Amazon AWS Certified Solutions Architect Associate SAA-C03 Federation and Multi-Account Governance Practice Test

 

Topic 02 covers federation and multi-account governance for the AWS Certified Solutions Architect – Associate certification. These original SAA-C03 questions test trust, session and organization boundaries using explicit constraints. Select one answer unless a fixed number is requested. For broader preparation, visit the AWS Certified Solutions Architect Associate SAA-C03 Exam Dumps page. Each alternative explains the governing behavior.

Question 1

A company has configured SAML authentication between its external workforce IdP and IAM Identity Center. A new engineering group exists only in the IdP and has not been provisioned or assigned AWS account access. Which TWO steps make the group’s intended account role available without creating IAM users? Choose TWO.

1. Create a customer identity pool in Amazon Cognito for the same employees.
2. Provision the applicable users and group into IAM Identity Center, using SCIM or supported manual provisioning.
3. Assign the provisioned group the required permission set in the target account.
4. Increase the SAML assertion lifetime without provisioning the group.
5. Create the permission set but make no group-to-account assignment, relying on the IdP group membership alone.

Correct Answers: B, C

 

Correct Answers

Answer B is correct because SAML authentication does not discover the IdP’s directory objects. IAM Identity Center needs those users and groups represented before it can make account assignments.

Answer C is correct because the directory objects alone do not grant AWS account access. The assignment connects this group, its permitted role template and the particular account.

Incorrect Answers

Answer A is incorrect because Cognito addresses a different application identity use case. The existing workforce integration needs provisioning and assignments, not a parallel customer-identity design.

Answer D is incorrect because a longer-lived authentication assertion does not create missing directory objects or an account assignment. The missing authorization setup remains unchanged.

Answer E is incorrect because an unassigned permission set is only a template. External group membership does not automatically connect that template to the target AWS account.

 

Question 2

A support group needs a read-only role in production and a maintenance role in development. Both AWS accounts are in an organization with IAM Identity Center multi-account access enabled. The group must keep one workforce identity. Which configuration expresses the two account-specific authorizations?

1. Assign the maintenance permission set in both accounts and label production as read-only.
2. Assign a read-only permission set to the group in production and a maintenance permission set in development.
3. Assign a production read-only permission set only at the organization’s billing level.
4. Create one IAM user in each account with the same username and password.

Correct Answer: B

 

Correct Answer

Answer B is correct because account assignments can give the same workforce group different roles in different accounts. The identity does not need to be duplicated to express these scopes.

Incorrect Answers

Answer A is incorrect because a label does not narrow the production role’s effective permission set. The group would receive maintenance authority in an account where only reads are required.

Answer C is incorrect because permission sets are used in specific account assignments, not inherited as a billing-level authorization. Development maintenance access would also remain unassigned.

Answer D is incorrect because matching names do not make the identities centrally governed. This reintroduces separate credentials and does not meet the one-workforce-identity requirement.

 

Question 3

An IAM Identity Center user remains signed in to the access portal for several hours, but an AWS account console session obtained through a permission set ends after one hour. The company permits a two-hour account session. Which setting should be adjusted for newly issued sessions?

1. The session duration on an unrelated permission set assigned to another account.
2. Increase only the AWS access portal session duration while leaving the permission-set duration unchanged.
3. Only the external IdP’s password expiration interval.
4. The session duration on the account’s assigned permission set.

Correct Answer: D

 

Correct Answer

Answer D is correct because the permission-set duration controls the AWS account session acquired through that assignment. A longer portal session does not automatically lengthen the separate account session.

Incorrect Answers

Answer A is incorrect because the current account session comes from its selected assignment. Changing a different role template does not configure the session whose duration is being limited.

Answer B is incorrect because the portal can remain active while a separately issued account session expires. Lengthening the portal session does not change the shorter account-role session.

Answer C is incorrect because password aging determines when a password must be changed, not how long an issued AWS account role session remains valid.

 

Question 4

A company wants IAM Identity Center to use its existing on-premises Microsoft Active Directory. Its design specifically requires directory requests to be forwarded to that directory without caching directory information in AWS. Connectivity and the supported account prerequisites will be satisfied. Which Directory Service option meets the requirement?

