare provider uses Amazon Bedrock to summarize clinician notes for a care-coordination portal. Patient names and phone numbers must never appear in the summaries, but every note must still produce a usable summary. The compliance team also needs ongoing evidence of how often the guardrail acts on outputs. The current guardrail uses a sensitive-information filter with the Block action for names and phone numbers, and many summaries are being replaced by the blocked message. What change best meets the requirements?
Show answer
✅ Answer: C
Difficulty: applied · Topic: Amazon Bedrock Guardrails, Amazon CloudWatch
Block versus mask for sensitive information
Each PII entity type or custom regex in a Bedrock guardrail has an action:
• Block: if the entity is found, the whole input or response is replaced by the configured blocked message. Use it when the request itself must not proceed, for example a prompt that contains a credit card number in a chat that must never handle card data.
• Mask (anonymize): the matched text is replaced with a tag such as {NAME} or {PHONE}, and the rest of the text is returned. Use it when the content is useful but specific values must be removed.
Clinical notes almost always contain names, so Block on outputs throws away nearly every summary.
Evidence that the guardrail works
When tracing is enabled, the response includes a guardrail trace that lists which policies matched and what action was taken. Bedrock Guardrails also publishes CloudWatch metrics, including counts of invocations where the guardrail intervened, which give the compliance team ongoing, aggregate evidence; model invocation logging can keep the full records.
Why each option works or fails
• ✗ A. Prompt instructions only: the model may miss or ignore the instruction, so names can leak, and manual sampling is weak evidence for a "never appear" requirement.
• ✗ B. Denied topic for patient identity: a denied topic blocks the entire response just like the Block action, and summaries of patient notes would match it constantly.
• ✓ C. Mask instead of block, with trace and metrics (correct): masking removes names and phone numbers from every summary while keeping the summary usable, and the trace and intervention metrics document how often the guardrail acted.
• ✗ D. Block plus Macie scans: Block keeps destroying summaries, which is the actual problem, and Macie scans S3 objects after the fact. It does not measure guardrail activity.
🎯 What to remember
• CloudTrail tells you who called Bedrock; model invocation logging (per Region, kept in encrypted S3 with an Object Lock copy) records what was asked and answered.
• To move existing S3 data to SSE-KMS cheaply, enable Bucket Keys and rewrite old objects with Batch Operations Copy; default encryption changes affect only new objects.
• Deploy a versioned rule set organization-wide with an organization conformance pack; aggregators only view data, they never push rules.
• To revoke one Roles Anywhere identity, import the updated CRL for the trust anchor and deny its existing sessions by a certificate session tag; disabling the anchor or role takes everyone down.
• Block when the request must not proceed; mask when the content is needed but specific values must be removed. Use the guardrail trace and metrics as evidence.
🔗 Keep practicing on this blog
• AWS Solutions Architect – Professional (SAP-C03): 5 Practice Questions on Architecture Design and Implementation Built for the Cloud
• All SAP-C03 practice sets
• Every exam on this blog
📚 More SAP-C03 practice
More SAP-C03 questions: https://hyunhp.github.io/cert-bank/#exam=SAP-C03
Study guide: https://hyunhp.github.io/cert-bank/study.html#exam=SAP-C03
These are original practice questions, not real exam questions, and cert-bank is not affiliated with any certification vendor.
Original practice questions written for this blog, not exam dumps.
Comments
Post a Comment