S3 practice questions

S3 One Zone-IA

Why wrong: S3 One Zone-IA stores data in a single Availability Zone, reducing availability. For frequently accessed thumbnails that need high availability, this is inappropriate.

S3 Glacier Flexible Retrieval

Why wrong: S3 Glacier Flexible Retrieval has retrieval times of minutes to hours. Thumbnails that are accessed multiple times per day need immediate access, making Glacier unsuitable.

S3 Standard-IA

Why wrong: S3 Standard-IA is for infrequently accessed data. Using it for data accessed multiple times per day incurs retrieval charges that would make it more expensive than S3 Standard.

Amazon CloudWatch

Why wrong: CloudWatch collects metrics and logs from AWS services and applications. While it can capture application logs, it does not specifically record who made AWS API calls like deleting an S3 bucket.

AWS Config

Why wrong: AWS Config records the configuration state of AWS resources over time and can show that the bucket no longer exists, but it does not capture the API event details (caller identity, IP, timestamp) the way CloudTrail does.

Amazon GuardDuty

Why wrong: GuardDuty is a threat detection service that analyses CloudTrail logs among other sources to find suspicious activity. It uses CloudTrail data but is not the source of API audit records.

Create an IAM user and embed the access key in the application code

Why wrong: Hardcoding access keys in application code is a major security risk. Keys can be leaked in code repositories, and they are long-term credentials that do not rotate automatically.

Store the access key in an EC2 environment variable

Why wrong: Storing long-term access keys in environment variables on the instance still violates the requirement to avoid long-term credentials. Environment variables can be read by any process on the instance.

Use an IAM group to assign the permissions to the EC2 instance

Why wrong: IAM groups are used to manage permissions for IAM users, not EC2 instances. EC2 instances cannot be members of IAM groups.

AWS Cost Explorer across all accounts

Why wrong: Cost Explorer can aggregate spending data across accounts in an organisation but it is a reporting tool, not a billing feature that generates a single invoice or enables volume discounts.

AWS Budgets across all accounts

Why wrong: Budgets can set spending alerts across accounts but does not consolidate billing or unlock volume discounts by combining usage.

AWS Support Plan upgrade to Enterprise tier

Why wrong: Upgrading the Support Plan provides access to a TAM and enhanced support but does not consolidate billing or combine volume discounts across accounts.

Amazon GuardDuty

Why wrong: GuardDuty detects security threats and unusual behaviour based on API and network activity logs. It does not scan S3 object content to identify PII or PHI.

AWS CloudTrail

Why wrong: CloudTrail logs API calls to S3 (who accessed what bucket), but it does not inspect the content of S3 objects for sensitive data.

Amazon Inspector

Why wrong: Inspector assesses EC2 instances and container images for security vulnerabilities. It does not scan S3 objects for sensitive data classification.

AWS Cost Explorer

Why wrong: Cost Explorer provides interactive visualisations with 13 months of history and filtering. However, it does not provide per-resource, hourly granularity or the raw data export to S3 that the CUR provides.

AWS Budgets

Why wrong: Budgets provides cost threshold alerting. It does not export granular hourly per-resource billing data to S3.

Amazon CloudWatch Billing Metrics

Why wrong: CloudWatch Billing Metrics provide account-level billing alarms. They do not provide per-resource, hourly billing data exports.

S3 Versioning

Why wrong: Versioning maintains multiple copies of objects for recovery purposes. It does not automate the transition of objects between storage classes.

S3 Intelligent-Tiering

Why wrong: Intelligent-Tiering automatically moves objects between frequent and infrequent access tiers based on access patterns — but only within the Intelligent-Tiering storage class. Lifecycle policies give explicit control over transitions to Glacier tiers.

S3 Event Notification

Why wrong: S3 Event Notifications trigger actions (Lambda, SNS, SQS) when objects are created, deleted, or restored. They do not automate storage class transitions.

AWS DataSync

Why wrong: DataSync transfers data over the internet or Direct Connect. For 80 TB with a 100 Mbps connection, DataSync would take months — the same problem as a direct internet transfer.

AWS Direct Connect

Why wrong: Direct Connect provides a dedicated network connection to AWS and offers higher bandwidth than standard internet, but a 1 Gbps Direct Connect would still take 7+ days for 80 TB.

Amazon S3 Transfer Acceleration

Why wrong: S3 Transfer Acceleration uses CloudFront edge locations to speed up S3 uploads, but it still requires internet bandwidth. It does not help when the bottleneck is total available bandwidth.

AWS Identity and Access Management (IAM) policy

Why wrong: IAM policies are attached to IAM users, groups, or roles within a single account. They cannot restrict the root user of that account, and they do not apply across multiple accounts in an organization. Therefore, this option does not meet the requirement for central enforcement across all member accounts.

AWS Config rule with automatic remediation

Why wrong: AWS Config can evaluate resource configurations against rules and trigger automatic remediation actions (e.g., re-enabling Block Public Access). However, it operates by detecting noncompliant resources after the action has occurred, not by preventing the action in the first place. It also cannot prevent the root user from taking an action and is not a preventive control.

AWS Trusted Advisor

Why wrong: AWS Trusted Advisor provides best-practice checks and recommendations, including checks for S3 buckets with public access. However, it only reports on the current state; it does not enforce policies or prevent users from changing settings. It is an advisory tool, not a preventive control mechanism.

AWS Enterprise Support

Why wrong: Enterprise Support is a paid support plan. It does not provide free service usage.

