AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 33
Question 320
A security team inherits an S3 bucket with an existing bucket policy that allows anonymous GetObject. They enable the BlockPublicPolicy setting and assume that it immediately neutralizes the old policy, but the bucket remains readable anonymously. No legitimate cross-account access is required. Which specific S3 Block Public Access control directly restricts access through the existing public policy?
- Enable BlockPublicAcls; it retroactively disables all permissions granted by bucket policies.
- Enable IgnorePublicAcls; it overrides existing public bucket-policy statements as well as ACLs.
- Enable RestrictPublicBuckets, then remove the public policy grant and verify the effective bucket-access configuration.
- Run BlockPublicPolicy again without changing any other setting; repeating it revokes the already stored public policy.
Explanation
Correct Answer
C:RestrictPublicBuckets limits a bucket with a public policy to authorized same-account users and AWS service principals, including restricting cross-account access. Remove the offending public policy as the durable correction and verify the intended access.
Incorrect Answers
A:BlockPublicAcls blocks new public ACL grants and certain public-ACL writes. ACL controls do not retroactively nullify an existing public bucket policy.
B:IgnorePublicAcls makes public ACL grants ineffective, but it does not negate an existing public Allow in a bucket policy.
D:BlockPublicPolicy rejects new public bucket-policy writes but does not change existing policy statements. Reapplying it alone cannot satisfy a requirement to restrict a legacy public policy.
Question 321
After removing a publicly readable statement from a sensitive bucket policy, an auditor wants to know whether any access-point or other policy still shares it outside the intended organization. What validation should follow the change?
- Assume changing one object ACL proves every bucket and access point has no external grant.
- Make the bucket publicly readable for one hour to see whether anyone notices the change.
- Review IAM Access Analyzer or appropriate S3 access findings and test the resulting bucket and access-point authorization.
- Use EC2 detailed CPU monitoring to detect all external S3 authorization grants.
Explanation
Correct Answer
C:External-access findings can expose unintended remaining grants that a single bucket-policy edit overlooks. Verification should confirm the effective resource access design.
Incorrect Answers
A:Object ACLs are only part of S3 authorization; other policies and access points may still permit access.
B:Intentionally opening sensitive data is not a safe verification procedure. Controlled policy analysis is appropriate.
D:Compute metrics do not analyze resource policies for unintended external principals.
Question 322
An insurance archive must preserve each object version against overwrite and deletion for a compliance retention period. A developer proposes a simple S3 lifecycle rule that deletes files after seven years, claiming it enforces immutability until then. What additional feature is required?
- Enable appropriately configured S3 Object Lock with versioning-compatible retention settings for WORM requirements.
- Use only S3 event notifications and expect notifications to block DeleteObjectVersion calls.
- Give every operator s3:DeleteObjectVersion and trust company policy to stop early removal.
- Use only a lifecycle expiration date because AWS automatically prohibits earlier object deletion while a lifecycle rule exists.
Explanation
Correct Answer
A:Object Lock places version-specific retention protection on supported objects, preventing prohibited deletion or modification during the protected interval.
Incorrect Answers
B:Events are emitted around object operations; notifications are not a synchronous immutable-retention authorization control.
C:Broad version-deletion permission defeats a technical nondeletion requirement unless Object Lock prevents the operation.
D:Lifecycle expiration schedules automated deletion but does not impose WORM protection against authorized manual deletes.
Question 323
An S3 bucket uses Object Lock governance mode for internal records. An auditor expects it to have the same non-bypassable guarantees as compliance mode even for principals authorized to bypass governance. Which distinction is correct?
- Governance mode is always harder to bypass than compliance mode for account administrators.
- Governance retention may be bypassed by principals with the required permission and explicit bypass; compliance retention cannot be shortened before expiry.
- S3 Versioning alone makes governance and compliance mode names irrelevant to retention.
- An S3 lifecycle expiration rule grants every administrator permission to bypass compliance retention.
