🔍

SAA-C03 — questions

Page 39 of 51 · 1019 total questions.

SAA-C03 Question 761

Single page →
Topic 1 · Question 761

A company needs to use its on-premises LDAP directory service to authenticate its users to the AWS Management Console. The directory service is not compatible with Security Assertion Markup Language (SAML). Which solution meets these requirements?

  • AEnable AWS IAM Identity Center (AWS Single Sign-On) between AWS and the on-premises LDAP.
  • BCreate an IAM policy that uses AWS credentials, and integrate the policy into LDAP.
  • CSet up a process that rotates the IAM credentials whenever LDAP credentials are updated.
  • DDevelop an on-premises custom identity broker application or process that uses AWS Security Token Service (AWS STS) to get short-lived credentials. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Develop an on-premises custom identity broker application or process that uses AWS Security Token Service (AWS STS) to get short-lived credentials.

SAA-C03 Question 762

Single page →
Topic 1 · Question 762

A company stores multiple Amazon Machine Images (AMIs) in an AWS account to launch its Amazon EC2 instances. The AMIs contain critical data and configurations that are necessary for the company’s operations. The company wants to implement a solution that will recover accidentally deleted AMIs quickly and efficiently. Which solution will meet these requirements with the LEAST operational overhead?

  • ACreate Amazon Elastic Block Store (Amazon EBS) snapshots of the AMIs. Store the snapshots in a separate AWS account.
  • BCopy all AMIs to another AWS account periodically.
  • CCreate a retention rule in Recycle Bin. (correct answer)
  • DUpload the AMIs to an Amazon S3 bucket that has Cross-Region Replication.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a retention rule in Recycle Bin.

SAA-C03 Question 763

Single page →
Topic 1 · Question 763

A company has 150 TB of archived image data stored on-premises that needs to be moved to the AWS Cloud within the next month. The company’s current network connection allows up to 100 Mbps uploads for this purpose during the night only. What is the MOST cost-effective mechanism to move this data and meet the migration deadline?

  • AUse AWS Snowmobile to ship the data to AWS.
  • BOrder multiple AWS Snowball devices to ship the data to AWS. (correct answer)
  • CEnable Amazon S3 Transfer Acceleration and securely upload the data.
  • DCreate an Amazon S3 VPC endpoint and establish a VPN to upload the data.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Order multiple AWS Snowball devices to ship the data to AWS.

Explanation

AWS Snowball physically ships data to AWS, ideal when bandwidth is limited or data is very large. This option delivers the requirement at the lowest cost.

SAA-C03 Question 764

Single page →
Topic 1 · Question 764

A company wants to migrate its three-tier application from on premises to AWS. The web tier and the application tier are running on third-party virtual machines (VMs). The database tier is running on MySQL. The company needs to migrate the application by making the fewest possible changes to the architecture. The company also needs a database solution that can restore data to a specific point in time. Which solution will meet these requirements with the LEAST operational overhead?

  • AMigrate the web tier and the application tier to Amazon EC2 instances in private subnets. Migrate the database tier to Amazon RDS for MySQL in private subnets.
  • BMigrate the web tier to Amazon EC2 instances in public subnets. Migrate the application tier to EC2 instances in private subnets. Migrate the database tier to Amazon Aurora MySQL in private subnets. (correct answer)
  • CMigrate the web tier to Amazon EC2 instances in public subnets. Migrate the application tier to EC2 instances in private subnets. Migrate the database tier to Amazon RDS for MySQL in private subnets.
  • DMigrate the web tier and the application tier to Amazon EC2 instances in public subnets. Migrate the database tier to Amazon Aurora MySQL in public subnets.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Migrate the web tier to Amazon EC2 instances in public subnets. Migrate the application tier to EC2 instances in private subnets. Migrate the database tier to Amazon Aurora MySQL in private subnets.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon Aurora is a high-performance managed relational database with built-in replication and failover.

