Question 20
An application obtains temporary role credentials using STS, then caches the AccessKeyId, SecretAccessKey and session token in a static configuration file. It starts failing when the credentials expire. Which design corrects the root cause?
- Add permanent S3 FullAccess to the existing expired access key.
- Use a supported AWS SDK role credential provider or bounded credential refresh flow instead of persisting one expiring session as permanent configuration.
- Retry every API call indefinitely with the same expired session token.
- Increase the IAM role maximum session duration but continue reusing the same previously issued expired STS credentials without retrieving new ones.
Explanation
Correct Answer
B:Temporary STS sessions have expiry; role providers retrieve fresh credentials for subsequent requests rather than reusing an expired snapshot.
Incorrect Answers
A:IAM policy changes do not extend the lifetime or renew an expired STS credential token.
C:The token has expired, so repeating it cannot succeed without obtaining fresh credentials.
D:A role maximum session setting constrains future credential issuance; it does not extend a token that has already expired. The application needs a refreshable provider for subsequent requests.
Question 21
An S3 report encrypted with a customer managed AWS KMS key is shared from the data account to a role in a separate analytics account. The bucket policy and S3 read grant are correct, but Decrypt is denied. Which authorization pair is essential?
- Grant kms:Decrypt only in the analytics role identity policy and leave the key policy limited to local accounts.
- Authorize the analytics role for kms:Decrypt in both the key-owning account’s KMS key policy and the external role’s effective IAM permissions.
- Grant the role only s3:ListBucket on the encrypted bucket.
- Copy the S3 object to another prefix in the same bucket without granting KMS permissions.
Explanation
Correct Answer
B:Cross-account KMS authorization needs key-owner policy permission and an IAM allowance on the external principal. S3 GetObject authorization does not convey decrypt rights.
Incorrect Answers
A:The key policy must allow external use; a caller-side IAM grant alone cannot override a KMS key’s cross-account policy boundary.
C:ListBucket concerns bucket object names, not ciphertext decryption by KMS for downloaded objects.
D:A new key prefix does not automatically change who is authorized to use the encryption key.
Question 22
A security team discovers that an access key may have executed ec2:StopInstances in a production account yesterday. It needs the caller principal, API action, request time, and target resources. Which native evidence is most direct?
- Review Amazon CloudWatch EC2 CPU utilization and infer which IAM identity stopped the instance.
- Inspect VPC flow logs for every IAM role that might have a key.
- Inspect the relevant AWS CloudTrail management events for StopInstances, principal identity and request parameters.
- Check S3 server access logs because all account management operations are stored there.
Explanation
Correct Answer
C:CloudTrail management event records contain IAM identity context, API event name/time and request details for supported control-plane calls. Check the event history or configured trails and delivery.
Incorrect Answers
A:CPU metrics show instance load, not the caller identity for an AWS API operation.
B:Flow records contain IP flow metadata, not the IAM principal that called EC2 StopInstances.
D:S3 access logs describe supported S3 requests, not EC2 management API events.
Question 23
An AWS organization adds and removes member accounts frequently. A central S3 resource policy must let roles from currently enrolled accounts access reports without maintaining a list of each account ID. What condition reduces maintenance while enforcing organization membership?
- Trust a wildcard principal with no conditions because the bucket ARN is difficult to discover.
- Use an appropriate aws:PrincipalOrgID condition alongside an authenticated principal and least-privilege actions in the resource policy.
- Apply aws:SourceAccount to every employee request instead of comparing the requesting principal’s organization.
- Restrict the bucket with the VPC CIDR alone and assume it proves the calling account is part of the organization.
Explanation
Correct Answer
B:aws:PrincipalOrgID compares the caller principal’s organization membership, so newly joined and removed accounts follow the policy without manually editing every listed account ID.
Incorrect Answers
A:An unqualified wildcard permits requests from principals outside the intended AWS organization.
C:aws:SourceAccount addresses service-principal source-account context; it is not an interchangeable filter for ordinary workforce principals.
