SAA-C03 Design Secure Architectures Practice Question
A CI/CD system creates an IAM role (CICDRole) used for deployments. Your organization uses IAM permission boundaries to prevent developers from granting themselves higher privileges. After an incident, you discover that CICDRole can perform unintended IAM actions because the role’s identity policy includes broad permissions. Which change most directly ensures permission boundaries continue to restrict CICDRole regardless of what is later added to the role’s identity policies?
⚠ Common exam trap
Candidates often think adding deny statements to the identity policy is sufficient, but they overlook that permission boundaries are the only mechanism that can restrict permissions added later, and that deny statements in the identity policy can be overridden by a broader allow if not carefully scoped.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure CICDRole is created with the required permissions boundary ARN, and verify that the boundary policy does not allow the unintended IAM actions.
IAM permission boundaries define the maximum permissions that an IAM role can have, regardless of what is later added to its identity-based policies. By ensuring CICDRole is created with a permission boundary that explicitly denies the unintended IAM actions, even if broad permissions are added to the role's identity policy, the boundary will override and restrict those actions. This directly addresses the requirement to prevent privilege escalation through policy modifications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the permission boundary from CICDRole so that only the identity policy controls access.
Why it's wrong here
Removing a permission boundary eliminates a critical preventative control that caps the maximum permissions an IAM entity can ever have. Without this guardrail, the effective permissions are solely determined by the identity policy. If the identity policy is misconfigured or becomes overly broad through subsequent updates, there would be no secondary enforcement mechanism to prevent unintended or unauthorized IAM actions, significantly increasing the risk of privilege escalation.
- ✓
Ensure CICDRole is created with the required permissions boundary ARN, and verify that the boundary policy does not allow the unintended IAM actions.
Why this is correct
Permission boundaries cap the maximum effective permissions for the role by intersecting the identity policy and the permissions boundary at authorization time. Even if the identity policy later expands, the boundary still prevents actions not allowed by the boundary policy, providing deterministic enforcement against privilege escalation.
- ✗
Add an identity-policy deny for iam:CreatePolicy and iam:UpdateRole on all resources.
Why it's wrong here
Identity-policy denies can be incomplete or bypassed indirectly through other actions/permissions or policy changes. They also depend on correct identity policy maintenance over time, whereas permission boundaries provide a centralized maximum cap for the role.
- ✗
Rely on CloudTrail alerts to stop deployments from performing IAM changes after the fact.
Why it's wrong here
Relying on CloudTrail alerts is a reactive, detective control, not a proactive preventative measure. CloudTrail records API calls and events, providing an audit trail and enabling alerts *after* an action has already occurred. It does not possess the capability to block or stop IAM changes in real-time during authorization. Therefore, this approach would only notify administrators of unauthorized IAM actions after they have been successfully executed, failing to prevent the security incident.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAA-C03 question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.