Amazon AWS SAA-C03 Cross-Account Access, Resource Policies, Organizations, SCPs, and Control Tower Practice Test 2

 

Topic 02 Practice Test 2 covers Cross-Account Access, Resource Policies, Organizations, SCPs, and Control Tower for AWS SAA-C03. For broader exam preparation, review the AWS SAA-C03 Exam Dumps. Every option includes focused technical reasoning explaining both the AWS architecture concept and its fit to the scenario.

Question 1

A role in Account B trusts Account A, but an engineer in Account A receives AccessDenied when calling sts:AssumeRole. The trust policy correctly names Account A. What permission is most likely missing?

1. A security group rule for TCP 443
2. An identity policy in Account A allowing sts:AssumeRole on the role
3. An S3 lifecycle rule
4. A tag policy in Organizations

Correct Answer(s)

 

B

Rationale

1. A security group rule for TCP 443 is stateful network filtering for trust policy. The scenario requires trust policy correct, so this alternative is insufficient. An identity policy in Account A allowing sts:AssumeRole on the role addresses caller receives AccessDenied within this identity policy scenario. By comparison, A security group rule for TCP 443 leaves cross-account role unresolved.
2. An identity policy in Account A allowing sts:AssumeRole on the role is principal-side permission authorization for trust policy, matching trust policy correct. It supports add caller-side sts AssumeRole permission when the destination role trust already permits the source account. With caller receives AccessDenied also required, An identity policy in Account A allowing sts:AssumeRole on the role is the appropriate STS control.
3. An S3 lifecycle rule is object-storage access control for trust policy. The scenario requires caller receives AccessDenied, so this alternative is insufficient. An identity policy in Account A allowing sts:AssumeRole on the role addresses cross-account role within this identity policy scenario. By comparison, An S3 lifecycle rule leaves trust policy correct unresolved.
4. A tag policy in Organizations is organization-wide tag standards for trust policy. The scenario requires cross-account role, so this alternative is insufficient. An identity policy in Account A allowing sts:AssumeRole on the role addresses trust policy correct within this identity policy scenario. By comparison, A tag policy in Organizations leaves caller receives AccessDenied unresolved.

 

Question 2

A role in Account B is listed in an S3 bucket policy in Account A, yet GetObject requests are denied. The bucket policy is valid and there is no explicit deny. Which cross-account check should be performed next?

1. Attach an SCP that grants s3:GetObject
2. Add an internet gateway to Account B
3. Enable S3 Transfer Acceleration
4. Verify the role’s identity policy also allows s3:GetObject on the bucket objects

Correct Answer(s)

 

D

Rationale

1. Attach an SCP that grants s3:GetObject is organization-wide permission ceilings for cross-account evaluation. The scenario requires bucket policy already grants principal, so this alternative is insufficient. Verify the role’s identity policy also allows s3:GetObject on the bucket objects addresses no explicit deny within this identity policy scenario. By comparison, Attach an SCP that grants s3:GetObject leaves GetObject denied unresolved.
2. Add an internet gateway to Account B is public VPC internet routing for cross-account evaluation. The scenario requires no explicit deny, so this alternative is insufficient. Verify the role’s identity policy also allows s3:GetObject on the bucket objects addresses GetObject denied within this identity policy scenario. By comparison, Add an internet gateway to Account B leaves bucket policy already grants principal unresolved.
3. Enable S3 Transfer Acceleration is object-storage access control for cross-account evaluation. The scenario requires GetObject denied, so this alternative is insufficient. Verify the role’s identity policy also allows s3:GetObject on the bucket objects addresses bucket policy already grants principal within this identity policy scenario. By comparison, Enable S3 Transfer Acceleration leaves no explicit deny unresolved.
4. Verify the role’s identity policy also allows s3:GetObject on the bucket objects is principal-side permission authorization for cross-account evaluation, matching bucket policy already grants principal. It supports verify caller-side S3 permission as the second half of a cross-account resource-policy authorization. With no explicit deny also required, Verify the role’s identity policy also allows s3:GetObject on the bucket objects is the appropriate S3 control.

