AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 20
Question 190
A multi-tenant API assumes an IAM role with caller-provided session tags. Its developers allow sts:TagSession for every label and an attacker tags their session as department=security. Which permission change prevents this identity spoofing?
- Use an S3 lifecycle policy to remove objects whose names contain the word security.
- Restrict who may pass session tags and which keys and values are accepted in the role's trust and caller permissions.
- Keep arbitrary session tagging because temporary credentials cannot influence IAM authorization.
- Increase the Lambda function timeout so IAM checks can inspect all supplied tags for longer.
Explanation
Correct Answer
B:STS session tags become principal attributes for IAM policy evaluation. Allowing arbitrary privileged labels can bypass ABAC, so tag-passing permission and conditions must be controlled.
Incorrect Answers
A:Object age rules do not validate STS principal attributes and risk destroying data without addressing session-tag spoofing.
C:Session tags can be evaluated by ABAC policies and therefore do influence effective permissions. Unrestricted values create a real escalation path.
D:Function duration does not determine trust policy conditions or allowable STS session tags. Authorization must reject disallowed attributes.
Question 191
A role in one AWS account passes a project tag when assuming a second role. The destination role's ABAC condition depends on the tag, but it is absent after role chaining despite appearing in the first session. What should the architect verify?
- Assume session tags are always inherited by every subsequent role with no tagging or trust rules.
- Enable S3 Cross-Region Replication because it copies IAM session tags to every assumed role.
- Confirm supported transitive session-tag configuration and propagation through the chained role assumption.
- Rotate the destination role name daily because role names control whether session tags propagate.
Explanation
Correct Answer
C:STS role chaining does not imply all source session tags become transitive automatically. Correct tag key propagation and trust policies are needed for the downstream ABAC comparison.
Incorrect Answers
A:Tags have explicit transitive behavior and applicable authorization. A downstream session may lack a tag unless its propagation is configured.
B:Object replication moves S3 data and metadata, not STS role-session attributes. It cannot repair chained-role ABAC tags.
D:Renaming roles does not establish transitive tag keys. The failure concerns session attributes and role-assumption conditions.
Question 192
An administrator is investigating an ABAC Deny. Two roles appear to have the correct department tag in their IAM definitions, but one role's assumed session lacks that tag and the target resource uses a differently capitalized value. What evidence should be compared?
- Enable a CloudFront distribution in front of the API to make IAM tag comparisons case-insensitive.
- Add public S3 read rights so tag comparisons are no longer necessary for any protected dataset.
- Assume role names override all tag conditions and rename the denied role to Administrator.
- Inspect effective session and principal tags alongside the resource tags and the exact IAM condition operators and values.
Explanation
Correct Answer
D:ABAC comparisons depend on the attributes visible in the current request, not only those expected in the role definition. Missing or mismatched session/resource values can cause a denial.
Incorrect Answers
A:CloudFront is a content-delivery service; it does not change IAM condition-key evaluation semantics for AWS API authorization.
B:Public access abandons the organization's attribute-based isolation policy and may expose sensitive resources to unintended principals.
C:An arbitrary role name does not satisfy a PrincipalTag or ResourceTag condition. The actual context attribute must be corrected.
Question 193
A software vendor reuses an identical least-privilege access policy across thirty IAM roles. Developers currently paste the same inline policy text into every role, causing inconsistent updates. Which IAM policy form simplifies controlled reuse?
- Attach a centrally maintained customer-managed IAM policy to the eligible roles and manage changes through its policy versions.
- Set all thirty roles to AdministratorAccess to eliminate drift from policy differences.
- Create one inline role policy and attach that same inline-policy object to thirty roles.
- Attach an identical IAM permissions boundary to all thirty roles and remove their reusable identity grants, treating the boundary as the authorization policy.
Explanation
Correct Answer
A:Customer-managed policies are reusable across principals and support managed versions. Updating an approved policy can synchronize permissions without separately editing repeated inline documents.
Incorrect Answers
B:Overbroad privileges eliminate the agreed least-privilege controls and make drift less visible. A managed scoped policy addresses reuse without escalation.
C:An inline policy is embedded in one principal and is not a standalone managed object shared across IAM roles. It does not solve policy duplication.
