AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 16
Question 150
An EC2 operations role in a member account has AdministratorAccess but an AWS Organizations SCP attached to its OU denies a specified service API. The operator assumes the account admin role and still gets AccessDenied. What is the correct explanation?
- AdministratorAccess takes precedence over every SCP because it contains a wildcard Allow.
- The applicable SCP explicit Deny limits the member-account principal even though the identity policy grants the API action.
- Add a second identity-based IAM policy that explicitly allows the same service action while leaving the OU SCP Deny in place.
- Add the same Deny statement to an S3 bucket policy so the operator receives permissions from both policies.
Explanation
Correct Answer
B:An SCP is an organization-level ceiling; an explicit Deny in it prevents covered principals from using the action. AdministratorAccess does not override that organization guardrail.
Incorrect Answers
A:A wildcard identity-policy Allow remains subject to applicable organization-wide denies. An administrator role in a member account is not automatically exempt from SCP restrictions.
C:The additional identity-based Allow cannot supersede an applicable SCP explicit Deny. The organization guardrail remains an authorization ceiling over member-account principals.
D:A resource-policy Deny cannot grant permissions. Duplicating a deny would add restrictions without removing the existing SCP ceiling.
Question 151
The security team attaches an SCP denying changes to certain AWS services to the organization management account and expects it to restrict the management-account root and IAM principals just as it restricts member accounts. Which assessment is accurate?
- SCPs enforce only network packet filtering and therefore apply through security groups in the management VPC.
- Change the SCP from JSON to YAML to activate management-account enforcement.
- SCPs do not restrict IAM principals in the management account; enforce its protections using appropriate management-account controls.
- The SCP will always restrict management-account root because root is the principal with the smallest permissions.
Explanation
Correct Answer
C:AWS Organizations SCPs apply to supported member accounts, not the organization's management-account principals. Management-account hardening requires separate IAM, root and operational guardrails.
Incorrect Answers
A:SCPs are organization-level authorization controls for supported AWS API actions, not VPC security group packet filters. The management-account exception concerns principal scope.
B:The policy document syntax is not what determines its applicability. SCP scope is defined by AWS Organizations and cannot be expanded to management-account principals by reformatting.
D:Root is highly privileged, and the management account is outside SCP principal restriction scope. Attaching a member-account style SCP does not change that applicability.
Question 152
An enterprise has 80 AWS member accounts grouped into workload and compliance OUs. It must prohibit a risky API throughout one OU while allowing an authorized exception in a different OU, and does not want to edit every IAM role. What is the best design?
- Use an ALB listener rule in the management account to deny API calls from the targeted OU.
- Add a different bucket policy to every S3 bucket and expect it to restrict unrelated EC2 or IAM actions.
- Share one IAM user's access key across all 80 accounts and revoke it whenever an API must be prohibited.
- Apply an appropriate SCP at the relevant OU level, with the intended hierarchy and member-account policy evaluation reviewed.
Explanation
Correct Answer
D:OU-level SCP attachment establishes a common maximum-permissions boundary for covered member accounts. Policy hierarchy can be adjusted without individually rewriting each role's identity policies.
Incorrect Answers
A:An ALB only routes traffic through that load balancer; it cannot govern direct signed AWS API calls from IAM principals in member accounts.
B:S3 bucket policies protect specific bucket resources, not arbitrary organization-wide service actions. They cannot implement an OU-wide API restriction across all resources.
C:Static credentials are per-principal access methods, not general governance ceilings for all accounts and services. Shared keys also break attribution and least privilege.
Question 153
A central data engineering account needs to read a narrow prefix in an S3 bucket owned by another AWS account. The provider wants resource-level authorization without creating a user in its own account for the visitor. Which design is appropriate?
- Grant the external AWS principal appropriate access with a bucket policy, together with its own identity-side authorization as required.
- Add the remote user to a local IAM group inside the bucket owner's account.
- Open TCP 443 on an RDS security group and assume it authorizes S3 object reads.
- Make the bucket publicly readable and rely on its object prefix to hide sensitive documents.
Explanation
Correct Answer
A:S3 bucket policies name AWS principals and resource ARNs, including principals in other accounts. They can grant resource access without creating a local IAM user for the consumer.
