SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable KMS automatic key rotation for the customer-managed key in account B.

  Why it's wrong here

  Automatic key rotation for a customer-managed KMS key only creates new backing keys for the same key material's version; it does not modify the key policy or alter how the key is authorized for cross-account use. The AccessDenied error stems from the key policy in account B lacking an explicit statement that permits the instance role from account A to call kms:Decrypt (and kms:CreateGrant). Since rotation adds no new principals or permissions, it cannot resolve the authorization failure, so the volume mount will still fail.

  When this WOULD be correct

  In a scenario where a customer-managed KMS key is used within the same account and the question asks for a best practice to improve security without changing permissions, enabling automatic key rotation would be correct to meet compliance requirements.

• ✓

  Update the KMS key policy in account B to allow the instance role’s principal from account A to call kms:Decrypt and kms:CreateGrant.

  Why this is correct

  Customer-managed KMS keys use resource-based key policies to control cross-account usage. Even if the IAM role in account A has kms:Decrypt permissions, the account B key policy must also allow that principal to use the key. Including kms:Decrypt (and often kms:CreateGrant) resolves cross-account mount authorization.

• ✗

  Attach the key policy as an IAM permissions policy to the instance role in account A only; key policies are not evaluated cross-account.

  Why it's wrong here

  In cross-account KMS authorization, the key policy in the key-owning account is the resource-based policy that KMS evaluates, and it must explicitly include the external principal (e.g., the instance role's ARN or the root of account A). Simply attaching an IAM permissions policy to the instance role in account A does not update that key policy, so the request still fails because the default key policy in account B grants access only to the account root or internal principals. For a valid cross-account call, both the IAM policy in the using account and the key policy in the key-owning account must grant permission; one-sided authorization is insufficient.

  When this WOULD be correct

  This option would be correct if the KMS key and the EBS volume were in the same account (account A). In that case, the key policy can be attached as an IAM permissions policy to the instance role, and the key policy itself is not evaluated separately for the same account.

• ✗

  Disable encryption on the EBS volume until authorization is fixed, then re-enable encryption after mount.

  Why it's wrong here

  EBS volume encryption cannot be disabled on an existing encrypted volume; you would have to create an unencrypted volume from a snapshot, which defeats the security requirement and still does not fix the KMS authorization denial. Even if you attempted to temporarily use an unencrypted volume, the root cause is that the key policy in account B does not allow the account A instance role to use the key. Bypassing encryption is a poor security practice and does not address the cross-account KMS policy misconfiguration; the correct fix is to update the key policy to grant kms:Decrypt and kms:CreateGrant to the instance role's principal.

  When this WOULD be correct

  In a scenario where an EBS volume is encrypted with a customer-managed KMS key and the instance role lacks kms:Decrypt permissions due to a misconfigured IAM policy, temporarily disabling encryption is not an option. This option would never be correct because EBS encryption cannot be toggled on an existing volume; it must be set at creation.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question