D:A permissions boundary establishes the maximum operations a role could receive but grants none by itself. It cannot replace a reusable customer-managed identity policy granting the intended actions to all eligible roles.
Question 194
A one-off emergency diagnostic IAM role must carry a tightly scoped exception that should disappear if the role is deleted. Security does not want the exception reused on unrelated principals. Which policy form is a reasonable fit?
- Use one customer-managed policy and attach it by default to every administrator role in the organization.
- Make the S3 bucket publicly writable so any investigator can perform the exceptional action.
- Add a public ALB listener rule because application routing inherits IAM role permissions.
- Attach an inline IAM policy directly to that role so the policy lifecycle is tied to the principal.
Explanation
Correct Answer
D:Inline policies are embedded in one IAM identity and are deleted with that identity. They can fit a strict one-to-one permission relationship, provided the exception itself is controlled.
Incorrect Answers
A:A broadly reused managed policy expands a one-off exception beyond its intended principal. Reuse is not the objective of this temporary diagnostic grant.
B:Public write access does not constrain privileges to the named emergency role and may allow unauthorized modification of data.
C:ALB listeners route network requests and cannot establish the role-specific IAM API permission the exception requires.
Question 195
An engineer tries to add an AWS Lambda function directly to an IAM group so it inherits a group's S3 permissions. The console does not allow this. Which identity-model correction is required?
- Put the function's ARN in an S3 bucket ACL and expect the ACL to grant the function all AWS API permissions.
- Use an IAM role as the Lambda execution identity; IAM groups organize IAM users and are not assumable workload principals.
- Attach the group to a VPC security group because both constructs share the same name and permission rules.
- Create a new IAM group containing only the lambda.amazonaws.com service principal and attach it to the function.
Explanation
Correct Answer
B:IAM groups simplify permissions for collections of users, whereas Lambda assumes an execution role through its service trust. The function must receive permissions on that role.
Incorrect Answers
A:S3 ACLs do not provide a general workload identity or Lambda execution-role credentials. They cannot replace IAM trust and identity policies.
C:IAM groups and VPC security groups have unrelated functions. Network filtering does not authorize the Lambda runtime to call AWS APIs.
D:Service principals are not IAM user-group members. Lambda requires a trust relationship with an execution role instead.
Question 196
A company manages dozens of AWS accounts with IAM Identity Center. The central identity instance was enabled in the AWS Organizations management account, but the security team wants its identity administrators to perform routine member-account assignments from a separate security member account. The management account should remain protected for organization-level reserved tasks. Which design uses the supported administrative boundary?
- Migrate the IAM Identity Center instance into the security member account and delete the management account instance so all administrative operations become member-owned.
- Add every help-desk employee to the management-account root user credential rotation schedule to centralize IAM Identity Center changes.
- Register the security member account as the IAM Identity Center delegated administrator from the management account, and retain management-only actions in the management account.
- Attach an AWS Organizations SCP Allow to the security account and assume it alone grants the ability to create accounts and configure Identity Center anywhere.
Explanation
Correct Answer
C:A management-account administrator can register one member account as delegated administrator. Authorized administrators there can perform most IAM Identity Center tasks, while actions such as registering another delegate and managing management-account access remain restricted.
Incorrect Answers
A:IAM Identity Center remains hosted in the Organizations management account; delegated administration does not move its instance or enable a separate replacement instance for the organization. Relocating the instance is not the supported delegation mechanism.
B:Sharing or expanding use of root credentials worsens attribution and privilege risk, and is not a supported way to delegate routine IAM Identity Center administration to a member account.
D:SCPs define applicable maximum permissions, not actual grants of service administration. They neither register a delegated Identity Center administrator nor override the management-account-only actions.
Question 197
An ECS service fails to use a service-managed resource after an engineer replaces the AWS-created service-linked IAM role with a generic administrator role. What is the correct role model for supported service operations?
- Give the ECS application task role root credentials so it can stand in for all AWS service-linked roles.
- Permit the AWS service to use its documented service-linked role with the expected service trust and permissions.
- Make all ECS task subnets public so managed services no longer need IAM service-linked identities.
