SAA-C03 Design High-Performing Architectures Practice Question
A media company uses CloudFront in front of an S3 bucket origin for video thumbnails. They want to prevent users from bypassing CloudFront and accessing the S3 bucket directly, while still allowing CloudFront to fetch objects. What is the best option?
⚠ Common exam trap
Candidates often think signed cookies or URLs alone are sufficient to secure direct S3 access, but they forget that those mechanisms only control access through CloudFront and do not restrict the S3 bucket's public endpoint unless the bucket policy explicitly denies direct access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use CloudFront Origin Access Control (OAC) or Origin Access Identity (OAI) and update the bucket policy to allow only CloudFront.
CloudFront Origin Access Control (OAC) or Origin Access Identity (OAI) allows you to restrict direct access to an S3 bucket by configuring the bucket policy to grant read permissions only to the CloudFront distribution's service principal. This ensures that users can only retrieve thumbnails through CloudFront, leveraging its caching and security features, while blocking any direct S3 requests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Keep the bucket public and rely on signed cookies for all thumbnail requests.
Why it's wrong here
Making the bucket public increases exposure and signed cookies are not an origin access control mechanism.
When this WOULD be correct
If the requirement were to restrict access to thumbnails while allowing both CloudFront and direct S3 access for authorized users, signed cookies (or signed URLs) could be used with a public bucket to control access at the CloudFront level, but the bucket itself would remain accessible.
- ✓
Use CloudFront Origin Access Control (OAC) or Origin Access Identity (OAI) and update the bucket policy to allow only CloudFront.
Why this is correct
OAC/OAI ensures only CloudFront can access the bucket while keeping the bucket private.
- ✗
Enable S3 static website hosting so users access thumbnails directly from the S3 website endpoint.
Why it's wrong here
S3 website endpoints are intended for public access patterns and bypass the security goal.
When this WOULD be correct
This option would be correct if the requirement was to serve static content (e.g., a single-page application) directly from S3 without CloudFront, and the question asked for the simplest way to host a static website with public access.
- ✗
Set S3 bucket permissions to allow all IAM users and block access only by using a WAF rule at CloudFront.
Why it's wrong here
IAM-wide access contradicts least privilege, and WAF does not secure direct S3 access paths.
When this WOULD be correct
In a scenario where the S3 bucket is already configured to allow only CloudFront access (e.g., via OAI/OAC) and the goal is to add an additional layer of security to block specific request patterns (e.g., SQL injection) at the CloudFront edge, a WAF rule would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use CloudFront Origin Access Control (OAC) or Origin Access Identity (OAI) and update the bucket policy to allow only CloudFront.Correct answer▾
Why this is correct
OAC/OAI ensures only CloudFront can access the bucket while keeping the bucket private.
✗Keep the bucket public and rely on signed cookies for all thumbnail requests.Wrong answer — click to see why▾
Why this is wrong here
Keeping the bucket public allows anyone with the S3 URL to access thumbnails directly, bypassing CloudFront. Signed cookies control access via CloudFront but do not prevent direct S3 access, so this fails to meet the requirement.
★ When this WOULD be the correct answer
If the requirement were to restrict access to thumbnails while allowing both CloudFront and direct S3 access for authorized users, signed cookies (or signed URLs) could be used with a public bucket to control access at the CloudFront level, but the bucket itself would remain accessible.
Why candidates choose this
Candidates may think signed cookies provide comprehensive access control, but they overlook that the bucket policy must also restrict direct access. The option seems to address user authentication without considering the need to block direct S3 access.
✗Enable S3 static website hosting so users access thumbnails directly from the S3 website endpoint.Wrong answer — click to see why▾
Why this is wrong here
Enabling S3 static website hosting exposes the S3 bucket via its website endpoint, allowing users to bypass CloudFront and access thumbnails directly, which violates the requirement to prevent direct access.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to serve static content (e.g., a single-page application) directly from S3 without CloudFront, and the question asked for the simplest way to host a static website with public access.
Why candidates choose this
Candidates may confuse 'static website hosting' with a security feature, thinking it restricts access, or they may mistakenly believe it integrates with CloudFront to block direct access.
✗Set S3 bucket permissions to allow all IAM users and block access only by using a WAF rule at CloudFront.Wrong answer — click to see why▾
Why this is wrong here
WAF rules at CloudFront can block certain requests but do not prevent direct access to the S3 bucket; users could still bypass CloudFront and access the bucket directly if the bucket policy allows it.
★ When this WOULD be the correct answer
In a scenario where the S3 bucket is already configured to allow only CloudFront access (e.g., via OAI/OAC) and the goal is to add an additional layer of security to block specific request patterns (e.g., SQL injection) at the CloudFront edge, a WAF rule would be appropriate.
Why candidates choose this
Candidates may think that a WAF rule at CloudFront can enforce access control globally, misunderstanding that WAF operates at the application layer and does not restrict network-level access to the S3 bucket.
Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 302 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.