AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 18
Question 170
A developer writes a role trust policy allowing the Lambda service to assume the role, then assumes this also grants the function permission to decrypt a KMS key and write to DynamoDB. What else must the architecture define?
- Enable an ALB health-check endpoint and expect health status to authorize database writes.
- Add the required KMS and DynamoDB operations to the execution role permissions, with matching key/resource authorization.
- Create a new root access key for the Lambda function as a substitute for execution-role policies.
- No further permissions are needed because trusting a service implies AdministratorAccess to all supported AWS APIs.
Explanation
Correct Answer
B:Trust grants the Lambda service entry to the role, but not implicit permissions for every downstream API. Role policies and resource/key policies govern what the resulting session can do.
Incorrect Answers
A:ALB health checks measure target readiness; they do not assign the function's IAM authority to call DynamoDB or KMS.
C:Embedding root credentials violates least privilege and avoids the correct permission model. The execution role should be scoped to required APIs.
D:A role trust relationship grants the right to assume a role, not the downstream actions available. A function can be invoked successfully and still receive AccessDenied on data APIs.
Question 171
A company recently acquired ten subsidiaries, bringing its AWS user population to 4,000. Security engineers currently maintain one Identity Center account assignment per employee, and employee transfers trigger thousands of manual edits. Which administration pattern scales best?
- Grant every employee AdministratorAccess because it avoids multiple permission-set changes.
- Create a unique permission set for every employee and duplicate it across every AWS account.
- Assign account-specific permission sets to managed workforce groups and maintain each worker's group memberships.
- Share one IAM user access key across the entire engineering department so group changes no longer matter.
Explanation
Correct Answer
C:Group-based Identity Center assignments centralize role entitlement by job function. Changing a worker's group membership can update their effective account access without individually revising many permission-set assignments.
Incorrect Answers
A:Broad administration permissions erase separation of duties. The requirement is to scale appropriate assignment management, not replace it with unchecked privilege.
B:Per-person permission sets and assignments multiply administrative work as the organization grows and make consistent least privilege harder to enforce.
D:A shared key prevents identity-level audit and revocation and is not a supported substitute for Identity Center group administration.
Question 172
A finance department needs permission to examine AWS billing, while help-desk staff need only to reset selected support-related resources. Both teams sign in through IAM Identity Center. Which authorization structure minimizes accidental cross-department power?
- Give both departments the same AdministratorAccess permission set to avoid denied actions.
- Assign the finance users a VPC security group and use that group as the policy for billing API calls.
- Require the help desk to use the billing account's root password whenever a support action is needed.
- Create separate finance and help-desk permission sets with only the necessary actions, assigning each to the correct employee groups.
Explanation
Correct Answer
D:Permission sets define reusable account permission policies for workforce sessions. Separating business functions reduces the consequences of mistakes or compromised users while preserving centrally administered access.
Incorrect Answers
A:AdministratorAccess exposes unrelated IAM, finance, and infrastructure actions to each department. It does not satisfy separation of duties.
B:A security group filters network packets to VPC resources. It does not authorize account billing actions or identity-center sessions.
C:Shared root access is more privileged and less accountable than the scoped support permission set. Root is not the correct workforce entitlement pattern.
Question 173
An organization manages IAM Identity Center permission sets using the SSO Admin API. An engineer uses PutInlinePolicyToPermissionSet to add an authorized read action to a permission set already assigned in 20 member accounts. The new inline policy appears in the permission-set definition, but users still encounter the old permissions in the account roles. No SCP or resource-policy deny applies. Which operation completes this programmatic update?
- Create new IAM users in each account and attach the updated policy directly to those users.
- Add users to additional Identity Center groups without updating the already provisioned permission set in any account.
- Call ProvisionPermissionSet for the relevant provisioned accounts, monitor provisioning status, and verify the refreshed account roles.
- Manually edit the AWSReservedSSO IAM roles in each member account instead of using the IAM Identity Center provisioning APIs.
Explanation
Correct Answer
C:The SSO Admin API explicitly requires ProvisionPermissionSet after PutInlinePolicyToPermissionSet for a permission set with account assignments. Target the assigned accounts or ALL_PROVISIONED_ACCOUNTS, wait for successful provisioning, then verify access.