 

Question 3

A cross-account application has s3:GetObject permission and can read unencrypted objects, but it fails on objects encrypted with a KMS key in another account. Which policy layer should be checked first for the encryption failure?

1. The KMS key policy and external role KMS permissions
2. The Organizations tag policy
3. The Route 53 hosted zone policy
4. The subnet network ACL

Correct Answer(s)

 

A

Rationale

1. The KMS key policy and external role KMS permissions is KMS key-use authorization for S3, matching S3 access works. It supports troubleshoot encrypted cross-account object reads by validating both KMS key-policy trust and external-role KMS permission. With KMS-encrypted objects fail also required, The KMS key policy and external role KMS permissions is the appropriate KMS control.
2. The Organizations tag policy is organization-wide tag standards for S3. The scenario requires S3 access works, so this alternative is insufficient. The KMS key policy and external role KMS permissions addresses KMS-encrypted objects fail within this cross-account scenario. By comparison, The Organizations tag policy leaves key owned by another account unresolved.
3. The Route 53 hosted zone policy is DNS zone configuration for S3. The scenario requires KMS-encrypted objects fail, so this alternative is insufficient. The KMS key policy and external role KMS permissions addresses key owned by another account within this cross-account scenario. By comparison, The Route 53 hosted zone policy leaves S3 access works unresolved.
4. The subnet network ACL is stateless subnet filtering for S3. The scenario requires key owned by another account, so this alternative is insufficient. The KMS key policy and external role KMS permissions addresses S3 access works within this cross-account scenario. By comparison, The subnet network ACL leaves KMS-encrypted objects fail unresolved.

 

Question 4

An administrator shares a supported resource with another account in the same AWS Organization after enabling AWS RAM sharing with Organizations. The recipient never receives an invitation. What should the administrator conclude?

1. No invitation is expected for in-organization sharing when integration is enabled
2. The resource share always failed
3. The recipient must create an IAM user first
4. The management account must disable all features

Correct Answer(s)

 

A

Rationale

1. No invitation is expected for in-organization sharing when integration is enabled is in-organization RAM invitation behavior for Organizations, matching same organization. It supports treat automatic access without invitations as expected for AWS RAM shares inside an enabled organization. With RAM Organizations sharing enabled also required, No invitation is expected for in-organization sharing when integration is enabled is the appropriate AWS RAM control.
2. The resource share always failed is managed cross-account resource sharing for Organizations. The scenario requires same organization, so this alternative is insufficient. No invitation is expected for in-organization sharing when integration is enabled addresses RAM Organizations sharing enabled within this invitations scenario. By comparison, The resource share always failed leaves no invitation unresolved.
3. The recipient must create an IAM user first is long-lived account credentials for Organizations. The scenario requires RAM Organizations sharing enabled, so this alternative is insufficient. No invitation is expected for in-organization sharing when integration is enabled addresses no invitation within this invitations scenario. By comparison, The recipient must create an IAM user first leaves same organization unresolved.
4. The management account must disable all features is full Organizations governance capabilities for Organizations. The scenario requires no invitation, so this alternative is insufficient. No invitation is expected for in-organization sharing when integration is enabled addresses same organization within this invitations scenario. By comparison, The management account must disable all features leaves RAM Organizations sharing enabled unresolved.

 

Question 5

A resource owner shares a supported AWS RAM resource with an account outside the AWS Organization. The external account can see a pending resource share but cannot use the resource. What must happen?

1. The owner must create a VPC peering connection
2. The owner must attach FullAWSAccess SCP
3. The external account must accept the resource-share invitation
4. The external account must join the owner’s organization

Correct Answer(s)

 

C

Rationale

1. The owner must create a VPC peering connection is private VPC-to-VPC connectivity for external account. The scenario requires outside organization, so this alternative is insufficient. The external account must accept the resource-share invitation addresses pending RAM share within this invitation scenario. By comparison, The owner must create a VPC peering connection leaves resource unavailable unresolved.
2. The owner must attach FullAWSAccess SCP is organization-wide permission ceilings for external account. The scenario requires pending RAM share, so this alternative is insufficient. The external account must accept the resource-share invitation addresses resource unavailable within this invitation scenario. By comparison, The owner must attach FullAWSAccess SCP leaves outside organization unresolved.
3. The external account must accept the resource-share invitation is RAM invitation behavior for external account, matching outside organization. It supports require invitation acceptance before an external account can consume an AWS RAM resource share. With pending RAM share also required, The external account must accept the resource-share invitation is the appropriate AWS RAM control.
4. The external account must join the owner’s organization is organization membership for external account. The scenario requires resource unavailable, so this alternative is insufficient. The external account must accept the resource-share invitation addresses outside organization within this invitation scenario. By comparison, The external account must join the owner’s organization leaves pending RAM share unresolved.

