AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 17
Question 160
A company writes an IAM condition requiring aws:MultiFactorAuthPresent to be true for sensitive administrative actions. Federated operators use assumed-role sessions, and some requests do not contain this condition key. Which evaluation practice is necessary?
- Remove the second factor from sign-in so the condition returns true more often.
- Use the EC2 metadata endpoint to supply an MFA flag for every human request made to STS.
- Assume all AWS API requests include MultiFactorAuthPresent=true whenever a human has logged into any identity provider.
- Test the actual session and request context, and design MFA conditions for the supported temporary-credential and federation patterns in use.
Explanation
Correct Answer
D:MultiFactorAuthPresent is context-sensitive and absent in some request patterns. An administrator must understand whether the key exists and which credential flow establishes MFA before relying on it as a universal test.
Incorrect Answers
A:Removing MFA weakens authentication and does not synthesize a missing IAM context key. The policy would remain inaccurate for the intended sessions.
B:EC2 instance metadata provides workload credentials and metadata, not a reliable MFA assertion for human federated sessions. The identity-provider integration and IAM policy context must align.
C:An external login's MFA state is not automatically conveyed as this IAM condition in every AWS session. Missing keys or a different context can change the evaluation.
Question 161
A team uses attribute-based access control: a developer can access S3 resources whose project tag equals the developer's principal tag. A user discovers they can edit their own project tag to 'finance' and read finance data. Which control closes this privilege-escalation path?
- Restrict who may set or change identity/session tags and validate authorized tag values before granting ABAC access.
- Make every S3 bucket's project tag public so developers can choose which department's data they want.
- Turn on S3 Transfer Acceleration because it checks project tags on every request.
- Expand the matching condition to allow every project tag whenever the user has any employee role.
Explanation
Correct Answer
A:ABAC depends on the integrity of principal tags as well as resource tags. If a user can self-assign a privileged label, the resource-matching condition becomes a privilege-escalation route.
Incorrect Answers
B:Resource-tag visibility does not establish authority to claim a project identity. Unrestricted principal-tag changes remain exploitable regardless of bucket tags.
C:Transfer Acceleration optimizes supported object transfer paths, not the authorization of who may alter principal tags. The ABAC trust input remains unprotected.
D:A wildcard match removes project separation entirely. The requirement is to trust only appropriately assigned attributes.
Question 162
A company lets ordinary clients tag existing S3 objects through PutObjectTagging. The permitted Project tag values are Finance and Research, and users must not add an Admin tag or any other unapproved key. Which authorization design enforces these constraints on object-tagging requests?
- Use aws:RequestTag/Project and aws:TagKeys alone on PutObjectTagging because generic creation-time tag keys cover every S3 object-tagging request.
- Allow s3:PutObjectTagging for all objects without conditions, relying on tag validation when the bucket was first created.
- Restrict PutObjectTagging by aws:SourceIp alone, allowing any tag values when the request comes through the corporate NAT.
- Use s3:RequestObjectTag/Project to restrict project values and s3:RequestObjectTagKeys with appropriate all-values conditions to restrict every submitted tag key, while authorizing the required S3 tagging action.
Explanation
Correct Answer
D:For S3 PutObjectTagging, AWS documents s3:RequestObjectTag/Project to evaluate the submitted Project value and s3:RequestObjectTagKeys to constrain submitted keys. Using the correct set qualifier is essential so every key is checked; the caller still needs s3:PutObjectTagging authorization.
Incorrect Answers
A:The policy must use the condition context supported by S3 object-tagging operations. AWS documents the s3:RequestObjectTag and s3:RequestObjectTagKeys keys; substituting unrelated global creation-tag keys is not a reliable control for PutObjectTagging.
B:Bucket-creation-time validation cannot constrain later independent object-tagging operations. A client allowed to change object tags without restrictions can add an Admin label or change Project even after a valid initial upload.
C:Network-origin conditions do not validate the key/value set submitted in a request. A permitted client using the corporate NAT could still submit an Admin key or forbidden project without tag-aware S3 conditions.
Question 163
An ABAC policy uses a condition comparing a role's department tag with a database resource tag. One new environment fails authorization for every user, but the exact same roles work in production. The new resources were created without department tags. What should be fixed?
- Add the department tag to the IAM role but leave the new environment’s database resource untagged, because only principal tags matter in an ABAC equality test.
- Apply the required consistent tags to resources and confirm principal/session tags and their exact policy comparison values.
- Grant the new environment wildcard AdministratorAccess to bypass the missing tag design.
- Change the database storage engine to Redshift because it automatically supplies missing IAM principal tags.