SAA-C03 Question 765

Single page →
Topic 1 · Question 765

A development team is collaborating with another company to create an integrated product. The other company needs to access an Amazon Simple Queue Service (Amazon SQS) queue that is contained in the development team's account. The other company wants to poll the queue without giving up its own account permissions to do so. How should a solutions architect provide access to the SQS queue?

  • ACreate an instance profile that provides the other company access to the SQS queue.
  • BCreate an IAM policy that provides the other company access to the SQS queue.
  • CCreate an SQS access policy that provides the other company access to the SQS queue. (correct answer)
  • DCreate an Amazon Simple Notification Service (Amazon SNS) access policy that provides the other company access to the SQS queue.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an SQS access policy that provides the other company access to the SQS queue.

Explanation

Amazon SQS is a fully managed message queue that decouples components and absorbs traffic spikes.

SAA-C03 Question 766

Single page →
Topic 1 · Question 766

A company’s developers want a secure way to gain SSH access on the company's Amazon EC2 instances that run the latest version of Amazon Linux. The developers work remotely and in the corporate office. The company wants to use AWS services as a part of the solution. The EC2 instances are hosted in a VPC private subnet and access the internet through a NAT gateway that is deployed in a public subnet. What should a solutions architect do to meet these requirements MOST cost-effectively?

  • ACreate a bastion host in the same subnet as the EC2 instances. Grant the ec2:CreateVpnConnection IAM permission to the developers. Install EC2 Instance Connect so that the developers can connect to the EC2 instances.
  • BCreate an AWS Site-to-Site VPN connection between the corporate network and the VPC. Instruct the developers to use the Site-to-Site VPN connection to access the EC2 instances when the developers are on the corporate network. Instruct the developers to set up another VPN connection for access when they work remotely.
  • CCreate a bastion host in the public subnet of the VPConfigure the security groups and SSH keys of the bastion host to only allow connections and SSH authentication from the developers’ corporate and remote networks. Instruct the developers to connect through the bastion host by using SSH to reach the EC2 instances.
  • DAttach the AmazonSSMManagedInstanceCore IAM policy to an IAM role that is associated with the EC2 instances. Instruct the developers to use AWS Systems Manager Session Manager to access the EC2 instances. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Attach the AmazonSSMManagedInstanceCore IAM policy to an IAM role that is associated with the EC2 instances. Instruct the developers to use AWS Systems Manager Session Manager to access the EC2 instances.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. This option delivers the requirement at the lowest cost.

SAA-C03 Question 767

Single page →
Topic 1 · Question 767

A pharmaceutical company is developing a new drug. The volume of data that the company generates has grown exponentially over the past few months. The company's researchers regularly require a subset of the entire dataset to be immediately available with minimal lag. However, the entire dataset does not need to be accessed on a daily basis. All the data currently resides in on-premises storage arrays, and the company wants to reduce ongoing capital expenses. Which storage solution should a solutions architect recommend to meet these requirements?

  • ARun AWS DataSync as a scheduled cron job to migrate the data to an Amazon S3 bucket on an ongoing basis.
  • BDeploy an AWS Storage Gateway file gateway with an Amazon S3 bucket as the target storage. Migrate the data to the Storage Gateway appliance.
  • CDeploy an AWS Storage Gateway volume gateway with cached volumes with an Amazon S3 bucket as the target storage. Migrate the data to the Storage Gateway appliance. (correct answer)
  • DConfigure an AWS Site-to-Site VPN connection from the on-premises environment to AWS. Migrate data to an Amazon Elastic File System (Amazon EFS) file system.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Deploy an AWS Storage Gateway volume gateway with cached volumes with an Amazon S3 bucket as the target storage. Migrate the data to the Storage Gateway appliance.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Storage Gateway bridges on-premises apps to AWS storage with local caching.

SAA-C03 Question 768

Single page →
Topic 1 · Question 768

A company has a business-critical application that runs on Amazon EC2 instances. The application stores data in an Amazon DynamoDB table. The company must be able to revert the table to any point within the last 24 hours. Which solution meets these requirements with the LEAST operational overhead?

  • AConfigure point-in-time recovery for the table. (correct answer)
  • BUse AWS Backup for the table.
  • CUse an AWS Lambda function to make an on-demand backup of the table every hour.
  • DTurn on streams on the table to capture a log of all changes to the table in the last 24 hours. Store a copy of the stream in an Amazon S3 bucket.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Configure point-in-time recovery for the table.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

SAA-C03 Question 769

Single page →
Topic 1 · Question 769

A company hosts an application used to upload files to an Amazon S3 bucket. Once uploaded, the files are processed to extract metadata, which takes less than 5 seconds. The volume and frequency of the uploads varies from a few files each hour to hundreds of concurrent uploads. The company has asked a solutions architect to design a cost-effective architecture that will meet these requirements. What should the solutions architect recommend?

  • AConfigure AWS CloudTrail trails to log S3 API calls. Use AWS AppSync to process the files.
  • BConfigure an object-created event notification within the S3 bucket to invoke an AWS Lambda function to process the files. (correct answer)
  • CConfigure Amazon Kinesis Data Streams to process and send data to Amazon S3. Invoke an AWS Lambda function to process the files.
  • DConfigure an Amazon Simple Notification Service (Amazon SNS) topic to process the files uploaded to Amazon S3. Invoke an AWS Lambda function to process the files.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure an object-created event notification within the S3 bucket to invoke an AWS Lambda function to process the files.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance. This option delivers the requirement at the lowest cost.

SAA-C03 Question 770

Single page →
Topic 1 · Question 770

A company’s application is deployed on Amazon EC2 instances and uses AWS Lambda functions for an event-driven architecture. The company uses nonproduction development environments in a different AWS account to test new features before the company deploys the features to production. The production instances show constant usage because of customers in different time zones. The company uses nonproduction instances only during business hours on weekdays. The company does not use the nonproduction instances on the weekends. The company wants to optimize the costs to run its application on AWS. Which solution will meet these requirements MOST cost-effectively?

  • AUse On-Demand Instances for the production instances. Use Dedicated Hosts for the nonproduction instances on weekends only.
  • BUse Reserved Instances for the production instances and the nonproduction instances. Shut down the nonproduction instances when not in use.
  • CUse Compute Savings Plans for the production instances. Use On-Demand Instances for the nonproduction instances. Shut down the nonproduction instances when not in use. (correct answer)
  • DUse Dedicated Hosts for the production instances. Use EC2 Instance Savings Plans for the nonproduction instances.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use Compute Savings Plans for the production instances. Use On-Demand Instances for the nonproduction instances. Shut down the nonproduction instances when not in use.

Explanation

Savings Plans reduce cost for consistent compute usage in exchange for a usage commitment. This option delivers the requirement at the lowest cost.

SAA-C03 Question 771

Single page →
Topic 1 · Question 771

A company stores data in an on-premises Oracle relational database. The company needs to make the data available in Amazon Aurora PostgreSQL for analysis. The company uses an AWS Site-to-Site VPN connection to connect its on-premises network to AWS. The company must capture the changes that occur to the source database during the migration to Aurora PostgreSQL. Which solution will meet these requirements?

  • AUse the AWS Schema Conversion Tool (AWS SCT) to convert the Oracle schema to Aurora PostgreSQL schema. Use the AWS Database Migration Service (AWS DMS) full-load migration task to migrate the data.
  • BUse AWS DataSync to migrate the data to an Amazon S3 bucket. Import the S3 data to Aurora PostgreSQL by using the Aurora PostgreSQL aws_s3 extension.
  • CUse the AWS Schema Conversion Tool (AWS SCT) to convert the Oracle schema to Aurora PostgreSQL schema. Use AWS Database Migration Service (AWS DMS) to migrate the existing data and replicate the ongoing changes. (correct answer)
  • DUse an AWS Snowball device to migrate the data to an Amazon S3 bucket. Import the S3 data to Aurora PostgreSQL by using the Aurora PostgreSQL aws_s3 extension.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use the AWS Schema Conversion Tool (AWS SCT) to convert the Oracle schema to Aurora PostgreSQL schema. Use AWS Database Migration Service (AWS DMS) to migrate the existing data and replicate the ongoing changes.