Incorrect Answers
B:IAM groups contain IAM users from their own account, not arbitrary users from a different AWS account. A cross-account resource policy or assumed role is needed.
C:Security groups filter network packets to their resources; they do not define S3 bucket permissions. The remote principal still needs authorization for GetObject.
D:Object key names are not an access-control boundary. Public-read grants could expose data to unintended parties instead of the selected external principal.
Question 154
An S3 ObjectCreated event should invoke an audit Lambda. The function's execution role can already read S3, but an authorization error indicates S3 cannot call the function. What permission is missing?
- Add an internet gateway to the Lambda VPC because service-to-service invocation is always an inbound VPC connection.
- Make the S3 bucket public-read so event notifications no longer require service permissions.
- Add a Lambda resource-based invocation permission for the authorized S3 service and source bucket/account as appropriate.
- Grant the Lambda execution role s3:PutBucketNotification, expecting that to authorize the S3 service to invoke it.
Explanation
Correct Answer
C:A Lambda resource policy controls which services and principals may invoke the function. The function's execution role controls its subsequent AWS calls, which is a separate permission boundary.
Incorrect Answers
A:AWS service invocation authorization is not repaired by an internet gateway. The error is the principal's permission to invoke Lambda, not a subnet route.
B:Public objects have no bearing on whether the S3 service can invoke a Lambda function. The extra exposure would not satisfy the event integration.
D:An execution-role API grant does not authorize S3 as an invoker. S3 must be permitted through the function's resource-based policy for this event path.
Question 155
An SNS topic owned by a notification account publishes messages to an SQS queue in an order-processing account. The subscription exists but queue delivery receives AccessDenied. What authorization should be added to the queue?
- Create a CloudWatch alarm on queue depth and assume it resolves all cross-account publisher permissions.
- Allow the specific SNS topic to call sqs:SendMessage in the SQS queue resource policy, with appropriate source conditions.
- Give every consumer of the queue the ability to delete all SNS topics in the source account.
- Add a permissive EC2 security group rule to the SQS queue's private IP address.
Explanation
Correct Answer
B:The queue policy authorizes SNS as a sender to that queue. Restricting the source topic or account ensures a different SNS topic cannot use an overly broad send grant.
Incorrect Answers
A:An alarm can report a backlog but does not change the queue's permission policy. Delivery would continue to be denied.
C:Consumer delete rights do not authorize the SNS service to deliver messages to SQS and introduce unnecessary destructive privileges.
D:SQS is a managed regional service, not an EC2 ENI protected by the application's security group. Queue resource authorization governs SNS delivery.
Question 156
A vendor-supplied CloudFormation template creates an S3 bucket policy allowing Principal '*' to write any object. The workload actually needs writes only from one ingestion role. What should the architect require before deployment?
- Keep Principal '*' because S3 server-side encryption automatically authenticates every uploader.
- Disable CloudTrail so unauthorized writes are not counted as security events.
- Attach AdministratorAccess to the vendor's root user and remove every bucket-level policy check.
- Replace the wildcard Principal with the authorized role and restrict actions, resources, and relevant request conditions.
Explanation
Correct Answer
D:Resource policies should match the precise trusted AWS principal and operations. A scoped ingestion grant avoids turning a private data landing zone into an open write target.
Incorrect Answers
A:Encryption at rest does not identify or authorize a caller. An anonymous or overly broad write policy can still permit unwanted objects to be uploaded.
B:Audit logging does not determine bucket authorization; disabling it would obscure evidence while leaving the permissive policy in force.
C:A vendor's account permissions do not safely narrow a wildcard resource grant. This proposal increases privilege rather than scoping access to the designated role.
Question 157
A company keeps adding AWS account IDs to an S3 bucket policy whenever a new member account is launched. Only principals belonging to its AWS Organization should have access. Which condition reduces policy maintenance while preserving that boundary?
- Use a supported resource-policy condition checking aws:PrincipalOrgID for the intended organization, along with suitable principal/action restrictions.
- Grant AWSOrganizationsFullAccess to the bucket, expecting a management API permission to restrict resource readers.
- Enable S3 static website hosting, which automatically makes the bucket private to the AWS Organization.
