AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 14
Question 130
A platform team permits delegated administration through an IAM role in account A followed by a second role in account B. Compliance requires the original caller identity to be carried on every chained temporary session and recorded in CloudTrail, rather than relying on easily reused role session names. Which IAM and STS control should the architect use?
- Assign the same RoleSessionName to all callers and rely on that label alone to prove the original principal across multiple account switches.
- Require only an ExternalId in the last trust policy and expect it to automatically become a source identity on every earlier and later role session.
- Enable CloudTrail management events but leave callers free to omit identity context when assuming and chaining roles.
- Use STS SourceIdentity and appropriate role trust and sts:SetSourceIdentity permissions so the chosen caller identity is recorded and persists across permitted role chaining.
Explanation
Correct Answer
D:STS source identity is retained in role-session context across role chaining, and the role policies must allow setting it. Appropriate trust conditions and CloudTrail event context make the original caller traceable.
Incorrect Answers
A:RoleSessionName can be chosen or reused by callers unless separately constrained. It does not by itself establish immutable original-caller provenance after multiple role assumptions.
B:ExternalId helps prevent a confused deputy in selected third-party trust arrangements; it is not the STS SourceIdentity feature and does not automatically supply chained caller attribution.
C:CloudTrail records the session context it receives, but simply enabling logs cannot require a caller to supply source identity or make that identity persist through subsequent role assumptions.
Question 131
A Java application on EC2 needs to read selected S3 objects each hour. The existing deployment image contains an IAM user's access key. Security policy requires credentials to rotate automatically without application releases. What should the architect do?
- Regenerate an IAM user key every 90 days and bake the new value into a replacement AMI.
- Attach an appropriate IAM role through an EC2 instance profile and use the standard SDK credential provider chain.
- Make the S3 bucket public-read so the EC2 application never requires AWS identity.
- Install an Application Load Balancer and pass AWS secret access keys in the HTTP Host header.
Explanation
Correct Answer
B:Instance-profile role credentials are delivered as temporary credentials through the instance metadata path. AWS SDKs can refresh them automatically, eliminating baked-in static user keys.
Incorrect Answers
A:Quarterly AMI replacement still distributes long-lived credentials in images and requires release work to rotate them. Instance-role credentials are better suited to frequent automatic renewal.
C:Public read exposes the objects to unintended clients and abandons the requirement for scoped application authorization. The workload should authenticate through its own role.
D:An ALB does not issue IAM temporary credentials to EC2 SDKs. Sending secrets through application request headers would create additional disclosure risk without solving rotation.
Question 132
An EC2 image processor has an instance role allowing s3:* on Resource '*'. The job should read objects only under a specific private bucket prefix and cannot alter bucket policies or delete the data. Which permission change is most appropriate?
- Make the entire bucket publicly readable and remove all application-role S3 permissions.
- Replace the instance profile with the account root access key to guarantee the processing job can list objects.
- Scope the instance role to the needed S3 GetObject resources for that bucket prefix and any narrowly required supporting actions.
- Keep s3:* on every bucket because a role is automatically least-privileged when attached through an instance profile.
Explanation
Correct Answer
C:IAM policies can distinguish object ARNs and allowed S3 actions, so the application gets only the read capabilities its processing path needs. This sharply reduces the impact of compromised instance credentials.
Incorrect Answers
A:Public access is not an appropriate substitute for privately authorized processing. It also removes control over which clients can obtain the protected objects.
B:Root keys enlarge the blast radius and violate the workload-identity requirement. The job needs a scoped S3 read grant, not account-owner authorization.
D:Temporary credentials reduce credential persistence, but do not restrict permissions beyond the policy attached to the role. s3:* on all resources still enables unnecessary modification and deletion operations.
Question 133
A security engineer wants all newly launched EC2 instances to require session-oriented IMDSv2 metadata requests. One older application fetches role credentials using an unmaintained IMDSv1 client. Which rollout plan prevents an avoidable credential outage?
- Open inbound SSH to the entire internet so the metadata request can pass through the EC2 security group.
- Upgrade the client to support IMDSv2 token requests, test credential retrieval, and then require IMDSv2 in instance metadata options.
- Disable the instance profile and replace the application credential provider with a hardcoded root secret.
- Require IMDSv2 immediately and assume IMDSv1-only clients silently upgrade without testing.
Explanation
Correct Answer
B:IMDSv2 uses session tokens for metadata requests. Enforcing token use is sound hardening, but the existing credential provider must support the protocol or it will lose role credentials.