- Use one customer-owned S3 bucket policy to grant every AWS service operation across the account.
Explanation
Correct Answer
B:Service-linked roles are predefined for specific AWS services and grant capabilities needed by supported managed operations. Substituting an arbitrary application role can break required service integration.
Incorrect Answers
A:Task credentials authorize application calls, not every infrastructure action performed by AWS services. Root secrets introduce needless risk.
C:Subnet routing and IAM role assumption are distinct. Public IP connectivity does not replace required service-linked roles.
D:S3 policies only govern S3 resources and cannot replace service-specific role trust and permissions for managed AWS actions.
Question 198
A member account belongs to an AWS Organizations OU with an SCP denying a particular administrative API. A human administrator in that account is denied as expected, but an AWS-managed service can still perform the API using its own service-linked role. The reviewer asks whether the SCP is broken. What should the architect explain?
- SCPs do not restrict AWS service-linked roles; inspect the owning service integration and any supported service-level or declarative controls rather than assuming the role is an ordinary member-account principal.
- Every service-linked role is automatically exempt from IAM authorization as well as SCP evaluation, so its permissions and service trust can never be constrained.
- An SCP applies only after the service-linked role is renamed to a customer-defined IAM role with a matching role path.
- The SCP will prevent service-linked-role operations once its statements are copied into a resource tag, even if no other service configuration changes.
Explanation
Correct Answer
A:AWS Organizations explicitly exempts permissions attached to service-linked roles from SCP restrictions. The service-specific role and supported configuration controls must be evaluated separately from ordinary user/role SCP ceilings.
Incorrect Answers
B:Service-linked roles still have defined AWS IAM trust and permissions. SCP exemption is not the absence of IAM authorization or unrestricted access to all AWS APIs.
C:Changing the role name is neither the documented service-linked role model nor a method to make an SCP govern service-linked-role activity.
D:Tags are not substitutes for SCP enforcement, and copying policy text to a resource tag does not alter AWS Organizations evaluation for service-linked roles.
Question 199
A service-linked role cannot be deleted because AWS reports that managed resources still depend on it. An administrator plans to force deletion first and clean up later. What is the correct operational sequence?
- Increase the EC2 instance size in the account so AWS automatically lifts IAM deletion blockers.
- Delete the role's trust policy first and leave dependent service resources running without service permissions.
- Identify and remove or migrate the dependent service resources through supported APIs, then retry service-linked role deletion.
- Open the account's S3 buckets publicly so the service can continue without the linked role.
Explanation
Correct Answer
C:AWS services may block deletion while linked resources require the role. The role should be retired only after its owning service no longer needs it to manage those resources.
Incorrect Answers
A:Compute capacity does not determine whether a service has active dependent resources using the linked IAM role.
B:Breaking trust can disrupt managed operations and may still fail the service-linked-role deletion constraints. Dependencies should be resolved through service procedures.
D:Public bucket access does not replace an AWS service's required role capabilities and introduces unrelated data exposure.
Question 200
A multi-account administrator delegates routine application deployments to developers. The developers should not be able to create new service-linked roles for arbitrary AWS integrations. Which restriction best fits least privilege?
- Grant iam:CreateServiceLinkedRole on all resources to every developer because AWS manages the resulting role.
- Deny all developers s3:PutObject but leave IAM service-linked-role creation unrestricted.
- Place a blanket iam:CreateServiceLinkedRole Deny in each developer identity policy, including for the services that the company explicitly authorizes developers to deploy.
- Constrain iam:CreateServiceLinkedRole permissions to approved service names using supported IAM conditions and resource scoping.
Explanation
Correct Answer
D:Creation of service-linked roles can enable additional managed AWS capabilities. Restricting permitted services reduces unexpected privileged integrations while supporting approved deployments.
Incorrect Answers
A:AWS-managed role definition does not make unrestricted service integration authorization appropriate. Unbounded creation can violate service governance.
B:S3 object write permissions do not govern the IAM API that creates service-linked roles. The requested guardrail must target that capability.
C:A blanket Deny prevents unauthorized integrations but also blocks the approved ones. Service-aware IAM condition and resource restrictions enforce the intended allowlist without banning legitimate deployments.