AWS Credits Programme

Why wrong: AWS Credits are promotional or research credits applied to an account's bill. They are separate from the Free Tier, which is a structural offering for all new accounts.

Reserved Instance discount

Why wrong: Reserved Instances require an upfront commitment for 1 or 3 years in exchange for a discount. They are not a free tier for new customers.

IAM permissions boundaries

Why wrong: IAM permissions boundaries limit the maximum permissions for an IAM user or role, but they are applied per entity and can be overridden by other policies within the account. They do not provide a centralized guardrail across all member accounts in an organization.

AWS Config conformance packs

Why wrong: AWS Config conformance packs contain a collection of AWS Config rules and remediation actions. They can evaluate resources against policies and trigger remediation, but they do not actively prevent actions; they detect and potentially fix noncompliant resources after the fact.

AWS CloudTrail Insights

Why wrong: AWS CloudTrail Insights analyzes management events to detect unusual activity, such as changes to S3 bucket policies. However, it is a monitoring and logging service; it does not prevent or block API calls.

AWS Direct Connect

Why wrong: Direct Connect provides a dedicated network link between on-premises and AWS regions. It does not bring AWS services to run on on-premises hardware.

AWS Snow Family

Why wrong: Snow Family devices (Snowball, Snowcone) are used for data migration and edge computing. They are deployed temporarily for data transfer or limited compute, not as a permanent on-premises AWS infrastructure solution.

AWS Local Zones

Why wrong: Local Zones are AWS-operated extensions of regions in metro areas. They are AWS-managed infrastructure, not on-premises installations in the customer's own facility.

Amazon Athena

Why wrong: Athena runs SQL queries on S3 data. It does not create interactive visual dashboards for business users.

Amazon Redshift

Why wrong: Redshift is a data warehouse for analytical queries. It does not create visual dashboards or provide BI capabilities directly.

Amazon CloudWatch

Why wrong: CloudWatch creates operational dashboards for AWS infrastructure metrics. It is not a business intelligence tool for business data visualisation.

Amazon EMR

Why wrong: EMR runs managed Hadoop/Spark clusters for big data processing. Unlike Glue, EMR requires cluster configuration and is not serverless — you provision and manage the cluster.

AWS Data Pipeline

Why wrong: Data Pipeline is an older AWS ETL orchestration service. AWS Glue is the modern, recommended serverless ETL service with built-in schema discovery and data cataloguing.

Amazon Kinesis Data Firehose

Why wrong: Kinesis Firehose streams data in near-real time to destinations like S3 or Redshift. It performs simple transformations via Lambda but is not designed for complex ETL workflows with schema discovery.

Amazon EC2 + Elastic Load Balancing

Why wrong: EC2 with ELB can serve websites but requires server management and doesn't provide built-in global CDN.

AWS Amplify only

Why wrong: Amplify is a valid option but S3+CloudFront is the more fundamental combination and better illustrates the underlying services.

Amazon Lightsail + Route 53

Why wrong: Lightsail can host websites but doesn't provide global CDN distribution out of the box.

AWS DataSync

Why wrong: DataSync transfers data over the network and would be too slow for petabytes on a constrained connection.

AWS Direct Connect

Why wrong: Direct Connect provides a dedicated network connection but provisioning takes weeks and transfer time for petabytes would still be significant.

Amazon S3 Transfer Acceleration

Why wrong: S3 Transfer Acceleration improves upload speed over the internet but still requires network bandwidth — insufficient for petabytes on slow connections.

Amazon EC2

Why wrong: EC2 requires server management and is not event-driven; it would be over-engineered for this use case.

AWS Fargate

Why wrong: Fargate runs containerized workloads but is typically used for longer-running tasks, not simple event-driven file processing.

Amazon ECS

Why wrong: ECS manages containerized applications and requires more setup than Lambda for simple event-triggered processing.

SSE-C (Customer-Provided Keys)

Why wrong: SSE-C requires the customer to manage and provide encryption keys with every API request — maximum overhead.

SSE-KMS (AWS KMS-Managed Keys)

Why wrong: SSE-KMS provides more control via customer-managed CMKs but requires KMS key management and incurs API costs per operation.

Client-side encryption

Why wrong: Client-side encryption requires the application to encrypt before upload and decrypt after download — maximum complexity and overhead.

Amazon Inspector

Why wrong: Inspector scans for software vulnerabilities and network exposure in EC2 and ECR, not for sensitive data in S3.

AWS Config

Why wrong: Config tracks resource configuration changes and compliance but doesn't scan S3 object content for sensitive data.

Amazon GuardDuty

Why wrong: GuardDuty detects threats using CloudTrail, DNS, and VPC flow logs — it doesn't scan S3 object content for sensitive data patterns.

On-demand self-service

Why wrong: On-demand self-service refers to the ability to provision and manage resources automatically without requiring human interaction from the service provider. The scenario focuses on connectivity and access, not on automated provisioning.

Resource pooling

Why wrong: Resource pooling refers to the provider’s computing resources being pooled to serve multiple customers, with physical and virtual resources dynamically assigned based on demand. The scenario does not involve multi-tenancy or dynamic assignment of infrastructure.

Rapid elasticity

Why wrong: Rapid elasticity allows resources to be scaled up or down quickly, often automatically, to meet fluctuating demand. The scenario does not mention scaling or capacity changes; it only describes accessing a fixed resource from multiple locations.