← SAA-C03·Amazon Web Services

Question 62 of 1,040

Design Secure Architectures →hardMultiple ChoiceObjective-mapped

Quick Answer

The answer is to pass an STS session policy when TeamA assumes the role, restricting the temporary credentials to the teamA/prod prefix. This is correct because an STS session policy acts as a granular, inline permissions boundary applied at the moment of role assumption, allowing you to further restrict the role’s effective permissions for that specific session without altering the underlying IAM role. The session policy is evaluated in addition to the role’s identity-based policies, so it can only narrow, never widen, the scope—perfect for keeping the central deployment role reusable across pipelines while enforcing per-session constraints. On the SAA-C03 exam, this scenario tests your understanding of how to use session policies to implement least privilege without creating separate roles, a common trap being to overcomplicate with resource-based policies or separate IAM roles. Memory tip: think of a session policy as a temporary “permission shrink-wrap” that wraps around the assumed role’s credentials for just that one session.

SAA-C03 Design Secure Architectures Practice Question

This SAA-C03 practice question tests your understanding of design secure architectures. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

Network Topology

Based on the exhibit, a central deployment role in Account A is assumed by several CI/CD pipelines from Account B. The role must remain reusable, but the team wants the TeamA pipeline to upload artifacts only to s3://artifact-bucket/teamA/prod/ without creating a separate IAM role. What is the best approach?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

Question 1hardmultiple choice

Full question →

Network Topology

A
Use an IAM user in Account B and hard-code the narrower S3 path in its access key policy.
Why wrong: This reintroduces long-term credentials and defeats the purpose of using STS assumed-role access. It also creates a separate identity instead of reusing the central deployment role.
B
Add a bucket ACL that grants write access only to the TeamA pipeline session name.
Why wrong: S3 ACLs cannot evaluate STS session names or enforce per-session restrictions. They are also a poor fit for least-privilege automation because they are coarse and difficult to manage safely at scale.
C
Attach a permissions boundary to the central role so every pipeline session inherits the narrower prefix automatically.
Why wrong: A permissions boundary limits the maximum permissions of an IAM principal, but it does not let different callers apply different temporary restrictions when they assume the same role. The boundary would apply to the role itself, not dynamically to one TeamA session versus other pipeline sessions.
D
Pass an STS session policy when TeamA assumes the role to further restrict the temporary credentials to the teamA/prod prefix.
An STS session policy is specifically designed to reduce the permissions of temporary credentials for a single assume-role session. The reusable base role can remain broad enough for multiple pipelines, while TeamA can pass a session policy that limits effective permissions to the teamA/prod prefix. This preserves the shared role model and achieves least privilege without creating a separate IAM role.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Pass an STS session policy when TeamA assumes the role to further restrict the temporary credentials to the teamA/prod prefix.

Option D is correct because when the TeamA pipeline assumes the central IAM role in Account A, it can pass an STS session policy that further restricts the temporary credentials to only allow actions on the s3://artifact-bucket/teamA/prod/ prefix. This approach keeps the role reusable for other pipelines while enforcing a narrower permission scope at the session level, without requiring a separate IAM role.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use an IAM user in Account B and hard-code the narrower S3 path in its access key policy.
Why it's wrong here
This reintroduces long-term credentials and defeats the purpose of using STS assumed-role access. It also creates a separate identity instead of reusing the central deployment role.
✗
Add a bucket ACL that grants write access only to the TeamA pipeline session name.
Why it's wrong here
S3 ACLs cannot evaluate STS session names or enforce per-session restrictions. They are also a poor fit for least-privilege automation because they are coarse and difficult to manage safely at scale.
✗
Attach a permissions boundary to the central role so every pipeline session inherits the narrower prefix automatically.
Why it's wrong here
A permissions boundary limits the maximum permissions of an IAM principal, but it does not let different callers apply different temporary restrictions when they assume the same role. The boundary would apply to the role itself, not dynamically to one TeamA session versus other pipeline sessions.
✓
Pass an STS session policy when TeamA assumes the role to further restrict the temporary credentials to the teamA/prod prefix.
Why this is correct
An STS session policy is specifically designed to reduce the permissions of temporary credentials for a single assume-role session. The reusable base role can remain broad enough for multiple pipelines, while TeamA can pass a session policy that limits effective permissions to the teamA/prod prefix. This preserves the shared role model and achieves least privilege without creating a separate IAM role.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often think a permissions boundary (Option C) can dynamically restrict individual sessions, but permissions boundaries set a hard limit on the role's overall permissions and cannot be applied per-session like an STS session policy can.

Detailed technical explanation

How to think about this question

When an IAM role is assumed via STS AssumeRole, the resulting temporary credentials are governed by the intersection of the role's trust policy, the role's permissions policy, and any session policy passed in the request. The session policy acts as a further filter, allowing you to scope permissions down to a specific resource path (e.g., s3://artifact-bucket/teamA/prod/*) without modifying the role itself. This is commonly used in CI/CD scenarios where a central deployment role must be shared across teams but each team needs isolated access to specific S3 prefixes.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related SAA-C03 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Design Secure Architectures practice questions

Practise SAA-C03 questions linked to Design Secure Architectures.

Design Resilient Architectures practice questions

Practise SAA-C03 questions linked to Design Resilient Architectures.

Design High-Performing Architectures practice questions

Practise SAA-C03 questions linked to Design High-Performing Architectures.

Design Cost-Optimized Architectures practice questions

Practise SAA-C03 questions linked to Design Cost-Optimized Architectures.

SAA-C03 VPC practice questions

Practise SAA-C03 questions linked to SAA-C03 VPC.

SAA-C03 S3 lifecycle policy questions

Practise SAA-C03 questions linked to SAA-C03 S3 lifecycle policy questions.

SAA-C03 RDS Multi-AZ questions

Practise SAA-C03 questions linked to SAA-C03 RDS Multi-AZ questions.

SAA-C03 IAM policy practice questions

Practise SAA-C03 questions linked to SAA-C03 IAM policy.

SAA-C03 Route 53 failover questions

Practise SAA-C03 questions linked to SAA-C03 Route 53 failover questions.

SAA-C03 CloudFront practice questions

Practise SAA-C03 questions linked to SAA-C03 CloudFront.

SAA-C03 NAT gateway questions

Practise SAA-C03 questions linked to SAA-C03 NAT gateway questions.

SAA-C03 VPC endpoint questions

Practise SAA-C03 questions linked to SAA-C03 VPC endpoint questions.

Practice this exam

Start a free SAA-C03 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

SAA-C03 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this SAA-C03 question test?

Design Secure Architectures — This question tests Design Secure Architectures — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Pass an STS session policy when TeamA assumes the role to further restrict the temporary credentials to the teamA/prod prefix. — Option D is correct because when the TeamA pipeline assumes the central IAM role in Account A, it can pass an STS session policy that further restricts the temporary credentials to only allow actions on the s3://artifact-bucket/teamA/prod/ prefix. This approach keeps the role reusable for other pipelines while enforcing a narrower permission scope at the session level, without requiring a separate IAM role.

What should I do if I get this SAA-C03 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more ways this is tested on SAA-C03

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Based on the exhibit, a CI pipeline assumes a shared deployment role in Account A. The role can access several artifact prefixes, but this pipeline must only upload to teamA/prod/ and decrypt using a single KMS key for this execution. Changing the shared role would affect other pipelines. Which approach should the pipeline use?

hard

A.Attach a permission boundary to the pipeline's assumed session so the temporary credentials cannot exceed the shared role permissions.
✓ B.Pass an inline session policy in the AssumeRole request that further restricts the temporary credentials to teamA/prod/ and the approved KMS key.
C.Add an SCP to Account A that forces all roles to use the same S3 prefix and key whenever they are assumed.
D.Change the role trust policy to allow only the teamA/prod/ prefix and the key ARN because trust policies can scope S3 object paths directly.

Why B: Option B is correct because an inline session policy passed in the AssumeRole request allows you to further restrict the temporary credentials' permissions without modifying the shared role itself. This ensures the pipeline can only upload to teamA/prod/ and decrypt using the specified KMS key, while other pipelines using the same role remain unaffected.

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.