ANS-C01 Network Design Practice Question

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111111111111:root"
      },
      "Action": [
        "route53resolver:AssociateResolverRule",
        "route53resolver:DisassociateResolverRule"
      ],
      "Resource": "*"
    }
  ]
}
```

A network engineer is setting up a cross-account Route 53 Resolver rule association. The engineer creates the above resource-based policy on a resolver rule in account 111111111111. The engineer then tries to associate the rule from account 222222222222 but receives an access denied error. What is the MOST likely reason for the failure?

⚠ Common exam trap

AWS often tests the distinction between the resource-based policy's Principal field and the Action field, tricking candidates into thinking a missing action is the cause when the real issue is an incorrect principal account ID.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy's Principal is set to account 111111111111 instead of account 222222222222.

The resource-based policy on the Route 53 Resolver rule must specify the consuming account (222222222222) as the Principal to authorize cross-account association. Since the policy incorrectly sets the Principal to the owning account (111111111111), the request from account 222222222222 lacks the required permissions, resulting in an access denied error.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy does not allow the 'route53resolver:AssociateResolverRule' action.
Why it's wrong here
The policy includes that action.
✗
The policy does not include the 'route53resolver:DisassociateResolverRule' action.
Why it's wrong here
Disassociate is not needed for association.
✓
The policy's Principal is set to account 111111111111 instead of account 222222222222.
Why this is correct
The principal should be the account that will use the rule.
✗
The resolver rule is not shared with account 222222222222.
Why it's wrong here
The policy shares the rule with the principal specified.

Visual reference

Go deeper

ANS-C01 Network Design Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question