Courseiva
← SAA-C03
Full test
Question 823 of 1,040
Design Secure Architectures →mediumMultiple ChoiceObjective-mapped

Quick Answer

The correct approach is to add conditions to the trust policy that restrict the caller principals to engineers from account C, require the `sts:ExternalId` value, and mandate `aws:MultiFactorAuthPresent = true`. This works because the trust policy in the target account (Account A) is the only place where all three requirements—principal restriction, external ID, and MFA—can be enforced together; MFA cannot be delegated to the calling account’s permissions or a session policy when assuming a cross-account role. On the SAA-C03 exam, this scenario tests your understanding that cross-account IAM role MFA external ID conditions must be explicitly written into the trust policy, not the permissions policy, and a common trap is assuming the calling account can enforce MFA on its own users. Remember the mnemonic “PEM” for the three conditions: PrincipalArn, ExternalId, and MultiFactorAuthPresent.

SAA-C03 Design Secure Architectures Practice Question

This SAA-C03 practice question tests your understanding of design secure architectures. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

Account C wants engineers to access a role (RoleInAccountA) in account A using STS AssumeRole. Security policy requires that (1) only engineers from account C can assume the role, (2) they must provide an external ID value, and (3) the session must be MFA-authenticated. Which change is most appropriate in the RoleInAccountA trust policy to meet all three requirements?

Question 1mediummultiple choice
Full question →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Add conditions that (a) restrict the caller principals to account C engineers (for example, aws:PrincipalArn matches a specific engineer role/user pattern from account C), (b) require sts:ExternalId = <value>, and (c) require aws:MultiFactorAuthPresent = true.

Option B is correct because it satisfies all three security requirements: it restricts the caller principals to engineers from account C using the `aws:PrincipalArn` condition, enforces the external ID with `sts:ExternalId`, and mandates MFA authentication via `aws:MultiFactorAuthPresent = true`. The trust policy on RoleInAccountA must explicitly include the MFA condition because MFA enforcement cannot be delegated to the session policy or to the calling account's IAM permissions when the role is in a different account.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Add conditions sts:ExternalId = <value> only; do not include any MFA requirement because MFA can be enforced by the IAM role session policy.

    Why it's wrong here

    Adding sts:ExternalId satisfies the external ID requirement, but MFA is not enforced by that setting. MFA must be validated at AssumeRole time using trust policy conditions (for example, aws:MultiFactorAuthPresent = true). Otherwise, a caller could satisfy the external ID and still avoid MFA.

  • ✓

    Add conditions that (a) restrict the caller principals to account C engineers (for example, aws:PrincipalArn matches a specific engineer role/user pattern from account C), (b) require sts:ExternalId = <value>, and (c) require aws:MultiFactorAuthPresent = true.

    Why this is correct

    A trust policy can simultaneously (1) restrict who can call AssumeRole via principal-based conditions, (2) require sts:ExternalId to mitigate confused-deputy risk, and (3) enforce MFA by requiring aws:MultiFactorAuthPresent = true when STS issues the temporary credentials.

    Related concept

    Read the scenario before looking for a memorised answer.

  • ✗

    Add conditions for aws:PrincipalTag:Department = Engineering and sts:ExternalId = <value>; omit MFA because MFA is optional for AssumeRole.

    Why it's wrong here

    Principal tags are not guaranteed to exist for every caller and are not a reliable mechanism for enforcing an explicit MFA requirement. Omitting aws:MultiFactorAuthPresent fails the stated security requirement that the session be MFA-authenticated.

  • ✗

    Add conditions aws:SecureTransport = true and sts:ExternalId = <value>; rely on IAM permissions in account C to require MFA.

    Why it's wrong here

    aws:SecureTransport enforces TLS usage for API calls, not MFA. Also, caller-side IAM permissions cannot ensure that the STS trust evaluation validates MFA at AssumeRole time; MFA must be checked via trust conditions such as aws:MultiFactorAuthPresent.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often assume MFA can be enforced indirectly through session policies or the calling account's permissions, but in cross-account AssumeRole scenarios, the trust policy in the target account must explicitly require `aws:MultiFactorAuthPresent = true` to enforce MFA on the assumed role session.

Detailed technical explanation

How to think about this question

When using `sts:AssumeRole` across accounts, the trust policy in the target account (Account A) is the sole mechanism to enforce conditions like external ID and MFA. The `aws:MultiFactorAuthPresent` condition key checks that the caller's session was established using MFA; if absent, the AssumeRole call succeeds even without MFA. The `sts:ExternalId` condition prevents the confused deputy problem by requiring a unique identifier that only the trusted third party (Account C) knows. In practice, you would combine these with `aws:SourceIdentity` or `aws:PrincipalArn` to further restrict which IAM entities in Account C can assume the role.

KKey Concepts to Remember

  • Read the scenario before looking for a memorised answer.
  • Find the constraint that changes the correct option.
  • Eliminate answers that are true in general but not in this case.

TExam Day Tips

  • Watch for words such as best, first, most likely and least administrative effort.
  • Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related practice questions

Related SAA-C03 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Design Secure Architectures practice questions

Practise SAA-C03 questions linked to Design Secure Architectures.

Design Resilient Architectures practice questions

Practise SAA-C03 questions linked to Design Resilient Architectures.

Design High-Performing Architectures practice questions

Practise SAA-C03 questions linked to Design High-Performing Architectures.

Design Cost-Optimized Architectures practice questions

Practise SAA-C03 questions linked to Design Cost-Optimized Architectures.

SAA-C03 VPC practice questions

Practise SAA-C03 questions linked to SAA-C03 VPC.

SAA-C03 S3 lifecycle policy questions

Practise SAA-C03 questions linked to SAA-C03 S3 lifecycle policy questions.

SAA-C03 RDS Multi-AZ questions

Practise SAA-C03 questions linked to SAA-C03 RDS Multi-AZ questions.

SAA-C03 IAM policy practice questions

Practise SAA-C03 questions linked to SAA-C03 IAM policy.

SAA-C03 Route 53 failover questions

Practise SAA-C03 questions linked to SAA-C03 Route 53 failover questions.

SAA-C03 CloudFront practice questions

Practise SAA-C03 questions linked to SAA-C03 CloudFront.

SAA-C03 NAT gateway questions

Practise SAA-C03 questions linked to SAA-C03 NAT gateway questions.

SAA-C03 VPC endpoint questions

Practise SAA-C03 questions linked to SAA-C03 VPC endpoint questions.

Practice this exam

Start a free SAA-C03 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions20 questions30 questions50 questionsTimed 30
SAA-C03 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this SAA-C03 question test?

Design Secure Architectures — This question tests Design Secure Architectures — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Add conditions that (a) restrict the caller principals to account C engineers (for example, aws:PrincipalArn matches a specific engineer role/user pattern from account C), (b) require sts:ExternalId = <value>, and (c) require aws:MultiFactorAuthPresent = true. — Option B is correct because it satisfies all three security requirements: it restricts the caller principals to engineers from account C using the `aws:PrincipalArn` condition, enforces the external ID with `sts:ExternalId`, and mandates MFA authentication via `aws:MultiFactorAuthPresent = true`. The trust policy on RoleInAccountA must explicitly include the MFA condition because MFA enforcement cannot be delegated to the session policy or to the calling account's IAM permissions when the role is in a different account.

What should I do if I get this SAA-C03 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

More SAA-C03 practice questions

Browse all SAA-C03 questions →

Last reviewed: Jun 11, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

Sign in to join the discussion.

This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.