1|Page
AWS SAA-C03 – IAM ROLES EXAM:
COMPREHENSIVE PRACTICE EXAMINATION STUDY
GUIDE | LATEST UPDATE 2025/2026 | ACTUAL EXAM
PRACTICE QUESTIONS AND ANSWERS | EXAM
REVIEW | 100% CORRECT ANSWERS | 2026 UPDATE.
This comprehensive practice examination is designed for candidates preparing for the AWS
Certified Solutions Architect – Associate (SAA-C03) exam, with a focused emphasis on IAM
Roles, Trust Policies, Permissions Policies, Cross-Account Access, and Security Best Practices.
IAM roles are a critical component of the "Design Secure Architectures" domain, which
constitutes approximately 30% of the SAA-C03 exam. Questions are written at the level expected
for the certification examination, emphasizing real-world scenario application, least privilege
principles, cross-account access patterns, and secure credential management.
Table of Contents
1. IAM Roles: Definitions and Core Concepts
2. Trust Policies vs. Permissions Policies
3. IAM Roles for AWS Services (EC2, Lambda, ECS)
4. Cross-Account Access and Trust Relationships
5. IAM Roles Anywhere and Identity Federation
6. STS and Temporary Credentials
7. Security Best Practices and Least Privilege
8. Service-Linked Roles and PassRole Permissions
9. IAM Role Limitations and Quotas
10. Comprehensive Scenario-Based Review
,2|Page
UNIT 1 – IAM ROLES: DEFINITIONS AND CORE CONCEPTS
1. What is the proper definition of an IAM Role?
A) IAM Users in multiple User Groups
B) An IAM entity that defines a password policy for IAM Users
C) An IAM entity that defines a set of permissions for making requests to AWS services, and can
be assumed by users, applications, or AWS services
D) Permissions assigned to IAM Users to perform actions
Correct Answer: C
Rationale: An IAM role is an entity within AWS that defines a set of permissions for making
requests to AWS services. Unlike IAM users, roles are not associated with a specific person and
can be assumed by AWS services (e.g., EC2, Lambda), users, or applications that need
temporary permissions. Roles are a best practice for granting permissions to AWS services and
for cross-account access.
2. What is an IAM role primarily designed to provide?
A) Permanent credentials for a specific user
B) Temporary security credentials for making AWS API requests
C) A password policy for the AWS account
D) A way to organize IAM users into groups
Correct Answer: B
Rationale: IAM roles are designed to provide temporary security credentials for making AWS
API requests. Unlike IAM users, which have long-term credentials (password and access keys),
roles provide temporary credentials that are automatically rotated. This reduces the security risk
associated with storing long-term credentials.
3. Which of the following can assume an IAM role? (Select TWO.)
A) An IAM user in the same AWS account
B) An IAM user in a different AWS account
C) An AWS service (e.g., EC2, Lambda)
D) A root user only
, 3|Page
Correct Answer: A, B, C
Rationale: An IAM role can be assumed by IAM users in the same account (A), IAM users in a
different account (B), and AWS services (C). Roles are versatile and can be used in many
scenarios. The root user (D) is not typically used to assume roles; it already has full permissions.
4. An IAM role consists of two primary policy types. What are they?
A) Identity policy and resource policy
B) Trust policy and permissions policy
C) Inline policy and managed policy
D) Allow policy and deny policy
Correct Answer: B
Rationale: An IAM role has two primary policy types: a trust policy (who can assume the role)
and a permissions policy (what actions the role can perform once assumed). The trust policy
defines which principals are allowed to assume the role, while the permissions policy defines the
permissions granted to the role.
5. A solutions architect needs to grant an EC2 instance permissions to read from an S3
bucket. What is the most secure way to grant these permissions?
A) Store AWS access keys on the EC2 instance
B) Create an IAM user and embed the access keys in the application code
C) Create an IAM role with the necessary permissions and attach it to the EC2 instance profile
D) Use the root account credentials
Correct Answer: C
Rationale: The most secure way to grant permissions to an EC2 instance is to create an IAM role
with the necessary permissions and attach it to the EC2 instance profile. This avoids the need to
store long-term credentials on the instance. Options A and B involve storing credentials, which is
a security risk. Option D is never recommended.
