SAA-C03 Design Resilient Architectures Practice Question
A financial analytics platform stores results in an Amazon S3 bucket. Compliance requires that objects be recoverable for 30 days after deletion and that no user, including administrators, be able to permanently erase them during that window. Objects must also remain readable throughout the retention period. Which approach should the architect implement?
⚠ Common exam trap
The trap here is treating governance mode as equivalent to compliance mode, when governance mode still permits privileged users to bypass retention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable S3 Object Lock in compliance mode with a 30-day retention period on the bucket.
Meeting the requirement means using a control enforced by the storage service that no identity can override. S3 Object Lock in compliance mode provides exactly that: locked object versions cannot be deleted or overwritten by any principal until the retention period lapses, and they remain readable. Governance mode, versioning with policies, and lifecycle expiration all leave a deletion path open for privileged users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable S3 Object Lock in governance mode with a 30-day retention period on the bucket.
Why it's wrong here
Governance mode allows users with the s3:BypassGovernanceRetention permission to shorten or remove retention, so administrators can still delete protected objects. The requirement explicitly states that no user, including administrators, may permanently erase objects, which governance mode cannot guarantee. Compliance mode, not governance mode, is the setting that enforces immutability against all principals.
- ✗
Enable S3 Versioning and add a bucket policy that denies s3:DeleteObject to all principals.
Why it's wrong here
Versioning alone does not prevent permanent erasure: a principal with s3:DeleteObjectVersion can still remove individual object versions, and a bucket policy denying deletion can be edited or removed by an administrator. Compliance requires a control that even privileged users cannot bypass, and this design leaves a path to permanent deletion that administrators could exploit, intentionally or otherwise.
- ✗
Configure an S3 Lifecycle rule to transition objects to S3 Glacier Instant Retrieval after one day and expire them after 30 days.
Why it's wrong here
A lifecycle rule only automates storage class transitions and deletions; it does not prevent deletion by users. In fact, an expiration action actively removes objects, which is the opposite of the desired protection. Glacier Instant Retrieval changes retrieval latency and cost characteristics but offers no immutability guarantee, so an administrator could still erase the data at any time.
- ✓
Enable S3 Object Lock in compliance mode with a 30-day retention period on the bucket.
Why this is correct
Compliance mode enforces a write-once-read-many model in which no principal, including the root user, can overwrite or delete a locked object version before the retention date expires. Objects stay readable throughout the period, satisfying the availability clause. A 30-day retention directly matches the stated recovery window, and the protection is enforced by S3 itself rather than by policy that could be changed.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 935 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.