SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable S3 Versioning on the bucket to keep a history of all changes made to the logs.

  Why it's wrong here

  S3 Versioning is a prerequisite for Object Lock but does not inherently prevent the deletion of objects. A user with sufficient permissions can still delete specific versions or the entire object. Versioning provides a way to recover from accidental changes but does not enforce a strict, immutable retention period.

• ✗

  Use S3 Glacier Deep Archive as the storage class for the logs with a vault lock policy.

  Why it's wrong here

  S3 Glacier Deep Archive is a cost-effective storage class for long-term data retention, but it does not provide immutability on its own. While it supports vault lock policies, it is primarily designed for data that is rarely accessed and requires several hours for retrieval, which may not fit all use cases.

• ✓

  Enable S3 Object Lock in compliance mode with a retention period of seven years.

  Why this is correct

  S3 Object Lock in compliance mode ensures that an object version cannot be overwritten or deleted by any user, including the root user in the AWS account. This mode is essential for meeting regulatory requirements where data must be preserved and remain unalterable for a specified duration without any exceptions.

• ✗

  Configure AWS Backup to take daily snapshots of the S3 bucket and store them in a secure vault.

  Why it's wrong here

  AWS Backup provides centralized backup management and can protect S3 data, but it operates as a separate service rather than a native bucket-level immutability feature. While it offers recovery points, it does not prevent the original data from being modified or deleted before the next scheduled backup occurs.