 

Question 6

A member account role has AdministratorAccess, but ec2:RunInstances is denied after the organization changed from a deny-list SCP model to an allow-list model. The attached SCP set never allows EC2. What is the cause?

1. CloudTrail must be disabled first
2. The role trust policy controls EC2 API authorization
3. AdministratorAccess overrides all SCPs
4. The effective SCP boundary does not permit ec2:RunInstances

Correct Answer(s)

 

D

Rationale

1. CloudTrail must be disabled first is AWS API activity auditing for allow list. The scenario requires allow-list SCP model, so this alternative is insufficient. The effective SCP boundary does not permit ec2:RunInstances addresses AdministratorAccess present within this effective permissions scenario. By comparison, CloudTrail must be disabled first leaves EC2 omitted unresolved.
2. The role trust policy controls EC2 API authorization is trusted temporary identity delegation for allow list. The scenario requires AdministratorAccess present, so this alternative is insufficient. The effective SCP boundary does not permit ec2:RunInstances addresses EC2 omitted within this effective permissions scenario. By comparison, The role trust policy controls EC2 API authorization leaves allow-list SCP model unresolved.
3. AdministratorAccess overrides all SCPs is organization-wide permission ceilings for allow list. The scenario requires EC2 omitted, so this alternative is insufficient. The effective SCP boundary does not permit ec2:RunInstances addresses allow-list SCP model within this effective permissions scenario. By comparison, AdministratorAccess overrides all SCPs leaves AdministratorAccess present unresolved.
4. The effective SCP boundary does not permit ec2:RunInstances is organization-wide permission ceilings for allow list, matching allow-list SCP model. It supports diagnose an allow-list SCP boundary that omits EC2 even though the member role has AdministratorAccess. With AdministratorAccess present also required, The effective SCP boundary does not permit ec2:RunInstances is the appropriate SCP control.

 

Question 7

A team tests a restrictive SCP by attaching it to the AWS Organizations management account and sees no change to administrator permissions. What is the correct remediation?

1. Increase the SCP policy size quota
2. Test the SCP on a member account or test OU instead
3. Add the management account to AWS RAM
4. Replace the SCP with a security group

Correct Answer(s)

 

B

Rationale

1. Increase the SCP policy size quota is organization-wide permission ceilings for management account. The scenario requires management account test, so this alternative is insufficient. Test the SCP on a member account or test OU instead addresses no permission change within this testing scenario. By comparison, Increase the SCP policy size quota leaves needs safe validation unresolved.
2. Test the SCP on a member account or test OU instead is organization-wide permission ceilings for management account, matching management account test. It supports validate SCP behavior on member accounts because management-account identities are outside SCP enforcement. With no permission change also required, Test the SCP on a member account or test OU instead is the appropriate SCP control.
3. Add the management account to AWS RAM is organization hierarchy administration for management account. The scenario requires no permission change, so this alternative is insufficient. Test the SCP on a member account or test OU instead addresses needs safe validation within this testing scenario. By comparison, Add the management account to AWS RAM leaves management account test unresolved.
4. Replace the SCP with a security group is organization-wide permission ceilings for management account. The scenario requires needs safe validation, so this alternative is insufficient. Test the SCP on a member account or test OU instead addresses management account test within this testing scenario. By comparison, Replace the SCP with a security group leaves no permission change unresolved.

 

Question 8

A security engineer believes an SCP should stop an AWS service-linked role from making a prohibited call in a member account, but the call continues. Which interpretation is correct?