Explanation

Amazon Aurora is a high-performance managed relational database with built-in replication and failover. AWS Database Migration Service migrates databases with minimal downtime.

SAA-C03 Question 772

Single page →
Topic 1 · Question 772 · Select all that apply

A company built an application with Docker containers and needs to run the application in the AWS Cloud. The company wants to use a managed service to host the application. The solution must scale in and out appropriately according to demand on the individual container services. The solution also must not result in additional operational overhead or infrastructure to manage. Which solutions will meet these requirements? (Choose two.)

  • AUse Amazon Elastic Container Service (Amazon ECS) with AWS Fargate. (correct answer)
  • BUse Amazon Elastic Kubernetes Service (Amazon EKS) with AWS Fargate. (correct answer)
  • CProvision an Amazon API Gateway API. Connect the API to AWS Lambda to run the containers.
  • DUse Amazon Elastic Container Service (Amazon ECS) with Amazon EC2 worker nodes.
  • EUse Amazon Elastic Kubernetes Service (Amazon EKS) with Amazon EC2 worker nodes.
Reveal answer & explanation
Correct answer: A, B

The correct answer is A, B. Option A: Use Amazon Elastic Container Service (Amazon ECS) with AWS Fargate. Option B: Use Amazon Elastic Kubernetes Service (Amazon EKS) with AWS Fargate.

Explanation

AWS Fargate runs containers serverlessly so there are no EC2 hosts to manage or patch. Amazon ECS orchestrates containers and integrates natively with AWS networking and IAM. Amazon EKS runs managed Kubernetes when you need the Kubernetes ecosystem.

SAA-C03 Question 773

Single page →
Topic 1 · Question 773

An ecommerce company is running a seasonal online sale. The company hosts its website on Amazon EC2 instances spanning multiple Availability Zones. The company wants its website to manage sudden traffic increases during the sale. Which solution will meet these requirements MOST cost-effectively?

  • ACreate an Auto Scaling group that is large enough to handle peak traffic load. Stop half of the Amazon EC2 instances. Configure the Auto Scaling group to use the stopped instances to scale out when traffic increases.
  • BCreate an Auto Scaling group for the website. Set the minimum size of the Auto Scaling group so that it can handle high traffic volumes without the need to scale out.
  • CUse Amazon CloudFront and Amazon ElastiCache to cache dynamic content with an Auto Scaling group set as the origin. Configure the Auto Scaling group with the instances necessary to populate CloudFront and ElastiCache. Scale in after the cache is fully populated.
  • DConfigure an Auto Scaling group to scale out as traffic increases. Create a launch template to start new instances from a preconfigured Amazon Machine Image (AMI). (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure an Auto Scaling group to scale out as traffic increases. Create a launch template to start new instances from a preconfigured Amazon Machine Image (AMI).

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. AWS Config tracks resource configuration changes and evaluates compliance. This option delivers the requirement at the lowest cost.

SAA-C03 Question 774

Single page →
Topic 1 · Question 774

A solutions architect must provide an automated solution for a company's compliance policy that states security groups cannot include a rule that allows SSH from 0.0.0.0/0. The company needs to be notified if there is any breach in the policy. A solution is needed as soon as possible. What should the solutions architect do to meet these requirements with the LEAST operational overhead?