Incorrect Answers
A:IAM users would introduce independent credentials and unmanaged policies, not propagate the updated Identity Center permission set that is already assigned to the workforce.
B:Group assignments determine who receives permission sets; the stale IAM policies in already provisioned account roles are not fixed merely by adding more group memberships.
D:Identity Center controls its generated AWSReservedSSO roles. Manual role-policy edits are not the supported way to deploy a changed permission set and risk inconsistent or subsequently overwritten access.
Question 174
A telemetry agent installed on an EC2 instance cannot call CloudWatch. An engineer notes that staff can log in to the AWS console with IAM Identity Center and assumes the instance should inherit those employee sessions. What is the proper correction?
- Give the instance an IAM role through its instance profile with the required CloudWatch permissions, independent of human portal access.
- Assign an IAM Identity Center permission set to the operator’s workforce group and assume the EC2 application inherits the operator’s session credentials.
- Make an employee sign in to the AWS access portal once per day from a browser on the instance.
- Add a VPC interface endpoint for CloudWatch APIs but leave the instance without an appropriate IAM workload role.
Explanation
Correct Answer
A:Identity Center provides workforce sessions, whereas EC2 processes use workload identities such as instance-profile roles. The agent must receive its own short-lived API credentials and scoped authorization.
Incorrect Answers
B:Human Identity Center sessions are not transparently issued to instance software. EC2 workloads use an instance profile and task-appropriate IAM role policies regardless of staff console assignments.
C:A human browser session is not a reliable noninteractive credential source for an EC2 agent and creates unnecessary operational coupling.
D:A private endpoint can improve network reachability to supported APIs but does not grant the permissions to call them. The telemetry agent still needs temporary role credentials and permitted CloudWatch actions.
Question 175
A code reviewer finds a proposed IAM policy permitting s3:* on all resources even though a batch role only needs s3:GetObject in two buckets. The team wants a preventative check before the policy is attached. Which AWS capability is most appropriate?
- Enable EC2 detailed monitoring and assume CPU metrics will identify every broad IAM grant.
- Use IAM Access Analyzer policy validation findings to detect overly permissive or problematic policy statements and revise the policy.
- Add the role to an IAM group and assume group membership automatically removes wildcard permissions.
- Accept the wildcard s3:* policy if IAM Access Analyzer reports no external S3 bucket sharing, without validating the identity policy’s action and resource scope.
Explanation
Correct Answer
B:Access Analyzer policy validation checks IAM policy constructs against security and correctness guidance before rollout. It helps identify risky permissions while the application design still permits targeted correction.
Incorrect Answers
A:EC2 CPU metrics cannot validate IAM policy syntax or breadth. The review requires an identity authorization analysis.
C:IAM groups contain users rather than roles, and moving a principal into a group would not make a wildcard policy least privileged.
D:External-access findings and policy validation address different risks. A policy can be unnecessarily broad for its role even when the referenced buckets are not publicly or externally shared.
Question 176
An application role has accumulated dozens of permissions over five years. Engineers suspect some service actions are unused, but the business must not be interrupted by arbitrary policy removal. What evidence should guide a permissions refinement?
- Add a new internet gateway so the AWS service can identify which actions the role used.
- Assume that any policy named ReadOnlyAccess is least privileged without inspecting its statements.
- Delete all permissions that have not been used in the last hour and block all scheduled business operations.
- Use IAM access activity and Access Analyzer least-privilege insights, then validate proposed removals against observed usage and required workflows.
Explanation
Correct Answer
D:Service and action usage evidence can identify potentially unnecessary grants for review. It supports evidence-driven policy narrowing while still requiring owners to consider rare but legitimate operations.
Incorrect Answers
A:Internet gateways are routing components, not IAM usage analyzers. They provide no policy-usage evidence for narrowing permissions.
B:Policy names describe intended purpose, not the actual resource/action scope or use history. A role may still have unnecessary grants from other policies.
C:Short observation windows miss monthly and disaster-recovery actions. Blind removal can interrupt legitimate workflows rather than achieve safe least privilege.
Question 177
An S3 Access Analyzer finding reports that a sensitive bucket is shared externally. A team proposes marking every such finding as archived without checking the bucket policy. What should the architect require?
