Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 9

Question 80

A long-running EC2 service must call AWS APIs over weeks. Its current code caches a single STS session in a configuration file and fails after token expiry. Which design best balances secure credential lifetimes with continuity?

Disable expiration of all STS role sessions forever.
Increase all application calls to root credentials so tokens never expire.
Use the AWS SDK credential provider chain with a workload IAM role that renews temporary sessions, rather than persisting one role session.
Increase the IAM role max session duration but continue using the originally cached expired STS credentials instead of refreshing them.

Explanation

Correct Answer

SDK role providers can refresh temporary credentials without distributing a permanent access key, so secure expiration does not interrupt normal requests.

Incorrect Answers

AWS STS temporary sessions are intentionally time-limited; indefinite sessions are not a supported replacement.

Root credentials are far too privileged and do not solve secure role-based workload identity.

Changing a role maximum affects future session requests; it cannot extend a previously issued token. A refreshable SDK credential provider is needed for uninterrupted execution.

Question 81

A cross-account data-processing role reads SSE-KMS encrypted objects. The security team prefers not to grant broad rights to every principal in the caller’s account. How can the KMS boundary remain narrow?

Grant kms:* to the external account root as an unconstrained broad permission.
Rely solely on S3 GetObject authorization because S3 will bypass KMS policies.
Authorize only the designated external role and required cryptographic operations in the key policy, with matching identity permissions on that role.
Place the S3 bucket name in a KMS encryption alias as the only authorization.

Explanation

Correct Answer

A role-specific key principal and least-privilege actions minimize key-use exposure while meeting the cross-account KMS two-policy requirement.

Incorrect Answers

Broad key control exceeds the narrow decryption task and makes delegation difficult to contain.

S3 data permissions do not supersede the independent KMS key policy and IAM checks.

An alias identifies a key but does not grant decrypt permission to the intended principal.

Question 82

A compliance officer wants to attribute unauthorized API changes to an AWS principal. The proposed evidence sources are CloudTrail control-plane events, VPC Flow Logs and EC2 CPU metrics. Which should be primary for caller attribution?

CloudTrail management API events with principal identity, event name, timestamp and relevant request details.
VPC Flow Logs alone, because a network flow contains the full IAM role session issuer and exact API parameters.
CloudWatch CPU metrics alone, because utilization spikes reveal the authorized API principal.
Rely on CloudTrail data events for one S3 bucket while disabling control-plane management event collection, assuming it records every EC2 configuration change.

Explanation

Correct Answer

CloudTrail records supported management actions and their caller context, whereas flow and utilization telemetry describe different observability layers.

Incorrect Answers

Flow records provide network metadata, not complete API identity and request semantics.

A performance metric cannot uniquely identify who called a management operation.

S3 object-level data event trails are useful for object activity but do not replace management-event records for supported EC2 and IAM API changes and their caller identities.

Question 83

A company with dozens of AWS accounts wants a resource policy to recognize accounts as they join and leave its Organization. Should it maintain literal account ARNs or use organization membership context?

Where appropriate, use aws:PrincipalOrgID with a scoped principal/action policy to avoid manually updating each authorized account ID.
Use a wildcard Principal without any condition to eliminate account lists.
Use aws:PrincipalAccount values restricted to only the current set of account IDs and update that static list whenever AWS Organizations membership changes.
Use the aws:SourceAccount service-principal context key as a universal substitute for aws:PrincipalOrgID on human IAM callers.

Explanation

Correct Answer

Organization membership is evaluated from the requesting principal’s actual account context, allowing policy applicability to follow membership changes.

Incorrect Answers

Removing the organization condition would allow access attempts from untrusted accounts.

A literal account list can restrict access but needs ongoing maintenance and may omit new members. Where supported, a scoped aws:PrincipalOrgID condition can follow actual organization membership.

These keys address different request contexts; service origin is not the same as caller organization membership.

Question 84

A production restriction requires preventing developers from assuming ordinary roles with dangerous permissions, but an AWS-managed integration uses a service-linked role that runs despite the same SCP. Which design boundary must the architect recognize?

Force service-linked roles into the AWS account root to make SCP denial effective.
Replace all SCPs with permissive S3 bucket policies.
Ignore member-account IAM restrictions because SCPs independently grant user permission.
SCP guardrails cover ordinary member-account principals but exclude service-linked roles; review relevant service-specific integration controls for that exception.

Explanation

Correct Answer

Understanding SCP exclusions avoids an invalid claim that an organization deny alone restricts every AWS-managed service integration.

Incorrect Answers

Service-linked roles are distinct IAM constructs and do not become root principal sessions.

A bucket policy controls its own resources and cannot enforce general organization-wide API limits.

An SCP is a maximum, not an identity permission grant.

Question 85

An enterprise changes a shared IAM Identity Center permission set applied to 100 member accounts. The design objective is reliable change propagation without editing each generated role manually. What practice is relevant?

Provision the changed permission set to assigned AWS accounts and verify the effective generated role policy, using Identity Center management as source of truth.
Edit only the corporate SAML sign-in portal logo and assume account roles update.
Ask every employee to create new long-lived IAM users in the accounts after the update.
Edit the generated IAM roles directly in each of the 100 member accounts and assume IAM Identity Center will preserve these hand edits at the next provisioning event.

Explanation

Correct Answer

Central permission-set provisioning maintains consistent access across assigned accounts and avoids divergent hand edits to generated IAM roles.

Incorrect Answers

Portal appearance does not propagate IAM permissions.

Per-account users undermine the centralized model and do not reconcile the permission-set rollout.

Identity Center manages its generated roles from permission sets. Direct edits are fragile and diverge from the central source of truth; provision the updated permission set through the service.