1. Copy the users into a new internal identity store and stop forwarding directory requests.
2. An Amazon Cognito user pool populated with copied employee passwords.
3. AD Connector linked to the existing directory.
4. A new AWS Managed Microsoft AD directory with independent user accounts.

Correct Answer: C

 

Correct Answer

Answer C is correct because AD Connector acts as a directory gateway to the existing on-premises Active Directory. Its forwarding model matches the explicit requirement not to cache directory information in AWS.

Incorrect Answers

Answer A is incorrect because this introduces a separate stored directory representation rather than the required gateway to the existing directory. It does not satisfy the forwarding-only design.

Answer B is incorrect because a user pool is not an Active Directory request gateway. Copying passwords also introduces a separate identity store contrary to the stated integration constraint.

Answer D is incorrect because a newly managed directory creates a different directory environment. Independent users would not preserve the required forwarding-only relationship to the existing directory.

 

Question 5

An automation process already using credentials from Role A calls AssumeRole for Role B with DurationSeconds=7200. Role B’s maximum session duration is four hours. The request is rejected because it is a role-chained session. Which change permits this assumption within the documented chaining limit?

1. Request a session of no more than 3600 seconds.
2. Add an extra allow for sts:AssumeRole to Role A’s identity policy.
3. Keep DurationSeconds at 7200 but pass a more restrictive session policy.
4. Increase Role B’s maximum session duration to twelve hours and keep 7200 seconds.

Correct Answer: A

 

Correct Answer

Answer A is correct because a CLI/API role-chained session is limited to one hour even when the destination role permits longer sessions for other assumption paths. Two hours exceeds that separate limit.

Incorrect Answers

Answer B is incorrect because the stated rejection concerns session duration rather than missing authorization. Repeating an allow does not alter a service limit.

Answer C is incorrect because a session policy narrows authorized actions; it does not change the separate role-chaining lifetime limit. The two-hour request remains invalid.

Answer D is incorrect because the destination role’s higher maximum does not remove the role-chaining limit. The requested two-hour chained session would still exceed it.

 

Question 6

An IAM user in Account A must assume ReaderRole in Account B and use that role to read designated S3 objects owned by Account B. No relevant grants are configured yet. There are no denies, boundaries, encryption-key dependencies or bucket-policy requirements. Which THREE permissions or trust relationships form the required design? Choose THREE.

1. Give the Account A user iam:PassRole on ReaderRole instead of sts:AssumeRole.
2. Configure ReaderRole to trust only the S3 service principal.
3. Grant ReaderRole s3:GetObject on the designated Account B objects.
4. Allow the Account A user to call sts:AssumeRole on ReaderRole.
5. Grant only the Account A user s3:GetObject and leave ReaderRole without data permissions.
6. Configure ReaderRole’s trust policy to accept that Account A principal.

Correct Answers: C, D, F

 

Correct Answers

Answer C is correct because after successful assumption, the role needs permission for the data operation. Permission to acquire a role does not inherently grant that role object-read access.

Answer D is correct because the external caller needs authorization in its own account to request the target role. That permission does not by itself establish the target account’s trust.

Answer F is correct because the target account must explicitly trust the external principal for role assumption. The caller cannot create this target-side trust by changing its own identity policy.

Incorrect Answers

Answer A is incorrect because passing a role to an AWS service is a different operation. The caller needs a role session for its own requests, not service role delegation.

Answer B is incorrect because S3 is not the principal requesting the role in this scenario. That trust would not authorize the named user in Account A to assume it.

Answer E is incorrect because the S3 request is made using ReaderRole’s session, not the user’s original credentials. The proposed grant does not supply the target runtime identity with read access.

 

Question 7

An external IAM user is allowed to assume a production support role, and the role trusts that user only when aws:MultiFactorAuthPresent is true. A call using long-term keys without MFA is denied. The user has an assigned MFA device. Which request satisfies the trust condition?

1. Change the role’s permissions policy while leaving its trust condition and request unchanged.
2. Call AssumeRole with the assigned MFA device information and its current token code.
3. Add production S3 permissions to the user’s original identity and repeat the same request.
4. Set the role session name to MFA-Approved while omitting the MFA parameters.

Correct Answer: B

 

Correct Answer

Answer B is correct because the role trust requires an MFA-authenticated assumption. Supplying the supported MFA parameters lets STS evaluate that condition for the requested session.

