🧪 AWS SAA – Practice Exam Questions
Question 1 (IAM – Core concept)
A company wants to allow a developer to access the AWS Management Console and deploy Lambda functions.
The developer must NOT be able to manage IAM users or access billing information.
What is the MOST secure solution?
A. Create an IAM role with AdministratorAccess
B. Create an IAM user and attach AdministratorAccess
C. Use the root account with MFA enabled
D. Create an IAM user, add it to a group with least-privilege permissions
Question 2 (IAM Roles – EC2 access)
An application running on an EC2 instance needs to read and write objects to an Amazon S3 bucket.
What is the BEST way to grant these permissions?
A. Attach an IAM role with S3 permissions to the EC2 instance
B. Store IAM user access keys on the EC2 instance
C. Embed the access keys in the application code
D. Use the root account credentials
Question 3 (AWS Organizations)
A company operates multiple AWS accounts and wants to receive a single consolidated bill and apply security restrictions across all accounts.
Which AWS service should be used?
A. AWS IAM
B. AWS Control Tower
C. AWS Organizations
D. AWS Cost Explorer
Question 4 (Service Control Policies – SCP)
A security team wants to ensure that no account in the organization can delete AWS CloudTrail logs, even if an IAM administrator allows it.
Which solution should be used?
A. IAM identity-based policies
B. Security Groups
C. AWS Config rules
D. Service Control Policies (SCPs)
Question 5 (SCP behavior – exam trap)
Which statement about Service Control Policies (SCPs) is TRUE?
A. SCPs grant permissions to IAM users
B. SCPs override resource-based policies
C. SCPs define the maximum permissions for accounts
D. SCPs apply only to IAM roles
Question 6 (AWS Control Tower)
A startup wants to create a secure multi-account AWS environment following AWS best practices, without manually configuring security controls.
Which service should be used?
A. AWS Control Tower
B. AWS IAM
C. AWS Organizations
D. AWS Config
Question 7 (Guardrails)
Which statement about AWS Control Tower guardrails is correct?
A. Guardrails replace IAM policies
B. Guardrails only generate alerts
C. Guardrails can be preventive or detective
D. Guardrails only apply to the management account
Question 8 (EC2 – AMI)
What does an Amazon Machine Image (AMI) define?
A. The AWS Region where the instance runs
B. The operating system and initial software for an EC2 instance
C. The network configuration of the instance
D. The pricing model of EC2
Question 9 (EC2 – Graviton)
A company wants to reduce EC2 costs while maintaining good performance for Linux-based applications written in Python and Node.js.
Which EC2 option should be recommended?
A. Intel-based EC2 instances
B. Windows-based EC2 instances
C. EC2 instances powered by AWS Graviton processors
D. Spot Instances only
Question 10 (Graviton + AMI compatibility)
Which requirement must be met when launching an EC2 instance using AWS Graviton processors?
A. The instance must run Windows
B. The AMI must be ARM-compatible
C. The instance must use Spot pricing
D. The instance must be in us-east-1
✅ Correct Answer 1: D
✅ Correct Answer 2: A
✅ Correct Answer 3: C
✅ Correct Answer 4: D
✅ Correct Answer 5: C
✅ Correct Answer 6: A
✅ Correct Answer 7: C
✅ Correct Answer 8: B
✅ Correct Answer 9: C
✅ Correct Answer 10: B