1|Page
AWS SAA-C03 – IAM USERS EXAM: COMPREHENSIVE
PRACTICE EXAMINATION STUDY GUIDE | LATEST
UPDATE 2025/2026 | ACTUAL EXAM PRACTICE
QUESTIONS AND ANSWERS | EXAM REVIEW | 100%
CORRECT ANSWERS | VERIFIED SOLUTIONS MOST
RECENT.
This comprehensive practice examination is designed for candidates preparing for the AWS Certified
Solutions Architect – Associate (SAA-C03) exam, with a focused emphasis on Identity and Access
Management (IAM) Users, Groups, Roles, Policies, and best practices. IAM is a critical component of the
"Design Secure Architectures" domain, which constitutes approximately 30% of the SAA-C03 exam.
Questions are written at the level expected for the certification examination, emphasizing real-world
scenario application, least privilege principles, cross-account access patterns, and secure credential
management. This resource is intended to help candidates assess their readiness, identify knowledge
gaps, and strengthen their preparation for the certification examination.
Table of Contents
1. IAM Users, Groups, and Policies Fundamentals
2. IAM Roles and Trust Relationships
3. Least Privilege and Security Best Practices
4. Cross-Account Access and AWS Organizations
5. Identity Federation and Temporary Credentials (STS)
6. Resource-Based Policies and Service-Linked Roles
7. IAM Policy Evaluation and Explicit Deny Logic
8. Password Policies, MFA, and Credential Rotation
9. IAM Security Tools (Credentials Report, Access Advisor)
10. Comprehensive Scenario-Based Review
,2|Page
11. What is the proper definition of an IAM Role?
A) IAM Users in multiple User Groups
B) An IAM entity that defines a password policy for IAM Users
C) An IAM entity that defines a set of permissions for making requests to AWS services, and will
be used by an AWS service
D) Permissions assigned to IAM Users to perform actions
Correct Answer: C
Rationale: An IAM role is an entity within AWS that defines a set of permissions for making requests to
AWS services. Unlike IAM users, roles are not associated with a specific person and can be assumed by
AWS services (e.g., EC2, Lambda) or users who need temporary permissions. Roles are a best practice
for granting permissions to AWS services and for cross-account access. Option A describes a user group,
not a role. Option B describes a password policy. Option D describes permissions assigned to a user.
2. Which of the following answers is INCORRECT regarding IAM Users?
A) IAM Users can belong to multiple User Groups
B) IAM Users don't have to belong to a User Group
C) IAM Policies can be attached directly to IAM Users
D) IAM Users access AWS services using root account credentials
Correct Answer: D
Rationale: IAM Users access AWS services using their own credentials (access keys or password), not
root account credentials. The root account credentials should be secured and used only for account-level
management tasks. Options A, B, and C are all correct statements regarding IAM Users. Users can
belong to multiple groups, they are not required to belong to any group, and policies can be attached
directly to users or to groups they belong to.
3. Which of the following is an IAM best practice?
A) Create several IAM Users for one physical person
B) Don't use the root user account
C) Share your AWS account credentials with your colleague, so they can perform a task for you
D) Do not enable MFA for easier access
Correct Answer: B
Rationale: The root user account should not be used for daily tasks. Instead, create IAM users with
appropriate permissions. Option A is incorrect; each person should have a single IAM user. Option C is
,3|Page
incorrect; credentials should never be shared. Option D is incorrect; MFA should always be enabled for
root and privileged users.
4. IAM User Groups can contain IAM Users and other User Groups. True or False?
A) True
B) False
Correct Answer: B
Rationale: IAM User Groups can contain IAM Users only. They cannot contain other User Groups.
Groups are a way to assign permissions to multiple users at once, but groups cannot be nested. This is a
common misconception.
5. What are IAM Policies?
A) A set of policies that defines how AWS accounts interact with each other
B) JSON documents that define a set of permissions for making requests to AWS services, and
can be used by IAM Users, User Groups, and IAM Roles
C) A set of policies that define a password for IAM Users
D) A set of policies defined by AWS that show how customers interact with AWS
Correct Answer: B
Rationale: IAM policies are JSON documents that define permissions. They can be attached to IAM users,
groups, or roles. The policy defines what actions are allowed or denied on which resources. Option A
describes cross-account policies. Option C describes password policies. Option D describes AWS service
documentation.
6. Which principle should you apply regarding IAM Permissions?
A) Grant most privilege
B) Grant more permissions if your employee asks you to
C) Grant least privilege
D) Restrict root account permissions
Correct Answer: C
Rationale: The principle of least privilege is a core security best practice in AWS. It means granting only
the permissions necessary for a user or service to perform its intended function. Options A and B are the
opposite of least privilege. Option D is a best practice for root account security but does not directly
address the principle of least privilege.
, 4|Page
7. What should you do to increase your root account security?
A) Remove permissions from the root account
B) Only access AWS services through AWS Command Line Interface (CLI)
C) Don't create IAM Users, only access your AWS account using the root account
D) Enable Multi-Factor Authentication (MFA)
Correct Answer: D
Rationale: Enabling Multi-Factor Authentication (MFA) on the root account is a critical security best
practice. It adds an additional layer of protection beyond the password. Options A, B, and C are
incorrect; you should not remove permissions from root (it already has full permissions), you should use
IAM users for daily tasks, and you should create IAM users.
8. A company wants to allow a deployment engineer to use AWS CloudFormation templates to
create resources. The solutions architect wants to follow the principle of least privilege. Which
two actions should be taken?
A) Have the deployment engineer use AWS account root user credentials
B) Create a new IAM user and add to a group with the PowerUsers IAM policy
C) Create a new IAM user and add to a group with the AdministratorAccess IAM policy
D) Create a new IAM user and add to a group with an IAM policy that allows AWS
CloudFormation actions only
E) Create an IAM role for the deployment engineer to explicitly define permissions specific to
AWS CloudFormation
Correct Answer: D, E
Rationale: The principle of least privilege requires granting only the minimal permissions necessary.
Creating a user with a policy that allows only CloudFormation actions (D) and using an IAM role with
explicit permissions (E) both align with least privilege. Options A, B, and C grant excessive permissions
or use the root account, which violates security best practices.
9. Why is it recommended to apply permissions to a group instead of individual users?
A) User access keys are sometimes faulty and must be reconfigured periodically
B) Group access is less time-consuming to configure than user access
C) Groups allow for centralized permission management and easier updates
D) Groups can be used across multiple AWS accounts
Correct Answer: C
Rationale: Managing permissions through groups allows administrators to assign permissions once to a
AWS SAA-C03 – IAM USERS EXAM: COMPREHENSIVE
PRACTICE EXAMINATION STUDY GUIDE | LATEST
UPDATE 2025/2026 | ACTUAL EXAM PRACTICE
QUESTIONS AND ANSWERS | EXAM REVIEW | 100%
CORRECT ANSWERS | VERIFIED SOLUTIONS MOST
RECENT.
This comprehensive practice examination is designed for candidates preparing for the AWS Certified
Solutions Architect – Associate (SAA-C03) exam, with a focused emphasis on Identity and Access
Management (IAM) Users, Groups, Roles, Policies, and best practices. IAM is a critical component of the
"Design Secure Architectures" domain, which constitutes approximately 30% of the SAA-C03 exam.
Questions are written at the level expected for the certification examination, emphasizing real-world
scenario application, least privilege principles, cross-account access patterns, and secure credential
management. This resource is intended to help candidates assess their readiness, identify knowledge
gaps, and strengthen their preparation for the certification examination.
Table of Contents
1. IAM Users, Groups, and Policies Fundamentals
2. IAM Roles and Trust Relationships
3. Least Privilege and Security Best Practices
4. Cross-Account Access and AWS Organizations
5. Identity Federation and Temporary Credentials (STS)
6. Resource-Based Policies and Service-Linked Roles
7. IAM Policy Evaluation and Explicit Deny Logic
8. Password Policies, MFA, and Credential Rotation
9. IAM Security Tools (Credentials Report, Access Advisor)
10. Comprehensive Scenario-Based Review
,2|Page
11. What is the proper definition of an IAM Role?
A) IAM Users in multiple User Groups
B) An IAM entity that defines a password policy for IAM Users
C) An IAM entity that defines a set of permissions for making requests to AWS services, and will
be used by an AWS service
D) Permissions assigned to IAM Users to perform actions
Correct Answer: C
Rationale: An IAM role is an entity within AWS that defines a set of permissions for making requests to
AWS services. Unlike IAM users, roles are not associated with a specific person and can be assumed by
AWS services (e.g., EC2, Lambda) or users who need temporary permissions. Roles are a best practice
for granting permissions to AWS services and for cross-account access. Option A describes a user group,
not a role. Option B describes a password policy. Option D describes permissions assigned to a user.
2. Which of the following answers is INCORRECT regarding IAM Users?
A) IAM Users can belong to multiple User Groups
B) IAM Users don't have to belong to a User Group
C) IAM Policies can be attached directly to IAM Users
D) IAM Users access AWS services using root account credentials
Correct Answer: D
Rationale: IAM Users access AWS services using their own credentials (access keys or password), not
root account credentials. The root account credentials should be secured and used only for account-level
management tasks. Options A, B, and C are all correct statements regarding IAM Users. Users can
belong to multiple groups, they are not required to belong to any group, and policies can be attached
directly to users or to groups they belong to.
3. Which of the following is an IAM best practice?
A) Create several IAM Users for one physical person
B) Don't use the root user account
C) Share your AWS account credentials with your colleague, so they can perform a task for you
D) Do not enable MFA for easier access
Correct Answer: B
Rationale: The root user account should not be used for daily tasks. Instead, create IAM users with
appropriate permissions. Option A is incorrect; each person should have a single IAM user. Option C is
,3|Page
incorrect; credentials should never be shared. Option D is incorrect; MFA should always be enabled for
root and privileged users.
4. IAM User Groups can contain IAM Users and other User Groups. True or False?
A) True
B) False
Correct Answer: B
Rationale: IAM User Groups can contain IAM Users only. They cannot contain other User Groups.
Groups are a way to assign permissions to multiple users at once, but groups cannot be nested. This is a
common misconception.
5. What are IAM Policies?
A) A set of policies that defines how AWS accounts interact with each other
B) JSON documents that define a set of permissions for making requests to AWS services, and
can be used by IAM Users, User Groups, and IAM Roles
C) A set of policies that define a password for IAM Users
D) A set of policies defined by AWS that show how customers interact with AWS
Correct Answer: B
Rationale: IAM policies are JSON documents that define permissions. They can be attached to IAM users,
groups, or roles. The policy defines what actions are allowed or denied on which resources. Option A
describes cross-account policies. Option C describes password policies. Option D describes AWS service
documentation.
6. Which principle should you apply regarding IAM Permissions?
A) Grant most privilege
B) Grant more permissions if your employee asks you to
C) Grant least privilege
D) Restrict root account permissions
Correct Answer: C
Rationale: The principle of least privilege is a core security best practice in AWS. It means granting only
the permissions necessary for a user or service to perform its intended function. Options A and B are the
opposite of least privilege. Option D is a best practice for root account security but does not directly
address the principle of least privilege.
, 4|Page
7. What should you do to increase your root account security?
A) Remove permissions from the root account
B) Only access AWS services through AWS Command Line Interface (CLI)
C) Don't create IAM Users, only access your AWS account using the root account
D) Enable Multi-Factor Authentication (MFA)
Correct Answer: D
Rationale: Enabling Multi-Factor Authentication (MFA) on the root account is a critical security best
practice. It adds an additional layer of protection beyond the password. Options A, B, and C are
incorrect; you should not remove permissions from root (it already has full permissions), you should use
IAM users for daily tasks, and you should create IAM users.
8. A company wants to allow a deployment engineer to use AWS CloudFormation templates to
create resources. The solutions architect wants to follow the principle of least privilege. Which
two actions should be taken?
A) Have the deployment engineer use AWS account root user credentials
B) Create a new IAM user and add to a group with the PowerUsers IAM policy
C) Create a new IAM user and add to a group with the AdministratorAccess IAM policy
D) Create a new IAM user and add to a group with an IAM policy that allows AWS
CloudFormation actions only
E) Create an IAM role for the deployment engineer to explicitly define permissions specific to
AWS CloudFormation
Correct Answer: D, E
Rationale: The principle of least privilege requires granting only the minimal permissions necessary.
Creating a user with a policy that allows only CloudFormation actions (D) and using an IAM role with
explicit permissions (E) both align with least privilege. Options A, B, and C grant excessive permissions
or use the root account, which violates security best practices.
9. Why is it recommended to apply permissions to a group instead of individual users?
A) User access keys are sometimes faulty and must be reconfigured periodically
B) Group access is less time-consuming to configure than user access
C) Groups allow for centralized permission management and easier updates
D) Groups can be used across multiple AWS accounts
Correct Answer: C
Rationale: Managing permissions through groups allows administrators to assign permissions once to a