1. SCPs require CloudTrail to be enabled
2. The SCP is ignored only during business hours
3. Service-linked roles are not restricted by SCPs
4. Service-linked roles are controlled by tag policies

Correct Answer(s)

 

C

Rationale

1. SCPs require CloudTrail to be enabled is organization-wide permission ceilings for service-linked roles. The scenario requires member account, so this alternative is insufficient. Service-linked roles are not restricted by SCPs addresses service-linked role within this troubleshooting scenario. By comparison, SCPs require CloudTrail to be enabled leaves SCP expected to block unresolved.
2. The SCP is ignored only during business hours is organization-wide permission ceilings for service-linked roles. The scenario requires service-linked role, so this alternative is insufficient. Service-linked roles are not restricted by SCPs addresses SCP expected to block within this troubleshooting scenario. By comparison, The SCP is ignored only during business hours leaves member account unresolved.
3. Service-linked roles are not restricted by SCPs is organization-wide permission ceilings for service-linked roles, matching member account. It supports explain continued service-linked-role activity by the documented SCP exemption for those roles. With service-linked role also required, Service-linked roles are not restricted by SCPs is the appropriate SCP control.
4. Service-linked roles are controlled by tag policies is AWS-service operational permissions for service-linked roles. The scenario requires SCP expected to block, so this alternative is insufficient. Service-linked roles are not restricted by SCPs addresses member account within this troubleshooting scenario. By comparison, Service-linked roles are controlled by tag policies leaves service-linked role unresolved.

 

Question 9

Security must prevent ordinary principals in member accounts from leaving the organization without approval. Which centralized control is most direct?

1. AWS RAM resource share
2. SCP denying organizations:LeaveOrganization
3. S3 Object Lock
4. Tag policy requiring an Owner tag

Correct Answer(s)

 

B

Rationale

1. AWS RAM resource share is managed cross-account resource sharing for LeaveOrganization. The scenario requires member accounts, so this alternative is insufficient. SCP denying organizations:LeaveOrganization addresses prevent departure within this governance scenario. By comparison, AWS RAM resource share leaves central guardrail unresolved.
2. SCP denying organizations:LeaveOrganization is organization-wide permission ceilings for LeaveOrganization, matching member accounts. It supports deny organizations LeaveOrganization with an SCP for governed member-account principals. With prevent departure also required, SCP denying organizations:LeaveOrganization is the appropriate SCP control.
3. S3 Object Lock is object-storage access control for LeaveOrganization. The scenario requires prevent departure, so this alternative is insufficient. SCP denying organizations:LeaveOrganization addresses central guardrail within this governance scenario. By comparison, S3 Object Lock leaves member accounts unresolved.
4. Tag policy requiring an Owner tag is organization-wide tag standards for LeaveOrganization. The scenario requires central guardrail, so this alternative is insufficient. SCP denying organizations:LeaveOrganization addresses member accounts within this governance scenario. By comparison, Tag policy requiring an Owner tag leaves prevent departure unresolved.

 

Question 10

A data bucket should be accessible only by roles whose accounts remain under the Production OU tree, including nested OUs. The bucket owner wants the policy to follow OU membership changes automatically. Which condition key is most specific?

1. aws:SecureTransport
2. aws:SourceIp only
3. aws:PrincipalOrgPaths
4. aws:CurrentTime

Correct Answer(s)

 

C

Rationale

1. aws:SecureTransport is TLS-use policy filtering for resource policy. The scenario requires nested OU tree, so this alternative is insufficient. aws:PrincipalOrgPaths addresses resource policy within this OU scenario. By comparison, aws:SecureTransport leaves membership changes unresolved.
2. aws:SourceIp only is source-IP context filtering for resource policy. The scenario requires resource policy, so this alternative is insufficient. aws:PrincipalOrgPaths addresses membership changes within this OU scenario. By comparison, aws:SourceIp only leaves nested OU tree unresolved.
3. aws:PrincipalOrgPaths is organizational-path policy filtering for resource policy, matching nested OU tree. It supports scope a resource policy to the Production OU hierarchy by evaluating aws PrincipalOrgPaths. With resource policy also required, aws:PrincipalOrgPaths is the appropriate PrincipalOrgPaths control.
4. aws:CurrentTime is time-based policy filtering for resource policy. The scenario requires membership changes, so this alternative is insufficient. aws:PrincipalOrgPaths addresses nested OU tree within this OU scenario. By comparison, aws:CurrentTime leaves resource policy unresolved.

