A data lake stores raw files in a single Amazon S3 bucket that is shared by three internal analytics teams. Each team should access only its own prefix, and the company wants to eliminate ACL management because objects come from multiple producers. Which three changes should the architect make? Select three.

Leave ACLs enabled so each producer can grant permissions directly on uploaded objects.

ACLs increase complexity and are harder to govern across many producers. The requirement explicitly calls for eliminating ACL management, so this would work against the design goal.

Make the bucket public and rely on application-layer authorization for data protection.

Making the bucket public defeats the security requirement and exposes the data to unnecessary risk. Authorization should be enforced at the S3 policy layer, not by public exposure.

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Create a separate S3 access point for each team and scope it to that team’s prefix. — The correct architecture uses access points to separate team access, disables ACLs with Bucket owner enforced, and relies on bucket or access point policies to enforce prefix-level authorization. This gives each analytics team a clear access boundary while keeping the shared bucket manageable. It is a strong example of replacing fragile object ACL handling with policy-driven S3 access control. Why others are wrong: Leaving ACLs enabled or making the bucket public both undermine the stated security goals. ACLs add operational burden and are easy to misconfigure, while public access is plainly unsafe. The point of access points and bucket owner enforced ownership is to replace those older patterns with simpler, centralized policy control.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.