- Archive every finding so the system automatically deletes the corresponding S3 bucket policy.
- Investigate the actual principal and bucket policy, remove unintended external access, and archive only intentionally accepted findings with justification.
- Remove S3 server-side encryption because encrypted objects cannot be externally shared.
- Increase the bucket's lifecycle expiration period to make the Access Analyzer finding disappear.
Explanation
Correct Answer
B:An analyzer finding identifies a potential external-access exposure; changing the underlying authorization closes it. Archival changes finding management but does not revoke permission.
Incorrect Answers
A:Archiving is not remediation and does not change the evaluated bucket policy. A dangerous external grant could persist.
C:At-rest encryption and authorization are separate controls. Disabling encryption increases data risk without fixing the bucket's principal grant.
D:Object retention affects data lifetime, not which principals can access it. The underlying resource policy must be examined.
Question 178
A media company wants to investigate who downloaded individual files from a sensitive S3 bucket. Its existing CloudTrail trail collects management events but provides no object-level GetObject record. Which change is required?
- Use a Route 53 resolver query log as the sole source of object-level S3 read authorization.
- Increase the management-event retention period and assume GetObject calls are included by default.
- Enable the appropriate CloudTrail S3 object-level data events for the relevant bucket or prefixes and deliver them to protected audit storage.
- Turn on S3 Transfer Acceleration, which logs the IAM principal for every object read into a new CloudTrail event type.
Explanation
Correct Answer
C:CloudTrail data events capture supported object API activity separately from ordinary management events. Selecting the right S3 resources allows object-access attribution without relying on console sign-in history.
Incorrect Answers
A:DNS query logs show name resolution behavior, not the signed AWS principal making each GetObject request. They cannot provide object API audit evidence.
B:Retention does not change event categories. Object API activity requires data-event collection rather than a longer management-event history.
D:Transfer Acceleration affects S3 transfer routing, not whether the trail captures S3 data events. It cannot replace the data-event selection.
Question 179
An incident response team investigates access to a resource in account B by a role assumed from account A. A CloudTrail event in B names an assumed-role ARN but the team needs the upstream caller. What correlation will help?
- Correlate the assumed-role session ARN, session name or source identity with related STS AssumeRole and CloudTrail identity context across the accounts.
- Infer the caller exclusively from the target-account role name, which cannot be assumed by more than one principal.
- Use only the sourceIPAddress value from the target-account event as the unique identity of the human who assumed the role.
- Use the EC2 instance's network interface ID as proof that the account owner initiated the STS request.
Explanation
Correct Answer
A:Role-session identifiers and STS assumption records can connect target-account API calls to the source principal that obtained the session. Proper logs and source identity improve cross-account attribution.
Incorrect Answers
B:A role may trust multiple allowed principals, so its name alone is insufficient for individual attribution. The particular session matters.
C:A source IP is not a unique human principal and may be shared by NAT, proxies or multiple sessions. STS role-assumption and session attribution records identify the upstream caller more reliably.
D:An ENI identifies a network resource, not necessarily the identity that assumed a role. Identity audit records are needed for attribution.
Question 180
A central CloudTrail log bucket is writable by application teams, and those same teams can delete audit objects that describe their own privileged changes. What hardening best protects the forensic record?
- Turn off CloudTrail event delivery during high-change periods to reduce storage bills.
- Enable CloudTrail log-file integrity validation but continue allowing application teams unrestricted deletion of log objects from the central bucket.
- Grant every application administrator s3:DeleteObject on the audit bucket for convenient housekeeping.
- Restrict log bucket modification and deletion, enable suitable log integrity validation and retention controls, and separate audit administrators from workload owners.
Explanation
Correct Answer
D:Protected centralized storage and CloudTrail integrity mechanisms reduce opportunities to erase or alter relevant evidence. Access to the audit destination must be independently controlled.
Incorrect Answers
A:Stopping delivery creates gaps exactly when privileged changes occur. It undermines incident reconstruction and audit completeness.
B:Digest validation can help detect manipulation, but it does not stop the same administrators from deleting the evidentiary log objects. Access separation and protected retention are also needed.
C:This would allow potentially compromised workloads to destroy the evidence of their own actions. Audit retention must be protected from the actors it monitors.
