SAA-C03 Questions 11-20: IAM and Access Control

Designing secure architectures is the largest domain on the AWS Certified Solutions Architect – Associate (SAA-C03) exam, worth 30% of scored content. This set focuses on identity and access: giving applications and people the right permissions, controlling many accounts at once, and keeping S3 data from being exposed.

This is the second set in our SAA-C03 series (Questions 11-20). If you are new to the series, start with SAA-C03 Questions 1-10 on EC2 and Auto Scaling. Every question is an original practice scenario mapped to the official exam guide, not a copy of a real exam item.

Pick your answer before you reveal it. Security questions often have two answers that would work; the exam wants the one that is most secure with the least operational effort.

Question 11: Giving an EC2 Application Access to S3

An application on Amazon EC2 needs to read and write objects in one S3 bucket. A developer plans to create an IAM user, generate access keys, and store them in a configuration file on the instance. What is the most secure approach?

A) Store the access keys in environment variables instead of a file

B) Use the AWS account root user’s access keys, because they never expire

C) Attach an IAM role with a least-privilege policy to the instance through an instance profile

D) Make the bucket public so no credentials are needed

👁 Reveal Answer

Correct Answer: C

Explanation: An IAM role attached to an EC2 instance through an instance profile gives applications temporary credentials that AWS rotates automatically, and the AWS SDKs pick them up without any keys stored on the instance. A least-privilege policy limits the role to that one bucket. A still uses long-term keys, just in a different place. B is the worst choice: root credentials have unrestricted access and should not be used for applications. D exposes the data to everyone.

Reference: Use an IAM role to grant permissions to applications running on Amazon EC2 instances

Question 12: An Allow and a Deny for the Same Action

A user’s identity-based policy allows s3:DeleteObject on a bucket. The bucket policy explicitly denies s3:DeleteObject to everyone except a backup role. The user is not the backup role. What happens when the user tries to delete an object?

A) The request is denied, because an explicit deny in any applicable policy overrides any allow

B) The request is allowed, because identity-based policies take priority over resource-based policies

C) The request is allowed, because the bucket owner and the user are in the same account

D) The result is random, depending on which policy is evaluated first

👁 Reveal Answer

Correct Answer: A

Explanation: In AWS policy evaluation, all requests start as implicitly denied. An explicit allow can override that default, but an explicit deny in any applicable policy always wins, no matter where it appears or what allows exist. Explicit denies are therefore a reliable way to protect critical actions. B and C describe priorities that do not exist. D is wrong because policy evaluation is deterministic.

Reference: IAM policy evaluation logic

Question 13: Letting an Auditor Read Another Account

A company keeps production and security tooling in separate AWS accounts. Auditors who sign in to the security account need read-only access to resources in the production account. The company does not want to create IAM users in the production account. What should it do?

A) Share the production account’s root password with the auditors

B) Copy the production resources into the security account every night

C) Make the production resources public for the duration of the audit

D) Create a read-only IAM role in the production account that trusts the security account, and let auditors assume it

👁 Reveal Answer

Correct Answer: D

Explanation: Cross-account access is done with an IAM role. The role in the production account has a trust policy that allows principals from the security account to assume it, and a permissions policy that grants read-only access. Auditors switch to the role and receive temporary credentials, so no IAM users or long-term keys are needed in production. A breaks every security best practice. B is costly and creates stale copies. C exposes data to the internet.

Reference: IAM tutorial: Delegate access across AWS accounts using IAM roles

Question 14: Sign-Up and Sign-In for a Mobile App

A startup is building a mobile app. Customers must be able to create an account with email and password or sign in with Google, and the team does not want to build or run its own user database. Which service fits?

A) IAM users, one for each customer

B) An Amazon Cognito user pool

C) AWS IAM Identity Center

D) AWS Directory Service for Microsoft Active Directory

👁 Reveal Answer

Correct Answer: B

Explanation: A Cognito user pool is a managed user directory for app users. It handles sign-up and sign-in, password policies, MFA, and federation with social identity providers such as Google. If the app also needs to call AWS services directly, a Cognito identity pool can exchange the user’s token for temporary AWS credentials. A is meant for people and workloads that manage AWS, not millions of app customers, and has account limits. C is for workforce access to AWS accounts and business apps. D runs Microsoft Active Directory for enterprise users.

Reference: Amazon Cognito user pools

Question 15: No Bucket Should Ever Become Public

After an incident in which a developer made a bucket public by mistake, a company wants to make sure that no bucket or object in the account can be made public through ACLs or bucket policies, including buckets created in the future. What should it enable?

A) S3 Block Public Access at the account level

B) S3 Versioning on every bucket

C) Server-side encryption with AWS KMS keys

D) S3 Transfer Acceleration

👁 Reveal Answer

Correct Answer: A

Explanation: S3 Block Public Access provides settings that override bucket policies and ACLs to prevent public access. Turning it on at the account level applies to all current and future buckets in the account, so a developer cannot accidentally grant public access with an ACL or bucket policy. New buckets also have it on by default. B keeps old versions of objects but does not control access. C protects data at rest but does not stop public read access. D speeds up transfers.

Reference: Amazon S3 Block Public Access

Question 16: Refusing Unencrypted Requests to S3

A compliance rule says that all requests to a bucket holding medical records must use HTTPS. Requests over plain HTTP must be rejected. How can this be enforced?