- Use aws:SourceIp to allow all internet IP addresses because membership is automatically inferred from DNS.
Explanation
Correct Answer
A:The organization-principal condition can restrict supported resource access to callers belonging to the specified AWS Organization. It scales better than manually listing every changing account ID.
Incorrect Answers
B:An Organizations management policy does not implement the bucket-specific organization-membership condition. It would add unnecessary administration privileges.
C:Website hosting is a content-delivery feature and does not establish an organization-only IAM policy. It can introduce public-access concerns rather than enforce this requirement.
D:Source IP conditions test a network attribute, not AWS Organizations membership. Internet IP addresses do not establish the caller's organization identity.
Question 158
A private application must retrieve confidential reports from S3 only through the company's approved VPC endpoint. The bucket policy should reject reads that arrive by other supported request paths even if the principal has an identity-policy Allow. Which condition best expresses the restriction?
- Check only aws:UserAgent and treat every matching browser string as a trusted endpoint identity.
- Apply an appropriate S3 bucket-policy condition using aws:SourceVpce for the approved endpoint, accounting for AWS service exceptions.
- Use only an Allow for the s3:GetObject action in the instance role, without checking the network source.
- Set the S3 lifecycle transition to Glacier Instant Retrieval, which forces all reads through the endpoint.
Explanation
Correct Answer
B:For supported requests the SourceVpce key identifies the originating VPC endpoint. An explicit bucket policy restriction can deny reads that bypass the approved endpoint despite identity-side allows.
Incorrect Answers
A:User-Agent is client supplied and not proof of the AWS VPC endpoint used. It cannot replace the supported network-origin condition.
C:An identity Allow says which principal may read but does not enforce the required endpoint path. Requests from other locations could still satisfy the permission.
D:Storage class affects object economics and retrieval behavior, not which VPC endpoint originated a request. It cannot enforce network-path conditions.
Question 159
A global enterprise wants to deny an application's attempts to create certain regional resources outside approved AWS Regions. A reviewer proposes a simple aws:RequestedRegion rule applying uniformly to every service endpoint. What is the correct design consideration?
- Apply aws:RequestedRegion as an S3 object size limit because Region is a synonym for object storage class.
- Disable all IAM permissions when a service is global and assume the global resource will still work.
- Use region-aware IAM or SCP conditions where supported and explicitly account for global services and cross-Region request semantics.
- Create a VPC network ACL for the administrator's laptop to enforce the Region of every AWS management API.
Explanation
Correct Answer
C:RequestedRegion restricts the endpoint Region of applicable API requests, but services and global endpoints have exceptions. Effective guardrails must be validated against the services involved.
Incorrect Answers
A:The condition concerns request endpoint geography, not object bytes or storage tier. It would not express a regional resource governance rule.
B:Global AWS services may require carefully designed policy exemptions or other controls. Blanket denial can break essential operations without delivering a precise location restriction.
D:NACLs govern subnet network packets and cannot reliably express AWS API Region authorization for organization principals.
Question 160
A company writes an IAM condition requiring aws:MultiFactorAuthPresent to be true for sensitive administrative actions. Federated operators use assumed-role sessions, and some requests do not contain this condition key. Which evaluation practice is necessary?
- Remove the second factor from sign-in so the condition returns true more often.
- Use the EC2 metadata endpoint to supply an MFA flag for every human request made to STS.
- Assume all AWS API requests include MultiFactorAuthPresent=true whenever a human has logged into any identity provider.
- Test the actual session and request context, and design MFA conditions for the supported temporary-credential and federation patterns in use.
Explanation
Correct Answer
D:MultiFactorAuthPresent is context-sensitive and absent in some request patterns. An administrator must understand whether the key exists and which credential flow establishes MFA before relying on it as a universal test.
Incorrect Answers
A:Removing MFA weakens authentication and does not synthesize a missing IAM context key. The policy would remain inaccurate for the intended sessions.
B:EC2 instance metadata provides workload credentials and metadata, not a reliable MFA assertion for human federated sessions. The identity-provider integration and IAM policy context must align.
C:An external login's MFA state is not automatically conveyed as this IAM condition in every AWS session. Missing keys or a different context can change the evaluation.
