SCS-C03 Identity and Access Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  MFA requirement on the role.

  Why it's wrong here

  MFA is for verifying the identity of the user assuming the role. While good practice, it does not address the confused deputy problem, which is about ensuring the service provider is acting on behalf of the right entity. The External ID is the correct mechanism for that specific security concern.

• ✓

  External ID.

  Why this is correct

  The External ID is the primary mechanism for preventing the confused deputy problem in cross-account role assumptions. It serves as a secret value shared only between the trustor and the trustee, ensuring that the trust relationship is validated correctly during the assume-role process and preventing unauthorized access to resources.

• ✗

  Role session name.

  Why it's wrong here

  The role session name is a descriptive label for the session. It does not provide any security validation or prevent the confused deputy problem. It is useful for logging and auditing, helping to identify which user initiated an action, but it does not act as a security credential or check.

• ✗

  Source IP condition.

  Why it's wrong here

  Restricting by IP address can prevent unauthorized access from unexpected locations, but it does not solve the confused deputy problem. A deputy could still be confused even if the request comes from an allowed IP address. The External ID provides the necessary context-aware validation that simple IP filtering lacks.