SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Amazon S3 bucket versioning

  Why it's wrong here

  S3 bucket versioning protects object data inside an Amazon S3 bucket by retaining multiple versions of each object, allowing rollback after accidental deletion or overwrite. However, an EBS volume is a raw block device mapped to an EC2 instance, not an object in S3, so versioning does not capture the volume's file system, boot sector, or unallocated blocks. Even if you copy files from the volume to S3, versioning would only manage those individual object versions, not the volume itself. It cannot generate a point-in-time snapshot or restore the EBS volume as a usable device.

  When this WOULD be correct

  A question asks for a backup method for files stored in an S3 bucket, where the requirement is to preserve previous versions of objects to recover from accidental deletions or overwrites. In that scenario, S3 bucket versioning is the correct answer.

• ✓

  Amazon EBS snapshots

  Why this is correct

  EBS snapshots are the native backup mechanism for EBS volumes. They capture point-in-time copies that can later be used to create a new volume, making them a simple and reliable way to restore data after a server or volume loss. Snapshots are incremental, so repeated backups are efficient and suitable for ongoing protection.

• ✗

  AWS Security Hub

  Why it's wrong here

  AWS Security Hub is a security posture management service that aggregates findings from services like GuardDuty, Inspector, and Macie, and runs compliance checks against standards such as CIS AWS Foundations and PCI DSS. It gives you dashboards and alerts about misconfigurations and threats, but it has no mechanism to initiate backups, create snapshots, or restore EBS volumes. The service never reads or writes to the block-level data on your EBS volumes, so it cannot recover lost or corrupted data. While security findings might indicate a problem, Security Hub itself is not a backup or disaster recovery tool.

  When this WOULD be correct

  A question asks: 'Which AWS service should be used to centrally view and manage security alerts and compliance status across multiple AWS accounts?' In that context, Security Hub would be the correct answer.

• ✗

  Amazon CloudFront invalidations

  Why it's wrong here

  Amazon CloudFront is a content delivery network that caches web content at edge locations, and invalidations simply remove cached objects to force the origin to serve updated versions. It operates at the HTTP layer and has no visibility into or control over Amazon EBS block storage attached to an EC2 instance. An invalidation can never recreate a lost EBS volume or restore its point-in-time data because CloudFront has no interaction with EBS volumes, snapshots, or regional storage APIs. Therefore, it is wholly irrelevant for protecting or recovering EBS data.

  When this WOULD be correct

  A company uses CloudFront to distribute a static website and updates the origin content. They need to ensure users see the latest version immediately. CloudFront invalidations would be the correct answer to clear the cache.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question