Task 1.1: Design Secure Access to AWS Resources SAA-C03 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company has an IAM role that grants full access to Amazon S3. The security team wants to ensure that the role can only be used to access a specific S3 bucket. What should a solutions architect do?

   • AAttach a managed policy that allows full S3 access to the role.
   • BUse an S3 bucket policy to deny access to all other buckets.
   • CCreate a new IAM role with a policy that allows all S3 actions on the specific bucket.
   • DModify the IAM role's policy to allow only the s3:GetObject and s3:PutObject actions on the specific bucket ARN.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company has a single AWS account. The security team wants to ensure that the root user is protected and that no one can use the root user for routine administrative tasks. What should a solutions architect do?

   • ACreate an IAM role with administrative permissions and allow the root user to assume it.
   • BChange the root user password to a very complex password and store it in a secure location.
   • CDelete the root user account and create a new IAM user with full administrative permissions.
   • DEnable MFA on the root user account and create IAM users with administrative permissions for routine tasks.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is an AWS security best practice for IAM?

   • AShare access keys among team members
   • BGrant broad permissions to simplify administration
   • CEnable MFA for all IAM users
   • DUse the root user for all administrative tasks
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which statement about AWS Regions and Availability Zones is correct?

   • AA Region consists of a single Availability Zone
   • BEach Availability Zone is a separate geographic Region
   • CData is automatically replicated across all Regions by default
   • DAvailability Zones within a Region are connected by low-latency networking
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company uses Microsoft Active Directory on-premises for user authentication. The company wants to allow its employees to access AWS resources using their existing corporate credentials, without creating IAM users. What should a solutions architect do?

   • AUse AWS Directory Service to create a new managed Active Directory and migrate all users to it.
   • BSet up AWS IAM Identity Center (AWS SSO) and connect it to the company's Active Directory as the identity source.
   • CCreate IAM users for each employee and configure the Active Directory to synchronize passwords with IAM.
   • DCreate an IAM role for each employee and configure the Active Directory to assume the role.
   Reveal Solution Discussion Select an answer first