Incorrect Answers

Answer A is incorrect because the permissions policy determines actions after assumption. The failure occurs earlier when STS evaluates whether the caller can obtain the session.

Answer C is incorrect because permissions on the original identity do not satisfy the target role’s authentication condition. They also introduce an unrelated direct-access path.

Answer D is incorrect because a session name is an identifier chosen for the session, not proof of MFA. It cannot satisfy the target trust policy’s authentication context.

 

Question 8

A monitoring vendor assumes roles in many customer accounts. The company must prevent another customer from tricking the vendor into using the company’s role. The vendor supplies a unique customer external ID. Which TWO design elements address that risk? Choose TWO.

1. Use the same external ID for every customer because all calls come from the vendor account.
2. Require the supplied external ID in the role’s trust policy while trusting the vendor’s intended principal.
3. Publish the role ARN only through an encrypted email and omit the external-ID condition.
4. Require the vendor to send this customer’s external ID in its AssumeRole request.
5. Put the external ID in the role’s S3 permissions policy instead of its trust policy.

Correct Answers: B, D

 

Correct Answers

Answer B is correct because the target account checks that the vendor is acting for this customer. The external ID supplements the trusted principal rather than replacing identity-based trust.

Answer D is correct because the vendor must bind its customer context to the role request. A trust condition is useful only when the corresponding request carries the correct value.

Incorrect Answers

Answer A is incorrect because a shared value cannot distinguish which customer the vendor is serving. Unique vendor-controlled customer identifiers are what prevent this confused-deputy path.

Answer C is incorrect because treating a role ARN as a secret is not a dependable tenant-context control. The vendor could still be directed to a known ARN by another customer.

Answer E is incorrect because the confused-deputy check belongs at role assumption. A data-action policy is not where the ExternalId parameter authorizes entry to the role.

 

Question 9

A broker assumes a cross-account project role that can read projects/a/* and projects/b/*. For one approved job, the broker must issue credentials limited to projects/a/*. There are no direct resource-policy session grants. Which approach narrows that issued session without changing permissions for other jobs?

1. Name the role session projects-a while retaining all the role’s permissions.
2. Pass a session policy to AssumeRole allowing only the required projects/a/* reads.
3. Change the role’s policy to projects/a/* permanently for every consumer.
4. Pass a session policy allowing an administrative action that the role itself lacks.

Correct Answer: B

 

Correct Answer

Answer B is correct because the session’s permissions are constrained by the role policy and session policy together. This limits the selected session while retaining the broader role for other authorized jobs.

Incorrect Answers

Answer A is incorrect because the session name supports identification and auditing but is not an object-prefix permission filter. The issued credentials would remain broader than requested.

Answer C is incorrect because this can narrow the role, but it also removes the access required by other jobs. The request calls for a per-session restriction without that shared-role change.

Answer D is incorrect because a session policy cannot add permissions beyond the assumed role’s identity policy. This would not provide the required controlled project-only session.

 

Question 10

A partner has an active session for a standard IAM role in the company’s account. The company removes the partner from the role trust policy to stop new assumptions, but also needs to stop sessions already issued before the incident. Which additional action addresses those existing sessions?

1. Reduce the external IdP’s password lifetime and wait for the session to notice.
2. Rename the IAM role and rely on the name change to expire all credentials.
3. Remove only the partner’s permission to view the role’s trust-policy document.
4. Revoke the role’s older active sessions using the supported session-revocation control.

Correct Answer: D

 

Correct Answer

Answer D is correct because changing trust prevents new role assumptions but does not by itself invalidate already issued session permissions. The revocation control adds a denial for older sessions, subject to propagation.

Incorrect Answers

Answer A is incorrect because an existing AWS role session is not continuously authenticated against that password-lifetime setting. It can continue until expiration or an effective AWS denial.

Answer B is incorrect because the session’s authority is not governed simply by the displayed role name. An explicit supported revocation mechanism is needed for already issued sessions.

Answer C is incorrect because viewing policy metadata is separate from using an issued role session. Removing that read permission does not revoke existing credentials.

 

Question 11

A production OU has an SCP explicitly denying ec2:TerminateInstances. A member-account administrator attaches AdministratorAccess to an emergency role and tries to terminate an instance. The role is an ordinary IAM role, not an excluded service-linked role. What permits the action while preserving the organization governance model?

