What is the primary purpose of requiring multi-factor authentication (MFA) for IAM users?

To add an extra layer of security beyond the password

To allow users to access AWS from any device

To provide a backup method for password recovery

To replace the need for IAM policies

Which AWS service issues temporary security credentials when an IAM role is assumed?

AWS Identity and Access Management (IAM)

AWS Security Token Service (STS)

AWS Key Management Service (KMS)

A company uses AWS Organizations with multiple accounts. The security team wants to enforce a policy that prevents any IAM user in any account from being able to delete an S3 bucket. The company also wants to allow the security team to make exceptions for specific accounts if needed. What should a solutions architect do?

Use AWS Control Tower to create a guardrail that prevents S3 bucket deletion.

Create a Service Control Policy (SCP) that denies the s3:DeleteBucket action and attach it to the root organizational unit (OU).

Create an IAM policy that denies the s3:DeleteBucket action and attach it to every IAM user in the organization.

Create a bucket policy on every S3 bucket that denies the s3:DeleteBucket action.

What is the recommended way to grant a user in Account A access to resources in Account B?

Create an IAM role in Account B and allow the user in Account A to assume it

Share the root user credentials of Account B with the user in Account A

Create an IAM user in Account B with the same name as the user in Account A

Use an S3 bucket policy to grant access to the user in Account A

What is the benefit of federating an existing Active Directory with IAM roles?

It provides a backup of the on-premises directory

It automatically encrypts all S3 buckets

It allows AWS to manage the on-premises servers

Users can use their existing corporate credentials to access AWS resources

AWSCertified Solutions Architect - Associate

Domain 1Objective 1

Task 1.1: Design Secure Access to AWS Resources SAA-C03 Practice Questions (Page 1)

Part of the Design Secure Architectures domain, which makes up ~18% of our current practice bank. AWS does not publish an official question count, but from its 130-minute exam (~50–85 total, ~9–15 in this domain), expect 3–5 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

14concepts

Questions 1–5

1foundation · easy
What is the primary purpose of requiring multi-factor authentication (MFA) for IAM users?
Select an answer first
2foundation · easy
Which AWS service issues temporary security credentials when an IAM role is assumed?
Select an answer first
3expert · hard
A company uses AWS Organizations with multiple accounts. The security team wants to enforce a policy that prevents any IAM user in any account from being able to delete an S3 bucket. The company also wants to allow the security team to make exceptions for specific accounts if needed. What should a solutions architect do?
Select an answer first
4foundation · easy
What is the recommended way to grant a user in Account A access to resources in Account B?
Select an answer first
5foundation · easy
What is the benefit of federating an existing Active Directory with IAM roles?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SAA-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SAA-C03” is a trademark of its owner, used for identification only.