Question 86

A service using a role session must assume another role. It needs several hours of continuous service but role chaining caps each secondary session at one hour. Which design is safer than requesting a prohibited four-hour chained session?

Raise the secondary role maximum to 12 hours and keep sending DurationSeconds=14400 through chaining.
Use the source account root user as a permanent replacement for STS.
Design bounded one-hour chained sessions with authorized refresh or choose a suitable initial workload federation path that can support the required duration.
Call AssumeRole once with a one-hour chained session, then continue using its credentials for six hours without another authentication attempt.

Explanation

Correct Answer

STS chaining limits secondary sessions; rotating valid sessions or avoiding unnecessary chaining respects the limit without sharing static credentials.

Incorrect Answers

The one-hour chaining ceiling still applies to a second assumed role.

Root credentials are overprivileged and are not an acceptable long-running workload identity.

Temporary chained credentials expire after their allowed session lifetime and cannot be reused after that expiry. A workload should refresh authorized sessions or avoid unnecessary chaining.

Question 87

A company’s workforce IdP occasionally becomes unavailable. It wants recoverable administrator control-plane access without making the root account its primary fallback. Which architecture has the more appropriate dependency model?

A second IAM Identity Center portal using the same failed IdP and no other authentication path.
A publicly disclosed root password kept in the engineering runbook for emergencies.
A protected and periodically tested emergency administrator route with a separate authentication dependency and root reserved for root-only operations.
Rely on IAM Identity Center configured only against the same primary SAML IdP and designate another portal URL as the emergency administrator access route.

Explanation

Correct Answer

Isolation from the normal IdP prevents a shared outage from blocking both routine federation and recovery; exceptional activity should be monitored.

Incorrect Answers

A second front end with the same authentication dependency cannot ensure outage access.

Shared root credentials create account-wide compromise risk and eliminate individual accountability.

Changing the portal address does not eliminate the shared identity-provider dependency. A genuinely separate, safeguarded recovery identity path must survive the IdP outage.

Question 88

A compliance design calls for S3 object reads only through one private VPC endpoint. A network engineer suggests restricting application subnets but leaving the S3 IAM resource policy path-agnostic. Which additional control closes the authorization gap?

Enforce the expected aws:SourceVpce request condition in the applicable S3 policy and validate approved service-call exceptions.
Enable S3 Object Ownership to force all callers through the same VPC endpoint.
Restrict the role by AWS Region only and assume that determines which VPC endpoint carried a request.
Restrict the bucket to requests from one AWS Region using aws:RequestedRegion without enforcing any VPC endpoint context.

Explanation

Correct Answer

A network topology alone can be bypassed by other authorized routes; the IAM context condition ties supported object requests to the specific endpoint.

Incorrect Answers

Object ownership and ACL behavior are independent of request network path.

A regional condition cannot uniquely identify a private endpoint.

Regional authorization does not prove the network path traversed a particular VPC endpoint. The supported aws:SourceVpce key is needed for endpoint-scoped access, with service exceptions planned.

Question 89

Several application tenants share a DynamoDB table, and requests are authenticated to a tenant ID. The team wants an IAM-level boundary rather than relying entirely on application filters. Which modeling choice makes that possible?

Use the same fixed partition key value for all tenants and expect LeadingKeys to identify individual tenants.
Include tenant identity in the DynamoDB partition-key design and restrict supported actions with dynamodb:LeadingKeys tied to the authorized tenant.
Grant tenant callers DynamoDB table-wide Query access and filter other tenants from the Query response in application code.
Require each client to send a tenant ID in an unverified comment string and trust it without authorization checks.

Explanation

Correct Answer

A tenant-aligned partition key allows DynamoDB IAM conditions to distinguish permitted items; application filtering after broad reads is not sufficient isolation.

Incorrect Answers

If tenants share the identical leading key, the condition cannot separate their items.

A post-read filter is insufficient as an IAM-layer tenant boundary because the table request may access another tenant before the application discards the result. LeadingKeys can enforce partition-key scope.

A user-supplied value is not an independently authenticated tenancy boundary.

Question 90

A shared audit bucket permits one AWS service principal with aws:SourceAccount set correctly, but aws:SourceArn uses a wildcard that matches ANY trail from that account. Security requires only a single approved trail to write. What tightening most directly enforces that narrower source identity?

Constrain aws:SourceArn to the exact supported ARN of the approved trail, retaining the appropriate aws:SourceAccount condition and service principal.
Remove aws:SourceArn entirely because SourceAccount by itself proves which named trail invoked the service.
Use the VPC subnet CIDR as the only condition even though the AWS service principal performs the write on a customer’s behalf.
Match aws:SourceAccount to the correct account but leave aws:SourceArn wildcarded across all CloudTrail trails in that account.

Explanation

Correct Answer

The account condition identifies the originating account while a properly scoped source ARN restricts a particular service resource within that account.

Incorrect Answers

Multiple service resources in one account can share the same account identifier; account-only filtering cannot distinguish their trail ARNs.

Network location is not a substitute for supported service-origin authorization context in a resource policy.

SourceAccount distinguishes the service customer account, not the particular trail. To restrict one trail, match a supported exact SourceArn alongside the account condition.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 80

Explanation

Correct Answer

Incorrect Answers

Question 81

Explanation

Correct Answer

Incorrect Answers

Question 82

Explanation

Correct Answer

Incorrect Answers

Question 83

Explanation

Correct Answer

Incorrect Answers

Question 84

Explanation

Correct Answer

Incorrect Answers

Question 85

Explanation

Correct Answer

Incorrect Answers

Question 86

Explanation

Correct Answer

Incorrect Answers

Question 87

Explanation

Correct Answer

Incorrect Answers

Question 88

Explanation

Correct Answer

Incorrect Answers

Question 89

Explanation

Correct Answer

Incorrect Answers

Question 90

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests