Amazon AWS Certified Solutions Architect Associate SAA-C03 IAM Permissions and Identity Hardening Practice Test

 

Topic 01 covers IAM permissions and identity hardening for the AWS Certified Solutions Architect – Associate certification. These original SAA-C03 practice questions apply access-control requirements to concrete architecture decisions. Select one answer unless a fixed number is requested. For broader preparation, visit the AWS Certified Solutions Architect Associate SAA-C03 Exam Dumps page. Each alternative includes an explanation of its technical behavior and the decisive constraints.

Question 1

A nightly process on EC2 uploads settlement files to one S3 prefix. It currently uses a root access key copied into the machine image. The redesign must remove root access and require no stored long-term access keys in the image or application. Uploads must remain unattended. Which design meets these requirements?

1. Replace the root key with an IAM user key and embed the replacement in the image.
2. Store the root key as an encrypted parameter and allow the instance to retrieve it.
3. Delete the root key and use automatically renewed instance-role credentials scoped to the upload prefix.
4. Require root MFA and retain the root key for the nightly uploads.

Correct Answer: C

 

Correct Answer

Answer C is correct because the instance role can supply automatically managed credentials to the process. Restricting the role to the upload action and destination removes the unnecessary account-wide authority.

Incorrect Answers

Answer A is incorrect because the IAM identity can be narrower, but an embedded long-term secret still survives in image copies and requires distribution and rotation. The instance already supports role credentials.

Answer B is incorrect because encryption changes storage protection, not the authority of the recovered credential. Compromise of the process would still expose a credential with unnecessary root privileges.

Answer D is incorrect because root sign-in MFA does not transform a long-term access key into a narrowly scoped workload identity. The process should not retain root access for an S3 operation.

 

Question 2

A temporary operations role must run ec2:DescribeInstances to collect inventory across one account, but must not change instances or read S3 objects. For this question, the requested Describe operation does not support resource-level ARN restrictions. Which identity-policy grant is sufficient and appropriately scoped?

1. Allow ec2:DescribeInstances with Resource set to *, without broader service grants.
2. Allow ec2:DescribeInstances with Resource set to the account’s instance ARN pattern.
3. Allow ec2:DescribeInstances and s3:GetObject with Resource set to *.
4. Allow ec2:* with Resource set to * and rely on the short session duration.

Correct Answer: A

 

Correct Answer

Answer A is correct because the wildcard is required by this action’s stated authorization model, while the exact action limits the role to inventory discovery. A resource wildcard does not itself grant modification or S3 actions.

Incorrect Answers

Answer B is incorrect because the action is explicitly stated not to support resource-level ARN restrictions. An instance ARN pattern therefore cannot provide the required grant for this API operation.

Answer C is incorrect because the extra object-read permission is unrelated to EC2 inventory and violates the stated prohibition on reading S3 data. The inventory action alone is sufficient.

Answer D is incorrect because this adds modification actions that the role must not perform. A short session bounds time but does not reduce the operations authorized during that session.

 

Question 3

A security engineer confirms that an active root access key from a standalone AWS account was published in a public repository. Production workloads do not use it. Which TWO actions directly contain and investigate the exposure? Choose TWO.

1. Delete the exposed root access key.
2. Attach an IAM identity policy denying all actions to the root user.
3. Change the root console password and leave the access key active.
4. Rotate every IAM user’s access keys before addressing the exposed root key.
5. Review account activity logs for actions performed with the exposed identity.

Correct Answers: A, E

 

Correct Answers

Answer A is correct because removing the compromised credential prevents further requests signed with that key. No production dependency requires keeping it active while the investigation proceeds.

Answer E is correct because activity evidence is needed to identify unauthorized changes or persistence. Credential removal alone does not show what occurred before containment.

Incorrect Answers

Answer B is incorrect because the root user is not an IAM user to which such a policy can be attached. This proposal does not revoke the exposed root credential.

Answer C is incorrect because console password authentication and access-key authentication are separate. Changing one does not invalidate the other credential that was actually exposed.

Answer D is incorrect because IAM user keys are distinct credentials from the root key that was exposed. Rotating those users first would leave the confirmed compromised credential usable.

 

Question 4

A maintenance user has permission to stop development instances. A policy denies that operation when BoolIfExists on aws:MultiFactorAuthPresent is false. The user’s console sign-in uses a virtual MFA device, but a CLI command signed with the user’s long-term access key is denied. How should the user perform the CLI operation without weakening the policy?

1. Call STS GetSessionToken without an MFA code, then use all three returned credential fields.
2. Repeat the console MFA sign-in immediately before retrying the same access-key command.
3. Add another Allow statement for ec2:StopInstances to the same user.
4. Call STS GetSessionToken with the virtual MFA device code, then use the returned key, secret and session token.

Correct Answer: D

 

Correct Answer

Answer D is correct because GetSessionToken with valid MFA information returns credentials carrying the IAM user’s MFA authentication context. Using that complete set satisfies the request-context condition; the earlier browser sign-in does not.

Incorrect Answers

Answer A is incorrect because a complete temporary credential set can authenticate a request without having MFA context. Obtaining it without the MFA device code leaves this policy’s conditional deny applicable.

Answer B is incorrect because the CLI request still uses its original long-term credential. A separate browser session does not add MFA context to that signed API request.

Answer C is incorrect because an additional allow cannot overcome the applicable explicit deny. The missing MFA context must be corrected rather than masked by another grant.

 

Question 5

A standalone account keeps a root sign-in for infrequent tasks that AWS requires the root user to perform. An internal policy requires that one departing employee cannot retain sole control of sign-in or recovery. Which TWO measures best support this requirement? Choose TWO.

1. Use a documented multi-person root-access process with protected MFA and recovery mechanisms.
2. Keep the recovery email under the lead administrator’s control and give backup staff AdministratorAccess.
3. Use a shared operations mailbox but let one administrator alone control its access, MFA and recovery phone.
4. Use an organization-controlled group email address with tightly governed membership for the root identity.
5. Put the root password in a team vault but leave MFA and the recovery phone with one employee.

Correct Answers: A, D

 

Correct Answers

Answer A is correct because separating approvals and protecting the authentication and recovery factors reduces dependence on one person’s custody while retaining a controlled emergency procedure.

Answer D is correct because the organization retains control over recovery communication when an employee leaves. Membership governance prevents that shared destination from becoming uncontrolled access.

Incorrect Answers

Answer B is incorrect because administrative IAM permissions do not transfer control of a standalone account’s root recovery email. The departing employee could still retain the recovery channel.

Answer C is incorrect because the mailbox label does not create separation of control. One person would still control both normal authentication and the mechanisms used to recover access.

Answer E is incorrect because a shared password vault addresses only one factor. Personal custody of MFA and recovery channels preserves the departure dependency the policy prohibits.

 

Question 6

An EC2 instance has a correctly configured instance profile granting access to a report bucket. Its application explicitly constructs an SDK client with an old IAM user’s access key, and requests are denied. That user is being retired. Which change addresses the cause while preserving automatic credential renewal?

1. Increase the role’s maximum session duration and leave the SDK client unchanged.
2. Add S3 full access to the retired IAM user.
3. Remove explicit SDK credentials and use the instance-profile credential provider.
4. Copy the role’s current temporary access key and secret into the source code.

Correct Answer: C

 

Correct Answer

Answer C is correct because the application’s explicit credential choice prevents it from using the attached role. The role provider can obtain refreshed temporary credentials without embedding replacement keys.

Incorrect Answers

Answer A is incorrect because changing this setting does not change the SDK’s explicitly selected identity. EC2 instance-role credentials are also not subject to the role’s configured maximum session duration.

Answer B is incorrect because this would preserve the undesired user dependency and widen permissions. The instance profile cannot help until the application stops signing requests with the old identity.

Answer D is incorrect because a copied temporary credential expires and also requires its session token. Hard-coding a current credential bypasses the provider’s renewal behavior.

 

Question 7

An S3 event invokes a Lambda function successfully. The function then receives AccessDenied when writing a result object to a second bucket in the same account. Its execution role has only logging permissions; no other authorization controls or encryption-key requirements block the write. What is the narrowest appropriate correction?

1. Grant the destination-prefix PutObject permission to the execution role.
2. Add s3:PutObject to a permissions boundary on the execution role, leaving its identity policy unchanged.
3. Add a function resource-policy statement allowing the destination bucket to invoke Lambda.
4. Allow s3:PutObject to the IAM identity that originally deployed the function.

Correct Answer: A

 

Correct Answer

Answer A is correct because the invoked function uses its execution role for AWS API operations. Granting the specific write action on the required objects supplies the missing runtime authority.

Incorrect Answers

Answer B is incorrect because a permissions boundary limits identity-policy grants but does not supply them. The execution role would still lack the identity-policy permission needed for the write.

Answer C is incorrect because invocation already succeeds, and the failure occurs during an outbound S3 request. A policy governing who can invoke the function does not grant its code S3 write permission.

Answer D is incorrect because the deployment identity is not the runtime identity signing the failed request. Changing its permissions does not change the function’s execution role.

 

Question 8

A Fargate task starts, pulls its image, and sends logs successfully. Application code inside the container is denied when it calls S3. The task execution role permits image retrieval and logging, and no task role is configured. Which design supplies the application with S3 permissions?

1. Grant S3 permissions to the identity that registered the task definition.
2. Associate an S3-authorized task IAM role with the task definition.
3. Add the application’s S3 permissions only to the task execution role.
4. Attach an EC2 instance profile to the Fargate task.

Correct Answer: B

 

Correct Answer

Answer B is correct because the task role supplies permissions to application code inside the container. It is separate from the execution role used for managed startup and related agent operations.

Incorrect Answers

Answer A is incorrect because registration permissions govern the deployment action. They do not become the credentials used by running application code.

Answer C is incorrect because the execution role supports operations such as pulling the image and publishing logs. Its successful startup permissions do not make it the application’s task identity.

Answer D is incorrect because a Fargate task does not expose a customer-managed EC2 host on which to attach that profile. The supported application identity is the task role.

 

Question 9

An operator copies an unexpired STS credential response into a CLI environment. AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are set, but requests fail authentication before authorization is evaluated. The response also contained a SessionToken. What should the operator do?

1. Attach AdministratorAccess to the role associated with the temporary session.
2. Set AWS_SESSION_TOKEN to the token from the same STS response.
3. Use the session token as the AWS_SECRET_ACCESS_KEY value.
4. Request a longer STS session and export only the new access key ID and secret access key.

Correct Answer: B

 

Correct Answer

Answer B is correct because temporary credentials include a token in addition to the key pair. All components must come from the same issued session for AWS to validate the request.

Incorrect Answers

Answer A is incorrect because broader role permissions cannot repair an incomplete authentication credential. AWS must validate the key, secret and matching session token before evaluating authorized actions.

Answer C is incorrect because the token and secret access key have different roles in the request. Replacing one credential component with another produces an invalid credential set.

Answer D is incorrect because a longer lifetime does not eliminate the session-token component. Exporting only a replacement key pair reproduces the same authentication failure.

 

Question 10

A legacy integration cannot yet use roles and must keep an IAM user access key. The current key is not suspected of compromise, the user has one key, and a planned replacement must avoid downtime. Which sequence best meets that requirement?

1. Change the user’s console password and keep the existing access key.
2. Delete the current key, create the replacement, and then identify every consumer.
3. Create a replacement key and leave both keys active permanently.
4. Create the replacement key, update and verify all consumers, deactivate the old key, monitor, and then delete it.

Correct Answer: D

 

Correct Answer

Answer D is correct because a controlled overlap allows consumers to switch before the previous credential is disabled. Verification and deactivation provide a recovery window without keeping the old key indefinitely.

Incorrect Answers

Answer A is incorrect because a console password change does not replace the programmatic access key. The integration would continue to use the credential scheduled for replacement.

Answer B is incorrect because deleting the only working key first interrupts consumers that have not been updated. That sequence conflicts with the explicit planned, non-emergency no-downtime requirement.

Answer C is incorrect because two working keys can support a temporary migration, but indefinite overlap leaves the old credential usable. It fails the requirement to complete the replacement.

 

Question 11

An IAM role’s policy allows s3:GetObject on every object in a reports bucket. A bucket policy explicitly denies that action for the restricted/ prefix to all principals. The role requests restricted/payroll.csv. Assume no other policy applies. What is the outcome?

1. The request is denied because the role needs a separate identity-policy allow for the exact object key.
2. The request is denied because the matching explicit deny overrides the role’s allow.
3. The request is allowed because the bucket policy’s wildcard principal does not match an assumed-role session.
4. The request is allowed because an identity policy takes priority over a bucket policy.

Correct Answer: B

 

Correct Answer

Answer B is correct because the request matches both statements, and an explicit deny wins over an allow. The broader object permission cannot override the resource policy’s narrower restriction.

Incorrect Answers

Answer A is incorrect because the role’s stated object grant already includes this key. Another exact-key allow would not remove the matching explicit deny, so this is the wrong explanation for the denial.

Answer C is incorrect because a deny applying to all principals also applies to this role request. A role session is not exempt merely because the policy uses a wildcard principal.

Answer D is incorrect because identity and resource policies do not use this precedence rule. A matching explicit deny remains effective regardless of which of these policy types contains the allow.

 

Question 12

A report reader can download an S3 object when given its exact key, but cannot discover keys with ListObjectsV2. Its only permission is s3:GetObject on the bucket’s objects. The application must list all objects in this bucket but must not write them. What additional permission is needed?

1. Allow s3:ListBucket on the bucket’s object ARN pattern.
2. Allow s3:ListBucket on the bucket ARN.
3. Allow s3:ListAllMyBuckets on all resources.
4. Allow s3:GetObject on the bucket ARN without a trailing object path.

Correct Answer: B

 

Correct Answer

Answer B is correct because listing objects is authorized as a bucket-level action. Adding that action enables discovery while the existing object permission remains responsible for reading content.

Incorrect Answers

Answer A is incorrect because the action is appropriate, but its resource must identify the bucket. An object ARN pattern does not authorize this bucket-level listing request.

Answer C is incorrect because listing bucket names in the account is different from listing keys inside this bucket. The application’s failed operation needs the latter permission.

Answer D is incorrect because GetObject is an object operation and does not authorize ListObjectsV2. Changing its resource to the bucket also fails to grant the separate listing action.

 

Question 13

A role can read a private S3 bucket, but a signed HTTP GetObject request is denied. The bucket policy denies requests when aws:SecureTransport is false. The same object is encrypted at rest. Which change satisfies the policy without broadening access?

1. Send the signed request over HTTPS using the existing authorized identity.
2. Generate a new presigned HTTP URL for the object using the same role.
3. Enable a different at-rest encryption algorithm on the object.
4. Add a second identity-policy allow for the object.

Correct Answer: A

 

Correct Answer

Answer A is correct because the condition concerns transport protection on this request. HTTPS changes that context while preserving the same identity and object permission.

Incorrect Answers

Answer B is incorrect because a presigned URL authorizes a signed request; it does not make HTTP use TLS. The same transport-related deny still applies when that URL is used over HTTP.

Answer C is incorrect because at-rest encryption protects stored data and does not make an HTTP request use TLS. The transport condition would still match the deny.

Answer D is incorrect because a second allow cannot override the explicit transport-related deny. The request must satisfy the transport requirement.

 

Question 14

An S3 bucket policy in an account explicitly allows an IAM user ARN from the same account to read one object. The user has no identity-policy allow for S3. There are no explicit denies, permissions boundaries, session policies, or organization controls. How is that user’s GetObject request evaluated?

1. It is denied unless the user first assumes a role named in a separate bucket-policy statement.
2. It is allowed by the direct resource-policy grant.
3. It is denied because every S3 request requires both an identity allow and a bucket-policy allow.
4. It is denied because a bucket policy can name accounts but cannot name IAM users.

Correct Answer: B

 

Correct Answer

Answer B is correct because under the stated same-account conditions, the bucket policy can grant the user’s access. A matching identity-policy allow is not additionally required for this direct grant.

Incorrect Answers

Answer A is incorrect because the current statement directly names the IAM user and grants the requested object action. Requiring a different role principal is unnecessary under the stated same-account conditions.

Answer C is incorrect because that rule does not apply to this same-account direct resource grant. It would incorrectly treat a missing identity allow as an explicit deny.

Answer D is incorrect because resource policies can identify an IAM principal as described. The exact user ARN and requested object are already included in the grant.

 

Question 15

A role has an identity policy allowing S3 reads and writes. Its permissions boundary allows S3 reads only. No resource-based grants or other policies apply. Which effective permission set results?

1. No S3 operations because a boundary replaces the identity policy.
2. S3 writes only because more specific identity actions override the boundary.
3. S3 reads only.
4. S3 reads and writes.

Correct Answer: C

 

Correct Answer

Answer C is correct because the identity policy supplies the grants, while the boundary limits their maximum scope. Only reads are permitted by both policy layers.

Incorrect Answers

Answer A is incorrect because a boundary does not replace the granting policy. Reads remain effective because both applicable layers allow them.

Answer B is incorrect because an identity-policy action cannot override a missing boundary permission. Specificity does not turn the boundary into an optional control.

Answer D is incorrect because the boundary is a limiting policy rather than an additional grant. The identity policy’s write permission is outside the permitted intersection.

 

Question 16

A role policy allows s3:GetObject with Resource set only to arn:aws:s3:::monthly-reports. The application requests monthly-reports/2026/summary.csv and receives AccessDenied. The bucket also contains reports under other year prefixes. No other policy grants access. Which correction is appropriately scoped to all report objects?

1. Use arn:aws:s3:::monthly-reports/* as the resource for s3:GetObject.
2. Use arn:aws:s3:::monthly-reports/2026/* as the resource for s3:GetObject.
3. Keep the bucket ARN and replace s3:GetObject with s3:ListBucket.
4. Use Resource ‘*’ and Action ‘s3:*’.

Correct Answer: A

 

Correct Answer

Answer A is correct because GetObject evaluates an object resource. The object ARN pattern matches report keys, whereas the current ARN identifies only the bucket.

Incorrect Answers

Answer B is incorrect because this pattern repairs access to the requested year but excludes reports under other year prefixes. It is too narrow for the stated requirement to read all report objects.

Answer C is incorrect because the replacement would support listing rather than retrieving object content. It does not satisfy the application’s download operation.

Answer D is incorrect because this would remove both action and destination restrictions. The required repair can be made by correcting the object ARN without granting unrelated S3 access.

 

Question 17

A tenant reader must use ListObjectsV2 and GetObject to list and download only objects under tenant-a/ in the same-account S3 bucket tenant-store. It must not discover or read other tenants’ objects, even when their keys are known. No other policies grant access. Which TWO identity-policy elements together provide this scope? Choose TWO.

1. Allow s3:GetObject on every object and rely on the list-prefix condition to restrict downloads.
2. Allow s3:GetObject on the object ARN pattern ‘arn:aws:s3:::tenant-store/tenant-a/*’.
3. Allow s3:ListBucket on arn:aws:s3:::tenant-store with StringLike on s3:prefix set to ‘tenant-a/*’.
4. Allow s3:ListBucket on the bucket ARN without conditions and filter other tenants’ keys in application code.
5. Allow s3:GetObject on all bucket objects with an s3:prefix condition set to ‘tenant-a/*’.

Correct Answers: B, C

 

Correct Answers

Answer B is correct because the object ARN pattern restricts retrieval to the tenant’s keys. Listing restrictions alone would not restrict downloads when another key is already known.

Answer C is correct because the listing action is evaluated against the bucket, and the condition constrains the requested listing prefix. This prevents discovery through a broader list request.

Incorrect Answers

Answer A is incorrect because the prefix condition on ListBucket does not limit the separate GetObject permission. A caller knowing another tenant’s key could still retrieve it.

Answer D is incorrect because an unrestricted list grant lets this identity request other tenants’ key names. Client-side filtering does not enforce the required authorization boundary.

Answer E is incorrect because s3:prefix constrains listing requests, not GetObject authorization. Downloads need the tenant-specific object resource pattern rather than a listing-only condition key.

 

Question 18

Teams provision new resources frequently. Security controls the Project tags on supported resources and principal identities; developers cannot alter either set of authorization tags. For tag-aware actions, each team must access only resources with a matching Project value. Which authorization approach scales with new resources?

1. Allow developers to set their own principal Project tag to match any requested resource.
2. Allow access whenever the requested resource has a Project tag, without comparing its value with the principal tag.
3. Use an IAM condition comparing the supported resource Project tag with the principal’s Project tag.
4. Check the principal’s Project tag but allow all resource ARNs without comparing resource Project values.

Correct Answer: C

 

Correct Answer

Answer C is correct because the request can be authorized from controlled attributes without enumerating every new resource ARN. The stated tag-governance restriction is essential to keeping that comparison trustworthy.

Incorrect Answers

Answer A is incorrect because self-controlled authorization attributes would let developers move themselves across the intended project boundary. That defeats the separation the policy is meant to enforce.

Answer B is incorrect because tag presence alone does not identify the caller’s project. A resource tagged for another team would meet that weaker test.

Answer D is incorrect because validating only the caller’s attribute leaves the target resource unconstrained. Authorization needs the comparison that ties this team to the requested resource.

