SAA-C03 Design High-Performing Architectures Practice Question
Exhibit
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-app-data/*",
"Condition": {
"StringEquals": {
"aws:SourceVpce": "vpce-1a2b3c4d"
}
}
}
]
}Refer to the exhibit. A company wants to optimize the performance and security of data transfers between their EC2 instances and an S3 bucket named 'my-app-data'. Which architectural benefit is primarily achieved by implementing the policy shown in the exhibit?
⚠ Common exam trap
The trap is confusing VPC endpoint policies with S3 Transfer Acceleration or replication — all three mention S3 and performance, but only the endpoint keeps traffic on the private AWS network.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It ensures traffic remains on the private AWS network, reducing latency.
The policy shown is a VPC endpoint policy (or an S3 bucket policy restricting access to a VPC endpoint), which forces traffic between EC2 and S3 to traverse the AWS private backbone via a Gateway or Interface VPC Endpoint instead of the public internet. This keeps traffic on the private AWS network, reducing latency, avoiding NAT gateway data-processing charges, and improving security posture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It enables S3 Transfer Acceleration for faster global uploads.
Why it's wrong here
S3 Transfer Acceleration uses Amazon CloudFront's edge locations to speed up long-distance data transfers over the public internet. The policy in the exhibit, however, restricts access to a specific VPC endpoint, which keeps traffic entirely within the AWS private network. These are two different performance optimization strategies that serve different geographic use cases.
- ✓
It ensures traffic remains on the private AWS network, reducing latency.
Why this is correct
By specifying a SourceVpce condition, the policy ensures that only requests coming through the designated VPC Gateway Endpoint are allowed. This configuration routes S3 traffic over the AWS private network backbone rather than the public internet. This results in more consistent performance, lower latency, and reduced data transfer costs for internal AWS traffic.
- ✗
It provides cross-region replication for high availability of data.
Why it's wrong here
Cross-region replication is a feature used to automatically copy objects across different AWS Regions for disaster recovery or latency reduction for global users. The exhibited policy is a resource-based access control policy and does not configure or enable replication features. It focuses strictly on controlling the network path used to access the bucket.
- ✗
It allows public access to the bucket for faster content delivery.
Why it's wrong here
The policy actually restricts access rather than allowing general public access, as it requires the request to originate from a specific VPC endpoint. While the Principal is a wildcard, the Condition block effectively limits access to authorized internal network paths. This improves security and performance for internal applications but does not facilitate public delivery.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva writes every SAA-C03 question from scratch — 149 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.