AWS SAA-C03 — IAM GROUPS — STUDY GUIDE |
LATEST UPDATE 2026/2027 | ACTUAL EXAM |
PRACTICE QUESTIONS AND ANSWERS | EXAM
REVIEW | 100% CORRECT ANSWERS WITH
RATIONALES.
Course/Program: AWS Solutions Architect Associate (SAA-C03)
Field of Study: AWS Identity and Access Management, IAM Groups, Cloud Security, AWS
Permissions
Level: Associate Certification, AWS Solutions Architect, Cloud Practitioner
Edition: 2026–2027
Introduction
This comprehensive practice examination is designed for candidates preparing for the AWS
Certified Solutions Architect – Associate (SAA-C03) exam, with a specific focus on IAM
Groups. It contains 100 advanced multiple-choice questions covering IAM group creation and
management, user membership, inline versus managed policies, permissions boundaries,
group-based access control, least privilege principles, policy evaluation logic, identity-based
versus resource-based policies, cross-account access, and real-world AWS security scenarios.
Each question reflects current AWS best practices and the AWS Well-Architected Framework
security pillar, with detailed rationales to reinforce correct architectural decisions. Use this
document to assess readiness, identify knowledge gaps, and strengthen preparation for the
2026–2027 examination cycle. All questions are original practice items and are not from
actual AWS exams.
Table of Contents
1. IAM Groups Fundamentals
2. Group Membership and User Management
3. IAM Policies and Permissions
4. Managed vs Inline Policies
,5. Policy Evaluation and Effective Permissions
6. Permissions Boundaries and Service Control Policies
7. Cross-Account Access and Roles
8. Security Best Practices and Least Privilege
9. Troubleshooting Access Denied
10. Scenario-Based Architecture Decisions
1.
Which AWS service is used to manage users, groups, roles, and their permissions?
A) Amazon Cognito
B) AWS Identity and Access Management (IAM)
C) AWS Organizations
D) AWS Directory Service
Correct Answer: B
Rationale: AWS IAM is the core service for controlling access to AWS resources through
users, groups, roles, and policies. Cognito handles app user pools; Organizations manages
multi-account; Directory Service integrates Microsoft AD.
2.
What is an IAM group?
A) A container that holds only EC2 instances
B) A collection of IAM users to whom you can attach common permissions
C) A type of security group for VPCs
D) A resource-based policy for S3 buckets
Correct Answer: B
Rationale: An IAM group is a logical collection of IAM users. Attaching policies to a group
grants those permissions to all group members, simplifying management. Groups are not EC2
or VPC constructs and are distinct from S3 policies.
3.
,How many IAM groups can a single IAM user belong to?
A) Only one
B) Up to five
C) Up to ten
D) Any number, subject to default IAM limits (10, adjustable)
Correct Answer: D
Rationale: An IAM user can be a member of multiple groups (default limit 10 per user,
adjustable). This allows flexible permission combinations. Options A, B, and C are
underestimates of the default limit.
4.
Which of the following is NOT a valid way to assign permissions to an IAM group?
A) Attaching an AWS managed policy directly to the group
B) Attaching an inline policy to the group
C) Adding the group to another group
D) Attaching multiple managed policies to the group
Correct Answer: C
Rationale: IAM groups cannot be nested; a group cannot be a member of another group.
Permissions are assigned via inline or managed policies attached to the group. Users can be in
multiple groups but groups cannot contain groups.
5.
A solutions architect needs to grant the same permissions to a team of 20 developers. What is the
most efficient approach?
A) Create 20 separate IAM users and attach policies individually
B) Create one IAM group, attach the required policies, and add all 20 users to the group
C) Create one IAM role and share credentials among users
D) Attach the policies to the AWS account root user only
Correct Answer: B
Rationale: Using an IAM group centralizes permission management—attach policies once,
, then add users to the group. Individual attachment is inefficient and error-prone; sharing
credentials violates security; root user should not be used for routine tasks.
6.
Which of the following is a best practice for IAM group permissions?
A) Grant broad admin privileges to all groups for convenience
B) Follow least privilege: grant only the permissions needed for specific job functions
C) Attach the AdministratorAccess policy to every group
D) Avoid groups and use inline policies for each user
Correct Answer: B
Rationale: Least privilege grants minimum necessary permissions, reducing risk. Broad
admin or individual inline policies are not efficient or secure. Groups enable least privilege at
scale.
7.
What happens to an IAM user's permissions when they are removed from a group?
A) They retain group permissions for 24 hours
B) They immediately lose permissions granted only through that group
C) Their permissions are unchanged
D) The group is automatically deleted
Correct Answer: B
Rationale: Group membership determines group-based permissions. Removing a user from a
group revokes those permissions immediately. The user may still have permissions from other
groups or direct policies. The group itself is not deleted.
8.
Which IAM entity can be a member of an IAM group?
A) IAM role
B) IAM user only
C) Another group
D) AWS account root user
LATEST UPDATE 2026/2027 | ACTUAL EXAM |
PRACTICE QUESTIONS AND ANSWERS | EXAM
REVIEW | 100% CORRECT ANSWERS WITH
RATIONALES.
Course/Program: AWS Solutions Architect Associate (SAA-C03)
Field of Study: AWS Identity and Access Management, IAM Groups, Cloud Security, AWS
Permissions
Level: Associate Certification, AWS Solutions Architect, Cloud Practitioner
Edition: 2026–2027
Introduction
This comprehensive practice examination is designed for candidates preparing for the AWS
Certified Solutions Architect – Associate (SAA-C03) exam, with a specific focus on IAM
Groups. It contains 100 advanced multiple-choice questions covering IAM group creation and
management, user membership, inline versus managed policies, permissions boundaries,
group-based access control, least privilege principles, policy evaluation logic, identity-based
versus resource-based policies, cross-account access, and real-world AWS security scenarios.
Each question reflects current AWS best practices and the AWS Well-Architected Framework
security pillar, with detailed rationales to reinforce correct architectural decisions. Use this
document to assess readiness, identify knowledge gaps, and strengthen preparation for the
2026–2027 examination cycle. All questions are original practice items and are not from
actual AWS exams.
Table of Contents
1. IAM Groups Fundamentals
2. Group Membership and User Management
3. IAM Policies and Permissions
4. Managed vs Inline Policies
,5. Policy Evaluation and Effective Permissions
6. Permissions Boundaries and Service Control Policies
7. Cross-Account Access and Roles
8. Security Best Practices and Least Privilege
9. Troubleshooting Access Denied
10. Scenario-Based Architecture Decisions
1.
Which AWS service is used to manage users, groups, roles, and their permissions?
A) Amazon Cognito
B) AWS Identity and Access Management (IAM)
C) AWS Organizations
D) AWS Directory Service
Correct Answer: B
Rationale: AWS IAM is the core service for controlling access to AWS resources through
users, groups, roles, and policies. Cognito handles app user pools; Organizations manages
multi-account; Directory Service integrates Microsoft AD.
2.
What is an IAM group?
A) A container that holds only EC2 instances
B) A collection of IAM users to whom you can attach common permissions
C) A type of security group for VPCs
D) A resource-based policy for S3 buckets
Correct Answer: B
Rationale: An IAM group is a logical collection of IAM users. Attaching policies to a group
grants those permissions to all group members, simplifying management. Groups are not EC2
or VPC constructs and are distinct from S3 policies.
3.
,How many IAM groups can a single IAM user belong to?
A) Only one
B) Up to five
C) Up to ten
D) Any number, subject to default IAM limits (10, adjustable)
Correct Answer: D
Rationale: An IAM user can be a member of multiple groups (default limit 10 per user,
adjustable). This allows flexible permission combinations. Options A, B, and C are
underestimates of the default limit.
4.
Which of the following is NOT a valid way to assign permissions to an IAM group?
A) Attaching an AWS managed policy directly to the group
B) Attaching an inline policy to the group
C) Adding the group to another group
D) Attaching multiple managed policies to the group
Correct Answer: C
Rationale: IAM groups cannot be nested; a group cannot be a member of another group.
Permissions are assigned via inline or managed policies attached to the group. Users can be in
multiple groups but groups cannot contain groups.
5.
A solutions architect needs to grant the same permissions to a team of 20 developers. What is the
most efficient approach?
A) Create 20 separate IAM users and attach policies individually
B) Create one IAM group, attach the required policies, and add all 20 users to the group
C) Create one IAM role and share credentials among users
D) Attach the policies to the AWS account root user only
Correct Answer: B
Rationale: Using an IAM group centralizes permission management—attach policies once,
, then add users to the group. Individual attachment is inefficient and error-prone; sharing
credentials violates security; root user should not be used for routine tasks.
6.
Which of the following is a best practice for IAM group permissions?
A) Grant broad admin privileges to all groups for convenience
B) Follow least privilege: grant only the permissions needed for specific job functions
C) Attach the AdministratorAccess policy to every group
D) Avoid groups and use inline policies for each user
Correct Answer: B
Rationale: Least privilege grants minimum necessary permissions, reducing risk. Broad
admin or individual inline policies are not efficient or secure. Groups enable least privilege at
scale.
7.
What happens to an IAM user's permissions when they are removed from a group?
A) They retain group permissions for 24 hours
B) They immediately lose permissions granted only through that group
C) Their permissions are unchanged
D) The group is automatically deleted
Correct Answer: B
Rationale: Group membership determines group-based permissions. Removing a user from a
group revokes those permissions immediately. The user may still have permissions from other
groups or direct policies. The group itself is not deleted.
8.
Which IAM entity can be a member of an IAM group?
A) IAM role
B) IAM user only
C) Another group
D) AWS account root user