A) Enable default encryption with SSE-S3 on the bucket

B) Turn on S3 Object Lock

C) Add a bucket policy that denies all S3 actions when the condition aws:SecureTransport is false

D) Put the bucket in a private subnet

👁 Reveal Answer

Correct Answer: C

Explanation: The aws:SecureTransport condition key shows whether a request was sent over TLS. A bucket policy statement that denies access when it is false rejects every HTTP request, which enforces encryption in transit. A encrypts data at rest, not in transit. B prevents objects from being deleted or overwritten. D is not possible, because S3 buckets are not placed in VPC subnets.

Reference: Protecting data in transit with encryption (Amazon S3)

Question 17: Database Passwords That Change Themselves

An application connects to an Amazon RDS for MySQL database with a password stored in its code. Security now requires that the password be stored securely and rotated every 30 days without downtime or code changes after the initial update. What should the team use?

A) A plaintext parameter in AWS Systems Manager Parameter Store, updated by hand each month

B) An encrypted file in an S3 bucket

C) An environment variable on each server

D) AWS Secrets Manager with automatic rotation turned on for the database secret, with the application retrieving the secret at runtime

👁 Reveal Answer

Correct Answer: D

Explanation: Secrets Manager stores credentials encrypted and supports managed automatic rotation for Amazon RDS database secrets on a schedule you choose. The application reads the current secret at runtime, so rotation does not require redeploying code. A relies on manual work and stores the value in plaintext. B and C still need someone to change the password and update every copy, and they do not rotate anything.

Reference: Set up automatic rotation for Amazon RDS database secrets

Question 18: Guardrails for Every Account in the Organization

A company uses AWS Organizations with 60 member accounts. It must make sure that no one in any member account, including administrators, can disable AWS CloudTrail or use AWS Regions outside the EU. What should it use?

A) An IAM policy attached to each administrator in each account

B) Service control policies (SCPs) attached to the organization root or organizational units

C) An S3 bucket policy on the CloudTrail bucket

D) Amazon GuardDuty in every Region

👁 Reveal Answer

Correct Answer: B

Explanation: SCPs set the maximum permissions available to IAM users and roles in member accounts, including account administrators. They do not grant permissions themselves; they act as guardrails. Denying CloudTrail changes and actions outside approved Regions in an SCP applies across all affected accounts at once. Note that SCPs do not affect the organization’s management account. A has to be managed in 60 accounts and can be removed by the administrators it is meant to restrict. C protects log files, not the CloudTrail configuration. D detects threats but does not prevent actions.

Reference: Service control policies (SCPs)

Question 19: One Sign-In for Employees Across Many Accounts

A company’s 400 employees sign in to Microsoft Entra ID. They need access to several AWS accounts with different permission levels, and the company wants a single place to assign that access without creating IAM users in each account. Which service fits?

A) Amazon Cognito identity pools

B) IAM users with the same password in every account

C) AWS IAM Identity Center connected to Microsoft Entra ID as the identity source, with permission sets assigned to accounts

D) AWS Key Management Service

👁 Reveal Answer

Correct Answer: C

Explanation: IAM Identity Center is the recommended way to manage workforce access to multiple AWS accounts and applications. It can use an external identity provider such as Microsoft Entra ID, and administrators assign permission sets to users and groups for each account, so people sign in once and pick the account and role they need. A gives app users AWS credentials, not workforce access. B multiplies long-term credentials and management effort. D manages encryption keys.

Reference: What is IAM Identity Center?

Question 20: Blocking One Abusive IP Address

A web application runs on EC2 instances in a public subnet. An IP address is sending malicious traffic, and the team wants to block it at the subnet level. Security groups already allow HTTPS from anywhere. What should the team use, and why?

A) A network ACL deny rule, because network ACLs support explicit deny rules and apply to the whole subnet

B) A security group deny rule, because security groups evaluate deny rules first

C) An IAM policy that denies the IP address

D) A Route 53 health check

👁 Reveal Answer

Correct Answer: A

Explanation: Network ACLs operate at the subnet level, are stateless, and support both allow and deny rules, evaluated in number order, so a deny rule for one IP address blocks it for every instance in the subnet. Security groups operate at the instance (network interface) level, are stateful, and support only allow rules, so B describes something security groups cannot do. C controls calls to AWS APIs, not network traffic to an application. D monitors endpoint health. For web traffic, AWS WAF IP set rules are another option.

Reference: AWS SAA-C03 exam guide, Task 1.2 (security groups and network ACLs); Amazon VPC User Guide

Study Tips for Identity and Access on SAA-C03

• Roles over keys. EC2, Lambda, and cross-account access should use roles with temporary credentials, never stored access keys.
• Explicit deny always wins. Know the evaluation order: implicit deny, then explicit allow, and any explicit deny overrides everything.
• Customers vs employees. App customers use Cognito. Employees across accounts use IAM Identity Center.
• Guardrails at scale. SCPs limit what member accounts can do but never grant permissions.
• S3 protection layers. Block Public Access stops exposure, aws:SecureTransport enforces HTTPS, and encryption protects data at rest.

Keep Practicing for SAA-C03

Review compute in SAA-C03 Questions 1-10, then continue to Questions 21-30 on data protection and network security. The official SAA-C03 exam guide lists every task in scope.