AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 15
Question 140
An ECS Fargate application can pull its image and send container logs to CloudWatch, but the application itself receives AccessDenied when calling DynamoDB. An engineer wants to add dynamodb:* to the ECS task execution role. What is the more targeted change?
- Grant DynamoDB FullAccess only to the task execution role because it always authorizes SDK calls inside containers.
- Disable AWS CloudWatch logging so the container has more CPU to make authorized DynamoDB calls.
- Add the required DynamoDB permissions to the ECS application task role used by the container.
- Make the DynamoDB table publicly writable without AWS authentication for the ECS task.
Explanation
Correct Answer
C:The task execution role lets ECS infrastructure pull images and perform defined startup/logging actions. Container code obtains its AWS API identity from the task role, which should carry scoped DynamoDB permissions.
Incorrect Answers
A:The task execution role and application task role have separate responsibilities. Enlarging the execution role does not normally change the credentials injected for container application API requests.
B:Logging overhead is irrelevant to IAM AccessDenied. Removing logs discards useful diagnostic evidence and does not alter the task role policies evaluated by DynamoDB.
D:DynamoDB API authorization uses supported AWS principals and policies. Public anonymous writes are not an appropriate substitute for granting the task's role only the required operations.
Question 141
A cluster hosts two ECS services. A billing container must read invoices in S3, while a marketing container must access only a separate customer-preference table. Both currently inherit broad credentials from the host. Which policy design limits lateral access?
- Assign distinct narrowly scoped IAM task roles to the two ECS task definitions and remove shared broad credentials.
- Put the two services behind one ALB listener and assume HTTP routing enforces their AWS API permissions.
- Enable ECS deployment circuit breakers and leave the shared role with wildcard permissions.
- Give the EC2 host role every billing and marketing permission and let all tasks use it as a common identity.
Explanation
Correct Answer
A:ECS task roles distinguish application AWS permissions at the task boundary. A compromised marketing task then lacks the S3 invoice rights needed only by the billing task.
Incorrect Answers
B:An ALB distributes incoming application traffic but does not restrict each container's AWS SDK calls to distinct S3 or DynamoDB resources. IAM task roles govern those calls.
C:Deployment failure detection may roll back unhealthy releases, but it does not restrict credential scope. The request concerns isolation of AWS API privileges between services.
D:Sharing a broad host role defeats task-level least privilege because compromise of one container may expose operations required by unrelated services. Separate task roles are preferable.
Question 142
After a container-image rebuild, one ECS task unexpectedly calls AWS APIs using an old access key even though the task definition has a valid scoped IAM task role. Which diagnostic action best identifies the source of this identity mismatch?
- Change the ECS log driver from awslogs to a local file because log drivers set the caller's IAM principal.
- Increase the ECS service desired count until a new task happens to receive a different IAM role.
- Inspect the application's credential provider chain and container environment or image for static keys overriding task-role credentials.
- Increase permissions on the ECS task execution role that pulls images and writes logs, without removing the embedded access key from the application.
Explanation
Correct Answer
C:Most AWS SDK providers prefer configured static environment credentials over later container task-role sources. Removing an inherited key allows the application to use temporary ECS task credentials as intended.
Incorrect Answers
A:The log driver affects collection of container logs and does not determine the AWS credentials chosen by the application SDK. Static environment variables can still override its task role.
B:Scaling creates additional tasks using the same task definition and environment. It cannot fix a credential-provider precedence problem present in every newly launched container.
D:The ECS task execution role does not necessarily supply the application’s AWS API credentials. A static credential earlier in the application provider chain can still override its intended task role.
Question 143
A Kubernetes cluster on Amazon EKS contains several teams' applications. Only one namespace's image-resizing pods need access to a narrow S3 prefix. Security refuses to give all pods the worker-node role's S3 privileges. Which access design is most suitable?
- Attach s3:* to the EKS node's EC2 role so every pod can read the bucket.
- Associate the intended Kubernetes workload identity with a scoped AWS IAM role using EKS Pod Identity or supported IRSA.
- Make the S3 prefix publicly readable and depend on Kubernetes namespace labels for network protection.
- Grant Kubernetes RBAC get/list permissions on the pod service account and assume Kubernetes API authorization automatically supplies S3 API credentials.
Explanation
Correct Answer
B:Pod-specific identity lets selected applications obtain AWS temporary credentials without reusing broad node permissions. The configured association and IAM permissions can be scoped to exactly the required S3 objects.
