SAP-C03 Practice ExamSAP-C03 Domain 2: Security, Compliance, and Governance
25% of the scored content, about 16 of the 65 scored questions. 5 tasks and 24 skills, 9 of them new in SAP-C03. Our bank has 75 questions on this domain, 10 of them free.
- Task 2.1: Design identity security architectures 17 questions
- Task 2.2: Design solutions to implement encryption and key management strategies 11 questions
- Task 2.3: Design multi-account governance and compliance solutions 22 questions
- Task 2.4: Design architectures to meet compliance requirements 13 questions
- Task 2.5: Design security and responsible AI controls 12 questions
Facts that decide Domain 2 questions
Most wrong answers in this domain use the right service and miss one of these rules.
- SCPs limit what principals in member accounts can do; RCPs limit what can be done to resources in member accounts, including by principals outside the organization. Neither grants permissions, and neither applies to the management account.
- Preventive beats detective when the scenario says data must never exist somewhere: an SCP, RCP or Control Tower control blocks the call, while an AWS Config rule only reports it afterwards.
- The Control Tower Region deny control blocks ungoverned Regions while exempting global services such as IAM and CloudFront; a blanket Region-deny SCP without exemptions breaks them.
- Workloads outside AWS get temporary credentials from IAM Roles Anywhere with X.509 certificates from a registered trust anchor, instead of long-term access keys.
- Amazon Bedrock Guardrails applies content filters, denied topics, sensitive-information filters and contextual grounding checks, and the ApplyGuardrail API can screen text for models hosted outside Bedrock.
- A human approval step for an AI action is a Step Functions task with a task token (.waitForTaskToken): the workflow pauses until an approver's call returns the token.
Task 2.1: Design identity security architectures
Moved here from SAP-C02 — Task 1.2: identity federation using standard protocols, least-privilege access controls (cross-account access, temporary credentials), data perimeter controls and external access validation.
| Skill | What the guide says you must do | Our questions |
|---|---|---|
| 2.1.1 | Implement identity federation by using standard protocols (for example, AWS IAM Identity Center, SAML 2.0, OpenID Connect, System for Cross-domain Identity Management [SCIM]). | 4 |
| 2.1.2 | Design application authentication and authorization solutions (for example, by using Amazon Cognito user pools, identity pools, OAuth 2.0, Amazon EKS Pod Identity). New | 4 |
| 2.1.3 | Design least-privilege access controls such as cross-account access and temporary credentials (for example, by using IAM roles, IAM policies, permissions boundaries, external IDs, session policies, attribute-based access control [ABAC]). | 3 |
| 2.1.4 | Design data perimeter controls and external access validation solutions (for example, by using AWS Identity and Access Management Access Analyzer, VPC endpoint policies, AWS Verified Access). | 3 |
| 2.1.5 | Design workload identities for hybrid and multi-cloud environments (for example, by using IAM Roles Anywhere). New | 3 |
Task 2.2: Design solutions to implement encryption and key management strategies
Moved here from SAP-C02 — Task 1.2: dedicated hardware security modules for compliance.
| Skill | What the guide says you must do | Our questions |
|---|---|---|
| 2.2.1 | Implement encryption at rest by using customer managed keys and automatic key rotation (for example, by using AWS KMS). | 4 |
| 2.2.2 | Implement encryption in transit by using certificate management (for example, TLS 1.3, AWS Certificate Manager [ACM], AWS Private CA). | 2 |
| 2.2.3 | Implement dedicated hardware security modules to comply with regulations (for example, AWS CloudHSM). | 2 |
| 2.2.4 | Design post-quantum cryptography strategies (for example, by using AWS KMS with Module-Lattice Digital Signature Algorithm [ML-DSA], Module-Lattice-Based Key-Encapsulation Mechanism [ML-KEM]). New | 3 |
Task 2.3: Design multi-account governance and compliance solutions
Moved here from SAP-C02 — Task 1.4: organizational structures with guardrails and landing zones, centralized logging and configuration management, policy enforcement using SCPs and RCPs; Task 3.2: automated compliance monitoring.
