AWS Certified Solutions Architect Associate - SAA-C03

1. A company is setting up AWS accounts for the first time and wants to follow IAM best practices. The security team requires that no one should use the root account for day-to-day operations and that all privileged actions must require an additional layer of verification. Which combination of actions should a solutions architect recommend? (Choose the most complete answer.)

2. A solutions architect is designing an application where an Amazon EC2 instance needs to read objects from an Amazon S3 bucket in the same AWS account. The security team requires that no long-term credentials be stored on the instance. Which solution meets these requirements?

3. A company has a web application that allows users to sign in with their existing Google or Facebook accounts. The application must then provide these users with temporary AWS credentials to access a specific Amazon DynamoDB table. Which AWS service should be used to federate social identity providers and vend temporary credentials?

4. A company needs to grant a third-party auditor access to specific AWS resources in the company's account. The auditor has their own AWS account. The company wants to follow security best practices and avoid sharing long-term credentials. Which approach should a solutions architect recommend?

5. A large enterprise uses AWS Organizations to manage 80 AWS accounts. The security team wants to ensure that no account in the organization can disable AWS CloudTrail, regardless of the permissions of any IAM user or role in those accounts. Which solution meets this requirement?