AWS SAA-C03: Design Secure Architectures Practice Questions

An organization-level trail created in the management account automatically covers all member accounts and cannot be modified or deleted by member account administrators. Log file validation uses SHA-256 hashing to detect any tampering with log files. Storing logs in a separate dedicated security account and applying a restrictive bucket policy (denying deletions and policy modifications to everyone except a tightly controlled break-glass role) ensures that even an administrator in the management account cannot delete the logs. MFA Delete adds a useful layer but requires the root account to enable it and still allows deletion if someone has physical access to the MFA device—the bucket policy in the security account is a stronger preventive control. Aggregating individual per-account trails via EventBridge is complex and does not create an immutable trail; member account administrators could still disable their local trail. CloudTrail cannot natively deliver logs to DynamoDB; this is not a supported delivery mechanism.

AWS WAF supports IP set-based rules that block traffic from specified IP address ranges and AWS Managed Rules groups (such as the SQL database managed rule group) that detect and block SQL injection patterns — together these satisfy both requirements with minimal operational overhead when applied to the ALB. GuardDuty identifies threats from logs and events but does not inline-block HTTP requests; automated remediation with Lambda adds significant operational complexity. Network ACLs can block IPs but operate at the subnet/IP level and cannot inspect HTTP query string content for SQL injection patterns. AWS Shield Advanced is focused on DDoS volumetric attack mitigation and does not provide application-layer SQL injection detection or IP blocklisting.

IAM permission boundaries define the maximum permissions that an identity-based policy can grant to an IAM entity (user or role). Even if a user attaches an additional permissive policy, they cannot exceed the permissions allowed by their boundary — making this the correct control for capping individual user permissions within an account. SCPs apply at the AWS Organizations account level and are not granular enough to restrict individual IAM users within an account from self-escalating; they control what principals in an account can do, not what policies a user can attach to themselves. Resource-based policies restrict access to specific resources but do not prevent a user from creating new resources or attaching policies. Managed policies with explicit denies can be circumvented if the user has the iam:AttachUserPolicy permission and can attach another policy without a deny, and they do not create a hard ceiling the way permission boundaries do.

Enabling S3 Block Public Access at the account level with all four settings (BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets) is the most effective single preventive control because it overrides any bucket- or object-level ACL or bucket policy that would otherwise grant public access—even future misconfigurations cannot bypass it. Attaching an explicit Deny bucket policy to every bucket is operational overhead and must be maintained per bucket; it can also be removed by a bucket owner. Amazon Macie is a detective control that identifies sensitive data and alerts on public buckets but does not prevent access. The AWS Config rule is also a detective control that identifies violations after the fact but does not block them.

Amazon Macie is purpose-built for discovering and protecting sensitive data (including PII) in S3. When delegated through AWS Organizations, it can automatically enroll all member accounts and scan their S3 buckets for sensitive data with no custom code. GuardDuty with S3 protection detects threats like unusual API activity against S3 but does not classify or identify PII content within objects. AWS Config checks bucket configuration posture (e.g., public access settings) but cannot inspect object content for PII. Security Hub aggregates findings from other services but does not independently scan S3 object content for sensitive data.