Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 4

Question 30

An AWS service principal can deliver audit files into an S3 bucket. The bucket owner must prevent a different customer from directing that same service to write into the bucket under an unintended source resource. Which condition combination is appropriate when supported?

Allow the service principal unconditionally because its service name is always sufficient to identify the owning AWS customer.
Use aws:PrincipalOrgID as the only condition on all service calls regardless of whether that key is included.
Accept any AWS account ID embedded in the object key and assume IAM validates that filename as a principal.
Restrict the resource policy to the expected aws:SourceArn and aws:SourceAccount of the service’s originating resource and account.

Explanation

Correct Answer

These global context keys bind an AWS service principal invocation to the permitted originating resource and account, mitigating cross-service confused-deputy exposure.

Incorrect Answers

A shared service principal can act on behalf of multiple customers; service identity alone may not scope the original caller resource.

Organization membership of a service principal is not a substitute for the relevant service-origin context keys.

An object key is caller-supplied resource data and does not independently authorize who may invoke the service-to-bucket request.

Question 31

An engineer creates an IAM user in account A for every employee even though IAM Identity Center centrally assigns access in 40 accounts. Offboarding removes the employee from the identity provider but their account A access key continues to work. What explains the gap?

The account A SCP must automatically rotate every IAM access key after Identity Center offboarding.
Remove the user from the Identity Center account-assignment group and assume that action deactivates the independent IAM user access key in account A.
Delete the Identity Center permission set but leave the independent IAM user and its AccessKeyId active, assuming both credential systems share a common revocation state.
The independent IAM user and long-lived access key are not automatically revoked by removing an Identity Center workforce assignment.

Explanation

Correct Answer

IAM users are separate account identities; their stored keys require explicit lifecycle management and are not the temporary sessions provisioned by Identity Center.

Incorrect Answers

SCPs limit allowed actions but do not rotate or delete IAM user access keys.

Identity Center permission-set assignments affect its provisioned role-based workforce access, not a separate long-lived IAM user credential. The IAM user key must be deactivated or removed explicitly.

Removing a permission set changes the Identity Center role access path; it does not revoke unrelated IAM user access keys. Independent credential lifecycles need an explicit offboarding control.

Question 32

A finance analyst in account A assumes a read-only role in account B, but the new session receives AccessDenied for one S3 report. STS AssumeRole succeeded and the bucket policy has no explicit deny. What should be examined next?

Verify only that sts:AssumeRole was permitted and assume successful role issuance automatically authorizes s3:GetObject on all objects in the bucket.
Check the assumed role’s effective s3:GetObject permission for the object ARN and any relevant bucket or KMS policy requirements.
Increase the STS role session duration from one hour to twelve.
Grant s3:ListBucket on the report bucket and assume successful key listing proves that the role can read every listed object body.

Explanation

Correct Answer

Assuming a trusted role establishes an identity; it does not automatically grant every data action. S3 and possibly KMS authorization are evaluated during the subsequent read.

Incorrect Answers

AssumeRole controls entry into a role session, not the role's subsequent S3 data permissions. Effective object action authorization, object ARN and encryption-key rules must still be examined.

Session longevity cannot grant an action missing from the assumed role.

Bucket listing and object retrieval are separate actions and resources. A role can enumerate keys yet still lack s3:GetObject or kms:Decrypt on the requested object.

Question 33

An engineer in account A has an identity policy Allow for sts:AssumeRole, and the role in account B explicitly trusts the engineer's source role. However, a permissions boundary attached to the source role does not include sts:AssumeRole and AssumeRole is denied. What should be fixed?

An authorized administrator must update the source-role permissions boundary to permit the narrowly scoped AssumeRole action while keeping its identity policy and target trust aligned.
Add more S3 GetObject privileges to the target role's inline policy while leaving the source permissions boundary unchanged.
Increase the STS session duration from one to eight hours without changing the source-role boundary.
Change the target-role trust to allow all external account principals and assume the source permissions boundary is no longer evaluated.

Explanation

Correct Answer

An IAM boundary limits what the source role's identity-based policies can grant. Here the identity Allow and destination trust are present, but the boundary does not permit the role-assumption action; an authorized narrowly scoped boundary change resolves that specific ceiling.

Incorrect Answers

Target S3 data permissions apply only after a role session is issued. They cannot repair a missing Allow in the source identity's effective permissions boundary.

