AWS Solutions Architect Associate - SAA-C03

About the SAA-C03 certification

Exam code

SAA-C03

Official exam guideDomain weightings come from the vendor and change over time. Check the official guide before you book.

1. 1.A company manages 40 AWS accounts with AWS Organizations. The security team must guarantee that no member account can disable AWS CloudTrail logging, even if an account administrator holds full administrative IAM permissions in that account. Which solution meets this requirement?

   • AAttach a service control policy (SCP) to the organizational units that denies the CloudTrail actions that stop or delete trails.Correct answer
   • BAttach an IAM policy that denies the CloudTrail stop and delete actions to every IAM user in each member account.
   • CApply a permissions boundary that denies the CloudTrail stop and delete actions to the administrator role in each member account.
   • DCreate an AWS Config rule in each member account that checks whether CloudTrail is enabled.

   Why

   A service control policy (SCP) applied to the organizational unit sets the maximum available permissions for every principal in the member accounts, including account administrators. Denying cloudtrail:StopLogging and cloudtrail:DeleteTrail in an SCP makes the action impossible regardless of the identity-based policies granted inside the account. IAM policies attached inside each account can be modified by an account administrator. Permissions boundaries only limit the principals they are attached to and can be removed by an administrator. AWS Config detects drift after the fact but does not prevent the action.

2. 2.An application runs on Amazon EC2 instances in an Auto Scaling group and must read objects from an Amazon S3 bucket. Developers currently bake long-lived IAM access keys into the AMI. A solutions architect must remove the static credentials while keeping the application working after every scaling event. What should the solutions architect do?

   • ACreate an IAM role with the required S3 permissions and attach it to the instances through an instance profile referenced by the launch template.Correct answer
   • BStore the IAM access keys as a SecureString parameter in AWS Systems Manager Parameter Store and read them at application startup.
   • CStore the IAM access keys in AWS Secrets Manager and enable automatic rotation every 30 days.
   • DAdd a bucket ACL that grants read permission to the AuthenticatedUsers group so no credentials are needed.

   Why

   An IAM role attached to the instances through an instance profile delivers temporary credentials from the EC2 instance metadata service. The AWS SDK retrieves and refreshes them automatically, so every new instance launched by the Auto Scaling group is authorized without any embedded secret. Storing keys in Systems Manager Parameter Store or Secrets Manager still leaves a long-lived key that must be rotated and protected. A bucket ACL that allows public access exposes the data to the internet.

3. 3.A company hires an external monitoring vendor that needs read-only access to resources in the company AWS account. The vendor serves many customers from a single AWS account. The security team wants to eliminate the risk of the confused deputy problem. Which approach meets this requirement MOST securely?

   • ACreate an IAM role that trusts the vendor AWS account and requires a unique external ID in the sts:AssumeRole condition.Correct answer
   • BCreate an IAM role that trusts the vendor AWS account with no additional conditions and share the role ARN.
   • CCreate an IAM user for the vendor, attach a read-only policy, and send the access keys over an encrypted channel.
   • DShare temporary root user credentials with the vendor and rotate them every 90 days.

   Why

   The recommended pattern for third-party cross-account access is an IAM role whose trust policy names the vendor AWS account as principal and requires a unique sts:ExternalId value. The external ID prevents another vendor customer from tricking the vendor into assuming this role, which is exactly the confused deputy scenario. Creating an IAM user with access keys reintroduces long-lived credentials that must be shared and rotated. A trust policy without an external ID leaves the confused deputy exposure. Root user credentials must never be shared.

4. 4.A company runs Microsoft Active Directory on premises and is adopting AWS across 15 accounts. Employees must sign in to the AWS Management Console with their existing corporate credentials, and permissions must be assigned centrally based on their AD group membership. Which solution meets these requirements with the LEAST operational overhead?

   • AEnable AWS IAM Identity Center with Active Directory as the identity source and assign permission sets to AD groups across the accounts.Correct answer
   • BConfigure a separate SAML 2.0 identity provider and IAM roles in each of the 15 AWS accounts.
   • CCreate IAM users in every account and synchronize passwords with Active Directory using a scheduled script.
   • DCreate an Amazon Cognito user pool federated with Active Directory and map users to IAM roles.

   Why

   AWS IAM Identity Center integrates with an external identity source such as Active Directory and assigns permission sets to groups across every account in the organization from one place. Creating IAM users in each account duplicates identities and requires manual synchronization. Configuring SAML federation account by account works but multiplies the identity provider and role configuration by the number of accounts. Amazon Cognito user pools target application end users, not workforce console access.

5. 5.A solutions architect must allow a group of database administrators to perform sensitive Amazon RDS operations only after they prove possession of a second authentication factor. Day-to-day work must continue to use their standard permissions. What should the solutions architect implement?

   • AMove the sensitive permissions into a separate IAM role whose trust policy requires aws:MultiFactorAuthPresent, and have the administrators assume that role with AWS STS.Correct answer
   • BEnforce MFA at console sign-in for the administrator group and keep all permissions in their existing IAM policy.
   • CIssue a second set of IAM access keys to each administrator to be used only for the sensitive operations.
   • DApply an IAM password policy that requires password rotation every 30 days for the administrator group.

   Why

   Placing the sensitive permissions in a separate IAM role and adding a condition on aws:MultiFactorAuthPresent in the role trust policy forces the administrators to call AWS STS AssumeRole with an MFA token before they obtain the elevated permissions, while their base permissions remain untouched. Requiring MFA on console sign-in alone does not gate individual API actions when credentials are used programmatically. Access keys and password policies do not provide a second factor for specific operations.

Practice all 65 questions

Frequently asked questions