1. An authorized organization administrator must change the applicable SCP restriction through the governance process.
2. Add an EC2 resource tag marking the instance as an emergency exception.
3. Attach a second AdministratorAccess policy to the emergency role.
4. Create a new ordinary IAM role in the same member account.

Correct Answer: A

 

Correct Answer

Answer A is correct because a member-account identity policy cannot override its inherited explicit deny. Any approved exception must be implemented at the policy layer that actually imposes the restriction.

Incorrect Answers

Answer B is incorrect because the described SCP contains no tag-based exception. A resource tag changes authorization only when the applicable policy evaluates that condition.

Answer C is incorrect because multiple identity allows do not override an inherited organization-level deny. The member account cannot grant its role authority beyond the applicable guardrail.

Answer D is incorrect because the SCP constrains ordinary principals in that account, not just the original role. Changing the role name leaves the account-level restriction in place.

 

Question 12

An organization uses an SCP allow-list model. The root and target account permit EC2 and S3, but an intermediate OU permits only EC2. An IAM role in the target account allows S3 reads. There are no explicit denies. Why do the role’s S3 reads fail?

1. The OU on the inheritance path lacks an S3 allow.
2. The role must receive S3 permissions from an IAM group instead of its own policy.
3. SCPs must name the specific IAM role ARN to grant the role S3 access.
4. The root and account allows cancel each other because they name the same services.

Correct Answer: A

 

Correct Answer

Answer A is correct because an allow-list SCP model requires the action to remain permitted through every level on the account’s path. The role’s own allow cannot fill a missing organization-level allowance.

Incorrect Answers

Answer B is incorrect because IAM roles do not obtain permissions through IAM group membership. Its direct identity permission is already present; the missing ancestor allowance remains decisive.

Answer C is incorrect because SCPs constrain member-account permissions rather than grant permissions to individual roles. Adding a principal-style role grant is not the required fix.

Answer D is incorrect because matching allows do not cancel. The restrictive intermediate OU is the layer that removes S3 from the effective organization permission ceiling.

 

Question 13

An SCP attached to a member account denies an ordinary EC2 operation. A local administrator proposes using that member account’s root user to bypass the restriction. No documented SCP exemption applies to the operation. Which assessment is correct?

1. Root can bypass the SCP if it signs in with MFA.
2. Root bypasses every SCP because it does not use an IAM role.
3. Add an account-attached FullAWSAccess SCP below the inherited explicit deny.
4. The member account’s root user remains subject to the applicable SCP.

Correct Answer: D

 

Correct Answer

Answer D is correct because the root identity’s broad account authority does not override organization restrictions on that member account. The explicit exclusion caveat does not apply to this ordinary operation.

Incorrect Answers

Answer A is incorrect because MFA strengthens authentication but does not change the organization’s permission ceiling. The same denied operation remains restricted after a stronger sign-in.

Answer B is incorrect because SCP scope includes the member account’s root user. Whether the caller is a role or root does not create the proposed bypass.

Answer C is incorrect because a permissive SCP at a lower level cannot override an applicable ancestor deny. Root remains inside the member account’s organization permission ceiling.

 

Question 14

An SCP denies a regional service across all member accounts, but an administrator in the organization’s management account can still use it. The company wants its business workloads subject to those guardrails and wants minimal daily use of the management account. Which design addresses both requirements?

1. Register the management account as a member of its own production OU.
2. Attach the same SCP to the organization root a second time.
3. Create a new administrative role inside the management account and rely on its different name.
4. Run business workloads in governed member accounts and keep management-account access tightly limited.

Correct Answer: D

 

Correct Answer

Answer D is correct because SCPs do not constrain management-account users or roles. Moving ordinary workloads to member accounts places their principals within the intended guardrail scope.

Incorrect Answers

Answer A is incorrect because the management account is not moved into the member-account OU hierarchy this way. The design should separate workload accounts from organization management.

Answer B is incorrect because the management-account exemption is not caused by too few policy attachments. Repeating the policy does not bring those identities under SCP scope.

Answer C is incorrect because the new role is still in the exempt management account. Role naming does not change that account-level SCP boundary.