 

Question 11

A company wants a single CloudTrail trail that records supported activity across all current and future accounts in the organization and delivers centrally managed logs. Which architecture is intended for this?

1. Use AWS RAM to share CloudTrail events
2. Create an individual trail manually in every account only
3. Use an SCP as the log destination
4. Create an organization trail

Correct Answer(s)

 

D

Rationale

1. Use AWS RAM to share CloudTrail events is managed cross-account resource sharing for organization trail. The scenario requires all organization accounts, so this alternative is insufficient. Create an organization trail addresses future accounts included within this central logging scenario. By comparison, Use AWS RAM to share CloudTrail events leaves central logging unresolved.
2. Create an individual trail manually in every account only is account-by-account audit logging for organization trail. The scenario requires future accounts included, so this alternative is insufficient. Create an organization trail addresses central logging within this central logging scenario. By comparison, Create an individual trail manually in every account only leaves all organization accounts unresolved.
3. Use an SCP as the log destination is organization-wide permission ceilings for organization trail. The scenario requires central logging, so this alternative is insufficient. Create an organization trail addresses all organization accounts within this central logging scenario. By comparison, Use an SCP as the log destination leaves future accounts included unresolved.
4. Create an organization trail is organization-wide audit logging for organization trail, matching all organization accounts. It supports use a CloudTrail organization trail for centrally governed multi-account activity logging. With future accounts included also required, Create an organization trail is the appropriate CloudTrail control.

 

Question 12

A compliance account must query AWS Config data aggregated from many organization accounts without manually authorizing each source account. Which approach best supports this?

1. Attach a tag policy to the compliance account
2. Create a NAT gateway in each account
3. Share an S3 bucket with AWS RAM only
4. Use an organization-enabled AWS Config aggregator

Correct Answer(s)

 

D

Rationale

1. Attach a tag policy to the compliance account is organization-wide tag standards for aggregator. The scenario requires many member accounts, so this alternative is insufficient. Use an organization-enabled AWS Config aggregator addresses central compliance queries within this Organizations scenario. By comparison, Attach a tag policy to the compliance account leaves avoid per-account authorization unresolved.
2. Create a NAT gateway in each account is managed private-subnet internet egress for aggregator. The scenario requires central compliance queries, so this alternative is insufficient. Use an organization-enabled AWS Config aggregator addresses avoid per-account authorization within this Organizations scenario. By comparison, Create a NAT gateway in each account leaves many member accounts unresolved.
3. Share an S3 bucket with AWS RAM only is managed cross-account resource sharing for aggregator. The scenario requires avoid per-account authorization, so this alternative is insufficient. Use an organization-enabled AWS Config aggregator addresses many member accounts within this Organizations scenario. By comparison, Share an S3 bucket with AWS RAM only leaves central compliance queries unresolved.
4. Use an organization-enabled AWS Config aggregator is organization-scale Config administration for aggregator, matching many member accounts. It supports aggregate AWS Config compliance data across organization accounts through Organizations-integrated authorization. With central compliance queries also required, Use an organization-enabled AWS Config aggregator is the appropriate AWS Config control.

 

Question 13

An existing OU was registered with AWS Control Tower, but administrators later created a new nested OU outside the Control Tower console. They want the nested OU brought under governed management. What should they do?

1. Delete the parent OU
2. Register or govern the nested OU through AWS Control Tower
3. Convert the nested OU into a resource share
4. Grant the nested OU AdministratorAccess

Correct Answer(s)

 

