Crucial Exams

AWS Certified Solutions Architect Professional SAP-C02 Practice Question

Your company operates several AWS accounts managed with AWS Organizations. In the shared dev account, application teams need to create and maintain IAM roles for their Lambda functions and ECS tasks. The security team has produced a guardrail policy that grants only the following permissions:

  • Read access to two designated S3 buckets
  • Write access to one DynamoDB table

Developers must be allowed to self-service creation and updates of IAM roles only if the resulting roles never exceed the permissions in the guardrail policy, and the security team does not want to manually review each policy or role that is created.

Which solution BEST enforces the principle of least privilege while meeting these requirements?

  • Require developers to tag their roles with Environment=Dev and apply an ABAC policy that allows actions only when the principal and resource share the same tag.

  • Enable the AWS Config managed rule IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS and use an EventBridge rule to invoke a Lambda function that automatically deletes any policy marked NON_COMPLIANT.

  • Create a customer-managed policy that contains the approved S3 and DynamoDB permissions and designate it as a permissions boundary. Grant the developer group iam:CreateRole, iam:PutRolePolicy, and iam:AttachRolePolicy permissions only when the iam:PermissionsBoundary condition key equals the boundary policy's ARN.

  • Attach a service control policy to the dev account that denies iam:CreateRole for all principals except the security team, and have the security team create roles for developers on request.

AWS Certified Solutions Architect Professional SAP-C02
Continuous Improvement for Existing Solutions
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot