1|Page
AWS SAA-C03 — IDENTITY-BASED POLICIES EXAM:
COMPREHENSIVE PRACTICE EXAMINATION STUDY GUIDE
| LATEST UPDATE 2025/2026 | ACTUAL EXAM PRACTICE
QUESTIONS AND ANSWERS | EXAM REVIEW | 100%
CORRECT ANSWERS | VERIFIED SOLUTIONS
This comprehensive practice examination is designed for candidates preparing for the AWS
Certified Solutions Architect – Associate (SAA-C03) exam, with a focused emphasis on
Identity-Based Policies (IAM Policies). Identity-based policies are a foundational security
concept within the "Design Secure Architectures" domain, which constitutes approximately
30% of the SAA-C03 exam. This resource covers policy types (managed vs. inline), attachment
targets (users, groups, roles), policy evaluation logic, permission boundaries, and integration
with other policy types like Service Control Policies (SCPs) and resource-based policies.
Questions are written at the level expected for the certification examination, emphasizing real-
world scenario application, least privilege principles, and troubleshooting access denied
errors.
Table of Contents
1. Identity-Based Policy Fundamentals and Attachment Targets
2. Managed Policies vs. Inline Policies
3. Policy Evaluation Logic and the "Explicit Deny Wins" Rule
4. Permission Boundaries
5. Identity-Based vs. Resource-Based Policies
6. Service Control Policies (SCPs) and Identity-Based Policies
7. Policy Structure and Condition Keys
8. Comprehensive Scenario-Based Review
,2|Page
UNIT 1 – IDENTITY-BASED POLICY FUNDAMENTALS AND ATTACHMENT TARGETS
1. What is the proper definition of an identity-based policy in AWS IAM?
A) A JSON policy document attached to a resource (e.g., an S3 bucket) that defines who can
access it
B) A JSON permissions policy document that you can attach to an IAM identity (user, group of
users, or role)
C) A policy that sets the maximum permissions an IAM entity can be granted
D) A policy that defines the maximum permissions for an AWS organization or organizational
unit
Correct Answer: B
Rationale: Identity-based policies are JSON permission documents attached to an IAM
identity (users, groups, or roles). They are the most common type of policy in AWS and define
what actions an identity can perform, on which resources, and under what conditions. Option
A describes a resource-based policy. Option C describes a permissions boundary. Option D
describes a Service Control Policy (SCP).
2. To which IAM principals can a solutions architect attach an identity-based policy?
(Choose two.)
A) IAM Role
B) IAM Group
C) AWS Organization
D) Amazon EC2 resource
Correct Answer: A, B
Rationale: Identity-based policies can be attached to IAM users, groups, or roles. They cannot
be attached to an AWS Organization (C) — that would be a Service Control Policy (SCP).
They also cannot be attached directly to a resource like an EC2 instance (D) — that would be
a resource-based policy or an instance profile (which uses a role).
3. A solutions architect needs to grant a set of permissions to multiple IAM users. What is
the most efficient and maintainable approach?
A) Attach the same inline policy to each individual IAM user
, 3|Page
B) Create an IAM group, add the users to the group, and attach the policy to the group
C) Create a separate IAM role for each user
D) Attach the policy directly to each user's access keys
Correct Answer: B
Rationale: Attaching the policy to an IAM group is the most efficient and maintainable
approach. Groups allow for centralized permission management—users added to the group
inherit the group's policies. Inline policies (A) attached to individual users would be difficult
to manage at scale. Roles (C) are typically used for services or cross-account access, not for
grouping users. Access keys (D) are credentials, not policy attachment points.
4. A solutions architect wants to use an identity-based policy to grant specific permissions.
Which of the following can the architect attach this policy to?
A) IAM Role
B) IAM Group
C) IAM User
D) All of the above
Correct Answer: D
Rationale: Identity-based policies can be attached to IAM users, groups, and roles. This
flexibility allows architects to apply permissions directly to individual users, to groups of users
for centralized management, or to roles for services and cross-account access.
5. An administrator needs to grant temporary, elevated permissions to a developer for a
specific task. The developer should not have these permissions permanently. What is the
best practice?