B

Rationale

1. Delete the parent OU is organizational-unit hierarchy behavior for OU registration. The scenario requires nested OU exists, so this alternative is insufficient. Register or govern the nested OU through AWS Control Tower addresses outside Control Tower workflow within this governance scenario. By comparison, Delete the parent OU leaves needs governance unresolved.
2. Register or govern the nested OU through AWS Control Tower is Control Tower OU enrollment for OU registration, matching nested OU exists. It supports bring a newly created organizational unit under Control Tower management by registering or governing that OU. With outside Control Tower workflow also required, Register or govern the nested OU through AWS Control Tower is the appropriate Control Tower control.
3. Convert the nested OU into a resource share is organizational-unit hierarchy behavior for OU registration. The scenario requires outside Control Tower workflow, so this alternative is insufficient. Register or govern the nested OU through AWS Control Tower addresses needs governance within this governance scenario. By comparison, Convert the nested OU into a resource share leaves nested OU exists unresolved.
4. Grant the nested OU AdministratorAccess is organizational-unit hierarchy behavior for OU registration. The scenario requires needs governance, so this alternative is insufficient. Register or govern the nested OU through AWS Control Tower addresses nested OU exists within this governance scenario. By comparison, Grant the nested OU AdministratorAccess leaves outside Control Tower workflow unresolved.

 

Question 14

A company must block use of disallowed AWS Regions across governed OUs as part of its landing-zone controls. Which Control Tower capability directly addresses this requirement?

1. Region Deny preventive control
2. AWS RAM invitation
3. Detective control for S3 versioning
4. Account Factory enrollment form

Correct Answer(s)

 

A

Rationale

1. Region Deny preventive control is policy-based operation prevention for Region Deny, matching landing zone. It supports apply the Control Tower Region Deny preventive control to restrict disallowed regions for governed OUs. With disallowed Regions also required, Region Deny preventive control is the appropriate Control Tower control.
2. AWS RAM invitation is managed cross-account resource sharing for Region Deny. The scenario requires landing zone, so this alternative is insufficient. Region Deny preventive control addresses disallowed Regions within this preventive scenario. By comparison, AWS RAM invitation leaves preventive enforcement unresolved.
3. Detective control for S3 versioning is postdeployment compliance detection for Region Deny. The scenario requires disallowed Regions, so this alternative is insufficient. Region Deny preventive control addresses preventive enforcement within this preventive scenario. By comparison, Detective control for S3 versioning leaves landing zone unresolved.
4. Account Factory enrollment form is governed AWS account provisioning for Region Deny. The scenario requires preventive enforcement, so this alternative is insufficient. Region Deny preventive control addresses landing zone within this preventive scenario. By comparison, Account Factory enrollment form leaves disallowed Regions unresolved.

 

Question 15

A preventive Control Tower control is enabled on a parent OU that has nested child OUs. Administrators ask whether accounts in those child OUs inherit the preventive restriction. What is the correct expectation?

1. Only the management account inherits it
2. Inheritance occurs only after an AWS RAM invitation
3. Preventive controls never inherit
4. The preventive control is enforced through the nested OU hierarchy

Correct Answer(s)

 

D

Rationale

1. Only the management account inherits it is organization hierarchy administration for nested OUs. The scenario requires parent OU control, so this alternative is insufficient. The preventive control is enforced through the nested OU hierarchy addresses nested child OUs within this inheritance scenario. By comparison, Only the management account inherits it leaves preventive control unresolved.
2. Inheritance occurs only after an AWS RAM invitation is managed cross-account resource sharing for nested OUs. The scenario requires nested child OUs, so this alternative is insufficient. The preventive control is enforced through the nested OU hierarchy addresses preventive control within this inheritance scenario. By comparison, Inheritance occurs only after an AWS RAM invitation leaves parent OU control unresolved.
3. Preventive controls never inherit is policy-based operation prevention for nested OUs. The scenario requires preventive control, so this alternative is insufficient. The preventive control is enforced through the nested OU hierarchy addresses parent OU control within this inheritance scenario. By comparison, Preventive controls never inherit leaves nested child OUs unresolved.
4. The preventive control is enforced through the nested OU hierarchy is policy-based operation prevention for nested OUs, matching parent OU control. It supports expect preventive Control Tower controls to propagate through nested organizational-unit inheritance. With nested child OUs also required, The preventive control is enforced through the nested OU hierarchy is the appropriate Control Tower control.

 

Question 16

A member account is configured as delegated administrator for an AWS security service. Its admin role is still denied an API action by an SCP attached above the account. Why does delegation not bypass the restriction?