 

Question 19

A deployment role may create Lambda functions using ApprovedLambdaRole. It must not attach a more privileged execution role to a new function. The approved role already trusts Lambda, and no other policy grants the deployment role iam:PassRole. Which permission most directly enforces the role-passing boundary?

1. Allow iam:PassRole on every role, with iam:PassedToService restricted to lambda.amazonaws.com.
2. Restrict ApprovedLambdaRole’s trust policy to Lambda while allowing the deployer to pass any Lambda-trusting role.
3. Allow sts:AssumeRole on every role but omit iam:PassRole.
4. Allow iam:PassRole only for ApprovedLambdaRole, with iam:PassedToService restricted to lambda.amazonaws.com.

Correct Answer: D

 

Correct Answer

Answer D is correct because the resource restriction limits which role can be passed, and the condition limits the receiving service. Existing deployment permissions do not need unrestricted role passing.

Incorrect Answers

Answer A is incorrect because the service condition limits the recipient but not which role can be passed. A more privileged Lambda-trusting role would still be within the grant.

Answer B is incorrect because the approved role’s trust controls who may assume that role. It does not prevent the deployer from attaching a different, more privileged role permitted by the broad PassRole grant.

Answer C is incorrect because assuming a role for the deployer’s own session is different from passing it to Lambda. This does not provide the required controlled deployment permission.

 

Question 20

Developers may create application roles and edit those roles’ identity policies. Every created role must retain a security-owned permissions boundary. Developers cannot change their own delegation permissions, and no resource-based grants apply. Which THREE controls preserve the boundary as roles are created and updated? Choose THREE.

1. Prevent developers from modifying the security-owned boundary policy or its effective policy version.
2. Require the approved boundary ARN when developers create roles.
3. Allow an unrestricted iam:PutRolePermissionsBoundary after checking the role name prefix.
4. Treat the boundary as the only policy and omit identity-policy grants for every application role.
5. Allow application administrators to detach the boundary temporarily during deployments.
6. Prevent developers from removing or replacing the required boundary with an unapproved boundary.

Correct Answers: A, B, F

 

Correct Answers

Answer A is correct because a fixed attachment is ineffective if the developer can broaden the attached policy itself. Security must retain control of the policy that defines the ceiling.

Answer B is correct because the creation condition prevents a developer from starting with an unbounded role. Limiting only existing roles would leave newly created roles as a bypass.

Answer F is correct because a creation-time requirement alone does not preserve the restriction after creation. Boundary-management permissions must not allow the developer to remove the ceiling later.

Incorrect Answers

Answer C is incorrect because a role-name prefix does not establish that the new boundary is approved. This would permit replacing the enforced ceiling with a permissive policy.

Answer D is incorrect because a boundary does not grant application permissions. This would prevent required work instead of safely delegating permissions within a maximum.

Answer E is incorrect because a temporary exemption creates the same privilege escape the model is intended to prevent. Deployment convenience does not preserve the required continuous boundary.

 

Question 21

A team runs its application on EC2 using an AWS-provided operating-system image. A vulnerability is discovered in an operating-system package installed in the guest. The team argues that AWS owns patching because it supplied the image. Which allocation of work is correct?

1. Wait for AWS to patch the physical host before taking action on the guest package.
2. Update only the launch template’s image and leave the currently running instances unchanged.
3. The customer remediates the EC2 guest; AWS maintains underlying physical and virtualization infrastructure.
4. AWS must log into every running instance and patch the guest automatically.

Correct Answer: C

 

Correct Answer

Answer C is correct because using an AWS-provided starting image does not transfer ongoing guest operating-system management for EC2. The selected IaaS model leaves that workload responsibility with the customer.

Incorrect Answers

Answer A is incorrect because a provider host patch addresses a different layer. The customer still needs to remediate the vulnerable package in the running guest operating system.

Answer B is incorrect because changing the image used by future launches does not update packages in already running guests. Those instances still need customer-managed patching or replacement.

Answer D is incorrect because EC2 does not transfer guest operating-system administration to AWS merely because of the image source. The customer needs its own remediation process or a configured management service.

 

Question 22

A company moves a database from self-managed EC2 to Amazon RDS for PostgreSQL. It wants to remove direct administration of the database host while retaining control over which application users can read customer records. Which design reflects that boundary?

