SAA-C03 Design Resilient Architectures Practice Question

A inventory service exposes a static website from S3 and CloudFront. Users should still receive cached pages if the S3 origin has a short outage. Which feature helps most?

⚠ Common exam trap

Candidates often confuse CloudFront's caching with other AWS services like S3 Transfer Acceleration or S3 Cross-Region Replication, which do not provide cached responses during origin outages.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

CloudFront caching with appropriate TTLs

CloudFront caches responses from the S3 origin based on configured TTLs (Cache-Control or Expires headers). If the S3 origin experiences a short outage, CloudFront can still serve cached pages to users from its edge locations, maintaining availability. This is the most direct way to ensure users receive content during origin failures.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
CloudFront caching with appropriate TTLs
Why this is correct
CloudFront caching with appropriate TTLs is correct because it stores static content at edge locations, allowing the website to be served to users from cache even when the S3 origin is temporarily unavailable. As long as the TTL has not expired, users experience no interruption, and the cached content provides a buffer against origin outages. This makes the service more resilient, provided the TTL balances freshness and availability.
✗
AWS Backup Vault Lock
Why it's wrong here
AWS Backup Vault Lock is incorrect because it enforces a write-once-read-many (WORM) policy on backup vaults to protect backup files from deletion or alteration. It has no effect on how CloudFront or S3 serves website content, and it cannot serve cached versions of the site during an outage. Its purpose is data protection compliance, not content delivery resilience.
✗
IAM Access Analyzer
Why it's wrong here
IAM Access Analyzer is incorrect because it is a security tool that scans resource policies to detect external access, helping identify unintended sharing of S3 buckets. It does not cache content, proxy requests, or interact with CloudFront edge nodes. Therefore, it cannot mitigate an S3 origin outage, as its function is purely analytical and does not participate in the content delivery path.
✗
S3 Select
Why it's wrong here
S3 Select is incorrect because it enables efficient SQL-based querying of data stored in S3 objects, returning only filtered subsets of data to reduce network usage. It is designed for data processing scenarios, not for serving static websites, and it does not maintain a cache of responses. In an outage where S3 is unreachable, S3 Select would also be unavailable, so it offers no origin outage tolerance.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAA-C03 Design Resilient Architectures Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question