| Skill | What the guide says you must do | Our questions |
|---|---|---|
| 2.3.1 | Design organizational structures that include features such as guardrails, landing zones, and automated account provisioning (for example, by using AWS Organizations, OUs, AWS Control Tower, AWS Control Tower Account Factory). | 4 |
| 2.3.2 | Implement centralized logging and configuration management solutions, including solutions for AI model invocations and responses (for example, by using AWS CloudTrail organization trails, AWS Config aggregation, AWS GuardDuty, Amazon Security Lake, AWS Security Hub, Amazon CloudWatch Logs). | 5 |
| 2.3.3 | Configure cross-account resource sharing (for example, AWS Resource Access Manager [AWS RAM], AWS Transit Gateway). | 3 |
| 2.3.4 | Design policy enforcement by using SCPs and RCPs. | 5 |
| 2.3.5 | Implement automated compliance monitoring (for example, by using AWS Config rules, AWS Security Hub CSPM). | 3 |
| 2.3.6 | Configure automated vulnerability scanning and patch management (for example, by using Amazon Inspector, AWS Systems Manager Patch Manager). | 2 |
Task 2.4: Design architectures to meet compliance requirements
Moved here from SAP-C02 — Task 3.2: solutions to meet regulatory requirements (data sovereignty), audit trail management for regulated workloads.
| Skill | What the guide says you must do | Our questions |
|---|---|---|
| 2.4.1 | Design architectures to meet data protection requirements (for example, by implementing encryption, access controls, audit logging). | 2 |
| 2.4.2 | Design solutions to meet regulatory requirements such as data sovereignty controls. | 2 |
| 2.4.3 | Implement audit trail management for regulated workloads, including for AI services. | 3 |
| 2.4.4 | Design data residency controls such as AWS Region-specific deployments and transfer restrictions. New | 2 |
| 2.4.5 | Implement compliance evidence collection and reporting solutions (for example, by using AWS Artifact). New | 2 |
| 2.4.6 | Implement risk assessment solutions for cloud architectures such as threat modeling and mitigation strategies. New | 2 |
Task 2.5: Design security and responsible AI controls
| Skill | What the guide says you must do | Our questions |
|---|---|---|
| 2.5.1 | Implement content filtering and compliance controls for generative AI services (for example, by using Amazon Bedrock Guardrails). New | 5 |
| 2.5.2 | Implement access controls for generative and agentic AI applications (for example, by using Amazon Bedrock AgentCore Identity). New | 4 |
| 2.5.3 | Design human oversight workflows that include approval mechanisms for AI operations (for example, by using AWS Step Functions). New | 3 |
Free Domain 2 questions with answers
- Question 11 (skill 2.1.1): A retail company manages 40 AWS accounts in AWS Organizations and has enabled AWS IAM Identity Center.
- Question 12 (skill 2.1.3): A company is onboarding a third-party SaaS cost-monitoring vendor that needs read-only access to billing and resource metadata in 25 of the…
- Question 13 (skill 2.2.1): A bank encrypts data in Amazon S3 and Amazon EBS by using AWS KMS.
- Question 14 (skill 2.2.4): An industrial IoT company signs firmware images that will be installed on devices with an expected field life of 20 years.
- Question 15 (skill 2.3.2): A company has 200 accounts in AWS Organizations and adds new accounts every week.
- Question 16 (skill 2.3.3): A company's network team owns a transit gateway in a central networking account.
- Question 17 (skill 2.3.5): A company with 150 accounts in four Regions wants to continuously evaluate its accounts against the AWS Foundational Security Best Practices (FSBP)…
- Question 18 (skill 2.4.2): A European fintech company uses AWS Control Tower to manage 60 accounts.
- Question 19 (skill 2.4.6): A company completed a threat modeling exercise for a public web application that runs on Amazon EC2 instances behind an Application Load Balancer.
- Question 20 (skill 2.5.1): A media company already uses an Amazon Bedrock guardrail with content filters and denied topics for its Bedrock-based chat applications.