An organization lets application teams create IAM roles in member accounts. Security wants every newly created role to stay within an approved permission ceiling, and teams must not be able to remove that ceiling later. Which two controls best meet the requirement? Select two.

Use an S3 bucket policy to prevent the roles from gaining extra privileges.

S3 bucket policies control access to S3 resources only. They do not control the permissions granted to IAM roles across the account.

Rely on a role trust policy to limit the permissions the role can have.

Trust policies determine who can assume a role, not what the role can do after assumption. They cannot enforce an account-wide permission ceiling.

Use a session policy attached to one assumed-role session to enforce the ceiling permanently.

Session policies are temporary and apply only to a single STS session. They do not provide a permanent control over future role creation or role updates.

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Attach the approved permissions boundary to every role created by the teams. — The correct governance pattern is to use a permissions boundary to cap the role's maximum effective permissions, then use an SCP to make that boundary mandatory and to block attempts to remove or replace it. The boundary defines the ceiling; the SCP ensures the ceiling is applied consistently and cannot be bypassed by account users. S3 bucket policies and trust policies do not control the effective permissions of IAM roles. Session policies are temporary and session-scoped, so they do not provide the lasting guardrail the organization needs. The combination of a permissions boundary and an SCP is the enforceable design.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.