A) Attach an identity-based policy directly to the developer's IAM user
B) Create an IAM role with the required permissions and allow the developer to assume it
C) Add the developer to a group that has the required permissions
D) Create a new IAM user with the required permissions and share the credentials
Correct Answer: B
Rationale: Creating an IAM role with the required permissions and allowing the developer to
assume it is the best practice for temporary, elevated access. Roles provide temporary security
AWS SAA-C03 — IDENTITY-BASED POLICIES EXAM:
COMPREHENSIVE PRACTICE EXAMINATION STUDY GUIDE
| LATEST UPDATE 2025/2026 | ACTUAL EXAM PRACTICE
QUESTIONS AND ANSWERS | EXAM REVIEW | 100%
CORRECT ANSWERS | VERIFIED SOLUTIONS
This comprehensive practice examination is designed for candidates preparing for the AWS
Certified Solutions Architect – Associate (SAA-C03) exam, with a focused emphasis on
Identity-Based Policies (IAM Policies). Identity-based policies are a foundational security
concept within the "Design Secure Architectures" domain, which constitutes approximately
30% of the SAA-C03 exam. This resource covers policy types (managed vs. inline), attachment
targets (users, groups, roles), policy evaluation logic, permission boundaries, and integration
with other policy types like Service Control Policies (SCPs) and resource-based policies.
Questions are written at the level expected for the certification examination, emphasizing real-
world scenario application, least privilege principles, and troubleshooting access denied
errors.
Table of Contents
1. Identity-Based Policy Fundamentals and Attachment Targets
2. Managed Policies vs. Inline Policies
3. Policy Evaluation Logic and the "Explicit Deny Wins" Rule
4. Permission Boundaries
5. Identity-Based vs. Resource-Based Policies
6. Service Control Policies (SCPs) and Identity-Based Policies
7. Policy Structure and Condition Keys
8. Comprehensive Scenario-Based Review
,2|Page
UNIT 1 – IDENTITY-BASED POLICY FUNDAMENTALS AND ATTACHMENT TARGETS
1. What is the proper definition of an identity-based policy in AWS IAM?
A) A JSON policy document attached to a resource (e.g., an S3 bucket) that defines who can
access it
B) A JSON permissions policy document that you can attach to an IAM identity (user, group of
users, or role)
C) A policy that sets the maximum permissions an IAM entity can be granted
D) A policy that defines the maximum permissions for an AWS organization or organizational
unit
Correct Answer: B
Rationale: Identity-based policies are JSON permission documents attached to an IAM
identity (users, groups, or roles). They are the most common type of policy in AWS and define
what actions an identity can perform, on which resources, and under what conditions. Option
A describes a resource-based policy. Option C describes a permissions boundary. Option D
describes a Service Control Policy (SCP).
2. To which IAM principals can a solutions architect attach an identity-based policy?
(Choose two.)
A) IAM Role
B) IAM Group
C) AWS Organization
D) Amazon EC2 resource
Correct Answer: A, B
Rationale: Identity-based policies can be attached to IAM users, groups, or roles. They cannot
be attached to an AWS Organization (C) — that would be a Service Control Policy (SCP).
They also cannot be attached directly to a resource like an EC2 instance (D) — that would be
a resource-based policy or an instance profile (which uses a role).
3. A solutions architect needs to grant a set of permissions to multiple IAM users. What is
the most efficient and maintainable approach?
A) Attach the same inline policy to each individual IAM user
, 3|Page
B) Create an IAM group, add the users to the group, and attach the policy to the group
C) Create a separate IAM role for each user
D) Attach the policy directly to each user's access keys
Correct Answer: B
Rationale: Attaching the policy to an IAM group is the most efficient and maintainable
approach. Groups allow for centralized permission management—users added to the group
inherit the group's policies. Inline policies (A) attached to individual users would be difficult
to manage at scale. Roles (C) are typically used for services or cross-account access, not for
grouping users. Access keys (D) are credentials, not policy attachment points.
4. A solutions architect wants to use an identity-based policy to grant specific permissions.
Which of the following can the architect attach this policy to?
A) IAM Role
B) IAM Group
C) IAM User
D) All of the above
Correct Answer: D
Rationale: Identity-based policies can be attached to IAM users, groups, and roles. This
flexibility allows architects to apply permissions directly to individual users, to groups of users
for centralized management, or to roles for services and cross-account access.
5. An administrator needs to grant temporary, elevated permissions to a developer for a
specific task. The developer should not have these permissions permanently. What is the
best practice?
A) Attach an identity-based policy directly to the developer's IAM user
B) Create an IAM role with the required permissions and allow the developer to assume it
C) Add the developer to a group that has the required permissions
D) Create a new IAM user with the required permissions and share the credentials
Correct Answer: B
Rationale: Creating an IAM role with the required permissions and allowing the developer to
assume it is the best practice for temporary, elevated access. Roles provide temporary security
