SAA-C03 Design Secure Architectures Practice Question

A data lake stores raw files in a single Amazon S3 bucket that is shared by three internal analytics teams. Each team should access only its own prefix, and the company wants to eliminate ACL management because objects come from multiple producers. Which three changes should the architect make? Select three.

⚠ Common exam trap

Test-takers frequently think ACLs are necessary for multi-producer environments, but AWS recommends disabling ACLs and using bucket policies or access point policies with Object Ownership set to 'Bucket owner enforced' to simplify access control.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a separate S3 access point for each team and scope it to that team’s prefix.

S3 Access Points allow you to create separate access points scoped to specific prefixes within a shared bucket, enabling each analytics team to access only its own prefix without managing ACLs. This simplifies access control by using access point policies that restrict access to the allowed principals and prefixes, aligning with the requirement to eliminate ACL management.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Create a separate S3 access point for each team and scope it to that team’s prefix.
Why this is correct
Access points let you expose different policy boundaries on the same bucket. They are a good fit when multiple teams need controlled access to different prefixes without creating separate buckets.
✗
Leave ACLs enabled so each producer can grant permissions directly on uploaded objects.
Why it's wrong here
ACLs increase complexity and are harder to govern across many producers. The requirement explicitly calls for eliminating ACL management, so this would work against the design goal.
When this WOULD be correct
In a scenario where objects are uploaded by a single producer and each object needs individual permissions (e.g., a shared bucket with per-object access control for different users), and the company is willing to manage ACLs.
✓
Set Object Ownership to Bucket owner enforced so ACLs are disabled.
Why this is correct
Bucket owner enforced removes ACLs from the access model and makes the bucket owner control all objects. That simplifies ownership and is the recommended approach for shared producer workflows.
✓
Use bucket or access point policies to restrict access to the allowed principals and prefixes.
Why this is correct
Policies are the right enforcement layer for prefix-based access control. They provide centralized, auditable permissions for each team and work cleanly with access points.
✗
Make the bucket public and rely on application-layer authorization for data protection.
Why it's wrong here
Making the bucket public defeats the security requirement and exposes the data to unnecessary risk. Authorization should be enforced at the S3 policy layer, not by public exposure.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.

✓Create a separate S3 access point for each team and scope it to that team’s prefix.Correct answer▾

Why this is correct

Access points let you expose different policy boundaries on the same bucket. They are a good fit when multiple teams need controlled access to different prefixes without creating separate buckets.

✗Leave ACLs enabled so each producer can grant permissions directly on uploaded objects.Wrong answer — click to see why▾

Why this is wrong here

Leaving ACLs enabled contradicts the requirement to eliminate ACL management, and ACLs do not restrict access by prefix—they grant permissions on individual objects, which is not scalable for multiple producers and teams.

★ When this WOULD be the correct answer

In a scenario where objects are uploaded by a single producer and each object needs individual permissions (e.g., a shared bucket with per-object access control for different users), and the company is willing to manage ACLs.

Why candidates choose this

Candidates may think ACLs provide a straightforward way for producers to control access to their uploaded objects, overlooking the management overhead and the requirement to avoid ACLs.

Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAA-C03 Design Secure Architectures Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

AWS S3 Storage Class Comparison

Related to this question