A longer requested session is unrelated to the authorization failure; the sts:AssumeRole action still must survive the identity policy, boundary and applicable SCP evaluation.

Weakening the destination trust to arbitrary callers would be unsafe and still cannot grant the source role an action absent from its permissions boundary.

Question 34

An administrator policy permits cloudformation:CreateStack in eu-west-1, but a new stack request is denied. The member account inherits an AWS Organizations SCP that denies the action in that Region. Why is AdministratorAccess ineffective?

A permissive identity policy always takes precedence because IAM is evaluated after Organizations.
The applicable SCP explicit denial limits the member principal independently of its IAM AdministratorAccess allow.
CloudFormation never supports regional authorization.
Allow CloudFormation only in a stack execution role and assume that passing the role automatically exempts a member-account CloudFormation CreateStack caller from the SCP deny.

Explanation

Correct Answer

Organization SCPs form a ceiling on effective member-account permissions. IAM administrator privilege does not override an explicit organization deny.

Incorrect Answers

An explicit SCP deny remains effective even if the role’s IAM policies allow the same action.

CloudFormation is regional; the described issue is an enforced regional guardrail, not absence of regional support.

A service role may carry permissions for stack resource creation after a stack request is accepted. It does not turn an SCP-denied CloudFormation CreateStack caller action into an allowed operation.

Question 35

A service control policy strategy uses a strict allowlist. A new Lambda action is permitted by the engineer’s role but not by a parent OU allowlist. The role is denied. Which fact explains the failure?

Attach an identity-based Lambda Allow to an additional policy on the same role and assume that the extra identity Allow overrides the parent OU allowlist.
An SCP allowlist is itself an IAM role policy that directly grants missing permissions.
Changing the role’s name to Administrator will bypass a parent OU allowlist.
An allowlist SCP must permit the requested action at every required organization level; a role-level allow alone cannot widen that ceiling.

Explanation

Correct Answer

Under SCP allowlist strategy, permitted actions must remain allowed across root/OU/account ancestors as applicable; the effective IAM allow operates only within that maximum.

Incorrect Answers

Multiple identity Allows still intersect with the effective organization maximum. A parent SCP allowlist that omits the Lambda action continues to block the call.

SCPs restrict rather than grant permissions to account principals.

Role naming is not an authorization escape from inherited Organizations restrictions.

Question 36

A monitoring alert shows a privileged finance action performed using root when a scoped billing role already exists. The operator says the existing root session is convenient. Which security failure is evidenced?

The billing service automatically elevates any IAM role to root when a cost report is opened.
The operator used unrestricted account-level root authority for a routine task that can be delegated through a scoped identity.
Let employees use a shared privileged IAM role for everyday billing and rely solely on the shared role name for individual accountability.
Require a root MFA device but keep allowing routine finance operations under root because MFA makes a root session equivalent to a limited billing role.

Explanation

Correct Answer

Root cannot be reduced to a typical job-specific IAM permissions boundary; regular administrative tasks should be attributable to individual least-privileged identities.

Incorrect Answers

A delegated billing role does not silently become the root identity.

A shared privileged principal is still too broad for a routine finance action and weakens individual attribution. Job-scoped named workforce assignments and audit trails better meet least privilege.

Root MFA protects account authentication but does not reduce root's authority to a finance-only policy. Unnecessary routine root usage remains a privilege and accountability problem.

Question 37

A deployment copies its EC2 application's long-lived IAM access key into every Auto Scaling instance. Rotating the key breaks older instances, and the secret appears in an AMI inspection. What design defect caused this?

Static IAM user credentials were embedded into the fleet instead of delivering renewable role credentials through an EC2 instance profile.
Auto Scaling groups cannot run any IAM-authenticated AWS API calls.
Store the same IAM user key in the EC2 instance user data instead of the AMI and assume this change supplies automatically rotated temporary credentials.
Rotate the one shared IAM user key on a schedule but keep embedding its new value into every Auto Scaling instance at launch.

Explanation

Correct Answer

Instance roles allow SDKs to obtain rotated temporary credentials per workload, avoiding persistent secrets copied across images and configuration.

Incorrect Answers

EC2 instances in Auto Scaling groups can use instance profiles; the static-key pattern is the defect.

Moving the static key from the AMI to user data does not change its credential type or lifecycle, and user data itself can expose sensitive material.

Scheduled manual rotation leaves a persistent fleet-wide secret and rollout coordination burden. IAM instance profiles give each instance renewable role credentials without embedding a static key.

