Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 8

Question 70

A third-party compliance scanner has permission to assume a customer role, and the customer role trust policy still lists the correct vendor principal. After the vendor rotates the customer-specific ExternalId in its own configuration, STS AssumeRole starts returning AccessDenied. Why can this happen?

The customer role ARN must change every time an ExternalId value changes, or STS cannot locate the role.
Only the caller-side IAM identity policy matters when a role trusts the correct vendor, so trust conditions are never checked.
The ExternalId sent in the STS request no longer matches the customer role trust-policy condition; the customer and vendor must securely coordinate the expected value.
Adding sts:ExternalId as an IAM action in the vendor identity policy overrides the old ExternalId condition in the customer role trust policy.

Explanation

Correct Answer

STS evaluates the supplied ExternalId against the trust policy. A rotated caller value without the corresponding approved trust-policy update fails even if the principal matches.

Incorrect Answers

An IAM role ARN is independent of the STS ExternalId request argument and remains addressable without a rename.

AssumeRole permission needs both relevant caller authorization and the receiving role trust policy, including any required conditions.

sts:ExternalId is a request context condition key, not an IAM action to add to a permissions policy. The customer role still evaluates its trust policy condition against the ExternalId supplied on the AssumeRole request.

Question 71

A company has separate sandbox and production accounts. A strict root OU policy would impose the same limits on both, but security needs different guardrails without manually editing each account. What hierarchical design should it select?

Put production and sandbox accounts into separate child OUs and attach tested guardrails at the correct OU levels.
Put all accounts in one OU and have developers bypass policies with a billing tag.
Attach an SCP to each member account separately while keeping both environments under the same OU, then rely on manual updates after acquisitions.
Grant all sandbox accounts root permission to detach parent OU policies themselves.

Explanation

Correct Answer

OU inheritance lets policy vary across environment branches while retaining common parent protections where needed.

Incorrect Answers

Cost tags cannot override Organizations authorization.

Account-by-account guardrails can technically work but do not meet the requirement to scale distinct sandbox versus production policy without manual edits. Two child OUs supply inheritance by environment.

Member account root cannot override governing Organizations policy attachment.

Question 72

A company needs privileged AWS operators to complete MFA before role assumption, while unattended OIDC CI pipelines also assume roles. Which choice respects the authentication-path difference?

Enforce an applicable MFA condition on the supported interactive role-assumption path and design separate, tightly scoped token-based trust for noninteractive CI.
Require a human MFA prompt for every unattended CI token, even when the federation provider cannot provide the IAM MFA context.
Disable MFA on interactive privileged roles because CI also needs AWS access.
Store a shared OTP seed in every pipeline repository to satisfy human MFA.

Explanation

Correct Answer

MFA-authenticated human sessions and machine federation have different request contexts; requiring the same IAM MFA key on unsupported OIDC contexts can block automation without adding real assurance.

Incorrect Answers

An incompatible condition can make a legitimate noninteractive role impossible to assume.

Different identities and trust conditions allow human protections to remain strong.

A replicated human MFA secret defeats factor independence and is not a proper OIDC workload trust mechanism.

Question 73

An ETL role may read existing S3 objects only when their object tag Classification is set to Public; the bucket contains both public and confidential objects in the same reports/ prefix. A simple prefix-based GetObject Allow is too broad. Which authorization control directly distinguishes the objects?

Use an appropriate s3:ExistingObjectTag/Classification condition on the supported s3:GetObject permission and verify object tags and any explicit denies.
Use only s3:prefix on a bucket-level s3:ListBucket statement and assume that condition automatically prevents GetObject for confidential tagged objects in the same prefix.
Set the S3 Versioning property to Suspended and assume versioning state enforces object classification access by tag.
Configure a Route 53 hosted-zone TXT record containing Classification=Public and rely on S3 to treat DNS records as IAM conditions.

Explanation

Correct Answer

For supported object read operations, an existing-object-tag condition can narrow access to objects with the requested classification, beyond a bucket prefix.

Incorrect Answers

A ListBucket prefix condition scopes enumeration but cannot by itself restrict GetObject when confidential and public objects share the same key prefix.

