A company stores customer invoices in an Amazon S3 bucket. The application must keep the bucket private, ACLs should not be used, and customers should receive temporary download links for individual invoices. Which three changes should the architect make? Select three.

Continue using object ACLs so each customer invoice can be made public briefly.

ACLs are discouraged for modern S3 designs because they are harder to manage and easier to misconfigure. Brief public exposure also conflicts with the requirement to keep the bucket private.

Move the bucket to another AWS Region to isolate it from the internet.

Changing Regions does not make S3 private and does not solve access control problems. Privacy depends on policies and public access controls, not physical Region placement.

What does this SAA-C03 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Enable S3 Block Public Access on both the bucket and the AWS account. — The right approach is to block all public access, disable ACL usage, and issue temporary object-specific presigned URLs. Together these controls keep the bucket private while still allowing the business to share one invoice at a time. This design also reduces operational risk because it removes the need to manage ACLs and avoids exposing the full bucket to the internet. Why others are wrong: Using ACLs or moving the bucket to a different Region does not satisfy the security requirements. ACLs increase complexity and are specifically what the team wants to avoid. Region placement has no direct effect on whether objects are public or private. The controls that matter here are access policy, Block Public Access, and time-limited object access.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.