ExamPark
Course menuSOA-C03

Exams / SOA-C03 / IAM users, roles and policies / Question 2

SOA-C03 practice question: IAM users, roles and policies (2 of 2)

Security and Compliance A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A dental chain has hired a third-party monitoring company that needs read-only access to CloudWatch metrics and alarms in the chain's production account. The vendor uses its own AWS account to access the accounts of hundreds of customers. The chain's security team does not want long-term credentials shared, and it wants protection against another vendor customer tricking the vendor into accessing the chain's account. What should a CloudOps engineer set up?

Choose one answer.

  1. A. An IAM user with CloudWatchReadOnlyAccess whose access keys are given to the vendor and rotated every 90 days.
  2. B. An IAM role with CloudWatchReadOnlyAccess that trusts the vendor's account, with no conditions in the trust policy.
  3. C. A resource-based policy on the account's CloudWatch metrics that grants the vendor's account read access to all namespaces.
  4. D. An IAM role with read-only CloudWatch access that trusts the vendor's account and requires an external ID.
Show the answer and explanation

Answer: D

Explanation

Third-party access should use a cross-account IAM role, so the vendor gets temporary credentials and nothing long-lived is shared. Because the vendor serves many customers, the trust policy should require an external ID that is unique to this customer. That prevents the confused deputy problem.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free SOA-C03 practice examPractice IAM users, roles and policiesAll IAM users, roles and policies questions