Explanation
Correct Answer
B:Tag-based authorization depends on both sides of the comparison being present and matching. Untagged resources commonly fail an intended positive ABAC condition even when the caller's role exists.
Incorrect Answers
A:An ABAC condition comparing principal and resource department values requires the resource-side tag to exist and match. Updating the principal alone does not correct the missing database tag.
C:Broad permissions undermine separation and may still be constrained by explicit denies. Correcting the resource and principal attributes preserves ABAC intent.
D:Database engine choice does not cause an absent IAM resource tag to match a principal-tag condition. This is a policy-attribute issue.
Question 164
An IAM role has a permissions boundary whose Allow list includes s3:GetObject on one data bucket. The role has no identity-based policy allowing s3:GetObject, and the bucket policy does not separately grant this role access. An operator assumes the role and attempts to read an object. What is the expected result?
- The read succeeds because permissions boundaries act as standalone policies that grant every action in their Allow list.
- The read succeeds because assuming a role automatically adds a full set of S3 read permissions to the session.
- The read is not permitted; a permissions boundary can cap the effective permissions but does not independently grant an Allow for the request.
- The read succeeds if a network ACL permits HTTPS to S3 even though no identity or resource authorization grants the action.
Explanation
Correct Answer
C:The boundary may allow s3:GetObject within its maximum-permission set, but that is not a positive grant. With no applicable identity-based Allow or relevant resource-policy grant, the request receives an implicit Deny.
Incorrect Answers
A:A permissions boundary limits the maximum permissions allowed for a covered IAM principal. It does not provide the independent authorization necessary for the requested S3 read.
B:STS role assumption gives temporary credentials subject to the role’s effective policies, not general S3 permissions. A session without the needed grant cannot read the bucket just by authenticating.
D:Network ACLs control packet reachability, not whether an IAM principal is allowed to call GetObject. HTTPS routing cannot supply the missing IAM or resource-policy authorization.
Question 165
A platform group can create IAM roles under a required permission boundary. To escalate privileges, an engineer proposes deleting the boundary from a newly created role and attaching AdministratorAccess. What preventive restriction is needed?
- Deny unauthorized removal or replacement of required permission boundaries and enforce boundary requirements during role creation.
- Open all IAM APIs through an internet gateway and assume AWS filters boundary changes automatically.
- Allow anyone who can create a role to remove its boundary, because the boundary cannot affect newly created roles.
- Rely only on S3 default encryption to prevent modifications to IAM permission boundaries.
Explanation
Correct Answer
A:Boundary-based delegation works only if delegated principals cannot replace the ceiling with a broader one. IAM permissions must control boundary changes alongside role and policy creation.
Incorrect Answers
B:Internet routing is not a control over IAM authorization mutations. Explicit IAM restrictions must prevent unapproved boundary removal.
C:An attached boundary can cap a role's effective permissions. Letting its creator remove it defeats the intended delegation boundary.
D:Object encryption is unrelated to IAM role policy administration. It does not stop requests to update or delete a role's permissions boundary.
Question 166
An IAM policy review assumes that a role's permissions boundary always restricts every resource-policy grant identically, even where a resource policy names an assumed-role session principal directly. Which review approach is safest?
- Assume a boundary can never affect resource-policy access, so remove all explicit denies.
- Assume every role-session principal is exactly the same object as an IAM user for policy evaluation.
- Evaluate the exact principal named in the resource policy and apply IAM's role versus role-session boundary semantics instead of assuming universal intersection.
- Turn off CloudTrail data events to simplify permission-boundary calculations.
Explanation
Correct Answer
C:IAM evaluates some resource-based grants to role sessions differently from grants to the role ARN itself. The policy analyst must inspect the precise principal form and any explicit denies.
Incorrect Answers
A:Boundary and resource-policy interactions depend on principal type and grant context. Blanket removal of denies would weaken controls instead of evaluating them.
B:Assumed-role sessions have distinct principal semantics. Confusing them with IAM users can produce incorrect effective-permissions conclusions.
D:CloudTrail controls audit evidence and does not change IAM policy resolution. Removing it would conceal helpful diagnostics.
Question 167
A company gives an external MSP permission to assume a role in a production account. A proposed trust policy permits every AWS principal and relies on the role's S3 read-only policy to make it safe. Which change is required?
- Give the MSP root-user access and remove trust evaluation entirely.
- Restrict the role trust policy to the intended MSP principal and add suitable trust conditions before allowing AssumeRole.
- Put the trusted MSP VPC's CIDR range into an unrelated ALB listener rule.
