AWS SAA-C03 — CROSS-ACCOUNT ACCESS EXAM:
COMPREHENSIVE PRACTICE EXAMINATION STUDY GUIDE
| LATEST UPDATE 2025/2026 | ACTUAL EXAM PRACTICE
QUESTIONS AND ANSWERS | EXAM REVIEW | 100%
CORRECT ANSWERS | LATEST SOLUTION 2026.
This comprehensive practice examination is designed for candidates preparing for the AWS
Certified Solutions Architect – Associate (SAA-C03) exam, with a focused emphasis on cross-
account access patterns. Cross-account access is a critical component of the "Design Secure
Architectures" domain, which constitutes approximately 30% of the SAA-C03 exam. This
resource covers all essential cross-account access mechanisms including IAM roles with trust
policies, resource-based policies (S3 bucket policies, KMS key policies, SQS queue policies,
SNS topic policies), AWS Organizations and Service Control Policies (SCPs), AWS STS and
temporary credentials, the sts:ExternalId condition for third-party access, permission
boundaries, and IAM Access Analyzer for monitoring external access. Questions are written at
the level expected for the certification examination, emphasizing real-world scenario
application, security best practices, least privilege principles, and troubleshooting access
denied errors. This resource is intended to help candidates assess their readiness, identify
knowledge gaps, and strengthen their preparation for the certification examination.
Table of Contents
1. Cross-Account Access Fundamentals and IAM Roles
2. Trust Policies, Permissions Policies, and sts:AssumeRole
3. Resource-Based Policies (S3, KMS, SQS, SNS)
4. AWS STS and Temporary Credentials
5. AWS Organizations and Service Control Policies (SCPs)
6. Cross-Account Access with Specific AWS Services
7. Security Best Practices: Least Privilege, ExternalId, and Monitoring
1|Page
, 8. Troubleshooting Cross-Account Access
9. IAM Identity Center and Workforce Cross-Account Access
10. Comprehensive Scenario-Based Review
UNIT 1 – CROSS-ACCOUNT ACCESS FUNDAMENTALS AND IAM ROLES
1. What is the primary mechanism for granting cross-account access in AWS?
A) Sharing IAM user credentials between accounts
B) Creating IAM users in each account with the same permissions
C) Using IAM roles with trust policies that allow another account to assume them
D) Using the root account of one account to access another
Correct Answer: C
Rationale: The primary mechanism for cross-account access is creating an IAM role in the
target account (the account with the resources) with a trust policy that allows an IAM entity
from the source account to assume it. This provides secure, temporary access without sharing
long-term credentials.
2. A solutions architect needs to allow users in Account A to access resources in Account B.
What is the correct approach?
A) Create IAM users in Account B and share the credentials with users in Account A
B) Create an IAM role in Account B with a trust policy that allows Account A to assume
it
C) Create an IAM policy in Account A that grants permissions to resources in Account B
D) Use the root account of Account B to grant access
Correct Answer: B
Rationale: The correct approach is to create an IAM role in Account B (the target account)
with a trust policy that allows Account A (the source account) to assume the role. The role's
permissions policy defines what actions can be performed on the resources in Account B.
3. Which statement about cross-account IAM roles is true?
A) They provide long-term credentials that never expire
2|Page
, B) They use AWS STS to issue temporary credentials
C) They require sharing of access keys between accounts
D) They can only be used by IAM users, not AWS services
Correct Answer: B
Rationale: Cross-account IAM roles use AWS Security Token Service (STS) to issue
temporary, limited-privilege credentials. This enhances security by avoiding long-term access
key sharing.
4. A company has a centralized logging account and multiple application accounts. The
security team in the logging account needs to read CloudTrail logs stored in S3 buckets
across all application accounts. What is the most secure and scalable approach?
A) Create IAM users in each application account and share the credentials with the
security team
B) Create cross-account IAM roles in each application account with a trust policy
allowing the logging account to assume them
C) Make the S3 buckets public so the security team can access them
D) Copy all logs to the logging account using S3 replication
Correct Answer: B
Rationale: Creating cross-account IAM roles in each application account with a trust policy
allowing the logging account to assume them is the most secure and scalable approach. This
avoids managing multiple IAM users and provides temporary, auditable access.
5. Which of the following is NOT a valid principal in a cross-account trust policy?
A) Another AWS account ID
B) An IAM user in another AWS account
C) An IAM role in another AWS account
D) An EC2 instance ID
Correct Answer: D
Rationale: An EC2 instance ID is not a valid principal in a trust policy. Valid principals
include AWS accounts, IAM users, IAM roles, federated users, and AWS services. EC2
instances assume roles via instance profiles; the role is the principal, not the instance ID.
3|Page
, 6. A solutions architect needs to allow a Lambda function in Account A to read from an S3
bucket in Account B. What is the correct approach?
A) Create an IAM user in Account B and store the credentials in the Lambda function
B) Create an IAM role in Account B with a trust policy allowing the Lambda function's
execution role in Account A to assume it
C) Make the S3 bucket public
D) Use the root account of Account B to grant access
Correct Answer: B
Rationale: The Lambda function's execution role in Account A must have sts:AssumeRole
permission to assume the cross-account role in Account B. The role in Account B must have a
trust policy that allows the Lambda execution role ARN from Account A to assume it. This
follows the principle of least privilege and uses temporary credentials.
7. When configuring cross-account access using an IAM role, which two policies are
required?
A) An identity-based policy and a resource-based policy
B) A trust policy and a permissions policy
C) An inline policy and a managed policy
D) A service control policy and a permissions boundary
Correct Answer: B
Rationale: A cross-account IAM role requires two policies: a trust policy (which defines who
can assume the role) and a permissions policy (which defines what actions the role can
perform once assumed).
8. A company wants to allow its employees to assume roles in other AWS accounts from a
central identity provider account. What is the recommended approach?
A) Create IAM users in each account
B) Use IAM Identity Center with permission sets
C) Create cross-account roles with trust policies for each account
D) Use AWS Organizations with service control policies
4|Page
COMPREHENSIVE PRACTICE EXAMINATION STUDY GUIDE
| LATEST UPDATE 2025/2026 | ACTUAL EXAM PRACTICE
QUESTIONS AND ANSWERS | EXAM REVIEW | 100%
CORRECT ANSWERS | LATEST SOLUTION 2026.
This comprehensive practice examination is designed for candidates preparing for the AWS
Certified Solutions Architect – Associate (SAA-C03) exam, with a focused emphasis on cross-
account access patterns. Cross-account access is a critical component of the "Design Secure
Architectures" domain, which constitutes approximately 30% of the SAA-C03 exam. This
resource covers all essential cross-account access mechanisms including IAM roles with trust
policies, resource-based policies (S3 bucket policies, KMS key policies, SQS queue policies,
SNS topic policies), AWS Organizations and Service Control Policies (SCPs), AWS STS and
temporary credentials, the sts:ExternalId condition for third-party access, permission
boundaries, and IAM Access Analyzer for monitoring external access. Questions are written at
the level expected for the certification examination, emphasizing real-world scenario
application, security best practices, least privilege principles, and troubleshooting access
denied errors. This resource is intended to help candidates assess their readiness, identify
knowledge gaps, and strengthen their preparation for the certification examination.
Table of Contents
1. Cross-Account Access Fundamentals and IAM Roles
2. Trust Policies, Permissions Policies, and sts:AssumeRole
3. Resource-Based Policies (S3, KMS, SQS, SNS)
4. AWS STS and Temporary Credentials
5. AWS Organizations and Service Control Policies (SCPs)
6. Cross-Account Access with Specific AWS Services
7. Security Best Practices: Least Privilege, ExternalId, and Monitoring
1|Page
, 8. Troubleshooting Cross-Account Access
9. IAM Identity Center and Workforce Cross-Account Access
10. Comprehensive Scenario-Based Review
UNIT 1 – CROSS-ACCOUNT ACCESS FUNDAMENTALS AND IAM ROLES
1. What is the primary mechanism for granting cross-account access in AWS?
A) Sharing IAM user credentials between accounts
B) Creating IAM users in each account with the same permissions
C) Using IAM roles with trust policies that allow another account to assume them
D) Using the root account of one account to access another
Correct Answer: C
Rationale: The primary mechanism for cross-account access is creating an IAM role in the
target account (the account with the resources) with a trust policy that allows an IAM entity
from the source account to assume it. This provides secure, temporary access without sharing
long-term credentials.
2. A solutions architect needs to allow users in Account A to access resources in Account B.
What is the correct approach?
A) Create IAM users in Account B and share the credentials with users in Account A
B) Create an IAM role in Account B with a trust policy that allows Account A to assume
it
C) Create an IAM policy in Account A that grants permissions to resources in Account B
D) Use the root account of Account B to grant access
Correct Answer: B
Rationale: The correct approach is to create an IAM role in Account B (the target account)
with a trust policy that allows Account A (the source account) to assume the role. The role's
permissions policy defines what actions can be performed on the resources in Account B.
3. Which statement about cross-account IAM roles is true?
A) They provide long-term credentials that never expire
2|Page
, B) They use AWS STS to issue temporary credentials
C) They require sharing of access keys between accounts
D) They can only be used by IAM users, not AWS services
Correct Answer: B
Rationale: Cross-account IAM roles use AWS Security Token Service (STS) to issue
temporary, limited-privilege credentials. This enhances security by avoiding long-term access
key sharing.
4. A company has a centralized logging account and multiple application accounts. The
security team in the logging account needs to read CloudTrail logs stored in S3 buckets
across all application accounts. What is the most secure and scalable approach?
A) Create IAM users in each application account and share the credentials with the
security team
B) Create cross-account IAM roles in each application account with a trust policy
allowing the logging account to assume them
C) Make the S3 buckets public so the security team can access them
D) Copy all logs to the logging account using S3 replication
Correct Answer: B
Rationale: Creating cross-account IAM roles in each application account with a trust policy
allowing the logging account to assume them is the most secure and scalable approach. This
avoids managing multiple IAM users and provides temporary, auditable access.
5. Which of the following is NOT a valid principal in a cross-account trust policy?
A) Another AWS account ID
B) An IAM user in another AWS account
C) An IAM role in another AWS account
D) An EC2 instance ID
Correct Answer: D
Rationale: An EC2 instance ID is not a valid principal in a trust policy. Valid principals
include AWS accounts, IAM users, IAM roles, federated users, and AWS services. EC2
instances assume roles via instance profiles; the role is the principal, not the instance ID.
3|Page
, 6. A solutions architect needs to allow a Lambda function in Account A to read from an S3
bucket in Account B. What is the correct approach?
A) Create an IAM user in Account B and store the credentials in the Lambda function
B) Create an IAM role in Account B with a trust policy allowing the Lambda function's
execution role in Account A to assume it
C) Make the S3 bucket public
D) Use the root account of Account B to grant access
Correct Answer: B
Rationale: The Lambda function's execution role in Account A must have sts:AssumeRole
permission to assume the cross-account role in Account B. The role in Account B must have a
trust policy that allows the Lambda execution role ARN from Account A to assume it. This
follows the principle of least privilege and uses temporary credentials.
7. When configuring cross-account access using an IAM role, which two policies are
required?
A) An identity-based policy and a resource-based policy
B) A trust policy and a permissions policy
C) An inline policy and a managed policy
D) A service control policy and a permissions boundary
Correct Answer: B
Rationale: A cross-account IAM role requires two policies: a trust policy (which defines who
can assume the role) and a permissions policy (which defines what actions the role can
perform once assumed).
8. A company wants to allow its employees to assume roles in other AWS accounts from a
central identity provider account. What is the recommended approach?
A) Create IAM users in each account
B) Use IAM Identity Center with permission sets
C) Create cross-account roles with trust policies for each account
D) Use AWS Organizations with service control policies
4|Page
