SAA-C03 Design Resilient Architectures Practice Question
A content publishing system exposes a static website from S3 and CloudFront. Users should still receive cached pages if the S3 origin has a short outage. Which feature helps most?
⚠ Common exam trap
Many candidates confuse data protection features (like Backup Vault Lock) or data retrieval features (like S3 Select) with caching mechanisms that directly improve availability during origin outages.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CloudFront caching with appropriate TTLs
CloudFront caches responses from the S3 origin based on configured TTLs (Cache-Control or Expires headers). If the S3 origin experiences a short outage, CloudFront can still serve cached content to users until the TTL expires, maintaining availability. This is the most direct way to ensure users receive pages during transient origin failures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAM Access Analyzer
Why it's wrong here
IAM Access Analyzer is a security service that inspects resource-based policies (such as S3 bucket policies) to identify unintended external access and generate findings for remediation. It is purely a permission-review and audit tool—it does not process HTTP requests, cache objects, or help serve content when an origin fails. Since the issue is origin availability rather than overly broad permissions, Access Analyzer has no role in keeping the static website reachable during an S3 outage.
- ✗
AWS Backup Vault Lock
Why it's wrong here
AWS Backup Vault Lock provides a write-once-read-many (WORM) protection model for backup vaults, preventing recovery points from being deleted or overwritten even by root users. It is designed for compliance and data-retention governance, not for content delivery or improving the availability of a live static website. Even if backups of the S3 bucket exist, Vault Lock neither exposes them through a CDN nor makes the current website content available when the original bucket is temporarily unreachable.
- ✓
CloudFront caching with appropriate TTLs
Why this is correct
CloudFront caching with appropriate TTLs is correct because CloudFront edge locations store copies of S3 objects and serve them directly to viewers based on the configured cache TTL. If the S3 origin becomes temporarily unavailable, requests can still be fulfilled from cached content at the edge as long as the object is still in the cache and its TTL has not expired—this effectively masks origin downtime. Choosing appropriate TTLs (e.g., long TTL for immutable static assets) maximizes the chance that cached copies remain available during an outage while balancing freshness, and CloudFront can even serve stale content when it fails to reach the origin.
- ✗
S3 Select
Why it's wrong here
S3 Select is a data-retrieval feature that uses SQL statements to return only a subset of rows or columns from an object in an S3 bucket, reducing network transfer and client-side processing for analytical workloads. It does not cache objects, replicate data, or maintain any alternate content source—it only queries data that is already stored in S3. If the source bucket is unavailable, S3 Select has nothing to read from, so it provides zero tolerance for origin outages and cannot help serve the static website.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 935 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.