SAA-C03 Design Secure Architectures Practice Question
Exhibit
Current audit configuration:
- AWS Config recorder is enabled in one account only
- CloudTrail trail captures management events in us-east-1 only
- No EventBridge rules or SNS alerts are configured
Recent activity:
{
"eventSource": "s3.amazonaws.com",
"eventName": "PutBucketPolicy",
"errorCode": "AccessDenied",
"userIdentity": {"arn": "arn:aws:iam::999900001111:user/temp-admin"}
}
{
"eventSource": "kms.amazonaws.com",
"eventName": "PutKeyPolicy",
"errorCode": null,
"userIdentity": {"arn": "arn:aws:iam::999900001111:role/SecurityOps"}
}Based on the exhibit, the security team needs to detect and alert on both successful and failed attempts to change S3 bucket policies and KMS key policies across the organization. Which solution best meets that requirement?
⚠ Common exam trap
Test-takers frequently confuse AWS Config's compliance checks or IAM Access Analyzer's policy analysis with real-time API call monitoring, failing to realize that only CloudTrail management events capture every attempt (including failures) to change policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable an organization trail for management events in all regions and create an EventBridge rule that matches PutBucketPolicy and PutKeyPolicy, then send alerts to SNS.
AWS CloudTrail management events capture all API calls that modify S3 bucket policies (PutBucketPolicy) and KMS key policies (PutKeyPolicy). By enabling an organization trail for all regions, you centralize these events across the entire AWS Organization. An Amazon EventBridge rule can then filter for these specific API calls and send alerts via Amazon SNS, meeting the requirement to detect both successful and failed attempts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable an organization trail for management events in all regions and create an EventBridge rule that matches PutBucketPolicy and PutKeyPolicy, then send alerts to SNS.
Why this is correct
CloudTrail management events record API activity, including failed attempts, and an organization trail provides coverage across accounts and Regions. EventBridge can react to those API calls in near real time and route notifications to SNS. This is the clean detective-control pattern for policy-change auditing.
- ✗
Enable AWS Config in all accounts and use only a periodic compliance evaluation to alert when bucket or key policies drift.
Why it's wrong here
AWS Config is useful for detecting configuration drift, but it is not the best tool for alerting on every policy-change attempt, especially failed API calls. The requirement explicitly asks for attempts and timely alerting, which CloudTrail and EventBridge handle more directly.
- ✗
Use IAM Access Analyzer because it continuously blocks policy changes that would expose the resources publicly.
Why it's wrong here
Access Analyzer can identify broad resource-access patterns and generate findings, but it does not block or alert on every bucket policy or KMS key policy API call. It is not a real-time audit trail for successful and failed administrative actions.
- ✗
Turn on S3 server access logging and KMS key rotation, because both services will capture policy modifications automatically.
Why it's wrong here
S3 server access logging records object-level access to buckets, not administrative policy changes. KMS key rotation changes cryptographic material, not audit coverage for policy updates. Neither service alone satisfies the requirement to alert on policy-change attempts across the organization.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAA-C03 question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.