Explanation
Correct Answer
B:Governance mode supports controlled privileged override, while compliance mode is designed for stricter retention that even highly privileged account principals cannot shorten.
Incorrect Answers
A:The modes have different privileged override behavior; compliance mode provides the stricter immutability guarantee.
C:Versioning does not supply the required WORM controls, and the Object Lock retention mode affects deletion behavior.
D:Lifecycle rules do not override active compliance-mode retention protections on object versions.
Question 324
Legal counsel issues an indefinite preservation request for a subset of S3 object versions while a court proceeding continues. There is no known end date, and ordinary retention periods should remain independently configured. Which Object Lock mechanism fits?
- Rely only on the current object's tag as a technical block against version deletion.
- Set Object Lock compliance retention to an invented end date that is guaranteed to match court proceedings.
- Set a one-day S3 lifecycle transition and assume it prevents every deletion until litigation closes.
- Apply an S3 Object Lock legal hold to the relevant object versions and release the hold only through an authorized process.
Explanation
Correct Answer
D:A legal hold is an independent, no-fixed-expiration preservation mechanism on protected versions. It remains until an authorized principal removes it.
Incorrect Answers
A:Tags can identify records but do not by themselves enforce WORM deletion restrictions.
B:A speculative fixed date may not cover the actual legal obligation; a legal hold is designed for preservation without a known end date.
C:A lifecycle transition governs storage class timing, not an indefinite legal preservation hold.
Question 325
A data analyst overwrites an important S3 file. Versioning was enabled, and the old good version is still listed as a noncurrent object. What recovery action avoids deleting the entire bucket?
- Copy or otherwise restore the desired older object version as the current version using supported S3 version APIs.
- Delete the bucket and recreate it with the same name so AWS automatically recovers all prior versions.
- Enable S3 Transfer Acceleration because it automatically reverses earlier file overwrites.
- Attach an internet gateway to the VPC because prior object versions are accessible only through public routing.
Explanation
Correct Answer
A:S3 Versioning retains prior object versions after overwrites. Selecting the correct noncurrent version allows targeted recovery without destroying unrelated bucket contents.
Incorrect Answers
B:Bucket deletion can destroy the remaining versions and is not a supported targeted overwrite recovery method.
C:Transfer Acceleration optimizes supported upload/download routes, not object version recovery semantics.
D:S3 version access depends on object version IDs and authorization, not on adding a general VPC internet route.
Question 326
A versioned S3 bucket accumulates years of noncurrent object versions because each daily rewrite keeps the previous copy. Business policy permits retaining old revisions for ninety days. Which cost-and-governance control should be added?
- Enable CloudFront caching and assume cached objects cause previous S3 versions to be deleted.
- Disable CloudTrail so new versions are not recorded and billed as storage.
- Configure supported lifecycle handling for noncurrent object versions with expiration or class transitions consistent with the retention policy.
- Turn off S3 default encryption to shrink the number of retained historical versions.
Explanation
Correct Answer
C:Versioning preserves old object copies until an operation or lifecycle policy removes them. Noncurrent-version rules can bound historical storage while honoring retention obligations.
Incorrect Answers
A:CloudFront caches delivery responses; it does not administer the version history stored in the S3 bucket.
B:CloudTrail audit delivery is separate from S3 object version storage; disabling logs does not reduce retained versions.
D:Encryption choice does not remove old versions or change the versioning lifecycle. It weakens data protection without controlling count.
Question 327
A company enables S3 Versioning and assumes it automatically creates an immutable independent regional backup of every object. Ransomware recovery requirements call for separate failure-domain copies and preservation from malicious deletions. Which statement is correct?
- S3 Transfer Acceleration is the service that creates independent backup versions across Regions.
- Use appropriate replication and protected backup/retention controls in addition to Versioning; each mechanism addresses different recovery risks.
- Versioning alone always creates an independent copy in every AWS Region with non-bypassable retention.
- Cross-Region Replication automatically prevents all malicious deletion propagation without additional configuration.
Explanation
Correct Answer
B:Versioning retains revisions within a bucket, while cross-Region replication and protected backup copies address other failure domains. None should be mistaken for a complete immutable air-gapped backup by itself.
Incorrect Answers
A:Transfer Acceleration optimizes client transfer paths and does not implement cross-Region data protection or immutable retention.
C:Bucket version history remains associated with the configured bucket and does not automatically distribute immutable copies worldwide.
D:Replication semantics require deliberate design for delete markers, object versions and protection; it is not equivalent to an isolated immutable backup.
Question 328
A replica rule copies images from an S3 bucket to another Region, but newly uploaded objects protected by SSE-KMS are absent at the destination while SSE-S3 objects replicate. The source and destination buckets are otherwise healthy. What must the architect review first?
- Enable S3 Transfer Acceleration for the source bucket to make replication copy KMS ciphertext.
- Attach a wider inbound security group to the source S3 bucket to admit destination replication.
- Turn off source bucket encryption so objects no longer require a replication rule configuration.
- Enable replication of KMS-encrypted objects in the rule and identify a usable destination KMS key.
Explanation
Correct Answer
D:SSE-KMS replication requires deliberate rule configuration, including the destination encryption key. The default assumption that every encrypted source object follows an ordinary replication rule is unsafe.
Incorrect Answers
A:Transfer Acceleration speeds certain client uploads and downloads; it does not supply the missing KMS-specific replication rule settings.
B:S3 buckets are not attached to EC2 security groups; missing KMS replication options are not fixed by VPC ingress rules.
C:Removing encryption violates the protection requirement and is unnecessary: S3 supports replication of SSE-KMS objects when configured appropriately.
Question 329
A cross-account S3 replication rule explicitly includes SSE-KMS objects, but replication status shows access failures at the destination. The destination bucket uses a customer-managed KMS key owned by the receiving account. What is the likely authorization correction?
- Grant the S3 replication role the required bucket actions and destination KMS encryption permissions through applicable key/IAM policies.
- Increase the source bucket versioning retention to 365 days without inspecting destination policies.
- Add s3:ListAllMyBuckets to every application role but leave destination KMS permissions unchanged.
- Create a public-read bucket policy on the destination so ciphertext can be written without KMS authorization.
Explanation
Correct Answer
A:The replicating principal needs authorization to read the source and write encrypted destination objects, including use of the destination KMS key. A configured rule alone does not grant cross-account key use.
Incorrect Answers
B:Retention may preserve old versions, but it cannot authorize the replication role to invoke encryption operations on a destination key.
C:Listing account buckets is unrelated to encrypting replicated data with the receiver's key and does not resolve KMS AccessDenied.
D:Public object exposure cannot substitute for customer-managed KMS key permissions and makes a protected destination less secure.
Question 330
A ransomware scenario requires a truly isolated recoverable copy of S3 records even if an attacker with production privileges changes objects or replication rules. A developer proposes ordinary continuous replication as the sole backup. What is the core problem?
- Replication automatically provides an air-gapped immutable archive no administrator can alter under any circumstances.
- Replication is not an immutable isolated backup; create independently protected recovery copies with retention and separate security controls.
- Use S3 Transfer Acceleration for the destination, which prevents source changes from reaching existing objects.
- Disable versioning in both buckets so destructive changes cannot create additional object revisions.
Explanation
Correct Answer
B:Replication propagates eligible changes according to its configuration and can be administered by privileged identities. Separate immutable backup and isolation controls address malicious modification risk.
Incorrect Answers
A:Ordinary replication is a copy mechanism, not a universal WORM or isolation guarantee; delete-marker behavior and admin powers must be considered.
C:Transfer Acceleration changes client transfer routing, not replica immutability or an attacker's ability to affect production data.
D:Removing versioning reduces recovery options and does not make stored objects tamper-proof against authorized deletion or overwrite.
