AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 13
Question 120
A central operations account needs to administer a restricted workload account during a migration. Company policy forbids storing access keys for a user in the target account and requires short-lived credentials. Which cross-account access pattern is best?
- Create a target-account IAM user and email its access key to the central operations team.
- Add an S3 bucket policy permitting the operations account to read buckets and assume it grants all EC2 and IAM administration.
- Attach an internet gateway to both VPCs and rely on IP routing to provide AWS management API permissions.
- Create a scoped IAM role in the workload account and have authorized operators assume it through AWS STS.
Explanation
Correct Answer
D:STS AssumeRole yields temporary credentials for the target role with permissions granted there. Cross-account access can therefore be limited by trust and role policies without provisioning long-lived users in the target account.
Incorrect Answers
A:The long-lived IAM user key violates the stated credential-lifecycle requirement and complicates attribution and revocation. Cross-account role sessions are designed for temporary delegation instead.
B:A bucket policy is resource-specific; it does not authorize the full set of workload-account operations. A role with scoped policies and a matching trust relationship is needed.
C:An internet gateway permits network routing under its route-table conditions but does not grant a principal AWS API authorization in another account. Network paths and IAM permissions are separate.
Question 121
A workload-account administrator created an IAM role with the exact S3 permissions an external analytics account needs. However, attempts to assume the role from the analytics account are denied despite the role policy being correct. Which part of the design is most likely incomplete?
- Allow inbound TCP 443 from the analytics VPC to the target account's EC2 security groups.
- Enable S3 Versioning on the destination bucket to make the IAM role assumable.
- Add the authorized analytics account principal to the role's trust policy, with appropriate conditions.
- Add s3:* to the role's permissions policy, because broader resource access automatically grants role assumption.
Explanation
Correct Answer
C:A role permission policy defines what a successful session can do, whereas the trust policy controls who may call AssumeRole. The external principal must be trusted before STS can issue credentials.
Incorrect Answers
A:A VPC security-group rule does not alter the IAM trust relationship evaluated by AWS STS. Network reachability to a workload is separate from permission to assume an IAM role.
B:Bucket Versioning protects object revisions and has no bearing on the principal checks performed by STS for role assumption. The failure occurs before S3 object access.
D:Broadening S3 permissions cannot overcome a missing trust relationship. It only increases what a successful role session could do after STS admission and may create unnecessary data exposure.
Question 122
A developer in a separate AWS account is trusted by a target-account role, but an explicit identity-policy restriction in the developer's account prevents sts:AssumeRole for that role. The target role is otherwise configured correctly. What change is needed?
- Make the target account's S3 buckets publicly readable to avoid sts:AssumeRole entirely.
- Grant the target role AmazonS3FullAccess while leaving the caller's sts:AssumeRole denial unchanged.
- Create a VPC peering connection so the developer can reach the other account's private address space.
- Permit the authorized caller to perform sts:AssumeRole on the specific target-role ARN, subject to all relevant policy ceilings.
Explanation
Correct Answer
D:The caller needs authorization to request the STS role session, alongside a target trust policy that allows the principal. A caller-side deny prevents assumption even if the target role has broad downstream permissions.
Incorrect Answers
A:Public bucket access neither supplies the intended scoped cross-account role nor authorizes other actions. It creates data exposure instead of repairing the identity permission required for role assumption.
B:The role's resource permissions take effect only after successful assumption. Adding broad S3 access does not remove the caller's explicit denial of the STS API operation.
C:Peering establishes direct private packet routing between VPCs; STS authorization is evaluated by IAM and role trust, not by VPC connectivity. The denial would remain.
Question 123
A security engineer can assume a cross-account incident-response role from one team but not another. Both teams use an identical role name; the failed call is logged as AccessDenied. The architect is asked for a targeted diagnosis before changing permissions. Which procedure is most reliable?
- Review the caller identity policy and permission ceilings, the exact target role trust conditions, and the STS request context.
- Attach AdministratorAccess to both teams permanently so no authorization evaluation can return AccessDenied.
- Increase the EC2 instance type in the target account to make STS role assumption more reliable.
- Disable CloudTrail event collection so repeated failed attempts no longer appear in security logs.
Explanation
Correct Answer
A:Successful AssumeRole requires compatible caller-side authorization and target-side trust, subject to applicable explicit denies and conditions. Comparing the principals and request context identifies the missing control without needless escalation.