6. Which statement about IAM roles is INCORRECT?
A) IAM roles can be assumed by AWS services
B) IAM roles provide temporary security credentials
AWS SAA-C03 – IAM ROLES EXAM:
COMPREHENSIVE PRACTICE EXAMINATION STUDY
GUIDE | LATEST UPDATE 2025/2026 | ACTUAL EXAM
PRACTICE QUESTIONS AND ANSWERS | EXAM
REVIEW | 100% CORRECT ANSWERS | 2026 UPDATE.
This comprehensive practice examination is designed for candidates preparing for the AWS
Certified Solutions Architect – Associate (SAA-C03) exam, with a focused emphasis on IAM
Roles, Trust Policies, Permissions Policies, Cross-Account Access, and Security Best Practices.
IAM roles are a critical component of the "Design Secure Architectures" domain, which
constitutes approximately 30% of the SAA-C03 exam. Questions are written at the level expected
for the certification examination, emphasizing real-world scenario application, least privilege
principles, cross-account access patterns, and secure credential management.
Table of Contents
1. IAM Roles: Definitions and Core Concepts
2. Trust Policies vs. Permissions Policies
3. IAM Roles for AWS Services (EC2, Lambda, ECS)
4. Cross-Account Access and Trust Relationships
5. IAM Roles Anywhere and Identity Federation
6. STS and Temporary Credentials
7. Security Best Practices and Least Privilege
8. Service-Linked Roles and PassRole Permissions
9. IAM Role Limitations and Quotas
10. Comprehensive Scenario-Based Review
,2|Page
UNIT 1 – IAM ROLES: DEFINITIONS AND CORE CONCEPTS
1. What is the proper definition of an IAM Role?
A) IAM Users in multiple User Groups
B) An IAM entity that defines a password policy for IAM Users
C) An IAM entity that defines a set of permissions for making requests to AWS services, and can
be assumed by users, applications, or AWS services
D) Permissions assigned to IAM Users to perform actions
Correct Answer: C
Rationale: An IAM role is an entity within AWS that defines a set of permissions for making
requests to AWS services. Unlike IAM users, roles are not associated with a specific person and
can be assumed by AWS services (e.g., EC2, Lambda), users, or applications that need
temporary permissions. Roles are a best practice for granting permissions to AWS services and
for cross-account access.
2. What is an IAM role primarily designed to provide?
A) Permanent credentials for a specific user
B) Temporary security credentials for making AWS API requests
C) A password policy for the AWS account
D) A way to organize IAM users into groups
Correct Answer: B
Rationale: IAM roles are designed to provide temporary security credentials for making AWS
API requests. Unlike IAM users, which have long-term credentials (password and access keys),
roles provide temporary credentials that are automatically rotated. This reduces the security risk
associated with storing long-term credentials.
3. Which of the following can assume an IAM role? (Select TWO.)
A) An IAM user in the same AWS account
B) An IAM user in a different AWS account
C) An AWS service (e.g., EC2, Lambda)
D) A root user only
, 3|Page
Correct Answer: A, B, C
Rationale: An IAM role can be assumed by IAM users in the same account (A), IAM users in a
different account (B), and AWS services (C). Roles are versatile and can be used in many
scenarios. The root user (D) is not typically used to assume roles; it already has full permissions.
4. An IAM role consists of two primary policy types. What are they?
A) Identity policy and resource policy
B) Trust policy and permissions policy
C) Inline policy and managed policy
D) Allow policy and deny policy
Correct Answer: B
Rationale: An IAM role has two primary policy types: a trust policy (who can assume the role)
and a permissions policy (what actions the role can perform once assumed). The trust policy
defines which principals are allowed to assume the role, while the permissions policy defines the
permissions granted to the role.
5. A solutions architect needs to grant an EC2 instance permissions to read from an S3
bucket. What is the most secure way to grant these permissions?
A) Store AWS access keys on the EC2 instance
B) Create an IAM user and embed the access keys in the application code
C) Create an IAM role with the necessary permissions and attach it to the EC2 instance profile
D) Use the root account credentials
Correct Answer: C
Rationale: The most secure way to grant permissions to an EC2 instance is to create an IAM role
with the necessary permissions and attach it to the EC2 instance profile. This avoids the need to
store long-term credentials on the instance. Options A and B involve storing credentials, which is
a security risk. Option D is never recommended.
6. Which statement about IAM roles is INCORRECT?
A) IAM roles can be assumed by AWS services
B) IAM roles provide temporary security credentials