Versioning state controls historical object versions, not a principal’s classification-based read entitlement.

DNS text data is not an S3 IAM condition and cannot authorize or deny GetObject by object tags.

Question 74

A delegated IAM role creator has been required to attach an approved permissions boundary. A security test finds that the creator can later call iam:DeleteRolePermissionsBoundary or create a role without the boundary. Which additional guardrail closes this privilege-escalation path?

Give delegated admins IAMFullAccess and rely on an email asking them not to remove the boundary.
Restrict CreateRole using the iam:PermissionsBoundary condition and deny removal or unauthorized replacement of the approved boundary by delegated creators.
Require the approved boundary only when iam:CreateRole is called, but leave iam:DeleteRolePermissionsBoundary and arbitrary iam:PutRolePermissionsBoundary permitted afterward.
Skip all future role policy review because boundaries always permit only safe actions.

Explanation

Correct Answer

Creation-time enforcement limits new roles to the approved boundary; denying DeleteRolePermissionsBoundary and unapproved PutRolePermissionsBoundary prevents later self-escalation. The policy must be tested on actual delegated API paths.

Incorrect Answers

Informal guidance does not enforce a technical permission ceiling.

Create-time enforcement alone is insufficient: a delegated administrator able to remove or substitute the boundary may later create a role session with excessive permissions.

Boundaries are explicit maximum sets and still require correct configuration and review.

Question 75

A report owner needs to share one S3 prefix with a trusted role in a separate AWS account, keeping the bucket private. An architect suggests only granting the external role GetObject in its own account. Which complementary control is needed?

Place s3:GetObject on the external role identity policy and assume the resource-owner bucket will accept any already-authorized external principal.
Enable S3 static website hosting so the external role no longer needs IAM.
A scoped bucket resource policy granting that external role the intended object access, plus KMS authorization if customer-managed encryption is used.
Transfer ownership of the entire bucket to the external account.

Explanation

Correct Answer

External IAM policies cannot unilaterally open another account’s bucket; both sides of the access path must authorize the request.

Incorrect Answers

Cross-account S3 access requires the external identity to be permitted by resource-owner authorization as well, subject to denies and KMS controls. A single outside identity Allow is not a bucket grant.

Website hosting can expose public content but does not implement private role-scoped access.

Cross-account reads can be granted without relinquishing governance of all report objects.

Question 76

Many suppliers upload S3 objects to an archive bucket. The destination organization wants every newly uploaded object owned by the bucket and access managed through policies rather than supplier ACLs. Which configuration reduces ongoing ownership complexity?

Keep Object writer ownership and require the destination to request new ACL grants for each file.
Set Object Ownership to Bucket owner preferred while allowing suppliers to omit bucket-owner-full-control ACLs on their new objects.
Give each supplier the bucket owner’s root credentials.
Use Object Ownership Bucket owner enforced and require clients to upload without unsupported ACL grants.

Explanation

Correct Answer

This ownership setting disables ACL enforcement, simplifying policy-driven governance even when objects originate in different AWS accounts.

Incorrect Answers

That preserves the per-object administration the owner wants to eliminate.

Bucket owner preferred only changes object ownership when the uploader includes the required canned ACL. Without it, supplier ownership and ACL dependencies can remain; Bucket owner enforced removes that dependency.

Shared root access creates account-wide exposure and is unnecessary for supported cross-account uploads.

Question 77

A central team wants continuous detection when S3 bucket policies grant access outside its AWS Organization. Another team proposes scanning every bucket manually once a year. What is the direct operational advantage of IAM Access Analyzer?

It directly blocks every external bucket request as an IAM deny policy.
It determines every IAM user’s actual business justification for accessing objects.
It replaces all CloudTrail events with a single bucket-level metric.
It reasons about supported resource policies relative to a defined zone of trust and surfaces external-principal findings as policies change.

Explanation

Correct Answer

Automated external-access analysis reveals effective cross-account/public policy exposure more promptly than infrequent manual inspections.

Incorrect Answers

Finding external permissions is a diagnostic, not automatic enforcement of a bucket deny.