Incorrect Answers
A:IMDS is an instance-local metadata service, not an inbound SSH service from the internet. Public SSH exposure does not make an IMDSv1-only client speak IMDSv2.
C:Hardcoded root credentials remove instance identity protections and create a permanent high-privilege secret. They do not solve IMDSv2 client compatibility.
D:Clients that only issue the old metadata calls can fail when tokens are required. The application and SDK must be compatible before enforcing the new metadata option.
Question 134
A machine-image factory copies an EC2 instance's temporary metadata credentials into a configuration file in the golden AMI. Newly launched instances intermittently fail to call AWS APIs when that file's token expires. How should the architect correct the image design?
- Remove credential material from the AMI and let each launched instance acquire fresh role credentials through its own instance profile.
- Increase the AMI storage volume so the saved credentials can be kept for the full life of the instance.
- Create a public S3 bucket containing the copied metadata credentials so instances can reload them after failure.
- Disable the EC2 instance-profile role and run every launched instance under the account root identity.
Explanation
Correct Answer
A:Temporary metadata credentials are tied to a role session and expire. Each instance should obtain and refresh its own credentials dynamically instead of embedding a stale credential snapshot in a reusable image.
Incorrect Answers
B:Credential expiration is enforced by AWS, not by how many bytes an AMI can store. A larger volume does not extend the session or prevent stolen copies from being reused temporarily.
C:Publishing temporary credentials creates a severe disclosure path and still does not issue fresh instance-specific sessions. Metadata and instance profiles should provide the credentials directly.
D:Root access is not a safe replacement for workload credentials. It discards role scoping and recreates long-lived, overprivileged secrets instead of addressing expired cached sessions.
Question 135
An invoice-processing Lambda function reads private objects in S3. Developers have stored an IAM user's access key in its environment variables and want to eliminate all reusable static credentials from the function. What should the architect configure?
- Make the S3 bucket public-read and leave the function execution role without object permissions.
- Use the Lambda function resource policy to grant the function's own code permission to call s3:GetObject.
- Give the function an execution role with the specific S3 read permissions and use its temporary role credentials.
- Put the existing IAM user secret into Lambda environment variables encrypted at rest and keep using it indefinitely.
Explanation
Correct Answer
C:Lambda obtains temporary AWS credentials from the service-managed execution environment for the function's role. An appropriate scoped policy allows only the required bucket operations without deploying a permanent user key.
Incorrect Answers
A:Public bucket access would expose invoices beyond the authorized function and does not enforce the required least-privilege application access. The objects should remain private.
B:A Lambda resource policy controls who may invoke the function, not what AWS API calls its execution code can make. Outbound S3 calls depend on the execution role and resource authorization.
D:At-rest environment-variable encryption does not make an IAM user's key temporary or remove its reuse across function versions. The role-based credential provider is the correct workload identity path.
Question 136
A new Lambda deployment fails to start because AWS Lambda cannot assume the IAM role designated as its execution role. The policy attached to that role already allows the function's database queries. Which specific role setting should be checked?
- Enable point-in-time recovery on the RDS database used by the function.
- Add a public Lambda AddPermission statement allowing Principal '*' to invoke the function.
- Open inbound TCP 5432 from the entire internet to the RDS database security group.
- Ensure the role trust policy allows the lambda.amazonaws.com service principal to assume the role.
Explanation
Correct Answer
D:Execution roles must trust the Lambda service principal so that the service can obtain credentials. Database permissions on the role are evaluated only after the role has been assumed successfully.
Incorrect Answers
A:Point-in-time recovery improves data recovery after logical mistakes. It has no relationship to the Lambda service principal in the execution role's trust policy.
B:A resource-based invocation policy determines who can call the function; it does not grant the Lambda service authority to assume an execution role. The deployment trust failure would persist.
C:A database security group addresses network reachability, not whether the Lambda service is trusted by IAM STS. It adds unnecessary exposure and cannot fix the role assumption failure.
Question 137
A payment webhook Lambda should accept invocations only from an approved EventBridge rule. Separately, after invocation, the code needs permission to write an SQS message. Engineers incorrectly attempt to solve both with one Lambda resource-based policy. What is the correct distinction?
- Give EventBridge an SQS queue policy and expect it to grant the Lambda code all SQS operations.
- Allow anonymous invocation of the Lambda function and assume the SQS write permission is inherited from the caller.
- Assign the function a security group allowing outbound 443 and skip all IAM resource and execution policies.
