Home / Flashcard library / Careers & certifications / AWS Certified Solutions Architect – Associate / Networking, Security & IAM

Careers & certifications

AWS Solutions Architect — Networking, Security & IAM flashcards

10 of 60 cards free to study here · 9 topics · the whole deck is built into Willys

Scenario questions on VPC design, security groups versus NACLs, peering, Transit Gateway, endpoints and PrivateLink, Direct Connect and VPN, Route 53 and CloudFront security, IAM evaluation and roles, SCPs, KMS, Secrets Manager, ACM, Cognito and the security and audit services.

Get the app All AWS Certified Solutions Architect – Associate decks

Learn deck · part of AWS Certified Solutions Architect – Associate · written against: Exam SAA-C03 guide. Updated 2026-10-10.

Study the free sample

10 cards from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.

The 10 sample cards as a list
  1. What actually makes a subnet 'public' in a VPC?
    Its route table contains a default route (0.0.0.0/0) to an internet gateway, and instances in it have a public or Elastic IP. A subnet with no IGW route is private whatever it is named.
    VPC Fundamentals
  2. Two VPCs in different accounts must talk privately. What is the simplest option, and what are its two key limits?
    VPC peering — a one-to-one private link that works across accounts and Regions. It requires non-overlapping CIDRs and is not transitive: A to B and B to C does not let A reach C.
    VPC Connectivity
  3. Dozens of VPCs and several on-premises sites need any-to-any connectivity without a mesh of peering links. Which service?
    AWS Transit Gateway — a regional hub that VPCs, VPN connections and Direct Connect attach to, with its own route tables for segmentation. It is transitive, scales to thousands of attachments and can peer with gateways in other Regions.
    VPC Connectivity
  4. Users should be served the version of a site that matches their country, with a fallback for everyone else. Which routing policy?
    Geolocation — answers based on the user's continent, country or state, with a default record for unmatched locations.

    Compare: latency-based routing picks the Region with the lowest measured latency, which is not always the nearest.
    Route & CloudFront
  5. An application on EC2 must write to S3. Where should its credentials come from?
    An IAM role attached to the instance (an instance profile) — temporary credentials are served through the metadata service and rotated automatically. Never embed long-term access keys in the AMI or config.
    IAM
  6. A company wants consolidated billing and a guarantee that no account can use services outside approved Regions. Which service and feature?
    AWS Organizations with a service control policy attached to the organization or OU. SCPs set the maximum permissions for member accounts; they grant nothing by themselves.
    Organizations & SCPs
  7. What is envelope encryption, and why does KMS use it?
    Data is encrypted with a data key, and the data key is encrypted by a KMS key that never leaves KMS; the encrypted data key is stored alongside the data. This avoids sending bulk data to KMS, whose Encrypt API accepts at most 4 KB per call.
    Encryption & Secrets
  8. A mobile app needs sign-up, sign-in, MFA and social logins for millions of end users. Which Cognito component?
    A Cognito user pool — a managed user directory that authenticates users and issues JWTs, with hosted UI, MFA and federation through Google, Apple, Facebook, SAML or OIDC.
    Cognito
  9. A web application is hit by SQL injection attempts and a bot flood. Which service blocks these at layer 7, and where can it be attached?
    AWS WAF — web ACLs with managed rule groups, rate-based rules and geo or IP rules, attached to CloudFront, ALB, API Gateway, AppSync or Cognito.
    Security Services
  10. Who deleted a production S3 bucket last Tuesday, and from which IP? Which service answers this?
    AWS CloudTrail — records API calls with who, what, when and from where. Deliver the trail to S3 and CloudWatch Logs, and enable log file validation to detect tampering.
    Logging & Monitoring

Unlock the whole deck

You are studying a free 10-card sample. All 60 cards of AWS Solutions Architect — Networking, Security & IAM, the other 4 AWS Certified Solutions Architect – Associate decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

More AWS Certified Solutions Architect – Associate decks

Compute & Core ServicesStorage, Databases & IntegrationQuick Drills: Pick the ServicePractice Questions

← All AWS Certified Solutions Architect – Associate decks, with the study guide and topic outline.

About these cards

Review status: Second-reader reviewed, with corrections applied.

Checked against:

  • Checked against the AWS Certified Solutions Architect – Associate (SAA-C03) exam guide (topic list only; no text copied).
  • Checked against the AWS public documentation for VPC, Route 53, CloudFront, IAM, Organizations, KMS, Secrets Manager, ACM, Cognito and the security services (reference only; no sentences reproduced).

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

Amazon Web Services, AWS and AWS Certified are trademarks of Amazon.com, Inc. or its affiliates. This product is not affiliated with, sponsored by, or endorsed by Amazon Web Services.

Use of these pages is covered by our Terms of Use.