Policy analysis can expose technical grants, not the human business reason behind each one.

Policy findings and API event auditing answer different questions and may both be needed.

Question 78

A security team wants to reduce a role’s excess IAM permissions. Access Analyzer can propose a policy from observed CloudTrail use, but the role executes a recovery job only once a year. Which tradeoff must be made explicit?

Apply the generated policy without review because unobserved actions are necessarily unauthorized.
Generate the policy from 90 days of CloudTrail use and treat any recovery actions absent from that period as definitively unnecessary.
Use activity-derived permissions as a starting point but validate documented rare recovery operations before applying the narrowed role policy.
Replace the IAM policy with AdministratorAccess because least privilege is uncertain.

Explanation

Correct Answer

A historical audit window may omit infrequent but necessary actions; least privilege must be tested against the workload’s true operational contract.

Incorrect Answers

Low-frequency emergency tasks might legitimately be missing from the sample period.

CloudTrail-informed policy generation reflects observed activity during its lookback window; an annual recovery operation may be omitted despite being valid. Verify rare operating procedures before narrowing permissions.

Broad privilege abandons the intended permission reduction and increases blast radius.

Question 79

A security team wants to deny S3 object deletion over unencrypted transport while allowing only separately authorized TLS requests. A draft policy uses an unconditional explicit Deny for s3:DeleteObject and now blocks both secure and insecure sessions. Which correction preserves enforceable transport guardrails without globally disabling legitimate authorized deletion?

Attach a second unrestricted Allow for s3:DeleteObject to the same principal and assume its broader permissions cancel the explicit Deny.
Change the policy statement order to put the Allow last so the service evaluates the most recent statement as final.
Scope the explicit Deny using the appropriate aws:SecureTransport=false request condition, retaining separately scoped IAM or resource Allows for the intended secure requests.
Remove every DeleteObject policy statement and rely on S3 Standard-IA storage class to authenticate the transport protocol.

Explanation

Correct Answer

A request-context-based deny rejects insecure transport while no longer matching secure TLS requests; successful secure deletion still needs separate positive authorization.

Incorrect Answers

An applicable explicit Deny overrides identity and resource policy Allows regardless of their breadth; adding a new Allow cannot create a requested exception.

AWS evaluates matching effects and request context rather than treating the last statement as a rule that supersedes earlier denies.

A storage class governs price and retrieval behavior, not the TLS identity-policy evaluation or a narrowly scoped DeleteObject permission.

Question 80

A long-running EC2 service must call AWS APIs over weeks. Its current code caches a single STS session in a configuration file and fails after token expiry. Which design best balances secure credential lifetimes with continuity?

Disable expiration of all STS role sessions forever.
Increase all application calls to root credentials so tokens never expire.
Use the AWS SDK credential provider chain with a workload IAM role that renews temporary sessions, rather than persisting one role session.
Increase the IAM role max session duration but continue using the originally cached expired STS credentials instead of refreshing them.

Explanation

Correct Answer

SDK role providers can refresh temporary credentials without distributing a permanent access key, so secure expiration does not interrupt normal requests.

Incorrect Answers

AWS STS temporary sessions are intentionally time-limited; indefinite sessions are not a supported replacement.

Root credentials are far too privileged and do not solve secure role-based workload identity.

Changing a role maximum affects future session requests; it cannot extend a previously issued token. A refreshable SDK credential provider is needed for uninterrupted execution.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 70

Explanation

Correct Answer

Incorrect Answers

Question 71

Explanation

Correct Answer

Incorrect Answers

Question 72

Explanation

Correct Answer

Incorrect Answers

Question 73

Explanation

Correct Answer

Incorrect Answers

Question 74

Explanation

Correct Answer

Incorrect Answers

Question 75

Explanation

Correct Answer

Incorrect Answers

Question 76

Explanation

Correct Answer

Incorrect Answers

Question 77

Explanation

Correct Answer

Incorrect Answers

Question 78

Explanation

Correct Answer

Incorrect Answers

Question 79

Explanation

Correct Answer

Incorrect Answers

Question 80

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests