PAS-C01 Cross-account IAM role assumption Practice Question
Exhibit
Refer to the exhibit.
```
{
"Sid": "Stmt1234567890",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/SAPAdminRole"
},
"Action": "sts:AssumeRole",
"Resource": "arn:aws:iam::123456789012:role/CrossAccountBackupRole"
}
```The following IAM trust policy is attached to a role named CrossAccountBackupRole in account 123456789012:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111111111111:role/SAPAdminRole"
},
"Action": "sts:AssumeRole",
"Condition": {}
}
]
}What does this policy enable?
⚠ Common exam trap
A common trap is to assume that the trust policy alone grants resource permissions (like S3 access). In reality, the trust policy only allows assumption of the role; the permissions policy attached to the role defines what actions the assumed role can perform.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SAPAdminRole can assume the CrossAccountBackupRole.
The trust policy explicitly allows the IAM role SAPAdminRole (in account 111111111111) to perform sts:AssumeRole on the CrossAccountBackupRole. This enables SAPAdminRole to assume CrossAccountBackupRole and inherit its permissions. The policy does not grant direct S3 access; that would require a separate permissions policy attached to CrossAccountBackupRole.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SAPAdminRole directly receives permissions to access S3.
Why it's wrong here
Incorrect. The trust policy only allows role assumption; it does not grant any permissions to access S3. Direct S3 access would require a separate permissions policy.
- ✓
The SAPAdminRole can assume the CrossAccountBackupRole.
Why this is correct
Correct. The policy explicitly allows SAPAdminRole to assume CrossAccountBackupRole via sts:AssumeRole.
- ✗
The CrossAccountBackupRole can be assumed by any IAM user.
Why it's wrong here
Incorrect. The principal in the trust policy is specifically the SAPAdminRole ARN, not any IAM user. Only that role can assume CrossAccountBackupRole.
- ✗
The SAPAdminRole can list S3 buckets in account 123456789012.
Why it's wrong here
Incorrect. The policy does not grant any S3 permissions. Listing S3 buckets would require an IAM permissions policy with s3:ListAllMyBuckets or similar action.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.