  • AWrite an AWS Lambda script that monitors security groups for SSH being open to 0.0.0.0/0 addresses and creates a notification every time it finds one.
  • BEnable the restricted-ssh AWS Config managed rule and generate an Amazon Simple Notification Service (Amazon SNS) notification when a noncompliant rule is created. (correct answer)
  • CCreate an IAM role with permissions to globally open security groups and network ACLs. Create an Amazon Simple Notification Service (Amazon SNS) topic to generate a notification every time the role is assumed by a user.
  • DConfigure a service control policy (SCP) that prevents non-administrative users from creating or editing security groups. Create a notification in the ticketing system when a user requests a rule that needs administrator permissions.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Enable the restricted-ssh AWS Config managed rule and generate an Amazon Simple Notification Service (Amazon SNS) notification when a noncompliant rule is created.

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. AWS Config tracks resource configuration changes and evaluates compliance.

SAA-C03 Question 775

Single page →
Topic 1 · Question 775

Use Amazon Elastic Kubernetes Service (Amazon EKS) with Amazon EC2 worker nodes. A company has deployed an application in an AWS account. The application consists of microservices that run on AWS Lambda and Amazon Elastic Kubernetes Service (Amazon EKS). A separate team supports each microservice. The company has multiple AWS accounts and wants to give each team its own account for its microservices. A solutions architect needs to design a solution that will provide service-to-service communication over HTTPS (port 443). The solution also must provide a service registry for service discovery. Which solution will meet these requirements with the LEAST administrative overhead?

  • ACreate an inspection VPC. Deploy an AWS Network Firewall firewall to the inspection VPC. Attach the inspection VPC to a new transit gateway. Route VPC-to-VPC traffic to the inspection VPC. Apply firewall rules to allow only HTTPS communication.
  • BCreate a VPC Lattice service network. Associate the microservices with the service network. Define HTTPS listeners for each service. Register microservice compute resources as targets. Identify VPCs that need to communicate with the services. Associate those VPCs with the service network. (correct answer)
  • CCreate a Network Load Balancer (NLB) with an HTTPS listener and target groups for each microservice. Create an AWS PrivateLink endpoint service for each microservice. Create an interface VPC endpoint in each VPC that needs to consume that microservice.
  • DCreate peering connections between VPCs that contain microservices. Create a prefix list for each service that requires a connection to a client. Create route tables to route traffic to the appropriate VPC. Create security groups to allow only HTTPS communication.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a VPC Lattice service network. Associate the microservices with the service network. Define HTTPS listeners for each service. Register microservice compute resources as targets. Identify VPCs that need to commu...

SAA-C03 Question 776

Single page →
Topic 1 · Question 776

A company has a mobile game that reads most of its metadata from an Amazon RDS DB instance. As the game increased in popularity, developers noticed slowdowns related to the game's metadata load times. Performance metrics indicate that simply scaling the database will not help. A solutions architect must explore all options that include capabilities for snapshots, replication, and sub-millisecond response times. What should the solutions architect recommend to solve these issues?

  • AMigrate the database to Amazon Aurora with Aurora Replicas.
  • BMigrate the database to Amazon DynamoDB with global tables.
  • CAdd an Amazon ElastiCache for Redis layer in front of the database. (correct answer)
  • DAdd an Amazon ElastiCache for Memcached layer in front of the database.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Add an Amazon ElastiCache for Redis layer in front of the database.

Explanation

Amazon ElastiCache provides in-memory caching (Redis/Memcached) to reduce latency and offload the database.

SAA-C03 Question 777

Single page →
Topic 1 · Question 777 · Select all that apply

A company uses AWS Organizations for its multi-account AWS setup. The security organizational unit (OU) of the company needs to share approved Amazon Machine Images (AMIs) with the development OU. The AMIs are created by using AWS Key Management Service (AWS KMS) encrypted snapshots. Which solution will meet these requirements? (Choose two.)

  • AAdd the development team's OU Amazon Resource Name (ARN) to the launch permission list for the AMIs. (correct answer)
  • BAdd the Organizations root Amazon Resource Name (ARN) to the launch permission list for the AMIs.
  • CUpdate the key policy to allow the development team's OU to use the AWS KMS keys that are used to decrypt the snapshots. (correct answer)
  • DAdd the development team’s account Amazon Resource Name (ARN) to the launch permission list for the AMIs.
  • ERecreate the AWS KMS key. Add a key policy to allow the Organizations root Amazon Resource Name (ARN) to use the AWS KMS key.
Reveal answer & explanation
Correct answer: A, C

The correct answer is A, C. Option A: Add the development team's OU Amazon Resource Name (ARN) to the launch permission list for the AMIs. Option C: Update the key policy to allow the development team's OU to use the AWS KMS keys that are used to decrypt the snapshots.

Explanation

AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

SAA-C03 Question 778

Single page →
Topic 1 · Question 778

A data analytics company has 80 offices that are distributed globally. Each office hosts 1 PB of data and has between 1 and 2 Gbps of internet bandwidth. The company needs to perform a one-time migration of a large amount of data from its offices to Amazon S3. The company must complete the migration within 4 weeks. Which solution will meet these requirements MOST cost-effectively?

  • AEstablish a new 10 Gbps AWS Direct Connect connection to each office. Transfer the data to Amazon S3.
  • BUse multiple AWS Snowball Edge storage-optimized devices to store and transfer the data to Amazon S3. (correct answer)
  • CUse an AWS Snowmobile to store and transfer the data to Amazon S3.
  • DSet up an AWS Storage Gateway Volume Gateway to transfer the data to Amazon S3.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use multiple AWS Snowball Edge storage-optimized devices to store and transfer the data to Amazon S3.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Snowball physically ships data to AWS, ideal when bandwidth is limited or data is very large. This option delivers the requirement at the lowest cost.

SAA-C03 Question 779

Single page →
Topic 1 · Question 779

A company has an Amazon Elastic File System (Amazon EFS) file system that contains a reference dataset. The company has applications on Amazon EC2 instances that need to read the dataset. However, the applications must not be able to change the dataset. The company wants to use IAM access control to prevent the applications from being able to modify or delete the dataset. Which solution will meet these requirements?

  • AMount the EFS file system in read-only mode from within the EC2 instances.
  • BCreate a resource policy for the EFS file system that denies the elasticfilesystem:ClientWrite action to the IAM roles that are attached to the EC2 instances. (correct answer)
  • CCreate an identity policy for the EFS file system that denies the elasticfilesystem:ClientWrite action on the EFS file system.
  • DCreate an EFS access point for each application. Use Portable Operating System Interface (POSIX) file permissions to allow read-only access to files in the root directory.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a resource policy for the EFS file system that denies the elasticfilesystem:ClientWrite action to the IAM roles that are attached to the EC2 instances.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon EFS is a shared, elastic NFS file system that multiple instances can mount concurrently across AZs. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials.

SAA-C03 Question 780

Single page →
Topic 1 · Question 780

A company has hired an external vendor to perform work in the company’s AWS account. The vendor uses an automated tool that is hosted in an AWS account that the vendor owns. The vendor does not have IAM access to the company’s AWS account. The company needs to grant the vendor access to the company’s AWS account. Which solution will meet these requirements MOST securely?

  • ACreate an IAM role in the company’s account to delegate access to the vendor’s IAM role. Attach the appropriate IAM policies to the role for the permissions that the vendor requires. (correct answer)
  • BCreate an IAM user in the company’s account with a password that meets the password complexity requirements. Attach the appropriate IAM policies to the user for the permissions that the vendor requires.
  • CCreate an IAM group in the company’s account. Add the automated tool’s IAM user from the vendor account to the group. Attach the appropriate IAM policies to the group for the permissions that the vendor requires.
  • DCreate an IAM user in the company’s account that has a permission boundary that allows the vendor’s account. Attach the appropriate IAM policies to the user for the permissions that the vendor requires.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create an IAM role in the company’s account to delegate access to the vendor’s IAM role. Attach the appropriate IAM policies to the role for the permissions that the vendor requires.

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

Showing questions 761–780 of 1019 · Page 39 of 51