 

Question 15

An SCP is intended to restrict regional workloads to approved Regions. Its first draft denies all actions when aws:RequestedRegion is outside the approved list. Testing shows that required IAM administration is also blocked because IAM uses a global service endpoint. Which refinement best preserves the intended design?

1. Add every AWS Region to the approved list so all requests succeed.
2. Attach a second SCP allowing iam:* while retaining the original global-action deny.
3. Add another IAM allow policy to every administrator in the member accounts.
4. Exempt the necessary global-service actions while retaining the regional restriction for workload actions.

Correct Answer: D

 

Correct Answer

Answer D is correct because the endpoint-based condition can affect global services whose requests use a fixed Region. Deliberately scoped exceptions avoid breaking global administration while preserving the regional workload boundary.

Incorrect Answers

Answer A is incorrect because this avoids the failure by discarding the regional workload restriction. It does not preserve the stated governance objective.

Answer B is incorrect because the additional allow does not override a matching explicit deny. The restrictive statement must be refined to express the intended exception.

Answer C is incorrect because a local identity allow cannot override the applicable SCP deny. The organization policy itself needs the intended global-service exception.

 

Question 16

Developers need broad administrator permissions for experimental AWS resources. They must have no administrative authority over production, even when development and production use the same service names and resource tags. Which account design creates the intended security boundary?

1. Use separate IAM groups but attach AdministratorAccess to both groups in the same account.
2. Place experimentation and production in separate accounts with controlled cross-account delegation.
3. Use different Availability Zones in the same account and retain the same administrator role.
4. Keep one account and give developers AdministratorAccess, separating resources only with tags.

Correct Answer: B

 

Correct Answer

Answer B is correct because account ownership creates separate IAM and resource administration boundaries. Development authority does not automatically confer production access unless a deliberate cross-account path grants it.

Incorrect Answers

Answer A is incorrect because group separation does not neutralize the identical broad permission grants. Both groups would still have account-wide administration.

Answer C is incorrect because Availability Zones are infrastructure failure boundaries, not separate account authorization domains. The same account administrator can manage resources across those zones.

Answer D is incorrect because unrestricted account administration is not constrained merely by labels. The developers could alter controls unless enforceable policies remove that authority.

 

Question 17

A company requires an organization-wide CloudTrail record that ordinary member-account administrators cannot disable or erase. Which TWO design choices address trail control and stored-log ownership? Choose TWO.

1. Deliver logs to a separately controlled archive bucket without granting those member administrators deletion authority.
2. Create an organization trail managed by the management account or an authorized delegated administrator.
3. Grant every member-account administrator full access to the archive bucket for operational convenience.
4. Give each member account its own administrator-managed trail and rely only on a written retention request.
5. Use management-account Event history as a substitute for collecting all member-account events.

Correct Answers: A, B

 

Correct Answers

Answer A is correct because centralized trail configuration does not by itself justify broad access to the destination objects. Separately protected storage prevents the named administrators from erasing the retained evidence.

Answer B is correct because ordinary member accounts can see their organization trail but cannot turn it off or change it. This places trail configuration under the intended organization authority.

Incorrect Answers

Answer C is incorrect because that creates the deletion authority the design explicitly forbids. The archive’s access policy must preserve the separation from workload administration.

Answer D is incorrect because the member administrator would retain technical control over that trail. A written instruction does not enforce the requirement against disabling it.

Answer E is incorrect because the management account’s Event history does not display the organization’s full member-account history. An organization trail provides the required multi-account collection.

 

Question 18

A security team manages an AWS service that supports delegated administration for an organization. It needs organization-level service visibility, but should not use broad management-account credentials for daily work. Which arrangement fits?

1. Share the management account’s root credentials with each security engineer.
2. Remove all SCPs from all member accounts to enable security visibility.
3. Designate a controlled security member account as that service’s delegated administrator.
4. Move the security team to an unassociated account with no delegation and expect organization visibility.

Correct Answer: C

 

Correct Answer

Answer C is correct because supported service delegation gives the team the needed organization service function outside the management account. The member account still remains within applicable SCP governance.

Incorrect Answers

Answer A is incorrect because root sharing greatly exceeds the service administration requirement. It also makes routine security work depend on the most sensitive organization account.