1. Delegated administrators are service-linked roles
2. Delegated administrator member accounts are still subject to SCPs
3. Delegation removes the account from the organization
4. The SCP controls only billing

Correct Answer(s)

 

B

Rationale

1. Delegated administrators are service-linked roles is member-account service administration for delegated administrator. The scenario requires delegated administrator, so this alternative is insufficient. Delegated administrator member accounts are still subject to SCPs addresses member account within this Organizations scenario. By comparison, Delegated administrators are service-linked roles leaves SCP deny unresolved.
2. Delegated administrator member accounts are still subject to SCPs is organization-wide permission ceilings for delegated administrator, matching delegated administrator. It supports apply normal SCP limits to a delegated-administrator account because delegation does not exempt member identities. With member account also required, Delegated administrator member accounts are still subject to SCPs is the appropriate SCP control.
3. Delegation removes the account from the organization is organization hierarchy reassignment for delegated administrator. The scenario requires member account, so this alternative is insufficient. Delegated administrator member accounts are still subject to SCPs addresses SCP deny within this Organizations scenario. By comparison, Delegation removes the account from the organization leaves delegated administrator unresolved.
4. The SCP controls only billing is organization-wide permission ceilings for delegated administrator. The scenario requires SCP deny, so this alternative is insufficient. Delegated administrator member accounts are still subject to SCPs addresses delegated administrator within this Organizations scenario. By comparison, The SCP controls only billing leaves member account unresolved.

 

Question 17

A bucket policy currently uses Principal ‘*’ for a service workflow, but security wants to ensure only identities from the company’s AWS Organization can match that broad principal. Which additional condition is appropriate?

1. Require aws:PrincipalOrgID to equal the organization ID
2. Require s3:x-amz-storage-class to be STANDARD
3. Require aws:RequestedRegion to be us-east-1
4. Require aws:EpochTime to be greater than zero

Correct Answer(s)

 

A

Rationale

1. Require aws:PrincipalOrgID to equal the organization ID is organization-membership policy filtering for resource policy, matching Principal wildcard. It supports constrain a broad resource-policy principal to organization members with an aws PrincipalOrgID condition. With organization-only access also required, Require aws:PrincipalOrgID to equal the organization ID is the appropriate PrincipalOrgID control.
2. Require s3:x-amz-storage-class to be STANDARD is object-storage access control for resource policy. The scenario requires Principal wildcard, so this alternative is insufficient. Require aws:PrincipalOrgID to equal the organization ID addresses organization-only access within this organization perimeter scenario. By comparison, Require s3:x-amz-storage-class to be STANDARD leaves resource policy unresolved.
3. Require aws:RequestedRegion to be us-east-1 is region-request context filtering for resource policy. The scenario requires organization-only access, so this alternative is insufficient. Require aws:PrincipalOrgID to equal the organization ID addresses resource policy within this organization perimeter scenario. By comparison, Require aws:RequestedRegion to be us-east-1 leaves Principal wildcard unresolved.
4. Require aws:EpochTime to be greater than zero is time-based policy filtering for resource policy. The scenario requires resource policy, so this alternative is insufficient. Require aws:PrincipalOrgID to equal the organization ID addresses Principal wildcard within this organization perimeter scenario. By comparison, Require aws:EpochTime to be greater than zero leaves organization-only access unresolved.

 

Question 18

A vendor-operated automation assumes a customer role. The trust policy correctly names the vendor account, but the customer wants each tenant relationship uniquely bound so one tenant identifier cannot be reused for another. Which control should be added?

1. A tag policy on the vendor account
2. A CloudWatch metric filter only
3. A unique ExternalId condition in the trust policy
4. An SCP that allows all STS actions

Correct Answer(s)

 