- Leave Principal '*' in trust because the role's S3 permissions make role assumption private.
Explanation
Correct Answer
B:Trust determines who can obtain a session; a read-only role can still expose sensitive data if everyone can assume it. Restricting the allowed principal addresses entry to the delegated role.
Incorrect Answers
A:Root credential sharing abandons least-privilege delegation and extends far beyond read-only service requirements. It does not provide scoped MSP sessions.
C:An ALB listener rule filters application requests through that load balancer, not the AWS STS principal authorized in a role trust policy.
D:Resource permissions control what an assumed session can do, not who is allowed to assume it. Wildcard trust needlessly broadens the caller population.
Question 168
An AWS service invokes a role on behalf of a resource from another customer account. The policy must prevent that service from using its legitimate service identity to reach an unrelated customer's resource. Which trust-policy conditions are appropriate when the service supports them?
- Set s3:PutObjectAcl to public-read for the role, because public ACLs prevent confused deputy abuse.
- Trust the entire AWS service principal without source constraints whenever it is a managed service.
- Use a VPC security group source reference to prove which customer initiated the STS role assumption.
- Constrain the service trust with the expected aws:SourceArn and aws:SourceAccount values for the authorized resource.
Explanation
Correct Answer
D:SourceArn and SourceAccount can tie a service principal's action to a designated source resource or owner. This narrows the confused-deputy exposure beyond trusting the shared AWS service principal alone.
Incorrect Answers
A:Public-read ACLs expose objects and do not bind a service's IAM role assumption to the intended source account or resource.
B:The managed service's identity can be shared across many customers. Without available source-context restrictions, the role may accept unintended cross-customer service requests.
C:Security group references constrain VPC traffic and cannot substitute for AWS source ARN/account trust context in a service-to-service IAM request.
Question 169
A financial firm runs an on-premises transaction-validation daemon that must read a small, authorized set of objects in Amazon S3. The daemon already receives short-lived X.509 client certificates from the firm’s certificate authority. The security team prohibits persistent AWS access keys on the servers and wants to reuse scoped IAM role permissions. Which identity architecture best fits?
- Configure IAM Roles Anywhere with a trust anchor for the approved CA, a profile authorizing the scoped role and a role trust policy for the Roles Anywhere service; let the daemon obtain temporary credentials using its certificate.
- Create an IAM Identity Center workforce permission set and enter the daemon as a human user in the corporate employee directory, then store its access-portal login on the server.
- Attach an EC2 instance profile role directly to the on-premises bare-metal server, without providing AWS-managed instance identity or an applicable hybrid credential mechanism.
- Issue an IAM user access key with an expiration label and rotate the key manually at the end of every month, retaining it in the daemon configuration.
Explanation
Correct Answer
A:IAM Roles Anywhere authenticates workloads outside AWS using an X.509 certificate issued by a CA registered as a trust anchor. Its profile and an IAM role with the service trust grant temporary credentials restricted by that role, avoiding static IAM user keys.
Incorrect Answers
B:IAM Identity Center permission sets govern workforce access and account assignments. Treating an unattended server as a human workforce login introduces the wrong identity model and does not use its existing PKI workload credentials.
C:An EC2 instance profile supplies credentials to a supported EC2 instance through its instance metadata role path. An on-premises daemon cannot simply attach an instance profile as if it were an EC2 instance.
D:Rotated IAM user access keys are still long-term credentials stored on the host between rotations. Rotation does not satisfy the requirement to eliminate persistent AWS keys and reuse ephemeral role sessions.
Question 170
A developer writes a role trust policy allowing the Lambda service to assume the role, then assumes this also grants the function permission to decrypt a KMS key and write to DynamoDB. What else must the architecture define?
- Enable an ALB health-check endpoint and expect health status to authorize database writes.
- Add the required KMS and DynamoDB operations to the execution role permissions, with matching key/resource authorization.
- Create a new root access key for the Lambda function as a substitute for execution-role policies.
- No further permissions are needed because trusting a service implies AdministratorAccess to all supported AWS APIs.
Explanation
Correct Answer
B:Trust grants the Lambda service entry to the role, but not implicit permissions for every downstream API. Role policies and resource/key policies govern what the resulting session can do.
Incorrect Answers
A:ALB health checks measure target readiness; they do not assign the function's IAM authority to call DynamoDB or KMS.
C:Embedding root credentials violates least privilege and avoids the correct permission model. The execution role should be scoped to required APIs.
D:A role trust relationship grants the right to assume a role, not the downstream actions available. A function can be invoked successfully and still receive AccessDenied on data APIs.
