Courseiva
← SAA-C03
Full test
Design Secure Architectures →hardMultiple ChoiceObjective-mapped

SAA-C03 Design Secure Architectures Practice Question

Exhibit

CloudTrail event for a newly created role:
{
  "eventSource": "iam.amazonaws.com",
  "eventName": "CreateRole",
  "requestParameters": {
    "roleName": "AppDeployRole",
    "permissionsBoundary": null,
    "assumeRolePolicyDocument": "..."
  },
  "userIdentity": {
    "arn": "arn:aws:sts::111122223333:assumed-role/AutomationRole/ci-run-9841"
  }
}

Current guardrails:
- Developers can call iam:CreateRole
- The automation tool sometimes omits the permissions boundary field
- The organization uses AWS Organizations with multiple member accounts

Based on the exhibit, an automation pipeline in several member accounts creates IAM roles for application deployments. Security says no future role may exceed the approved boundary arn:aws:iam::123456789012:policy/DeployBoundary, even if someone later attaches AdministratorAccess. What should you implement to enforce this across the organization?

⚠ Common exam trap

Candidates often confuse the condition key `aws:RequestTag` (used for tagging) with `iam:PermissionsBoundary` (the actual boundary ARN), leading candidates to pick Option B, which would not enforce the boundary requirement.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create an SCP that denies iam:CreateRole unless iam:PermissionsBoundary equals arn:aws:iam::123456789012:policy/DeployBoundary, and also deny removing that boundary from created roles.

It uses an SCP to enforce that any IAM role creation must include the specific permissions boundary `arn:aws:iam::123456789012:policy/DeployBoundary`, and also prevents removal or modification of that boundary from existing roles. This ensures that even if an attacker or administrator later attaches a policy like AdministratorAccess, the effective permissions are still limited by the boundary, meeting the security requirement across all member accounts in the organization.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Attach DeployBoundary to the automation role only, because that automatically forces every created role to inherit the same boundary.

    Why it's wrong here

    A boundary on the creator role does not automatically propagate to newly created roles. The new role must either be created with the boundary or be blocked unless it includes the approved boundary. Creator boundaries and target-role boundaries are separate controls.

  • ✗

    Create an SCP that denies iam:CreateRole and iam:PutRolePermissionsBoundary unless aws:RequestTag equals DeployBoundary.

    Why it's wrong here

    Request tags are useful for tagging governance, but they do not validate which permissions boundary is attached to the new role. The enforcement must check the permissions boundary parameter or the boundary ARN condition, not a general request tag.

  • ✓

    Create an SCP that denies iam:CreateRole unless iam:PermissionsBoundary equals arn:aws:iam::123456789012:policy/DeployBoundary, and also deny removing that boundary from created roles.

    Why this is correct

    This is the strongest organization-wide enforcement. The SCP prevents role creation unless the approved permissions boundary is attached, and it can also prevent boundary removal later. That ensures the maximum effective permissions for all created roles remain capped, even if someone attaches a broader identity policy afterward.

  • ✗

    Use AWS Access Analyzer to automatically attach the approved boundary whenever a role is created without one.

    Why it's wrong here

    Access Analyzer is a detection and analysis service, not an enforcement mechanism that modifies IAM resources. It can help identify overly broad access, but it cannot automatically attach permissions boundaries to IAM roles during creation.

About these practice questions

This SAA-C03 question is part of Courseiva's 302-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.