D:An IP address is not an AWS Organizations membership assertion and can be shared or changed independently.
Question 24
A central security engineer attaches an SCP that denies a service action to a member account. An AWS-managed service-linked role still executes its documented integration operation. Which explanation is accurate?
- Assume the service-linked role receives root-user privileges and therefore needs no service-specific policy for the integration operation.
- Treat the SCP as a resource-based permissions policy for the integration service rather than as a guardrail for member-account principals.
- Rename a normal customer-managed integration role with the prefix AWSServiceRoleFor and assume that naming alone grants it the SCP exception.
- SCPs restrict member-account IAM users and ordinary roles, but do not restrict AWS service-linked roles.
Explanation
Correct Answer
D:Service-linked roles are a documented SCP exception; their service-defined integration permissions are not evaluated against the SCP permission ceiling.
Incorrect Answers
A:A service-linked role is a role with a defined AWS service trust and managed permissions, not a root-user session. Its exclusion from SCP restrictions does not imply unlimited root authority.
B:The policy types have different evaluation responsibilities. An SCP limits covered member-account principals, while a service-linked role is excluded from SCP evaluation; neither interpretation makes it an S3-style service resource policy.
C:A string resembling a service-linked role name does not create the AWS-controlled service-linked role type. Ordinary roles remain subject to applicable SCP restrictions.
Question 25
The security team updated an AWS IAM Identity Center permission set used by 60 accounts. Users in one assigned account still have the old effective account role permissions. Which operation should be checked?
- Change the employees’ external identity provider passwords because permission sets are password policies.
- Edit the AWS Organizations SCP to grant the missing action directly to the employee.
- Disable the SSO user portal so the account role synchronizes immediately.
- Provision or reprovision the updated permission set to the affected AWS account and verify its generated IAM role permissions.
Explanation
Correct Answer
D:Identity Center permission-set changes must be reflected in account provisioning; an unchanged account role can still expose the prior policy after an editor saved a new permission set.
Incorrect Answers
A:Passwords authenticate the workforce but do not update provisioned IAM role policies.
B:An SCP cannot grant role permissions, and changing the guardrail does not propagate an updated permission set.
C:Removing the login portal is not the process for provisioning changed Identity Center permissions into an account.
Question 26
A service operating with assumed-role credentials calls STS AssumeRole for a second role, requesting a four-hour session. The target role allows sessions up to eight hours, but the request fails. What is the relevant limitation?
- Role chaining caps the second assumed-role session at one hour, regardless of the second role’s longer configured maximum.
- The maximum session duration of a target role always overrides role chaining.
- STS sessions cannot use temporary credentials to assume any other role.
- Increase the target role MaximumSessionDuration to twelve hours and assume that the nested role assumption can therefore request four hours.
Explanation
Correct Answer
A:Role chaining is a separate STS limit: when existing role credentials assume another role, DurationSeconds cannot exceed 3600 seconds.
Incorrect Answers
B:A role’s 8-hour setting applies to suitable initial sessions but does not remove the one-hour chaining cap.
C:Role chaining is supported, but its duration is restricted rather than prohibited in every case.
D:The target role maximum setting does not override the separate one-hour role-chaining ceiling. The existing assumed-role credentials trigger that ceiling regardless of the target role configuration.
Question 27
A company relies on a corporate identity provider for administrator access. It is designing recovery for an outage that prevents workforce federation. Which architecture avoids turning the AWS account root into the everyday backup login?
- Let every engineer share the root password and turn off its MFA during identity-provider outages.
- Keep only IAM Identity Center sessions as emergency access even when the corporate IdP is unavailable.
- Maintain tightly protected, monitored emergency administrator access with an independently testable authentication path and reserve root for root-only recovery.
- Put emergency IAM role instructions in an S3 bucket but make the only authentication method for obtaining those instructions and assuming the role depend on the failed corporate IdP.
