1|Page
AWS SAA-C03 — ROLE ASSUMPTION EXAM:
COMPREHENSIVE PRACTICE EXAMINATION STUDY GUIDE
| LATEST UPDATE 2025/2026 | ACTUAL EXAM PRACTICE
QUESTIONS AND ANSWERS | EXAM REVIEW | 100%
CORRECT ANSWERS | VERIFIED SOLUTIONS BY PROF J.K
RYIAN A+ GRADE GUARANTEED.
This comprehensive practice examination is designed for candidates preparing for the AWS
Certified Solutions Architect – Associate (SAA-C03) exam, with a focused emphasis on IAM Role
Assumption. Role assumption is a critical security mechanism within the "Design Secure
Architectures" domain, which constitutes approximately 30% of the SAA-C03 exam. This
resource covers all essential aspects of role assumption including trust policies, permissions
policies, sts:AssumeRole, cross-account access patterns, the confused deputy problem,
sts:ExternalId, service roles, instance profiles, IAM Identity Center, and temporary credentials.
Questions are written at the level expected for the certification examination, emphasizing real-
world scenario application, security best practices, and least privilege principles. This resource
is intended to help candidates assess their readiness, identify knowledge gaps, and strengthen
their preparation for the certification examination.
Table of Contents
1. Role Assumption Fundamentals and Core Concepts
2. Trust Policies and Permissions Policies
3. sts:AssumeRole and Temporary Credentials
4. Cross-Account Role Assumption
5. Service Roles and Instance Profiles
6. Third-Party Access and the Confused Deputy Problem
7. IAM Identity Center and Workforce Role Assumption
,2|Page
8. Role Assumption Security Best Practices
9. Troubleshooting Role Assumption
10. Comprehensive Scenario-Based Review
1. What is the primary purpose of an IAM role in AWS?
A) To create a permanent user account for a person
B) To define a set of permissions that can be assumed by users, applications, or
services temporarily
C) To store access keys for long-term use
D) To manage password policies for IAM users
Correct Answer: B
Rationale: An IAM role is an entity that defines a set of permissions for making requests to
AWS services. Unlike IAM users, roles are not associated with a specific person and can be
assumed temporarily by users, applications, or AWS services. Roles provide temporary security
credentials, reducing the risk associated with long-term credentials.
2. Which AWS service is responsible for issuing temporary credentials when an IAM role is
assumed?
A) AWS Identity and Access Management (IAM)
B) AWS Security Token Service (STS)
C) AWS Certificate Manager (ACM)
D) AWS Key Management Service (KMS)
Correct Answer: B
Rationale: AWS Security Token Service (STS) is the service that issues temporary, limited-
,3|Page
privilege credentials when an IAM role is assumed. STS is used for cross-account access,
federated access, and granting temporary permissions.
3. A solutions architect needs to allow an EC2 instance to access an S3 bucket. What is the
best practice for granting permissions?
A) Store S3 credentials in an environment variable on the instance
B) Create an IAM role with S3 permissions and attach it to the EC2 instance profile
C) Create an IAM user with S3 permissions and store the access keys on the instance
D) Allow all traffic from the EC2 instance to S3
Correct Answer: B
Rationale: The best practice is to create an IAM role with the necessary permissions and
attach it to the EC2 instance profile. This avoids storing long-term credentials on the instance.
IAM roles are the recommended way for AWS services like EC2 and Lambda to access other
AWS services.
4. Which of the following can assume an IAM role? (Choose two.)
A) An IAM user in the same AWS account
B) An IAM user in a different AWS account
C) An AWS service (e.g., EC2, Lambda)
D) An IAM group
Correct Answer: A, B, C
Rationale: IAM roles can be assumed by IAM users in the same account, IAM users in a
different account, and AWS services. IAM groups cannot assume roles; groups are not
principals and cannot make requests. IAM Identity Center users and federated identities can
also assume roles through temporary credential issuance.
5. When a user assumes an IAM role, what type of credentials do they receive?
A) Long-term IAM user credentials
B) Temporary credentials from AWS STS
C) Root account credentials
D) API keys that never expire
, 4|Page
Correct Answer: B
Rationale: When a user assumes an IAM role, they receive temporary credentials from AWS
STS. These credentials have a limited lifetime and are automatically rotated, reducing the risk
of credential compromise. This is a key security benefit of using roles instead of long-term
access keys.
6. What is the default maximum session duration for an IAM role when assumed using the
AWS CLI?
A) 1 hour
B) 2 hours
C) 12 hours
D) 24 hours
Correct Answer: C
Rationale: The maximum session duration for an IAM role when assumed using the AWS CLI
is 12 hours. The default is 1 hour, but it can be increased up to 12 hours using the duration-
seconds parameter. This allows for long-running tasks without interrupting the session.
7. A solutions architect needs to allow a Lambda function to access a DynamoDB table.
What is the correct approach?
A) Create an IAM user with DynamoDB permissions and store the credentials in the
Lambda function code
B) Create an IAM role with DynamoDB permissions and attach it as the Lambda
execution role
C) Make the DynamoDB table public
D) Use the root account to access DynamoDB
Correct Answer: B
Rationale: The correct approach is to create an IAM role with DynamoDB permissions and
attach it as the Lambda execution role. Lambda functions assume this role when they run,
obtaining temporary credentials to access DynamoDB. This follows the principle of least
privilege and avoids storing credentials in code.
AWS SAA-C03 — ROLE ASSUMPTION EXAM:
COMPREHENSIVE PRACTICE EXAMINATION STUDY GUIDE
| LATEST UPDATE 2025/2026 | ACTUAL EXAM PRACTICE
QUESTIONS AND ANSWERS | EXAM REVIEW | 100%
CORRECT ANSWERS | VERIFIED SOLUTIONS BY PROF J.K
RYIAN A+ GRADE GUARANTEED.
This comprehensive practice examination is designed for candidates preparing for the AWS
Certified Solutions Architect – Associate (SAA-C03) exam, with a focused emphasis on IAM Role
Assumption. Role assumption is a critical security mechanism within the "Design Secure
Architectures" domain, which constitutes approximately 30% of the SAA-C03 exam. This
resource covers all essential aspects of role assumption including trust policies, permissions
policies, sts:AssumeRole, cross-account access patterns, the confused deputy problem,
sts:ExternalId, service roles, instance profiles, IAM Identity Center, and temporary credentials.
Questions are written at the level expected for the certification examination, emphasizing real-
world scenario application, security best practices, and least privilege principles. This resource
is intended to help candidates assess their readiness, identify knowledge gaps, and strengthen
their preparation for the certification examination.
Table of Contents
1. Role Assumption Fundamentals and Core Concepts
2. Trust Policies and Permissions Policies
3. sts:AssumeRole and Temporary Credentials
4. Cross-Account Role Assumption
5. Service Roles and Instance Profiles
6. Third-Party Access and the Confused Deputy Problem
7. IAM Identity Center and Workforce Role Assumption
,2|Page
8. Role Assumption Security Best Practices
9. Troubleshooting Role Assumption
10. Comprehensive Scenario-Based Review
1. What is the primary purpose of an IAM role in AWS?
A) To create a permanent user account for a person
B) To define a set of permissions that can be assumed by users, applications, or
services temporarily
C) To store access keys for long-term use
D) To manage password policies for IAM users
Correct Answer: B
Rationale: An IAM role is an entity that defines a set of permissions for making requests to
AWS services. Unlike IAM users, roles are not associated with a specific person and can be
assumed temporarily by users, applications, or AWS services. Roles provide temporary security
credentials, reducing the risk associated with long-term credentials.
2. Which AWS service is responsible for issuing temporary credentials when an IAM role is
assumed?
A) AWS Identity and Access Management (IAM)
B) AWS Security Token Service (STS)
C) AWS Certificate Manager (ACM)
D) AWS Key Management Service (KMS)
Correct Answer: B
Rationale: AWS Security Token Service (STS) is the service that issues temporary, limited-
,3|Page
privilege credentials when an IAM role is assumed. STS is used for cross-account access,
federated access, and granting temporary permissions.
3. A solutions architect needs to allow an EC2 instance to access an S3 bucket. What is the
best practice for granting permissions?
A) Store S3 credentials in an environment variable on the instance
B) Create an IAM role with S3 permissions and attach it to the EC2 instance profile
C) Create an IAM user with S3 permissions and store the access keys on the instance
D) Allow all traffic from the EC2 instance to S3
Correct Answer: B
Rationale: The best practice is to create an IAM role with the necessary permissions and
attach it to the EC2 instance profile. This avoids storing long-term credentials on the instance.
IAM roles are the recommended way for AWS services like EC2 and Lambda to access other
AWS services.
4. Which of the following can assume an IAM role? (Choose two.)
A) An IAM user in the same AWS account
B) An IAM user in a different AWS account
C) An AWS service (e.g., EC2, Lambda)
D) An IAM group
Correct Answer: A, B, C
Rationale: IAM roles can be assumed by IAM users in the same account, IAM users in a
different account, and AWS services. IAM groups cannot assume roles; groups are not
principals and cannot make requests. IAM Identity Center users and federated identities can
also assume roles through temporary credential issuance.
5. When a user assumes an IAM role, what type of credentials do they receive?
A) Long-term IAM user credentials
B) Temporary credentials from AWS STS
C) Root account credentials
D) API keys that never expire
, 4|Page
Correct Answer: B
Rationale: When a user assumes an IAM role, they receive temporary credentials from AWS
STS. These credentials have a limited lifetime and are automatically rotated, reducing the risk
of credential compromise. This is a key security benefit of using roles instead of long-term
access keys.
6. What is the default maximum session duration for an IAM role when assumed using the
AWS CLI?
A) 1 hour
B) 2 hours
C) 12 hours
D) 24 hours
Correct Answer: C
Rationale: The maximum session duration for an IAM role when assumed using the AWS CLI
is 12 hours. The default is 1 hour, but it can be increased up to 12 hours using the duration-
seconds parameter. This allows for long-running tasks without interrupting the session.
7. A solutions architect needs to allow a Lambda function to access a DynamoDB table.
What is the correct approach?
A) Create an IAM user with DynamoDB permissions and store the credentials in the
Lambda function code
B) Create an IAM role with DynamoDB permissions and attach it as the Lambda
execution role
C) Make the DynamoDB table public
D) Use the root account to access DynamoDB
Correct Answer: B
Rationale: The correct approach is to create an IAM role with DynamoDB permissions and
attach it as the Lambda execution role. Lambda functions assume this role when they run,
obtaining temporary credentials to access DynamoDB. This follows the principle of least
privilege and avoids storing credentials in code.
