Page 1 of 42
AWS SAA-C03 — RESOURCE-BASED POLICIES EXAM —
STUDY GUIDE | LATEST UPDATE 2026/2027 | ACTUAL EXAM |
PRACTICE QUESTIONS AND ANSWERS | EXAM REVIEW |
100% CORRECT ANSWERS | VERIFIED EXAM 2026|A+
GRADED.
Course/Program: AWS Solutions Architect Associate (SAA-C03)
Field of Study: AWS Resource-Based Policies, Access Management, Cloud Security, Cross-
Account Permissions
Level: Associate Certification, AWS Solutions Architect
Edition: 2026–2027
Introduction
This advanced practice examination is designed for candidates preparing for the AWS Certified
Solutions Architect – Associate (SAA-C03) exam, with a focused emphasis on resource-based
policies. It contains 100 multiple-choice questions covering S3 bucket policies, SNS and SQS
access policies, KMS key policies, Lambda function policies, API Gateway resource policies,
IAM role trust policies, cross-account access patterns, policy evaluation logic, condition keys,
and security best practices. Each question reflects real-world AWS architecture scenarios and
current AWS best practices, with detailed rationales to reinforce correct decisions and clarify
common misconceptions. Use this document to assess readiness, identify knowledge gaps, and
strengthen preparation for the 2026–2027 examination cycle. All questions are original practice
items and are not from actual AWS exams.
Table of Contents
1. Fundamentals of Resource-Based Policies
2. S3 Bucket Policies
,Page 2 of 42
3. SNS and SQS Access Policies
4. KMS Key Policies
5. Lambda and API Gateway Resource Policies
6. IAM Role Trust Policies
7. Cross-Account Access Patterns
8. Policy Evaluation and Precedence
9. Security Best Practices
10. Scenario-Based Architecture Decisions
1.
Which of the following best defines a resource-based policy in AWS?
A) A policy attached to an IAM user, group, or role
B) A policy attached to an AWS resource, such as an S3 bucket or KMS key, that specifies who
can access that resource
C) A policy that only applies to EC2 instances
D) A policy that is always AWS managed
Correct Answer: B
Rationale: A resource-based policy is attached to an AWS resource and defines which
principals (users, roles, accounts) can perform actions on that resource. Identity-based
policies are attached to IAM identities. Resource-based policies apply to many services,
including S3, SNS, SQS, KMS, and Lambda.
2.
Which of the following is required in a resource-based policy but not in an identity-based policy?
A) Effect
B) Action
,Page 3 of 42
C) Principal
D) Resource
Correct Answer: C
Rationale: Resource-based policies require a Principal element to specify who is granted or
denied access. Identity-based policies do not include a Principal because the identity is
implied by the attachment. Effect and Action are required in both; Resource is required in
identity-based but optional in some resource-based contexts.
3.
Which AWS service uses resource-based policies to control access to individual objects and
buckets?
A) Amazon EC2
B) Amazon S3
C) Amazon RDS
D) AWS Lambda only for functions
Correct Answer: B
Rationale: Amazon S3 uses bucket policies and access point policies (both resource-based)
to grant permissions at the bucket or object level. EC2 uses security groups and IAM roles,
RDS uses DB security, and Lambda uses function policies (also resource-based) but the
most classic is S3.
4.
An S3 bucket policy contains a Deny statement for s3:* on the bucket for all principals. A
specific IAM user has an identity-based policy allowing s3:GetObject on that bucket. What is the
result?
A) The user can access the object because identity policy overrides bucket policy
B) The user is denied because an explicit Deny in the bucket policy overrides any Allow
C) The user can access if MFA is enabled
D) The action is undefined
, Page 4 of 42
Correct Answer: B
Rationale: In AWS policy evaluation, an explicit Deny in any applicable policy (identity-
based or resource-based) always overrides an Allow. Therefore, the bucket policy Deny
blocks the user's S3 access. Thus B is correct.
5.
Which of the following is a valid Principal value in an S3 bucket policy?
A) An IAM group ARN
B) An IAM user ARN, IAM role ARN, or AWS account ID
C) An organizational unit ID
D) A permission boundary ARN
Correct Answer: B
Rationale: S3 bucket policies (and resource-based policies generally) support IAM users,
IAM roles, and AWS accounts as principals. IAM groups are not valid principals in
resource-based policies. OUs and permission boundaries are not principals.
6.
What is the purpose of an Amazon SNS access policy?
A) To define which IAM users can create SNS topics
B) To control which principals or accounts can publish or subscribe to an SNS topic
C) To encrypt messages in the topic
D) To replace IAM identity-based policies for SNS users
Correct Answer: B
Rationale: SNS access policies are resource-based policies attached to SNS topics,
controlling who can publish, subscribe, or manage the topic. They complement identity-
based policies and often enable cross-account access. They do not define user creation or
encryption directly.
7.
An SQS queue policy grants SendMessage permission to an AWS account. What additional
permissions must that account's IAM users have to send messages?