Question 38

A corporate SAML IdP authenticates a new employee successfully, and the AWS account has a permission-set assignment for the relevant workforce group. The employee has just joined that IdP group, but group membership in the Identity Center identity store has not updated; the access portal still lacks the AWS account. Which dependency should be diagnosed first?

Increase the permission set maximum session duration, because a longer STS session automatically creates missing directory group memberships.
Disable the organization SCP, since SCPs are the only mechanism that synchronizes external IdP group memberships.
Check that the IdP has actually provisioned the new group membership into IAM Identity Center (for example via SCIM) and that the stored identity is the assigned group member.
Re-save the existing AWS account permission-set assignment without verifying whether the employee is actually present in the assigned Identity Center group.

Explanation

Correct Answer

An assigned Identity Center group only authorizes members currently known to the Identity Center identity store; IdP membership updates must be provisioned to that store.

Incorrect Answers

STS duration applies after obtaining authorized AWS role sessions; it neither transports IdP directory updates nor assigns the new employee to a group.

SCP guardrails may limit actions but do not replace SCIM or other identity-store synchronization from an external SAML provider.

The group assignment can be valid yet ineffective for a person whose identity-store membership was not provisioned. Verify directory-to-Identity Center user/group synchronization before modifying the role permissions.

Question 39

A GitHub Actions job uses an OIDC token with the approved repository and branch subject, but sts:AssumeRoleWithWebIdentity returns an audience-related access error. The IAM role trust condition expects token.actions.githubusercontent.com:aud = sts.amazonaws.com. What should the engineer diagnose?

Change the repository's source branch name because AWS checks only GitHub branch metadata and never validates the OIDC audience claim.
Increase the target IAM role MaxSessionDuration so an audience mismatch can be ignored until after role assumption succeeds.
Verify the OIDC token audience and registered provider client-ID configuration match sts.amazonaws.com and that the role trust validates the correct audience.
Allow every GitHub repository subject in the role trust because a broader subject match automatically rewrites an invalid audience claim.

Explanation

Correct Answer

For the standard GitHub Actions AWS federation flow the audience is sts.amazonaws.com. The IAM OIDC provider client ID, token claim and audience condition must align before STS issues role credentials.

Incorrect Answers

The subject controls which workflow identity may assume the role, but the audience identifies the intended token recipient. A correct repo/branch subject cannot compensate for a mismatched audience.

Role session duration limits apply to issued credentials, not to whether a signed OIDC token's audience satisfies the trust relationship.

Subject conditions and audience conditions are independently checked. Removing branch restrictions weakens security and does not change a token aud value that fails its existing trust condition.

Question 40

A software vendor supports two customers with the same assume-role principal. A configuration bug sends the customer A role ARN while processing customer B. The third-party access succeeds because the trust has no customer-specific context. What protection is missing?

A distinct expected ExternalId condition in the customer-owned role trust, verified in the vendor’s AssumeRole request.
Use a single ExternalId value shared across all of the vendor's customers so customer-role calls can be distinguished by that one global ID.
Check only that the vendor principal ARN is trusted, without verifying any customer-specific ExternalId in the request.
A role name with at least 128 random characters as the only access protection.

Explanation

Correct Answer

ExternalId helps the vendor demonstrate which customer relationship an assume-role operation represents, mitigating confused-deputy cross-customer mistakes.

Incorrect Answers

A shared vendor-wide ExternalId does not bind the AssumeRole request to an individual customer relationship and therefore fails the intended cross-customer confused-deputy protection.

A valid trusted vendor principal establishes who can ask to assume the role, but not which customer relationship the request belongs to. The distinct ExternalId is the missing context boundary.

Role names are not secret authorization credentials and do not bind the intended customer context.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 30

Explanation

Correct Answer

Incorrect Answers

Question 31

Explanation

Correct Answer

Incorrect Answers

Question 32

Explanation

Correct Answer

Incorrect Answers

Question 33

Explanation

Correct Answer

Incorrect Answers

Question 34

Explanation

Correct Answer

Incorrect Answers

Question 35

Explanation

Correct Answer

Incorrect Answers

Question 36

Explanation

Correct Answer

Incorrect Answers

Question 37

Explanation

Correct Answer

Incorrect Answers

Question 38

Explanation

Correct Answer

Incorrect Answers

Question 39

Explanation

Correct Answer

Incorrect Answers

Question 40

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests