Page 1 of 40
AWS SAA-C03 — IAM POLICIES EXAM — STUDY GUIDE |
LATEST UPDATE 2026/2027 | ACTUAL EXAM | PRACTICE
QUESTIONS AND ANSWERS | EXAM REVIEW | 100%
CORRECT ANSWERS | VERIFIED SOLUTIONS|GRADED A+.
Course/Program: AWS Solutions Architect Associate (SAA-C03)
Field of Study: AWS Identity and Access Management, IAM Policies, Cloud Security,
Permissions Management
Level: Associate Certification, AWS Solutions Architect
Edition: 2026–2027
Introduction
This advanced practice examination is designed for candidates preparing for the AWS Certified
Solutions Architect – Associate (SAA-C03) exam, with a focused emphasis on AWS Identity and
Access Management (IAM) policies. It contains 100 multiple-choice questions covering policy
types, policy evaluation logic, policy elements, condition keys, managed versus inline policies,
identity-based versus resource-based policies, permissions boundaries, service control policies,
cross-account access, policy simulation, and real-world security scenarios. Each question is
written at a rigorous level to reflect current AWS best practices and the AWS Well-Architected
Framework security pillar. Detailed rationales reinforce correct architectural decisions and
clarify common misconceptions. Use this document to assess readiness, identify knowledge gaps,
and strengthen preparation for the 2026–2027 examination cycle. All questions are original
practice items and are not from actual AWS exams.
Table of Contents
1. IAM Policy Fundamentals and Types
2. Policy Elements and Syntax
3. Policy Evaluation Logic and Precedence
4. Identity-Based vs Resource-Based Policies
5. Managed vs Inline Policies
6. Permissions Boundaries and SCPs
,Page 2 of 40
7. Conditions and Policy Variables
8. Cross-Account Access and Roles
9. Troubleshooting and Policy Simulation
10. Security Best Practices and Scenarios
1.
Which AWS service is the primary mechanism for defining permissions and access control in an
AWS account?
A) AWS Organizations
B) AWS Identity and Access Management (IAM)
C) Amazon Cognito
D) AWS Directory Service
Correct Answer: B
Rationale: IAM is the core service for controlling access to AWS resources through policies
attached to users, groups, and roles. Organizations manages multi-account governance;
Cognito handles application user pools; Directory Service integrates Microsoft AD.
2.
What are the two main types of IAM policies?
A) Inline policies and managed policies
B) Identity-based policies and resource-based policies
C) Service control policies and session policies
D) All of the above are valid IAM policy classifications
Correct Answer: D
Rationale: IAM policy types include identity-based (attached to IAM entities), resource-
based (attached to resources), permissions boundaries, service control policies (SCPs),
session policies, and more. Managed vs inline is another classification. Thus all listed are
valid classifications.
3.
,Page 3 of 40
Which of the following is an identity-based policy?
A) A policy attached to an S3 bucket
B) A policy attached to an IAM user, group, or role
C) A policy attached to an organizational unit
D) A policy attached to a KMS key
Correct Answer: B
Rationale: Identity-based policies are attached to IAM identities (users, groups, roles) and
define what actions those identities can perform. Resource-based policies attach to AWS
resources like S3 buckets or KMS keys. SCPs attach to OUs.
4.
Which AWS service enables centralized policy management across multiple AWS accounts?
A) IAM Access Analyzer
B) AWS Organizations with Service Control Policies (SCPs)
C) AWS Config
D) Amazon Inspector
Correct Answer: B
Rationale: AWS Organizations allows you to apply SCPs at the organizational unit or
account level, setting guardrails for permissions across member accounts. IAM Access
Analyzer analyzes policies; AWS Config records resource configurations; Inspector assesses
vulnerabilities.
5.
What is the maximum size of an IAM policy document?
A) 2 KB
B) 10 KB
C) 20 KB
D) 50 KB
Correct Answer: C
Rationale: An IAM policy document can be up to 20,000 characters (approximately 20
, Page 4 of 40
KB). This limit applies to inline and managed policies. Exceeding this requires splitting
policies or using multiple policies.
6.
Which of the following is a required element in an IAM policy statement?
A) Sid
B) Effect
C) Condition
D) Principal
Correct Answer: B
Rationale: The Effect element (Allow or Deny) is required in every IAM policy statement.
Sid, Condition, and Principal are optional; Principal is required only for resource-based
policies, not identity-based policies.
7.
In an IAM policy, what does the "Action" element specify?
A) The AWS account number
B) The specific API operations the policy allows or denies
C) The resources the policy applies to
D) The time range when the policy is valid
Correct Answer: B
Rationale: The Action element lists the specific API calls (e.g., s3:GetObject,
ec2:RunInstances) that the statement allows or denies. Resource specifies the target;
Condition adds conditions; Principal specifies who.
8.
What is the default effect for any AWS API action not explicitly allowed by an IAM policy?
A) Allowed by default
B) Denied by default
C) Undefined until a support ticket is opened
D) Allowed only for the root user
AWS SAA-C03 — IAM POLICIES EXAM — STUDY GUIDE |
LATEST UPDATE 2026/2027 | ACTUAL EXAM | PRACTICE
QUESTIONS AND ANSWERS | EXAM REVIEW | 100%
CORRECT ANSWERS | VERIFIED SOLUTIONS|GRADED A+.
Course/Program: AWS Solutions Architect Associate (SAA-C03)
Field of Study: AWS Identity and Access Management, IAM Policies, Cloud Security,
Permissions Management
Level: Associate Certification, AWS Solutions Architect
Edition: 2026–2027
Introduction
This advanced practice examination is designed for candidates preparing for the AWS Certified
Solutions Architect – Associate (SAA-C03) exam, with a focused emphasis on AWS Identity and
Access Management (IAM) policies. It contains 100 multiple-choice questions covering policy
types, policy evaluation logic, policy elements, condition keys, managed versus inline policies,
identity-based versus resource-based policies, permissions boundaries, service control policies,
cross-account access, policy simulation, and real-world security scenarios. Each question is
written at a rigorous level to reflect current AWS best practices and the AWS Well-Architected
Framework security pillar. Detailed rationales reinforce correct architectural decisions and
clarify common misconceptions. Use this document to assess readiness, identify knowledge gaps,
and strengthen preparation for the 2026–2027 examination cycle. All questions are original
practice items and are not from actual AWS exams.
Table of Contents
1. IAM Policy Fundamentals and Types
2. Policy Elements and Syntax
3. Policy Evaluation Logic and Precedence
4. Identity-Based vs Resource-Based Policies
5. Managed vs Inline Policies
6. Permissions Boundaries and SCPs
,Page 2 of 40
7. Conditions and Policy Variables
8. Cross-Account Access and Roles
9. Troubleshooting and Policy Simulation
10. Security Best Practices and Scenarios
1.
Which AWS service is the primary mechanism for defining permissions and access control in an
AWS account?
A) AWS Organizations
B) AWS Identity and Access Management (IAM)
C) Amazon Cognito
D) AWS Directory Service
Correct Answer: B
Rationale: IAM is the core service for controlling access to AWS resources through policies
attached to users, groups, and roles. Organizations manages multi-account governance;
Cognito handles application user pools; Directory Service integrates Microsoft AD.
2.
What are the two main types of IAM policies?
A) Inline policies and managed policies
B) Identity-based policies and resource-based policies
C) Service control policies and session policies
D) All of the above are valid IAM policy classifications
Correct Answer: D
Rationale: IAM policy types include identity-based (attached to IAM entities), resource-
based (attached to resources), permissions boundaries, service control policies (SCPs),
session policies, and more. Managed vs inline is another classification. Thus all listed are
valid classifications.
3.
,Page 3 of 40
Which of the following is an identity-based policy?
A) A policy attached to an S3 bucket
B) A policy attached to an IAM user, group, or role
C) A policy attached to an organizational unit
D) A policy attached to a KMS key
Correct Answer: B
Rationale: Identity-based policies are attached to IAM identities (users, groups, roles) and
define what actions those identities can perform. Resource-based policies attach to AWS
resources like S3 buckets or KMS keys. SCPs attach to OUs.
4.
Which AWS service enables centralized policy management across multiple AWS accounts?
A) IAM Access Analyzer
B) AWS Organizations with Service Control Policies (SCPs)
C) AWS Config
D) Amazon Inspector
Correct Answer: B
Rationale: AWS Organizations allows you to apply SCPs at the organizational unit or
account level, setting guardrails for permissions across member accounts. IAM Access
Analyzer analyzes policies; AWS Config records resource configurations; Inspector assesses
vulnerabilities.
5.
What is the maximum size of an IAM policy document?
A) 2 KB
B) 10 KB
C) 20 KB
D) 50 KB
Correct Answer: C
Rationale: An IAM policy document can be up to 20,000 characters (approximately 20
, Page 4 of 40
KB). This limit applies to inline and managed policies. Exceeding this requires splitting
policies or using multiple policies.
6.
Which of the following is a required element in an IAM policy statement?
A) Sid
B) Effect
C) Condition
D) Principal
Correct Answer: B
Rationale: The Effect element (Allow or Deny) is required in every IAM policy statement.
Sid, Condition, and Principal are optional; Principal is required only for resource-based
policies, not identity-based policies.
7.
In an IAM policy, what does the "Action" element specify?
A) The AWS account number
B) The specific API operations the policy allows or denies
C) The resources the policy applies to
D) The time range when the policy is valid
Correct Answer: B
Rationale: The Action element lists the specific API calls (e.g., s3:GetObject,
ec2:RunInstances) that the statement allows or denies. Resource specifies the target;
Condition adds conditions; Principal specifies who.
8.
What is the default effect for any AWS API action not explicitly allowed by an IAM policy?
A) Allowed by default
B) Denied by default
C) Undefined until a support ticket is opened
D) Allowed only for the root user
