SAP-C02 Design for New Solutions Practice Question
A company wants to give its developers access to specific Amazon S3 buckets based on their team membership. The company uses AWS IAM Identity Center (successor to AWS SSO) for user management. Which approach should the company use to grant fine-grained access?
⚠ Common exam trap
Watch out — candidates often assume IAM groups (Option B) are the natural way to organize users from Identity Center, but Identity Center uses its own group structure and permission sets, not IAM groups, making Option B incompatible.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM policy that allows access to specific buckets based on tags, and assign the policy to an IAM role that developers can assume.
It uses IAM roles with tag-based policies, which integrate with AWS IAM Identity Center via attribute-based access control (ABAC). Developers assume the role after authenticating through Identity Center, and the policy dynamically grants access to S3 buckets matching their team tags, enabling fine-grained, scalable permissions without managing individual users or groups.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an IAM policy that allows access to specific buckets based on tags, and assign the policy to an IAM role that developers can assume.
Why this is correct
ABAC with tags enables fine-grained, scalable access control.
- ✗
Create separate IAM groups for each team and attach policies granting access to the appropriate buckets.
Why it's wrong here
This approach works but is less flexible than ABAC for dynamic attributes.
- ✗
Use resource-based policies on the buckets to allow access from the IAM Identity Center users.
Why it's wrong here
Resource-based policies cannot directly reference IAM Identity Center users.
- ✗
Use S3 bucket policies that grant access to specific IAM users based on their usernames.
Why it's wrong here
This requires updating bucket policies for each user change.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.