SAA-C03 Design Resilient Architectures Practice Question
A media streaming company stores millions of video assets in an Amazon S3 bucket. Compliance regulations mandate that objects must be protected against accidental deletion, malicious tampering, and region-wide disasters. The solution must prevent permanent deletion even by users with root credentials during a retention period. Which combination of features meets these requirements?
⚠ Common exam trap
Candidates forget to include S3 Object Lock in compliance mode, mistakenly believing that standard versioning or bucket policies alone can protect data from being deleted by root users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable S3 Versioning, configure S3 Object Lock in compliance mode, and set up S3 Cross-Region Replication to another AWS Region.
Enabling S3 Versioning preserves every version of every object, protecting against accidental overwrites and deletions. Configuring S3 Object Lock in compliance mode ensures that objects cannot be deleted or modified by any user, including the root account, until the retention period expires. Finally, S3 Cross-Region Replication protects against catastrophic regional disasters by maintaining synchronized copies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable S3 Versioning, apply an S3 Lifecycle rule to transition objects to S3 Glacier, and configure AWS Backup vaults.
Why it's wrong here
S3 Lifecycle rules and backup vaults protect data archive lifecycles, but they do not prevent an authorized user from permanently deleting current object versions. Lifecycle policies alone lack the strict immutability controls required by compliance mandates.
- ✓
Enable S3 Versioning, configure S3 Object Lock in compliance mode, and set up S3 Cross-Region Replication to another AWS Region.
Why this is correct
S3 Object Lock in compliance mode enforces a WORM retention period that no user, including the root account, can shorten or bypass, directly satisfying the mandate against permanent deletion. Versioning preserves prior object versions against tampering, while Cross-Region Replication provides the required resilience against region-wide disasters.
- ✗
Apply strict AWS Identity and Access Management (IAM) bucket policies denying s3:DeleteObject, and enable server-side encryption.
Why it's wrong here
IAM policies and encryption govern access and confidentiality, but a root user can alter those policies and delete objects, and encryption does not block deletion. S3 Object Lock in compliance mode with versioning is required to prevent deletion during retention, including by root.
- ✗
Configure Amazon S3 Intelligent-Tiering, enable Multi-Factor Authentication (MFA) Delete, and attach bucket policies.
Why it's wrong here
MFA Delete prevents deletion using MFA verification, but a user with root credentials can disable MFA Delete on the bucket. It does not provide the permanent, unalterable immutability guarantees of S3 Object Lock in compliance mode.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
One of 149 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.