Task 1.1: Design Secure Access to AWS Resources SAA-C03 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company has 50 developers who need read-only access to an S3 bucket containing build artifacts, and 5 team leads who need read/write access to the same bucket. The company wants to minimize administrative overhead and ensure that new developers automatically receive the correct permissions. What should a solutions architect do?

   • ACreate a single IAM group with a read-only S3 policy, and attach a separate inline policy allowing write access to the team leads' user accounts.
   • BAttach a read-only S3 policy directly to each developer's IAM user, and a read/write policy directly to each team lead's IAM user.
   • CCreate an IAM group for developers with a read-only S3 policy, and an IAM group for team leads with a read/write S3 policy. Add users to the appropriate groups.
   • DCreate an IAM role for developers with read-only access, and a separate IAM role for team leads with read/write access. Instruct users to assume the role when they need access.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the purpose of the trust policy on an IAM role used for cross-account access?

   • AIt specifies which accounts or principals are allowed to assume the role
   • BIt determines the AWS Region where the role is available
   • CIt encrypts the credentials used to assume the role
   • DIt defines what actions the role can perform
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company's security team is reviewing the AWS account's security posture. They notice that the root user has a password but no MFA enabled. What should the security team do to improve the security of the root user?

   • AChange the root user password to a more complex one.
   • BDelete the root user account and create a new one.
   • CCreate an IAM role with administrative permissions and use it instead of the root user.
   • DEnable MFA on the root user account.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which IAM entity is best suited for granting permissions to a set of users who share the same job function, such as developers?

   • AIAM role
   • BIAM group
   • CIAM policy
   • DIAM user
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is AWS responsible for under the Shared Responsibility Model when a customer uses Amazon S3?

   • AConfiguring S3 lifecycle rules
   • BManaging S3 bucket policies
   • CProtecting the infrastructure that runs S3
   • DEncrypting objects with customer-managed keys
   Reveal Solution Discussion Select an answer first