Explanation
Correct Answer
C:A break-glass access path should survive an identity-provider outage, limit unnecessary everyday privilege and produce auditable exceptional-use evidence; root stays protected.
Incorrect Answers
A:Shared root and missing MFA turn an availability contingency into account-wide credential exposure.
B:An emergency path with the same failed IdP dependency cannot meet the stated federation-outage scenario.
D:Documenting a recovery plan does not establish an independent working break-glass path. If every authentication step still relies on the down identity provider, the contingency cannot restore administrative access.
Question 28
A compliance-sensitive role must read an S3 dataset only through a designated VPC endpoint. The role has valid GetObject permission, but calls made over the public S3 endpoint should be rejected. Which IAM condition applies to this access-path control?
- Use only aws:SourceIp equal to the S3 bucket’s DNS name.
- Allow the role to use an S3 VPC endpoint policy but do not require the endpoint identifier in the effective bucket or role authorization checks.
- Require the intended aws:SourceVpce condition in the effective S3 authorization policy, with exceptions explicitly designed for supported service calls.
- Require aws:SourceVpc only and assume it uniquely identifies one designated VPC endpoint even if the VPC has several approved and unapproved endpoints.
Explanation
Correct Answer
C:aws:SourceVpce checks the VPC endpoint identifier in supported request context; a regular Internet call does not carry the matching endpoint condition.
Incorrect Answers
A:SourceIp expects an IP address range, not a DNS hostname; it also does not prove which VPC endpoint carried the request.
B:A permissive VPC endpoint policy governs requests that actually traverse that endpoint, but does not by itself reject otherwise authorized requests arriving at the public S3 service endpoint.
D:aws:SourceVpc restricts to a VPC context but is broader than matching a particular endpoint identifier. aws:SourceVpce is needed to tie the policy to the one designated endpoint.
Question 29
An application uses one DynamoDB table for many tenants. Its IAM role must query only items whose partition key starts with its authenticated tenant identifier, not all other tenants’ items. Which IAM condition is designed for this?
- Use an IAM condition on dynamodb:ConsumedCapacity equal to the tenant ID.
- Allow Scan on the whole table and ask the application to discard records from other tenants.
- Use dynamodb:Attributes to permit the partition-key attribute name but place no constraint on the partition-key values returned for other tenants.
- Constrain the allowed table operations using dynamodb:LeadingKeys matched to the tenant partition-key values with the documented multivalue condition operator.
Explanation
Correct Answer
D:dynamodb:LeadingKeys represents the table partition-key values in the operation, enabling fine-grained IAM scoping of item access when the key design supports tenancy.
Incorrect Answers
A:Consumed capacity measures billing units and cannot restrict which partition keys the request accesses.
B:Application-side filtering occurs after broad read permission, leaving a cross-tenant data access capability.
C:dynamodb:Attributes can restrict attribute names but does not independently limit the tenant-specific leading partition-key values that may be queried. The LeadingKeys condition is the relevant row-partition boundary.
Question 30
An AWS service principal can deliver audit files into an S3 bucket. The bucket owner must prevent a different customer from directing that same service to write into the bucket under an unintended source resource. Which condition combination is appropriate when supported?
- Allow the service principal unconditionally because its service name is always sufficient to identify the owning AWS customer.
- Use aws:PrincipalOrgID as the only condition on all service calls regardless of whether that key is included.
- Accept any AWS account ID embedded in the object key and assume IAM validates that filename as a principal.
- Restrict the resource policy to the expected aws:SourceArn and aws:SourceAccount of the service’s originating resource and account.
Explanation
Correct Answer
D:These global context keys bind an AWS service principal invocation to the permitted originating resource and account, mitigating cross-service confused-deputy exposure.
Incorrect Answers
A:A shared service principal can act on behalf of multiple customers; service identity alone may not scope the original caller resource.
B:Organization membership of a service principal is not a substitute for the relevant service-origin context keys.
C:An object key is caller-supplied resource data and does not independently authorize who may invoke the service-to-bucket request.
AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests