Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 2

Question 10

A multi-tenant monitoring vendor assumes customer-owned roles to audit usage. The customer needs to prevent the vendor from using another tenant's known role ARN under the wrong customer context. Select TWO controls that establish this third-party role-assumption boundary.

Create static IAM access keys for the customer root account and share them with the vendor.
Limit the customer role trust policy to the vendor's designated AWS principal.
Make the customer role assumable by all AWS principals and rely on a hard-to-guess role name.
Require a customer-specific ExternalId condition in the trust policy and have the vendor present it on AssumeRole.
Use the vendor's CloudWatch alarm name as the sole authorization check.

Explanation

Correct Answer

The trusted principal restricts which AWS identity can request the role; role names alone are not sufficient caller authentication.

The ExternalId binds a third-party AssumeRole operation to the intended customer context and mitigates the confused-deputy problem.

Incorrect Answers

Root static keys introduce excessive persistent authority and bypass the intended customer-scoped delegated role.

An ARN is not an authorization secret; open trust would allow unintended principals to try role assumption.

A monitoring alarm is not an STS trust condition and cannot distinguish customer context for role assumption.

Question 11

A company operates development and production accounts. It needs an organization-wide deny on specific high-risk actions in production without applying that deny to developer sandboxes. What account structure fits?

Put every account in one OU and remove the actions from its SCP for development and production alike.
Place production accounts in a separate organizational unit and attach tested production-specific SCP guardrails at that OU, while keeping sandbox policy separate.
Attach a deny only to the current production administrators' IAM identity policies without an SCP or protection against those administrators attaching other policies.
Attach the production restrictions only to the AWS Organizations management account and assume its SCP automatically governs every member production account.

Explanation

Correct Answer

OU-scoped organization policies provide a central guardrail for only the member accounts in that branch without denying every development account.

Incorrect Answers

A shared deny applies to both environments and cannot express the stated difference.

An identity-policy-only approach does not provide the specified centrally enforced OU-level account guardrail and can be bypassed by authorized administrators who change principal policies.

SCPs do not restrict principals in the Organizations management account or automatically propagate from a policy attached only to that account. The production OU or appropriate member accounts must be targeted.

Question 12

An operations team wants AWS administrators to assume sensitive roles only when they have met the approved MFA requirement. Which policy pattern should the architect evaluate?

Use an appropriate IAM role trust or identity-policy condition that requires the applicable MFA authentication context before assuming the privileged role.
Require MFA for interactive IAM user console sign-in while leaving every privileged-role trust policy open to trusted programmatic STS callers without MFA conditions.
Put an MFA reminder in the role description and leave its trust policy unchanged.
Set the role maximum session duration to one hour and rely on the shorter lifetime as proof that the caller has passed an MFA challenge.

Explanation

Correct Answer

A conditional role-assumption policy can reject sessions without the required MFA context, subject to the selected federation and STS authentication path.

Incorrect Answers

Console login MFA alone does not establish a universal MFA requirement for all authorized STS AssumeRole paths. The permitted federation and role-assumption flows must enforce the applicable authentication context.

Documentation does not enforce authentication context when STS evaluates the role assumption.

A shorter STS credential lifetime reduces exposure but does not attest to completed MFA. Duration and MFA context are separate policy conditions that must be evaluated appropriately.

Question 13

A payroll export role needs to download objects under one reports/ prefix in a single S3 bucket and list only that prefix. Which permission design best follows least privilege?

Grant only s3:ListAllMyBuckets and assume it permits download of objects.
Scope s3:GetObject to the intended object ARNs and s3:ListBucket to the bucket ARN with a suitable s3:prefix condition, subject to effective bucket/KMS permissions.
Allow s3:* on all resources and rely on the application never requesting other objects.
Use security group ingress CIDR rules to restrict S3 object key prefixes.

Explanation

Correct Answer

Object reads and bucket listing authorize different resources; combining object ARN scope with a constrained ListBucket prefix avoids granting all bucket content.

Incorrect Answers

Account bucket listing is not the same API authorization as reading objects from a specific bucket.

A broad IAM grant permits unauthorized object operations if the process is compromised or misconfigured.

Security groups filter network traffic and cannot enforce S3 object-key authorization or ListBucket conditions.

Question 14

A platform team delegates IAM role creation to project administrators but must prevent them from creating roles with permission beyond an approved maximum. Which mechanism should be required on the roles they create?

Give delegated administrators AdministratorAccess and ask them not to expand new roles.
Grant every new delegated role only the intended IAM policy at creation, while allowing project administrators to attach other policies later without a permissions boundary.
Require an IAM permissions boundary on delegated roles and restrict administrators from changing or removing that boundary.
Require delegated roles to use a restricted naming prefix but allow administrators to omit or remove the permissions boundary after creation.

Explanation

Correct Answer

A boundary sets the maximum permissions a role can receive from identity policies while the delegation policy controls what admins may create.

Incorrect Answers

Voluntary compliance cannot enforce an authorization ceiling against privilege escalation.

An initially narrow identity policy is not a durable ceiling when delegates can attach broader policies. A boundary and restrictions on changing or removing it enforce the maximum independently of attachments.

A role name is descriptive, not an authorization limit. Enforce the permissions boundary in delegation controls and explicitly prevent removal or substitution with a broader boundary.

Question 15

Account A operates a shared S3 bucket. A processing role from account B needs GetObject for an approved prefix but must not receive an account A IAM user. What is a valid cross-account data-access design?

Grant the account B role the necessary identity permissions and authorize that principal or role through a scoped bucket resource policy, with KMS permissions if the objects use SSE-KMS.
Add the role name to the S3 bucket tags and assume the tags create a permission grant.
Grant the processing role s3:ListBucket on the approved prefix but omit s3:GetObject on the object ARNs, assuming bucket listing grants object-body access.
Allow s3:GetObject only in the account B role identity policy while leaving the account A bucket policy with no authorization for that external role.

Explanation

Correct Answer

Cross-account S3 access needs effective permissions for the requester and the bucket resource; encrypted objects add a separate key-authorization boundary.

Incorrect Answers

Tags describe resources or support policy conditions but do not independently grant the caller GetObject.

ListBucket grants key enumeration subject to any prefix condition; it is a different action from GetObject. The requester and resource policy must permit actual object reads for the intended objects.

An identity Allow in the requesting account is not by itself a resource-account authorization grant for a cross-account S3 bucket. The bucket owner must also permit the external principal, and KMS restrictions may apply.

Question 16

A destination S3 bucket receives uploads from several partner AWS accounts. The security team wants the destination account to own newly uploaded objects and manage access through policies rather than per-object ACLs. Which setting should it choose?

Set Object Ownership to Bucket owner preferred and require partner uploads to use bucket-owner-full-control ACLs, while leaving object ACL management enabled.
Choose Object writer ownership and grant the bucket owner a policy Allow, assuming that the policy itself makes the destination account own uploaded objects.
Configure S3 Object Ownership to Bucket owner enforced, then authorize uploads using bucket policies without ACL grants.
Require every uploading partner to retain object ownership and manage all ACLs manually.

Explanation

Correct Answer

Bucket owner enforced makes the bucket owner own objects and disables ACLs as an access mechanism, simplifying cross-account object control.

Incorrect Answers

Bucket owner preferred can transfer ownership for uploads with the specified canned ACL, but still relies on an uploader-supplied per-object ACL and leaves ACLs enabled, contrary to the requested policy-only approach.

A bucket policy can authorize actions but cannot override the selected object-ownership mode. Under Object writer, uploading accounts ordinarily own their objects; Bucket owner enforced gives the owner policy-based control.

Partner-owned objects and ACL management undermine the stated bucket-owner policy control and create ongoing administration.

Question 17

A security team wants to identify an S3 bucket policy that grants resource access to an AWS principal outside its trusted organization. Which AWS capability should it use?

Turn on S3 Block Public Access and treat a successful setting check as a full inventory of every resource-policy grant to external AWS accounts.
Configure IAM Access Analyzer external access findings for the trusted zone and inspect the bucket's analyzer finding.
Review only successful S3 GetObject entries from CloudTrail and assume that the absence of external requests proves no bucket policy allows outside principals.
Rely only on IAM Access Analyzer unused-access findings and treat them as equivalent to resource external-access findings for the bucket.

Explanation

Correct Answer

IAM Access Analyzer evaluates supported resource policies to surface access by principals outside the configured zone of trust.

Incorrect Answers

Block Public Access applies public-access restrictions but does not enumerate the external principals and resource-policy paths that IAM Access Analyzer for S3 findings are intended to identify.

Request logs reflect observed actions, not every potential authorization grant. An external principal may have policy access without making any logged request during the chosen observation period.

Unused-access findings indicate permission usage patterns; external-access analysis specifically evaluates whether supported resource policies permit principals outside the selected zone of trust.

Question 18

An IAM role was temporarily overprivileged during an application migration. The team needs a least-privilege policy proposal based on observed CloudTrail activity during the recent review period. Which workflow provides that starting point?

Use IAM Access Analyzer policy generation on an appropriate CloudTrail trail, then review and refine its generated permissions with workload tests.
Enable a new empty CloudTrail trail today and assume it proves all permissions used over the past year.
Replace the role policy with a single wildcard action that was used by one request.
Copy the IAM service-last-accessed timestamps into an Allow policy and assume those timestamps supply exact resource-scoped actions without reviewing CloudTrail policy generation.

Explanation

Correct Answer

Policy generation can inspect CloudTrail action usage to build a candidate identity policy; a reviewer must add required unobserved operations and validate the result before replacement.

Incorrect Answers

A trail without historical event coverage cannot establish operations that occurred before it was recording.

A wildcard enlarges permissions rather than deriving an evidence-based least-privilege set.

Service-last-accessed information is a useful signal but does not capture complete resource-scoped actions for every service. Generated candidate policies and workload tests remain needed for a trustworthy least-privilege proposal.

Question 19

An IAM policy explicitly denies s3:DeleteObject for a reports bucket while another attached policy allows s3:* for that bucket. What is the effective outcome for DeleteObject?

Add a resource-based S3 bucket policy that explicitly allows the same principal to delete the object, assuming that this overrides the principal's identity-policy Deny.
The latest policy attached wins because IAM resolves conflicts by creation timestamp.
The delete is allowed because s3:* is syntactically broader than s3:DeleteObject.
The delete is denied because an applicable explicit Deny overrides an Allow in IAM policy evaluation.

Explanation

Correct Answer

IAM evaluates effective permissions with explicit denies prevailing; attaching a broader allow cannot cancel the specific Deny.

Incorrect Answers

A resource-policy Allow cannot cancel an applicable explicit Deny in the identity permission evaluation. Access remains denied even if both the bucket and a separate identity policy permit deletion.

IAM evaluation is not ordered by policy attachment time; explicit denial has precedence.

Wildcard breadth does not outrank an explicit deny in IAM policy logic.

Question 20

An application obtains temporary role credentials using STS, then caches the AccessKeyId, SecretAccessKey and session token in a static configuration file. It starts failing when the credentials expire. Which design corrects the root cause?

Add permanent S3 FullAccess to the existing expired access key.
Use a supported AWS SDK role credential provider or bounded credential refresh flow instead of persisting one expiring session as permanent configuration.
Retry every API call indefinitely with the same expired session token.
Increase the IAM role maximum session duration but continue reusing the same previously issued expired STS credentials without retrieving new ones.

Explanation

Correct Answer

Temporary STS sessions have expiry; role providers retrieve fresh credentials for subsequent requests rather than reusing an expired snapshot.

Incorrect Answers

IAM policy changes do not extend the lifetime or renew an expired STS credential token.

The token has expired, so repeating it cannot succeed without obtaining fresh credentials.

A role maximum session setting constrains future credential issuance; it does not extend a token that has already expired. The application needs a refreshable provider for subsequent requests.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 10

Explanation

Correct Answer

Incorrect Answers

Question 11

Explanation

Correct Answer

Incorrect Answers

Question 12

Explanation

Correct Answer

Incorrect Answers

Question 13

Explanation

Correct Answer

Incorrect Answers

Question 14

Explanation

Correct Answer

Incorrect Answers

Question 15

Explanation

Correct Answer

Incorrect Answers

Question 16

Explanation

Correct Answer

Incorrect Answers

Question 17

Explanation

Correct Answer

Incorrect Answers

Question 18

Explanation

Correct Answer

Incorrect Answers

Question 19

Explanation

Correct Answer

Incorrect Answers

Question 20

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests