Discuss Amazon SAA-C03 Exam Topic 1 Question 53

A company manages AWS accounts in AWS Organizations. AWS 1AM Identity Center (AWS Single Sign-On) and AWS Control Tower are configured for the accounts. The company wants to manage multiple user permissions across all the accounts.

The permissions will be used by multiple 1AM users and must be split between the developer and administrator teams. Each team requires different permissions. The company wants a solution that includes new users that are hired on both teams.

Which solution will meet these requirements with the LEAST operational overhead?

ACreate individual users in 1AM Identity Center (or each account. Create separate developer and administrator groups in 1AM Identity Center. Assign the users to the appropriate groups Create a custom 1AM policy for each group to set fine-grained permissions.

BCreate individual users in 1AM Identity Center for each account. Create separate developer and administrator groups in 1AM Identity Center. Assign the users to the appropriate groups. Attach AWS managed 1AM policies to each user as needed for fine-grained permissions.

CCreate individual users in 1AM Identity Center Create new developer and administrator groups in 1AM Identity Center. Create new permission sets that include the appropriate 1AM policies for each group. Assign the new groups to the appropriate accounts Assign the new permission sets to the new groups When new users are hired, add them to the appropriate group.

DCreate individual users in 1AM Identity Center. Create new permission sets that include the appropriate 1AM policies for each user. Assign the users to the appropriate accounts. Grant additional 1AM permissions to the users from within specific accounts. When new users are hired, add them to 1AM Identity Center and assign them to the accounts.

Suggested Answer: A

A: How do you protect your data in transit?

Best Practices:

Implement secure key and certificate management: Store encryption keys and certificates securely and rotate them at appropriate time intervals while applying strict access control; for example, by using a certificate management service, such as AWS Certificate Manager (ACM).

Enforce encryption in transit: Enforce your defined encryption requirements based on appropriate standards and recommendations to help you meet your organizational, legal, and compliance requirements.

Automate detection of unintended data access: Use tools such as GuardDuty to automatically detect attempts to move data outside of defined boundaries based on data classification level, for example, to detect a trojan that is copying data to an unknown or untrusted network using the DNS protocol.

Authenticate network communications: Verify the identity of communications by using protocols that support authentication, such as Transport Layer Security (TLS) or IPsec.

https://wa.aws.amazon.com/wat.question.SEC_9.en.html

Get Premium SAA-C03 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

31 comments · newest first

Delsie 11 months ago

Not sure if C will scale well with a growing team.

Omer 11 months ago

Wait, why not just use managed policies for everything?

Ruth 11 months ago

A is way too much overhead for new users.

Luz 11 months ago

I disagree, D looks better for individual user control.

Tuyet 12 months ago

Option C seems the most efficient for managing permissions.

Cathern 12 months ago

I’m a bit confused about the differences between permission sets and managed policies. I think option B could work, but I'm not certain if it’s the most efficient choice.

Tyra 1 year ago

I feel like option A might be too manual since it involves creating individual users in each account. That seems like a lot of work for new hires.

Nickolas 1 year ago

I think option C sounds familiar; it seems like it aligns with what we practiced about grouping users and managing permissions effectively.

Joni 1 year ago

I remember we discussed the importance of using permission sets in AWS SSO to simplify user management, but I'm not sure which option best minimizes overhead.

Kandis 1 year ago

Whew, lots of details to unpack here. I'll need to carefully read through each option and think about the tradeoffs in terms of flexibility, scalability, and ease of management.

Noemi 1 year ago

This seems like a classic AWS permissions management question. I'm pretty confident I can solve this by leveraging IAM Identity Center and the right combination of groups, permission sets, and account-level permissions.

Sharita 1 year ago

Okay, I think I've got a strategy here. I'll focus on the requirement to minimize operational overhead. That means looking for a solution that makes it easy to onboard new users and manage permissions across accounts.

Ernest 1 year ago

Hmm, I'm a bit confused by the different options. I need to make sure I understand the differences between creating groups vs. permission sets, and how that impacts managing new users.

Francine 1 year ago

This looks like a pretty straightforward IAM Identity Center and AWS Organizations question. I think the key is to focus on how to manage permissions across multiple accounts efficiently.

Kathrine 1 year ago

Option C is the clear winner here. It's like the AWS Permissions Lego set - just snap the pieces together and you're good to go!

Vallie 1 year ago

I'm a bit of a permissions nerd, so Option C is right up my alley. The ability to create custom permission sets is a game-changer.

Twanna 1 year ago

Option B looks good, but it might be a bit more manual to manage individual user permissions. C seems to strike the right balance between flexibility and ease of use.

Tran 1 year ago

↳ replying to Twanna

Option C seems to strike the right balance between flexibility and ease of use.

Theresia 1 year ago

↳ replying to Twanna

Option B might require more manual management of individual user permissions.

Novella 1 year ago

I agree, Option C is the way to go. It provides a scalable solution for managing permissions as the company grows and hires new developers and administrators.

Antonio 1 year ago

↳ replying to Novella

Option C: Use AWS Organizations to create two organizational units (OUs) for the developer and administrator teams. Use AWS Single Sign-On to assign the appropriate permissions to each OU.

Chana 1 year ago

↳ replying to Novella

Option B: Use AWS Single Sign-On to create two groups for the developer and administrator teams. Assign the appropriate permissions to each group.

Sherman 1 year ago

↳ replying to Novella

Option A: Use AWS Control Tower to create two organizational units (OUs) for the developer and administrator teams. Assign the appropriate permissions to each OU.

Janet 2 years ago

I'm not sure, I think option C could also work well by creating new groups and permission sets for each team. It might be worth considering as well.

Marjory 2 years ago

I agree with Callie. Option A seems to have the least operational overhead and provides fine-grained permissions for each team.

Virgie 2 years ago

Option C seems like the most efficient solution. Creating separate groups and permission sets in IAM Identity Center makes it easy to manage user permissions across multiple accounts.

Iraida 1 year ago

↳ replying to Virgie

Exactly, the goal is to streamline the process and minimize the effort required to manage user permissions across all accounts.

Ty 1 year ago

↳ replying to Virgie

It's important to have a solution that can scale with new hires on both teams without adding too much operational overhead.

Levi 1 year ago

↳ replying to Virgie

I agree, having separate groups and permission sets will make it easier to assign and update permissions as needed.

Emiko 1 year ago

↳ replying to Virgie

Option C is definitely the way to go. It simplifies managing permissions for both developer and administrator teams.

Callie 2 years ago

I think option A is the best solution because it allows us to create separate groups for developers and administrators with custom policies.

Amazon SAA-C03 Exam - Topic 1 Question 53 Discussion