SAA-C03 Design Secure Architectures Practice Question
A healthcare document service stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured?
⚠ Common exam trap
Watch out — candidates often confuse S3 versioning with immutability, assuming versioning alone prevents deletion, but versioning only protects against accidental overwrites by creating new versions—it does not prevent explicit deletion of the current version or the entire object.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
S3 Object Lock in compliance mode with an appropriate retention period
S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This meets the compliance requirement of immutable audit logs for seven years, as compliance mode enforces a strict write-once-read-many (WORM) model that cannot be bypassed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
S3 Object Lock in compliance mode with an appropriate retention period
Why this is correct
S3 Object Lock in compliance mode ensures that objects, once written, cannot be overwritten or deleted by any user, including the root account, until the specified retention period expires. This "write-once-read-many" (WORM) model is crucial for audit logs, providing an immutable record that meets stringent regulatory compliance requirements for data integrity and non-repudiation. It directly prevents any accidental or malicious alteration of the log data, making it tamper-proof.
- ✗
S3 server access logging
Why it's wrong here
S3 server access logging records detailed information about requests made to an S3 bucket, such as the requester, request type, and time. While valuable for security analysis, auditing access patterns, and operational insights, these logs themselves are stored as regular S3 objects. They do not inherently possess immutability features and can be deleted or modified by authorized users, failing to meet the requirement for tamper-proof audit logs.
- ✗
S3 lifecycle expiration after seven years
Why it's wrong here
An S3 lifecycle expiration rule is designed to automatically transition or delete objects after a specified period, optimizing storage costs and managing data retention policies. While setting an expiration after seven years ensures eventual deletion, it does not prevent objects from being deleted or modified *before* that seven-year mark by users with appropriate permissions. Therefore, it fails to provide the necessary immutability for audit logs requiring protection against premature alteration or deletion.
- ✗
S3 versioning only
Why it's wrong here
S3 versioning preserves multiple versions of an object, protecting against accidental overwrites and deletions by allowing retrieval of previous states. However, versioning alone does not prevent an authorized user from explicitly deleting an object's current version or even all versions, which would then be marked with a delete marker. It also doesn't prevent overwriting, as new versions are simply created, meaning the data is not truly immutable in a WORM sense.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 302 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.