C

Rationale

1. A tag policy on the vendor account is organization-wide tag standards for third party. The scenario requires multi-tenant vendor, so this alternative is insufficient. A unique ExternalId condition in the trust policy addresses same vendor account within this trust policy scenario. By comparison, A tag policy on the vendor account leaves tenant-specific trust unresolved.
2. A CloudWatch metric filter only is log-derived metric generation for third party. The scenario requires same vendor account, so this alternative is insufficient. A unique ExternalId condition in the trust policy addresses tenant-specific trust within this trust policy scenario. By comparison, A CloudWatch metric filter only leaves multi-tenant vendor unresolved.
3. A unique ExternalId condition in the trust policy is third-party role context binding for third party, matching multi-tenant vendor. It supports bind each vendor-customer role relationship to a distinct ExternalId value in the role trust conditions. With same vendor account also required, A unique ExternalId condition in the trust policy is the appropriate ExternalId control.
4. An SCP that allows all STS actions is organization-wide permission ceilings for third party. The scenario requires tenant-specific trust, so this alternative is insufficient. A unique ExternalId condition in the trust policy addresses multi-tenant vendor within this trust policy scenario. By comparison, An SCP that allows all STS actions leaves same vendor account unresolved.

 

Question 19

IAM Access Analyzer reports that a role in the production account can be assumed by an AWS account outside the company’s organization. The role was intended only for internal automation. Which configuration should be reviewed first?

1. The role trust policy’s principals and conditions
2. The role’s security group
3. The VPC route table
4. The organization’s consolidated billing settings

Correct Answer(s)

 

A

Rationale

1. The role trust policy’s principals and conditions is trusted temporary identity delegation for role trust, matching external-account finding. It supports remediate an external Access Analyzer role finding by tightening the IAM role trust policy. With role intended internal also required, The role trust policy’s principals and conditions is the appropriate IAM Access Analyzer control.
2. The role’s security group is stateful network filtering for role trust. The scenario requires external-account finding, so this alternative is insufficient. The role trust policy’s principals and conditions addresses role intended internal within this external finding scenario. By comparison, The role’s security group leaves Access Analyzer unresolved.
3. The VPC route table is VPC network path selection for role trust. The scenario requires role intended internal, so this alternative is insufficient. The role trust policy’s principals and conditions addresses Access Analyzer within this external finding scenario. By comparison, The VPC route table leaves external-account finding unresolved.
4. The organization’s consolidated billing settings is organization billing aggregation for role trust. The scenario requires Access Analyzer, so this alternative is insufficient. The role trust policy’s principals and conditions addresses external-account finding within this external finding scenario. By comparison, The organization’s consolidated billing settings leaves role intended internal unresolved.

 

Question 20

A service does not support a resource-based policy for the object that a workload in another account must administer. The company still needs controlled temporary cross-account access. Which general IAM pattern should it choose?

1. Create an AWS RAM share for every unsupported resource
2. Use an S3 bucket ACL regardless of service
3. Assume a cross-account IAM role in the resource account
4. Use a tag policy to grant the API

Correct Answer(s)

 

C

Rationale

1. Create an AWS RAM share for every unsupported resource is managed cross-account resource sharing for resource policies. The scenario requires service lacks resource policy, so this alternative is insufficient. Assume a cross-account IAM role in the resource account addresses temporary administration within this cross-account scenario. By comparison, Create an AWS RAM share for every unsupported resource leaves cross-account unresolved.
2. Use an S3 bucket ACL regardless of service is object-storage access control for resource policies. The scenario requires temporary administration, so this alternative is insufficient. Assume a cross-account IAM role in the resource account addresses cross-account within this cross-account scenario. By comparison, Use an S3 bucket ACL regardless of service leaves service lacks resource policy unresolved.
3. Assume a cross-account IAM role in the resource account is trusted temporary identity delegation for resource policies, matching service lacks resource policy. It supports use a cross-account role as the access proxy when the target service lacks a suitable resource-based policy. With temporary administration also required, Assume a cross-account IAM role in the resource account is the appropriate IAM role control.
4. Use a tag policy to grant the API is organization-wide tag standards for resource policies. The scenario requires cross-account, so this alternative is insufficient. Assume a cross-account IAM role in the resource account addresses service lacks resource policy within this cross-account scenario. By comparison, Use a tag policy to grant the API leaves temporary administration unresolved.

• < Amazon AWS SAA-C03 Cross-Account Access, Resource Policies, Organizations, SCPs, and Control Tower Practice Test 1
• Amazon AWS SAA-C03 Cross-Account Access, Resource Policies, Organizations, SCPs, and Control Tower Practice Test 3 >