AWS SAA-C03 — RESOURCE-BASED POLICIES EXAM —
STUDY GUIDE | LATEST UPDATE 2026/2027 | ACTUAL EXAM |
PRACTICE QUESTIONS AND ANSWERS | EXAM REVIEW |
100% CORRECT ANSWERS | VERIFIED EXAM 2026|A+
GRADED.
Course/Program: AWS Solutions Architect Associate (SAA-C03)
Field of Study: AWS Resource-Based Policies, Access Management, Cloud Security, Cross-
Account Permissions
Level: Associate Certification, AWS Solutions Architect
Edition: 2026–2027
Introduction
This advanced practice examination is designed for candidates preparing for the AWS Certified
Solutions Architect – Associate (SAA-C03) exam, with a focused emphasis on resource-based
policies. It contains 100 multiple-choice questions covering S3 bucket policies, SNS and SQS
access policies, KMS key policies, Lambda function policies, API Gateway resource policies,
IAM role trust policies, cross-account access patterns, policy evaluation logic, condition keys,
and security best practices. Each question reflects real-world AWS architecture scenarios and
current AWS best practices, with detailed rationales to reinforce correct decisions and clarify
common misconceptions. Use this document to assess readiness, identify knowledge gaps, and
strengthen preparation for the 2026–2027 examination cycle. All questions are original practice
items and are not from actual AWS exams.
Table of Contents
1. Fundamentals of Resource-Based Policies
2. S3 Bucket Policies
,Page 2 of 42
3. SNS and SQS Access Policies
4. KMS Key Policies
5. Lambda and API Gateway Resource Policies
6. IAM Role Trust Policies
7. Cross-Account Access Patterns
8. Policy Evaluation and Precedence
9. Security Best Practices
10. Scenario-Based Architecture Decisions
1.
Which of the following best defines a resource-based policy in AWS?
A) A policy attached to an IAM user, group, or role
B) A policy attached to an AWS resource, such as an S3 bucket or KMS key, that specifies who
can access that resource
C) A policy that only applies to EC2 instances
D) A policy that is always AWS managed
Correct Answer: B
Rationale: A resource-based policy is attached to an AWS resource and defines which
principals (users, roles, accounts) can perform actions on that resource. Identity-based
policies are attached to IAM identities. Resource-based policies apply to many services,
including S3, SNS, SQS, KMS, and Lambda.
2.
Which of the following is required in a resource-based policy but not in an identity-based policy?
A) Effect
B) Action
,Page 3 of 42
C) Principal
D) Resource
Correct Answer: C
Rationale: Resource-based policies require a Principal element to specify who is granted or
denied access. Identity-based policies do not include a Principal because the identity is
implied by the attachment. Effect and Action are required in both; Resource is required in
identity-based but optional in some resource-based contexts.
3.
Which AWS service uses resource-based policies to control access to individual objects and
buckets?
A) Amazon EC2
B) Amazon S3
C) Amazon RDS
D) AWS Lambda only for functions
Correct Answer: B
Rationale: Amazon S3 uses bucket policies and access point policies (both resource-based)
to grant permissions at the bucket or object level. EC2 uses security groups and IAM roles,
RDS uses DB security, and Lambda uses function policies (also resource-based) but the
most classic is S3.
4.
An S3 bucket policy contains a Deny statement for s3:* on the bucket for all principals. A
specific IAM user has an identity-based policy allowing s3:GetObject on that bucket. What is the
result?
A) The user can access the object because identity policy overrides bucket policy
B) The user is denied because an explicit Deny in the bucket policy overrides any Allow
C) The user can access if MFA is enabled
D) The action is undefined
, Page 4 of 42
Correct Answer: B
Rationale: In AWS policy evaluation, an explicit Deny in any applicable policy (identity-
based or resource-based) always overrides an Allow. Therefore, the bucket policy Deny
blocks the user's S3 access. Thus B is correct.
5.
Which of the following is a valid Principal value in an S3 bucket policy?
A) An IAM group ARN
B) An IAM user ARN, IAM role ARN, or AWS account ID
C) An organizational unit ID
D) A permission boundary ARN
Correct Answer: B
Rationale: S3 bucket policies (and resource-based policies generally) support IAM users,
IAM roles, and AWS accounts as principals. IAM groups are not valid principals in
resource-based policies. OUs and permission boundaries are not principals.
6.
What is the purpose of an Amazon SNS access policy?
A) To define which IAM users can create SNS topics
B) To control which principals or accounts can publish or subscribe to an SNS topic
C) To encrypt messages in the topic
D) To replace IAM identity-based policies for SNS users
Correct Answer: B
Rationale: SNS access policies are resource-based policies attached to SNS topics,
controlling who can publish, subscribe, or manage the topic. They complement identity-
based policies and often enable cross-account access. They do not define user creation or
encryption directly.
7.
An SQS queue policy grants SendMessage permission to an AWS account. What additional
permissions must that account's IAM users have to send messages?