- Grant EventBridge permission to invoke through the Lambda resource policy and grant SQS SendMessage through the Lambda execution role.
Explanation
Correct Answer
D:Lambda invocation authorization and its outbound AWS API authorization use different IAM boundaries. The resource policy permits the triggering service, whereas execution-role permissions govern calls performed by running function code.
Incorrect Answers
A:SQS resource policies can authorize queue access but do not replace the Lambda execution role for the function's signed API calls. EventBridge-to-Lambda invocation also still needs its own permission.
B:Function code executes under its configured role, not the invocation principal's IAM permissions. Public invocation increases attack exposure without authorizing the outbound SQS call.
C:Network egress reachability is necessary in some VPC configurations but does not establish AWS API permission to invoke Lambda or write to a queue. IAM controls remain required.
Question 138
A Lambda function can be invoked by its API Gateway integration but fails with AccessDenied while reading a KMS-encrypted S3 object. A developer proposes allowing all principals to invoke the function as a fix. What should the architect do instead?
- Review the Lambda execution role's object-read and KMS decrypt permissions and the applicable bucket and key policies.
- Add a Lambda resource-based permission allowing the S3 service principal to invoke the function, without changing the function execution role.
- Create another S3 object version and expect IAM encryption permissions to be inherited from Versioning.
- Add Lambda public invocation permission so the S3 service treats the function as the account root.
Explanation
Correct Answer
A:Invocation has already succeeded. The failing step is an outbound API operation using execution-role credentials; S3 object access and KMS key authorization both need to allow the requested encrypted read.
Incorrect Answers
B:Invocation permission controls who can call Lambda. The function already runs; its outbound S3 read and KMS decrypt operations are authorized by the execution role and resource/key policies.
C:Versioning preserves object revisions but does not grant principals permission to read encrypted object data or use a KMS key. The authorization gap remains.
D:Resource-based Lambda invocation permission does not change its execution identity. Granting anonymous invocation expands who can run the function but leaves the S3/KMS AccessDenied unchanged.
Question 139
An ECS service runs a container that periodically reads documents from a private S3 bucket. The team's Dockerfile includes an IAM user key so the application can authenticate. What redesign avoids baked-in credentials?
- Add an ALB path rule for /s3 and assume the load balancer issues S3 API credentials to the container.
- Assign the application task an IAM task role with scoped S3 access and let its SDK obtain task credentials.
- Put the IAM user key into a private image registry and mount it in every deployed container.
- Grant the ECS cluster EC2 instance a root access key and allow all containers to reuse it.
Explanation
Correct Answer
B:The ECS task role supplies temporary workload credentials to containers through the supported credential endpoint. That enables per-task authorization and avoids distributing static IAM user keys inside reusable images.
Incorrect Answers
A:ALB listener rules route HTTP traffic; they do not supply IAM credentials for application-initiated calls to Amazon S3. ECS task identity is the relevant mechanism.
C:Registry access does not shorten the key's lifetime or reduce its privileges. A leaked image or mounted secret can still expose a long-lived credential that should be replaced by task identity.
D:Sharing the host's root credential removes task isolation and creates account-wide exposure. The application needs a dedicated task role rather than host-wide permanent secrets.
Question 140
An ECS Fargate application can pull its image and send container logs to CloudWatch, but the application itself receives AccessDenied when calling DynamoDB. An engineer wants to add dynamodb:* to the ECS task execution role. What is the more targeted change?
- Grant DynamoDB FullAccess only to the task execution role because it always authorizes SDK calls inside containers.
- Disable AWS CloudWatch logging so the container has more CPU to make authorized DynamoDB calls.
- Add the required DynamoDB permissions to the ECS application task role used by the container.
- Make the DynamoDB table publicly writable without AWS authentication for the ECS task.
Explanation
Correct Answer
C:The task execution role lets ECS infrastructure pull images and perform defined startup/logging actions. Container code obtains its AWS API identity from the task role, which should carry scoped DynamoDB permissions.
Incorrect Answers
A:The task execution role and application task role have separate responsibilities. Enlarging the execution role does not normally change the credentials injected for container application API requests.
B:Logging overhead is irrelevant to IAM AccessDenied. Removing logs discards useful diagnostic evidence and does not alter the task role policies evaluated by DynamoDB.
D:DynamoDB API authorization uses supported AWS principals and policies. Public anonymous writes are not an appropriate substitute for granting the task's role only the required operations.