1. Restrict connections to application subnets and give every application the same database master login.
2. Grant an IAM policy permitting rds:DescribeDBInstances and treat it as permission to query every table.
3. Use RDS for the managed infrastructure and configure application/database permissions under the customer’s security policy.
4. Install a customer SSH administrator on the RDS host to configure user permissions.

Correct Answer: C

 

Correct Answer

Answer C is correct because managed infrastructure removes the need to administer the underlying host. It does not decide which of the customer’s users should be authorized to read its business data.

Incorrect Answers

Answer A is incorrect because network restrictions determine which hosts can connect, but a shared privileged database login does not preserve separate application-level data permissions. The customer must still configure appropriate database authorization.

Answer B is incorrect because permission to describe the AWS database resource is a management-plane permission. It does not automatically confer database-engine data access to customer tables.

Answer D is incorrect because RDS access control should use its management and database interfaces. The proposed host-administration model contradicts the move to a managed database service.

 

Question 23

An audit finds that a customer-managed S3 bucket policy grants access more broadly than the company’s classification policy permits. The team has an AWS compliance report proving controls over the service’s physical infrastructure. What remains necessary?

1. Attach the AWS compliance report to the audit and classify the bucket policy as an inherited provider control.
2. Enable bucket access logging and close the finding without changing the existing reader grants.
3. Keep the policy because encrypting stored objects replaces reader authorization.
4. The customer must correct and validate the bucket’s access controls against its classification policy.

Correct Answer: D

 

Correct Answer

Answer D is correct because infrastructure assurance does not specify the customer’s intended readers. The customer controls its data classification and resource permissions and must close the identified access gap.

Incorrect Answers

Answer A is incorrect because the report supports the provider’s infrastructure controls, not this customer-authored permission grant. Treating the policy as inherited leaves the identified access defect unresolved.

Answer B is incorrect because logging supplies evidence of access but does not remove the overly broad permission. The stated classification mismatch remains until the customer changes and validates the grant.

Answer C is incorrect because encryption and authorization address different questions. A principal that is legitimately granted usable access can still read data contrary to the company’s intended classification.

 

Question 24

A Lambda application writes customer email addresses into function tags for troubleshooting. The business prohibits personal data in metadata that may appear in billing or diagnostic records. The team says AWS’s managed runtime makes this acceptable. Which change addresses the customer’s obligation?

1. Remove email values from tags and retain necessary data in controlled application storage.
2. Retain the tags but move the function to a private subnet.
3. Use a customer managed key for the function’s environment variables while retaining the tags.
4. Redact email addresses from application log messages but leave the function tags unchanged.

Correct Answer: A

 

Correct Answer

Answer A is correct because the customer chooses its content and metadata. Managed execution does not make sensitive tag values suitable for broader operational records, and AWS cautions against sensitive information in tags.

Incorrect Answers

Answer B is incorrect because network placement does not prevent metadata from being used by authorized management, diagnostic or billing systems. The prohibited content must be removed from the tags.

Answer C is incorrect because environment-variable encryption protects a different configuration field. It does not remove personal information from tag metadata or satisfy the policy against its placement there.

Answer D is incorrect because application log redaction is useful where logs contain personal data, but it does not modify function tags. The identified metadata exposure remains after this change.

 

Question 25

A company contract requires customer records and backups to remain in an explicitly approved AWS Region. A project team expects AWS infrastructure certification to choose compliant locations for it. Who must translate the contract into the workload configuration, and what must be checked?

1. The customer design team must select compliant storage locations and verify its configured backup, replication and export destinations.
2. Use an AWS compliance report as evidence that any Region satisfies the contract.
3. Validate the primary storage Region and assume backup, replication and export destinations inherit its approval.
4. Encrypt the primary and backup data and permit replication to any Region.

Correct Answer: A

 

Correct Answer

Answer A is correct because the customer owns the workload-specific interpretation and configuration of its contractual requirement. AWS operates the regional infrastructure, but that does not select the company’s intended locations or validate all copies it configures.

Incorrect Answers

Answer B is incorrect because provider controls do not choose the Region named in a particular customer contract. The architect must map that contractual requirement to actual data locations.

Answer C is incorrect because the contract also covers copies. Validating the primary location does not verify separately configured destinations, so the customer’s configuration review remains incomplete.

Answer D is incorrect because encryption may protect confidentiality, but it does not change where the data is stored. The contract imposes a geographic restriction even on protected copies.