Answer B is incorrect because organization-wide control removal is not required merely to designate a supported administrator. Delegation and applicable guardrails can coexist.

Answer D is incorrect because a separate account alone does not establish authority over the organization’s service. The supported delegation relationship supplies that authority.

 

Question 19

A development account is moved from a Sandbox OU to a Regulated OU. It has no account-attached SCPs beyond the permissive baseline. The new OU denies a service that Sandbox permitted. After policy propagation, what must the account owner expect?

1. Only IAM identities created after the move become subject to the Regulated OU’s deny.
2. The account permanently keeps the Sandbox OU’s permissions because it was created there.
3. Ordinary account principals lose access to the denied service through the new inherited guardrail.
4. The Regulated OU’s deny applies only after every role trust policy names that OU.

Correct Answer: C

 

Correct Answer

Answer C is correct because the account’s current ancestor path determines applicable OU controls. Retaining its existing IAM roles does not preserve permissions disallowed by the new OU.

Incorrect Answers

Answer A is incorrect because an SCP applies to relevant principals in the account, not only new identities. Existing roles are also constrained after the updated policy takes effect.

Answer B is incorrect because OU inheritance is not fixed at account creation. Moving the account changes the ancestor policies that participate in authorization.

Answer D is incorrect because organization policy inheritance does not require role trust policies to name OUs. Trust policies govern role assumption rather than activating SCP scope.

 

Question 20

A company already uses an AWS Control Tower landing zone. New workload accounts must receive its standard enrollment and baseline configuration through the established account-provisioning workflow. Which starting point best fits?

1. Provision accounts through the landing zone’s Account Factory workflow.
2. Create independent accounts outside the organization and copy only the landing zone’s account names.
3. Create standalone accounts and configure only detective checks after teams begin deploying workloads.
4. Create accounts through AWS Organizations but omit Control Tower enrollment, assuming membership installs the entire landing zone baseline.

Correct Answer: A

 

Correct Answer

Answer A is correct because Account Factory participates in the established Control Tower provisioning process and baseline deployment. The company can extend its governed process rather than create untracked standalone accounts.

Incorrect Answers

Answer B is incorrect because names do not establish enrollment, controls, roles or logging configuration. The new accounts would not enter the required governed provisioning workflow.

Answer C is incorrect because later detection does not perform the requested governed enrollment and baseline provisioning. It leaves the initial account state outside the established workflow.

Answer D is incorrect because organization membership alone does not substitute for Control Tower provisioning or enrollment. The requirement includes that specific baseline workflow.

 

Question 21

A central networking account owns a VPC. Application teams in member accounts of the same organization must deploy their own supported resources into selected shared subnets without receiving the networking account’s credentials. Which design preserves separate resource ownership?

1. Share the selected subnets with AWS RAM and let each team use its own account identity.
2. Create VPC peering and assume that it transfers subnet ownership to the peer account.
3. Copy the networking account’s root access key into each application’s deployment system.
4. Move every application deployment into the networking account under one shared administrator role.

Correct Answer: A

 

Correct Answer

Answer A is correct because VPC sharing lets participating accounts place supported resources in shared subnets while retaining account-based ownership. The network account need not distribute its credentials.

Incorrect Answers

Answer B is incorrect because peering supplies network connectivity; it does not share a subnet for another account’s resource placement. It solves a different requirement.

Answer C is incorrect because credential sharing collapses the intended administrative boundary. It grants authority in the owner’s account instead of sharing the particular network resource.

Answer D is incorrect because that puts the resources under the central account instead of preserving team account ownership. It also broadens the shared administrative identity.

 

Question 22

Account B owns an S3 bucket and its objects. It will delegate object reads to Account A, whose administrators select which IAM user may read them. The bucket policy names Account A as the trusted account, not an individual user. No role assumption, ACL grant, explicit deny or KMS requirement is involved. Which TWO grants are required? Choose TWO.

1. A bucket policy in Account B permitting the intended GetObject access for Account A.
2. An iam:PassRole grant for the bucket ARN in Account A.
3. Only an IAM policy in Account A, because account administrators can authorize reads from any bucket.
4. Only a bucket-policy allow for the Account A account principal, with no user-side grant.
5. An identity policy in Account A allowing the selected user to perform the permitted object reads.