Incorrect Answers
B:Broad administrator policies can still be limited by explicit denies or target trust restrictions, and create excessive privilege. They are not a diagnosis of which policy condition failed.
C:Role assumption is an identity authorization request, not a compute-capacity problem in the target VPC. Instance sizing cannot correct an STS AccessDenied response.
D:Stopping auditing hides evidence but does not fix authorization. CloudTrail records can instead help identify the calling principal and request details that explain the differing outcomes.
Question 124
A SaaS cost-management vendor needs read-only access to each customer's AWS billing data. The vendor has hundreds of customers, and the security architect refuses to copy a customer IAM access key into the vendor's system. How should access be delegated?
- Share every customer root password with the vendor so it can list all AWS services.
- Create a permanent IAM user in every customer account and upload its access keys to the vendor portal.
- Have each customer create a narrowly scoped role with trust for the vendor's AWS principal and let the vendor assume it temporarily.
- Make every customer's billing-related S3 bucket publicly readable and ask the vendor to scrape the objects.
Explanation
Correct Answer
C:Cross-account role assumption keeps long-term vendor credentials out of customer accounts and limits each assumed session to the customer's defined permissions. ExternalId conditions can further mitigate confused-deputy risk.
Incorrect Answers
A:Root credentials provide excessive control and cannot isolate read-only SaaS permissions. They also undermine the tenant-by-tenant trust relationships the vendor must respect.
B:Long-lived keys distributed to a third party increase exposure and complicate revocation across customers. Role trust and STS sessions are the supported bounded-delegation pattern.
D:Public S3 access is neither a safe authorization path nor a general way to retrieve account billing and cost APIs. It exposes resources beyond the intended vendor role.
Question 125
A customer has terminated its contract with a security-assessment SaaS provider. The provider used temporary role sessions to inspect account resources; the customer wants to block future assumptions immediately without guessing whether the provider rotated its own credentials. Which control should change?
- Delete one access key from the vendor's AWS account by editing a customer-owned S3 bucket policy.
- Change the S3 lifecycle configuration so the vendor can no longer upload objects during the first 30 days.
- Enable Amazon CloudFront caching on the account's web assets to terminate the vendor integration.
- Remove the vendor principal from the delegated role's trust policy and revoke active sessions if the incident policy requires it.
Explanation
Correct Answer
D:The customer controls whether STS may issue further sessions for its cross-account role. Updating trust blocks new assumptions, while session revocation addresses sessions already issued before termination.
Incorrect Answers
A:Customer bucket policies do not administer IAM access keys in the vendor's account. This would leave any trusted AssumeRole path available for future sessions.
B:Lifecycle transitions govern stored object aging, not the trust policy STS uses to issue temporary credentials. They would not revoke access to other services or stop role assumption.
C:CloudFront caches HTTP content and cannot remove an external principal from IAM role trust. The vendor's authorization is managed through identity and role policies.
Question 126
A vendor asks a customer to put a predictable vendor-generated ExternalId into a cross-account role trust policy. A reviewer says ExternalId alone proves the request came from the vendor even if the trust policy permits Principal '*'. Which evaluation is correct?
- Give the vendor root credentials and remove ExternalId so no caller-side trust policy is needed.
- Create an S3 bucket condition on encryption headers and treat it as proof of who called AssumeRole.
- Require the trusted vendor principal in the role trust policy as well as the appropriate ExternalId condition; ExternalId is not a standalone secret authenticator.
- Accept a wildcard trusted Principal because possession of the ExternalId proves an AWS identity is an authorized vendor.
Explanation
Correct Answer
C:ExternalId helps prevent a SaaS vendor from being tricked into using another customer's role. STS still evaluates the actual calling principal and the role's trust conditions; the value alone does not authenticate arbitrary callers.
Incorrect Answers
A:Sharing root credentials abandons delegated access and tenant isolation. The trust policy remains the correct authorization boundary for third-party STS role sessions.
B:Encryption headers govern particular S3 requests, not STS caller identity. They cannot substitute for the role trust and ExternalId check used in cross-account delegation.
D:ExternalId is not designed to act as a secret password that replaces principal authorization. An overly broad Principal creates an avoidable role-assumption exposure.
Question 127
A CI job runs for nine minutes and deploys a container image once per commit. Developers currently store a permanent IAM access key in the build system. They require a short credential lifetime and role-scoped API permissions. What should the architect configure?
- Run the build under a narrowly scoped IAM role that obtains temporary STS credentials instead of a stored IAM user key.
- Add a Network Load Balancer in front of the build worker to conceal the static access key.
- Put the long-lived key into an encrypted environment variable and never revoke it unless deployment fails.
- Use an S3 storage class with automatic archiving for the container build logs.
Explanation
Correct Answer
A:Temporary role credentials expire after their session period and avoid distributing a reusable secret to build runners. A least-privilege role policy limits deployment APIs to the intended resources.
Incorrect Answers
B:Load balancers route connections and do not transform a worker's API credentials into a temporary role identity. The key remains long-lived and vulnerable if exposed.
C:Environment-variable encryption protects storage but does not bound credential lifetime or reduce what a stolen key can do. Short-lived role sessions address the stated exposure more directly.
D:Log archival can reduce storage cost, but it has no impact on the authentication method used by the build to call AWS APIs. The permanent key remains present.
Question 128
An automated deployment runner assumes an IAM role and then fails halfway through a two-hour job because its STS session expired. The team proposes setting the duration to 48 hours regardless of role configuration. Which change reflects AWS role-session limits?
- Disable the account's AWS CloudTrail trail to extend the validity of temporary credentials.
- Change the role to an S3 bucket policy because resource policies produce unlimited-duration AWS sessions.
- Change the EC2 instance tenancy to Dedicated Host to increase the role-session duration quota.
- Use a session duration permitted by the target role's configured maximum and the relevant STS API limits; refresh credentials when required.
Explanation
Correct Answer
D:STS sessions have bounded lifetimes and role configuration defines permissible maximum duration for many assumption paths. Long-running jobs should obtain new authorized sessions rather than assume credentials never expire.
Incorrect Answers
A:CloudTrail records AWS API events and does not determine STS credential expiration. Disabling audit records would weaken monitoring without helping the runner.
B:A bucket policy controls resource authorization, not issuance or expiry of STS temporary credentials. Switching policy type cannot create a permanent authenticated session.
C:Dedicated Host concerns compute placement and licensing, not IAM role session duration. It has no mechanism for extending an STS credential lifetime.
Question 129
A deployment tool first assumes an operations role, then uses those role credentials to assume a second role in another AWS account. It requests a six-hour second session but receives a duration validation error. What should be changed?
- Request a second AssumeRole session no longer than the role-chaining duration limit, usually one hour, or redesign the credential path.
- Create a longer S3 presigned URL and attach its signature as the STS session token.
- Enable Lambda provisioned concurrency so the STS API holds the original role credentials in a warm environment.
- Increase the second role's maximum session setting to twelve hours and retry six-hour chaining without changing the caller.
Explanation
Correct Answer
A:Role chaining applies a stricter session limit to an AssumeRole call performed with existing role credentials. A target role's advertised longer normal maximum does not override that chained-session restriction.
Incorrect Answers
B:S3 presigned URLs authorize object requests under a signing identity; they cannot replace the separate STS credential and duration rules for assuming IAM roles.
C:Function warm capacity affects invocation latency, not the expiry semantics of STS temporary credentials. A cached expired token still requires a valid new role session.
D:A longer maximum can help certain direct assumptions, but role chaining has its own maximum. The same chained request would still exceed that limit.
Question 130
A platform team permits delegated administration through an IAM role in account A followed by a second role in account B. Compliance requires the original caller identity to be carried on every chained temporary session and recorded in CloudTrail, rather than relying on easily reused role session names. Which IAM and STS control should the architect use?
- Assign the same RoleSessionName to all callers and rely on that label alone to prove the original principal across multiple account switches.
- Require only an ExternalId in the last trust policy and expect it to automatically become a source identity on every earlier and later role session.
- Enable CloudTrail management events but leave callers free to omit identity context when assuming and chaining roles.
- Use STS SourceIdentity and appropriate role trust and sts:SetSourceIdentity permissions so the chosen caller identity is recorded and persists across permitted role chaining.
Explanation
Correct Answer
D:STS source identity is retained in role-session context across role chaining, and the role policies must allow setting it. Appropriate trust conditions and CloudTrail event context make the original caller traceable.
Incorrect Answers
A:RoleSessionName can be chosen or reused by callers unless separately constrained. It does not by itself establish immutable original-caller provenance after multiple role assumptions.
B:ExternalId helps prevent a confused deputy in selected third-party trust arrangements; it is not the STS SourceIdentity feature and does not automatically supply chained caller attribution.
C:CloudTrail records the session context it receives, but simply enabling logs cannot require a caller to supply source identity or make that identity persist through subsequent role assumptions.