Incorrect Answers
A:Expanding the node role spreads S3 access to unrelated pods and violates namespace-level separation. Pod-specific AWS identity is the appropriate authorization boundary.
C:Namespace labels do not make a public S3 bucket private. Public object access bypasses the intended AWS principal-based authorization for the workload.
D:Kubernetes RBAC governs Kubernetes API requests, not AWS S3 authorization. A supported workload IAM identity binding is still needed for scoped AWS API access.
Question 144
A team runs EKS managed worker nodes and independent pods that call SQS. A proposed design attaches all SQS permissions to the node instance profile and treats the node as the sole security principal. Which separation should the architect establish?
- Move the SQS queue into the EKS cluster as a Kubernetes secret so it inherits namespace authorization.
- Use a public LoadBalancer service to distribute the pods' outbound SQS requests to AWS.
- Grant every worker-node role AdministratorAccess because Kubernetes RBAC automatically limits the underlying AWS API calls.
- Keep node permissions for node operations and give application-specific SQS access to the appropriate pod-associated role.
Explanation
Correct Answer
D:Node instance roles support node infrastructure and should not be the default shared identity for all applications. Pod-specific AWS identity separates queue privileges from unrelated Kubernetes workloads.
Incorrect Answers
A:An SQS queue is an AWS service resource and is not moved into a Kubernetes namespace by a Secret object. IAM permissions still govern AWS queue operations.
B:A Kubernetes service load balancer routes application networking. It cannot grant pod-specific IAM credentials to call SQS APIs.
C:Kubernetes RBAC controls Kubernetes API resources, not arbitrary AWS operations performed with the node's IAM credentials. AdministratorAccess would create cross-pod exposure.
Question 145
Most EKS pods can read from an S3 dataset, but one new deployment using a different Kubernetes service account gets AccessDenied. Its AWS role policy appears correct. What should the architect inspect first?
- Check the service account's EKS Pod Identity association or IRSA annotation and the corresponding IAM trust configuration.
- Increase the new deployment's CPU request so AWS IAM can issue credentials faster.
- Grant broader read access to the EKS control-plane service role because it is the default identity for every pod.
- Create a public S3 bucket replica in the same Region so the failing pod can fetch the dataset anonymously.
Explanation
Correct Answer
A:A role policy does not help if the pod receives no intended credentials or cannot assume its role. Mapping the service account to the authorized AWS identity and checking trust is the relevant diagnostic path.
Incorrect Answers
B:CPU sizing might affect application performance but does not grant role assumption or S3 permission. An IAM AccessDenied needs an identity/trust check.
C:The EKS service role is used for managed cluster operations and is not the application pod's credential path. Broadening it will not correct a missing service-account association.
D:Public replication bypasses authorization instead of fixing the new pod's identity mapping. The existing secure bucket can remain private with correct pod credentials.
Question 146
A platform engineer fixes one EKS batch pod's denied DynamoDB calls by adding dynamodb:* to the shared EC2 node role. The node hosts other teams' workloads. Which risk-focused correction should the architect require?
- Keep dynamodb:* on the node role because node permissions automatically become namespace-scoped in Kubernetes.
- Move the batch pod's narrowly scoped DynamoDB rights into a pod-specific AWS role and remove them from the shared node role.
- Give every EKS pod a local administrator password so Kubernetes can rewrite IAM policies per request.
- Add a Network Load Balancer in front of DynamoDB to force all pod calls through per-namespace network rules.
Explanation
Correct Answer
B:A pod identity association limits the AWS API authority of the batch workload without expanding the credentials potentially reachable by unrelated pods. This restores least privilege at the correct boundary.
Incorrect Answers
A:Node instance-profile permissions are not automatically filtered by namespace or RBAC. Broad node-level DynamoDB access can undermine application isolation.
C:Local container user passwords do not establish IAM role sessions and cannot transform a shared node role into pod-scoped AWS authorization.
D:DynamoDB is a managed AWS API, not a customer-owned NLB backend. A load balancer does not replace role-specific IAM permissions for table operations.
Question 147
A developer can create a role whose identity policy allows ec2:TerminateInstances, but the role has a permission boundary excluding that action. The developer asks why the role cannot terminate instances. Which explanation is correct?
- Adding a public inbound rule to the instances' security groups makes EC2 management actions authorized.
- The identity-policy Allow always overrides a permissions boundary because the boundary is only a naming convention.
- The permissions boundary is a maximum-permissions ceiling and the action must be allowed through applicable identity permissions and ceilings.
- The boundary automatically grants TerminateInstances if the application has an EC2 service-linked role.
Explanation
Correct Answer
C:A role's identity policy can grant only permissions that remain within its boundary and other applicable restrictions. The boundary does not grant additional actions by itself.
Incorrect Answers
A:Security groups govern network traffic to ENIs and do not alter the IAM permission evaluation for the EC2 termination API.
B:Permission boundaries participate in IAM policy evaluation and can restrict actions granted by identity policies. An Allow does not automatically escape the configured ceiling.
D:Service-linked roles support designated AWS service operations, not unrelated application permissions. The excluded action remains outside this role's boundary.
Question 148
A company stores sensitive documents in an S3 general purpose bucket. A security assessment finds that a role with valid s3:GetObject permissions can make non-TLS HTTP requests to some object URLs. The policy requirement is to reject all insecure transport to that bucket without breaking normal TLS access. Which bucket control is appropriate?
- Enable default SSE-KMS encryption and remove TLS restrictions, because server-side encryption automatically upgrades every client HTTP request.
- Add another IAM identity policy allowing s3:GetObject and rely on the S3 console to block HTTP clients.
- Require a VPC security group on the S3 bucket with port 443 inbound and assume that applies to every internet client.
- Apply an S3 bucket policy Deny for requests where aws:SecureTransport is false, and keep appropriate permissions for HTTPS requests.
Explanation
Correct Answer
D:The aws:SecureTransport global condition is available in S3 bucket policies; an explicit Deny on false enforces TLS regardless of another applicable s3:GetObject Allow. Scope the statement to the bucket and objects and verify the application uses HTTPS.
Incorrect Answers
A:Default SSE-KMS protects stored objects at rest. It does not require encrypted client transport or prevent HTTP access to an S3 API endpoint.
B:Adding an identity Allow does not enforce the transport scheme. The S3 console interface is not a universal access-policy control for all SDK and HTTP requests.
C:An S3 general purpose bucket is not a customer EC2 network interface on which a security group can be attached. Use service-aware resource policies to enforce this request property.
Question 149
An API call is denied although an engineer sees an Allow in the role's policy. The action depends on a principal tag, a resource tag, and a permissions boundary; the request is made through an assumed role. What should the architect use to isolate the failure?
- Evaluate the full IAM policy context, including actual session tags, resource attributes, boundaries and any explicit Deny, with policy simulation and audit evidence.
- Disable session tags so the ABAC condition can evaluate as true without a tag value.
- Add an internet gateway to the caller's VPC so IAM policy simulator bypasses tag conditions.
- Read the one identity-policy Allow and ignore all request attributes and other policy types.
Explanation
Correct Answer
A:An Allow statement is only one part of policy evaluation. Policy simulation and request context help determine whether condition keys match and whether a boundary or other policy prevents authorization.
Incorrect Answers
B:Removing required session tags generally makes a matching ABAC condition false rather than granting access. The tags must be supplied and authorized appropriately.
C:An internet gateway alters network routing and cannot change IAM condition evaluation for principal or resource tags. The denial requires an authorization analysis.
D:Conditional authorization is sensitive to the principal, resource, session and applicable ceilings. Ignoring those inputs cannot explain a policy condition mismatch or explicit Deny.
Question 150
An EC2 operations role in a member account has AdministratorAccess but an AWS Organizations SCP attached to its OU denies a specified service API. The operator assumes the account admin role and still gets AccessDenied. What is the correct explanation?
- AdministratorAccess takes precedence over every SCP because it contains a wildcard Allow.
- The applicable SCP explicit Deny limits the member-account principal even though the identity policy grants the API action.
- Add a second identity-based IAM policy that explicitly allows the same service action while leaving the OU SCP Deny in place.
- Add the same Deny statement to an S3 bucket policy so the operator receives permissions from both policies.
Explanation
Correct Answer
B:An SCP is an organization-level ceiling; an explicit Deny in it prevents covered principals from using the action. AdministratorAccess does not override that organization guardrail.
Incorrect Answers
A:A wildcard identity-policy Allow remains subject to applicable organization-wide denies. An administrator role in a member account is not automatically exempt from SCP restrictions.
C:The additional identity-based Allow cannot supersede an applicable SCP explicit Deny. The organization guardrail remains an authorization ceiling over member-account principals.
D:A resource-policy Deny cannot grant permissions. Duplicating a deny would add restrictions without removing the existing SCP ceiling.