Correct Answers: A, E

 

Correct Answers

Answer A is correct because the resource-owning account must authorize the external account’s use of its objects. A caller-side policy alone cannot grant access to another account’s resource.

Answer E is correct because delegation to an account lets that account’s administrator authorize the intended identity. It does not automatically make every IAM user in Account A a permitted reader.

Incorrect Answers

Answer B is incorrect because a bucket ARN is not a role to pass, and the scenario does not involve assigning a role to a service. This permission does not authorize the data request.

Answer C is incorrect because Account A cannot unilaterally grant permission over Account B’s resources. Target-side authorization is also required for this cross-account design.

Answer D is incorrect because the scenario delegates to the external account rather than directly authorizing the selected user. Account A must still grant that user the intended permission.

 

Question 23

An AWS service principal must write to a resource on behalf of one specified source resource in another account. This service integration supports aws:SourceArn and aws:SourceAccount in the request context. The target owner must reject requests made by the same service for unrelated customers. Which policy design addresses that boundary?

1. Allow any principal from the source account and omit the service-principal restriction.
2. Allow the service principal without conditions because all requests originate inside AWS.
3. Allow the service principal with conditions for the intended source ARN and source account.
4. Require the service principal to supply a third-party vendor’s ExternalId to every data-plane request.

Correct Answer: C

 

Correct Answer

Answer C is correct because the conditions bind the service’s request to the authorized customer resource. Trusting only the common service principal would not express whose work that service may perform.

Incorrect Answers

Answer A is incorrect because that broadens who can write beyond the intended service integration. The target needs both the appropriate service identity and the supported source context.

Answer B is incorrect because an AWS service can act for many customers. The shared service identity alone does not distinguish an authorized source from another customer’s source.

Answer D is incorrect because ExternalId is an STS role-assumption mechanism, not a universal condition supplied by service data requests. The scenario identifies supported source-context keys for this integration.

 

Question 24

A customer’s role requires a valid ExternalId in its trust policy for a vendor principal. The vendor has the correct ARN and identifier, but the standard AWS console Switch Role form fails because it cannot supply the required identifier. Which access method preserves the customer’s condition?

1. Remove the ExternalId condition whenever the vendor needs access through the console.
2. Add an ExternalId condition only to the role’s data-access policy and repeat the unchanged console request.
3. Call STS AssumeRole through the CLI or API with the required ExternalId.
4. Use the identifier as the role session name but omit the ExternalId request parameter.

Correct Answer: C

 

Correct Answer

Answer C is correct because the supported API request can carry the condition value. This obtains the controlled role session without removing the customer’s tenant-binding requirement.

Incorrect Answers

Answer A is incorrect because that discards the protection to accommodate a client limitation. The requirement is to preserve the condition and choose a compatible assumption method.

Answer B is incorrect because changing post-assumption data permissions does not supply missing context for the existing trust-policy check. The assumption client must send the required parameter.

Answer D is incorrect because RoleSessionName identifies the issued session, whereas ExternalId supplies the trust condition. Placing the same text in a different parameter does not satisfy that condition.

 

Question 25

An organization permits S3 API requests only through an approved Region using aws:RequestedRegion. An architect claims that this alone prevents every cross-Region data copy. A permitted PutBucketReplication request can configure a destination outside that Region. What additional design review is necessary?

1. Validate and constrain replication destinations and other cross-Region effects, not just request endpoint Regions.
2. Remove the endpoint restriction and rely only on an account naming convention.
3. Issue credentials through a global STS endpoint and leave replication destinations unrestricted.
4. Treat the endpoint restriction as sufficient because each request has exactly one Region value.

Correct Answer: A

 

Correct Answer

Answer A is correct because RequestedRegion controls the endpoint invoked, not every location affected by an operation. The architect must inspect the replication configuration and relevant permissions to enforce the data boundary.

Incorrect Answers

Answer B is incorrect because account names do not enforce replication destinations or request permissions. This would remove a real control without supplying the missing data-location control.

Answer C is incorrect because the endpoint that issues credentials does not determine where a subsequent S3 operation may replicate data. The workload’s data-moving configuration still requires control.

Answer D is incorrect because a single request endpoint does not imply a single affected data location. The stated replication operation illustrates why the conclusion does not follow.