1|Page
AWS SAA-C03 — LEAST PRIVILEGE EXAM:
COMPREHENSIVE PRACTICE EXAMINATION STUDY
GUIDE | LATEST UPDATE 2025/2026 | ACTUAL EXAM
PRACTICE QUESTIONS AND ANSWERS | EXAM
REVIEW | 100% CORRECT ANSWERS | VERIFIED
SOLUTIONS
This comprehensive practice examination is designed for candidates preparing for the AWS
Certified Solutions Architect – Associate (SAA-C03) exam, with a focused emphasis on the
Principle of Least Privilege. Least privilege is a foundational security concept within the
"Design Secure Architectures" domain, which constitutes approximately 30% of the SAA-C03
exam. This resource covers the application of least privilege across IAM policies, roles,
security groups, network ACLs, S3 bucket policies, KMS, and other AWS services. Questions
are written at the level expected for the certification examination, emphasizing real-world
scenario application, security best practices, and troubleshooting overly permissive
configurations. This resource is intended to help candidates assess their readiness, identify
knowledge gaps, and strengthen their preparation for the certification examination.
Table of Contents
1. IAM Users, Groups, and Least Privilege
2. IAM Roles and Least Privilege
3. IAM Policies and Permissions Boundaries
4. Security Groups and Least Privilege
5. S3 Bucket Policies and Least Privilege
6. AWS Organizations and Service Control Policies (SCPs)
7. KMS, Secrets Manager, and Least Privilege
,2|Page
8. Cross-Account Access and Least Privilege
9. Monitoring and Auditing Permissions
10. Comprehensive Scenario-Based Review
UNIT 1 – IAM USERS, GROUPS, AND LEAST PRIVILEGE
1. In AWS IAM, what does the principle of least privilege mean?
A) Providing users with minimum access to perform their job function
B) Providing users with root access
C) Providing all users with administrative access
D) Restricting all user access
Correct Answer: A
Rationale: The principle of least privilege means granting only the minimum permissions
necessary for a user, group, or role to perform its intended function. This is a core security
best practice in AWS.
2. A company wants to grant a set of permissions to multiple IAM users. What is the most
efficient and maintainable approach that follows least privilege?
A) Attach the same inline policy to each individual IAM user
B) Create an IAM group, add the users to the group, and attach a customer managed policy to the
group
C) Create a separate IAM role for each user
D) Attach the AdministratorAccess policy to each user
Correct Answer: B
Rationale: Creating an IAM group and attaching a customer managed policy to the group is
the most efficient and scalable approach. Users added to the group inherit the group's policies.
This aligns with best practices for centralized permission management and least privilege.
Inline policies on each user (A) are difficult to manage. Roles (C) are not intended for
grouping users. AdministratorAccess (D) violates least privilege.
,3|Page
3. A new employee has joined a company as a deployment engineer. The deployment
engineer will be using AWS CloudFormation templates to create multiple AWS resources. A
solutions architect wants the deployment engineer to perform job activities while following
the principle of least privilege. Which combination of actions should the solutions architect
take? (Choose two.)
A) Have the deployment engineer use AWS account root user credentials for performing AWS
CloudFormation stack operations.
B) Create a new IAM user for the deployment engineer and add the IAM user to a group that has
the PowerUsers IAM policy attached.
C) Create a new IAM user for the deployment engineer and add the IAM user to a group that has
the AdministratorAccess IAM policy attached.
D) Create a new IAM user for the deployment engineer and add the IAM user to a group that has
an IAM policy that allows AWS CloudFormation actions only.
E) Create an IAM role for the deployment engineer to explicitly define the permissions specific
to the AWS CloudFormation stack and launch stacks using that IAM role.
Correct Answer: D, E
Rationale: The principle of least privilege states that users should only be given the minimal
permissions necessary to perform their job function. The deployment engineer needs only
CloudFormation permissions. Creating a user with a policy that allows CloudFormation
actions only (D) and using an IAM role with explicit CloudFormation permissions (E) both
align with least privilege. Options A, B, and C grant excessive permissions or use the root
account, which violates security best practices.
4. Which principle should you apply regarding IAM Permissions?
A) Grant most privilege
B) Grant more permissions if your employee asks you to
C) Grant least privilege
D) Restrict root account permissions
Correct Answer: C
Rationale: The principle of least privilege is a core security best practice in AWS. It means
granting only the permissions necessary for a user or service to perform its intended function.
, 4|Page
Options A and B are the opposite of least privilege. Option D is a best practice for root account
security but does not directly address the principle of least privilege.
5. An administrator needs to grant temporary, elevated permissions to a developer for a
specific task. The developer should not have these permissions permanently. What is the
best practice that follows least privilege?
A) Attach an identity-based policy directly to the developer's IAM user
B) Create an IAM role with the required permissions and allow the developer to assume it
C) Add the developer to a group that has the required permissions
D) Create a new IAM user with the required permissions and share the credentials
Correct Answer: B
Rationale: Creating an IAM role with the required permissions and allowing the developer to
assume it is the best practice for temporary, elevated access. Roles provide temporary security
credentials. Attaching a policy directly to the user (A) would grant permanent permissions.
Adding to a group (C) would also grant permanent permissions. Creating a new user and
sharing credentials (D) is insecure and violates least privilege.
6. A developer has an IAM user with permissions to access S3. The developer receives an
"AccessDenied" error when trying to access an S3 object. The S3 bucket has a bucket
policy that denies access to all users except a specific role. What is the likely cause?
A) The developer's IAM user does not have s3:GetObject permission
B) The bucket policy is denying access
C) The object does not exist
D) The developer is in the wrong region
Correct Answer: B
Rationale: An explicit Deny from a bucket policy (resource-based policy) will override any
Allow from an identity-based policy. Since the bucket policy denies access to all users except a
specific role, the developer is denied access, even if the user has s3:GetObject permissions.
The AccessDenied error is due to the bucket policy, not a lack of user permissions (A). Options
C and D would cause different errors.
AWS SAA-C03 — LEAST PRIVILEGE EXAM:
COMPREHENSIVE PRACTICE EXAMINATION STUDY
GUIDE | LATEST UPDATE 2025/2026 | ACTUAL EXAM
PRACTICE QUESTIONS AND ANSWERS | EXAM
REVIEW | 100% CORRECT ANSWERS | VERIFIED
SOLUTIONS
This comprehensive practice examination is designed for candidates preparing for the AWS
Certified Solutions Architect – Associate (SAA-C03) exam, with a focused emphasis on the
Principle of Least Privilege. Least privilege is a foundational security concept within the
"Design Secure Architectures" domain, which constitutes approximately 30% of the SAA-C03
exam. This resource covers the application of least privilege across IAM policies, roles,
security groups, network ACLs, S3 bucket policies, KMS, and other AWS services. Questions
are written at the level expected for the certification examination, emphasizing real-world
scenario application, security best practices, and troubleshooting overly permissive
configurations. This resource is intended to help candidates assess their readiness, identify
knowledge gaps, and strengthen their preparation for the certification examination.
Table of Contents
1. IAM Users, Groups, and Least Privilege
2. IAM Roles and Least Privilege
3. IAM Policies and Permissions Boundaries
4. Security Groups and Least Privilege
5. S3 Bucket Policies and Least Privilege
6. AWS Organizations and Service Control Policies (SCPs)
7. KMS, Secrets Manager, and Least Privilege
,2|Page
8. Cross-Account Access and Least Privilege
9. Monitoring and Auditing Permissions
10. Comprehensive Scenario-Based Review
UNIT 1 – IAM USERS, GROUPS, AND LEAST PRIVILEGE
1. In AWS IAM, what does the principle of least privilege mean?
A) Providing users with minimum access to perform their job function
B) Providing users with root access
C) Providing all users with administrative access
D) Restricting all user access
Correct Answer: A
Rationale: The principle of least privilege means granting only the minimum permissions
necessary for a user, group, or role to perform its intended function. This is a core security
best practice in AWS.
2. A company wants to grant a set of permissions to multiple IAM users. What is the most
efficient and maintainable approach that follows least privilege?
A) Attach the same inline policy to each individual IAM user
B) Create an IAM group, add the users to the group, and attach a customer managed policy to the
group
C) Create a separate IAM role for each user
D) Attach the AdministratorAccess policy to each user
Correct Answer: B
Rationale: Creating an IAM group and attaching a customer managed policy to the group is
the most efficient and scalable approach. Users added to the group inherit the group's policies.
This aligns with best practices for centralized permission management and least privilege.
Inline policies on each user (A) are difficult to manage. Roles (C) are not intended for
grouping users. AdministratorAccess (D) violates least privilege.
,3|Page
3. A new employee has joined a company as a deployment engineer. The deployment
engineer will be using AWS CloudFormation templates to create multiple AWS resources. A
solutions architect wants the deployment engineer to perform job activities while following
the principle of least privilege. Which combination of actions should the solutions architect
take? (Choose two.)
A) Have the deployment engineer use AWS account root user credentials for performing AWS
CloudFormation stack operations.
B) Create a new IAM user for the deployment engineer and add the IAM user to a group that has
the PowerUsers IAM policy attached.
C) Create a new IAM user for the deployment engineer and add the IAM user to a group that has
the AdministratorAccess IAM policy attached.
D) Create a new IAM user for the deployment engineer and add the IAM user to a group that has
an IAM policy that allows AWS CloudFormation actions only.
E) Create an IAM role for the deployment engineer to explicitly define the permissions specific
to the AWS CloudFormation stack and launch stacks using that IAM role.
Correct Answer: D, E
Rationale: The principle of least privilege states that users should only be given the minimal
permissions necessary to perform their job function. The deployment engineer needs only
CloudFormation permissions. Creating a user with a policy that allows CloudFormation
actions only (D) and using an IAM role with explicit CloudFormation permissions (E) both
align with least privilege. Options A, B, and C grant excessive permissions or use the root
account, which violates security best practices.
4. Which principle should you apply regarding IAM Permissions?
A) Grant most privilege
B) Grant more permissions if your employee asks you to
C) Grant least privilege
D) Restrict root account permissions
Correct Answer: C
Rationale: The principle of least privilege is a core security best practice in AWS. It means
granting only the permissions necessary for a user or service to perform its intended function.
, 4|Page
Options A and B are the opposite of least privilege. Option D is a best practice for root account
security but does not directly address the principle of least privilege.
5. An administrator needs to grant temporary, elevated permissions to a developer for a
specific task. The developer should not have these permissions permanently. What is the
best practice that follows least privilege?
A) Attach an identity-based policy directly to the developer's IAM user
B) Create an IAM role with the required permissions and allow the developer to assume it
C) Add the developer to a group that has the required permissions
D) Create a new IAM user with the required permissions and share the credentials
Correct Answer: B
Rationale: Creating an IAM role with the required permissions and allowing the developer to
assume it is the best practice for temporary, elevated access. Roles provide temporary security
credentials. Attaching a policy directly to the user (A) would grant permanent permissions.
Adding to a group (C) would also grant permanent permissions. Creating a new user and
sharing credentials (D) is insecure and violates least privilege.
6. A developer has an IAM user with permissions to access S3. The developer receives an
"AccessDenied" error when trying to access an S3 object. The S3 bucket has a bucket
policy that denies access to all users except a specific role. What is the likely cause?
A) The developer's IAM user does not have s3:GetObject permission
B) The bucket policy is denying access
C) The object does not exist
D) The developer is in the wrong region
Correct Answer: B
Rationale: An explicit Deny from a bucket policy (resource-based policy) will override any
Allow from an identity-based policy. Since the bucket policy denies access to all users except a
specific role, the developer is denied access, even if the user has s3:GetObject permissions.
The AccessDenied error is due to the bucket policy, not a lack of user permissions (A). Options
C and D would cause different errors.
