SAA-C03 Design Secure Architectures Practice Question
This SAA-C03 practice question tests your understanding of design secure architectures. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. A key principle to apply: origin Access Control (OAC) is the recommended way to secure S3 origins for CloudFront.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A customer analytics portal uses CloudFront in front of an S3 origin. Which two settings help keep users from bypassing CloudFront and accessing the bucket directly? The design must avoid adding custom operational scripts.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Origin Access Control for the S3 origin
Option B is correct because Origin Access Control (OAC) is a CloudFront feature that restricts access to an S3 origin so that only the CloudFront distribution can retrieve objects. OAC uses a signed request mechanism that prevents direct S3 access, ensuring users cannot bypass CloudFront and hit the bucket directly without custom scripts.
Key principle: Origin Access Control (OAC) is the recommended way to secure S3 origins for CloudFront.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Enable CloudFront standard logging
Why it's wrong here
Logging records requests but does not block direct S3 access.
✓
Configure Origin Access Control for the S3 origin
Why this is correct
Origin Access Control allows CloudFront to securely access a private S3 bucket.
Related concept
Origin Access Control (OAC) is the recommended way to secure S3 origins for CloudFront.
✓
Use an S3 bucket policy that allows access only from the CloudFront distribution
Why this is correct
The bucket policy should trust the CloudFront distribution and deny direct public access.
Related concept
Origin Access Control (OAC) is the recommended way to secure S3 origins for CloudFront.
✗
Enable S3 static website hosting
Why it's wrong here
Website hosting requires public-style access patterns and does not protect the origin.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often think enabling logging (Option A) or static website hosting (Option D) can somehow restrict access, but these settings have no effect on access control and actually introduce new endpoints that could be exploited to bypass CloudFront.
Detailed technical explanation
How to think about this question
Under the hood, Origin Access Control replaces the older Origin Access Identity (OAI) and uses AWS Signature Version 4 to sign requests from CloudFront to S3, ensuring only requests with the correct signing key are accepted. The S3 bucket policy in Option C complements OAC by explicitly denying any request that does not come from the CloudFront distribution’s service principal, creating a defense-in-depth approach. In real-world scenarios, combining OAC with a bucket policy that allows only CloudFront access is the recommended pattern to prevent direct S3 access without custom scripts.
KKey Concepts to Remember
Origin Access Control (OAC) is the recommended way to secure S3 origins for CloudFront.
OAC prevents users from bypassing CloudFront and accessing S3 directly.
OAC uses a CloudFront service principal in the S3 bucket policy for secure access.
OAC replaces the older Origin Access Identity (OAI) for S3 origins.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Origin Access Control (OAC) is the recommended way to secure S3 origins for CloudFront.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Review origin Access Control (OAC) is the recommended way to secure S3 origins for CloudFront., then practise related SAA-C03 questions on the same topic to reinforce the concept.
Design Secure Architectures — This question tests Design Secure Architectures — Origin Access Control (OAC) is the recommended way to secure S3 origins for CloudFront..
What is the correct answer to this question?
The correct answer is: Configure Origin Access Control for the S3 origin — Option B is correct because Origin Access Control (OAC) is a CloudFront feature that restricts access to an S3 origin so that only the CloudFront distribution can retrieve objects. OAC uses a signed request mechanism that prevents direct S3 access, ensuring users cannot bypass CloudFront and hit the bucket directly without custom scripts.
What should I do if I get this SAA-C03 question wrong?
Review origin Access Control (OAC) is the recommended way to secure S3 origins for CloudFront., then practise related SAA-C03 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Origin Access Control (OAC) is the recommended way to secure S3 origins for CloudFront.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.