SAA-C03 Design High-Performing Architectures Practice Question

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::my-bucket/*"]
    }
  ]
}

Refer to the exhibit. An application running on an EC2 instance requires access to S3 objects but is encountering slow performance when fetching large files. An architect observes high network latency between the instance and S3. Which strategy will improve retrieval performance?

⚠ Common exam trap

Candidates often assume that CloudFront is always the answer for performance optimization or caching, ignoring that it is meant for edge-to-user delivery, whereas VPC endpoints are designed for secure and optimized internal AWS resource-to-resource traffic.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create an S3 VPC Endpoint.

Creating an Amazon S3 VPC Endpoint (Gateway Endpoint) allows resources within an Amazon VPC (such as an EC2 instance) to communicate with Amazon S3 without requiring an internet gateway, NAT device, or VPN connection. Traffic between the VPC and S3 leaves the instances and goes directly to S3 via the AWS network backbone, significantly improving retrieval performance, reducing latency, and avoiding public internet bottlenecks. CloudFront is intended for global end-user content delivery rather than optimizing backend EC2-to-S3 communication.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Update the IAM policy to include s3:ListBucket.
Why it's wrong here
Adding s3:ListBucket only allows the application to view the contents of the bucket. It does not address the underlying performance issue related to network latency or data transfer speeds. IAM permission changes do not impact the underlying network throughput between the EC2 instance and the S3 service.
✓
Create an S3 VPC Endpoint.
Why this is correct
While VPC endpoints keep traffic within the AWS network, they are primarily for security and private connectivity. CloudFront provides edge caching, which offers superior performance for large file retrieval by serving objects from closer geographical locations, whereas a VPC endpoint only optimizes the path to the S3 region.
✗
Deploy an Amazon CloudFront distribution in front of the S3 bucket.
Why it's wrong here
CloudFront uses edge locations to cache content, drastically reducing the latency for S3 object retrieval. For high-performance requirements, caching data closer to the compute source provides much faster response times than standard S3 requests, effectively mitigating network congestion and latency issues encountered during high-frequency data access.
✗
Change the S3 bucket storage class to S3 Intelligent-Tiering.
Why it's wrong here
Storage classes relate to cost management and data lifecycle policies, not performance. Changing the storage class does not influence the network latency or retrieval speeds of the files themselves. Performance optimization requires architectural changes to the delivery mechanism, such as caching or improved network routing, not storage class.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

About these practice questions

Courseiva writes every SAA-C03 question from scratch — 149 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint

This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.