SAA-C03 Design Secure Architectures Practice Question
A data lake stores raw files in a single Amazon S3 bucket that is shared by three internal analytics teams. Each team should access only its own prefix, and the company wants to eliminate ACL management because objects come from multiple producers. Which three changes should the architect make? Select three.
⚠ Common exam trap
Test-takers frequently think ACLs are necessary for multi-producer environments, but AWS recommends disabling ACLs and using bucket policies or access point policies with Object Ownership set to 'Bucket owner enforced' to simplify access control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a separate S3 access point for each team and scope it to that team’s prefix.
Option A is correct because S3 access points provide a dedicated endpoint per team, and each access point can be scoped with a policy limited to that team's prefix, giving clean per-team isolation without duplicating buckets. Option C is correct because setting Object Ownership to Bucket owner enforced disables ACLs entirely, so the bucket owner automatically owns every object and ACL management is eliminated, which matches the requirement that objects come from multiple producers. Option D is correct because bucket policies and access point policies are the IAM-based mechanism that restricts each team to its allowed principals and prefixes once ACLs are disabled. Option B is wrong because leaving ACLs enabled keeps the ACL management burden the company wants to remove. Option E is wrong because making the bucket public exposes the data and application-layer authorization does not replace S3-level access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a separate S3 access point for each team and scope it to that team’s prefix.
Why this is correct
An S3 access point gives each team a distinct hostname and policy scoped to its own prefix, so a single shared bucket can be partitioned without duplicating data. This enforces per-team prefix isolation while access point policies replace per-object ACL grants.
- ✗
Leave ACLs enabled so each producer can grant permissions directly on uploaded objects.
Why it's wrong here
Leaving ACLs enabled contradicts the requirement to eliminate ACL management; disabling ACLs and using bucket policies with prefix conditions enforces per-team access. It tempts because ACLs do grant object-level permissions, and they would suit a small producer set where central policy administration is not required.
When this WOULD be correct
In a scenario where objects are uploaded by a single producer and each object needs individual permissions (e.g., a shared bucket with per-object access control for different users), and the company is willing to manage ACLs.
- ✓
Set Object Ownership to Bucket owner enforced so ACLs are disabled.
Why this is correct
Bucket owner enforced sets Object Ownership so the bucket owner owns every object and ACLs are disabled entirely. This directly satisfies the requirement to eliminate ACL management, since producers can no longer attach grants and access is governed solely by policies.
- ✓
Use bucket or access point policies to restrict access to the allowed principals and prefixes.
Why this is correct
Bucket and access point policies evaluate the requesting principal and the prefix in the resource ARN, so each team is allowed only its own prefix. This replaces ACL-based grants with centralised, auditable policy control, satisfying the eliminate-ACL-management constraint.
- ✗
Make the bucket public and rely on application-layer authorization for data protection.
Why it's wrong here
A public bucket exposes every prefix to anonymous access, defeating per-team isolation; bucket policies scoped by prefix with IAM principals enforce it. It tempts because application-layer authorisation can gate access, and it would be acceptable for genuinely public datasets where no prefix-level restriction is needed.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a separate S3 access point for each team and scope it to that team’s prefix.Correct answer▾
Why this is correct
An S3 access point gives each team a distinct hostname and policy scoped to its own prefix, so a single shared bucket can be partitioned without duplicating data. This enforces per-team prefix isolation while access point policies replace per-object ACL grants.
✗Leave ACLs enabled so each producer can grant permissions directly on uploaded objects.Wrong answer — click to see why▾
Why this is wrong here
Leaving ACLs enabled contradicts the requirement to eliminate ACL management, and ACLs do not restrict access by prefix—they grant permissions on individual objects, which is not scalable for multiple producers and teams.
★ When this WOULD be the correct answer
In a scenario where objects are uploaded by a single producer and each object needs individual permissions (e.g., a shared bucket with per-object access control for different users), and the company is willing to manage ACLs.
Why candidates choose this
Candidates may think ACLs provide a straightforward way for producers to control access to their uploaded objects, overlooking the management overhead and the requirement to avoid ACLs.
Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 935 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.