SAA-C03 Design Secure Architectures Practice Question
A solutions architect is designing an S3 bucket for a claims portal. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure?
⚠ Common exam trap
Watch out — candidates often think an IAM deny policy (Option B) is sufficient, but they miss that bucket policies can grant access to anonymous users independently of IAM, making S3 Block Public Access the only reliable safeguard.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable S3 Block Public Access at the account or bucket level
S3 Block Public Access provides a definitive override that prevents any public access to objects, regardless of bucket policies or object ACLs. By enabling this setting at the account or bucket level, the architect ensures that even if a developer later adds an overly broad bucket policy, the S3 service will block all public access. This is the only option that directly and permanently prevents public exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable S3 Block Public Access at the account or bucket level
Why this is correct
S3 Block Public Access provides a centralized, account- or bucket-level safety net that overrides both bucket policies and object ACLs. When enabled, the IgnorePublicAcls and BlockPublicPolicy settings cause S3 to reject any attempt to make objects publicly accessible via a public ACL or a policy that grants public access. This is the definitive control for a claims portal because it closes the two most common misconfiguration paths, ensuring claim documents remain private even if an administrator accidentally attaches a permissive policy.
- ✗
Create an IAM policy that denies s3:GetObject to anonymous users
Why it's wrong here
An IAM policy can only be attached to IAM principals such as users, groups, or roles; anonymous users do not have an identity that can be referenced in an IAM policy. Even if you crafted a bucket policy with a Deny statement for anonymous principals, it would not stop a public ACL from being applied, because bucket ACLs are evaluated separately from IAM. Thus, a Deny-all IAM policy leaves a gaping hole for public bucket policies or ACLs that explicitly grant AllUsers READ access.
- ✗
Enable server access logging on the bucket
Why it's wrong here
Server access logging captures detailed records of requests made to the bucket, including source IP, requester, and operation, but it is purely a monitoring feature. It has no effect on S3's authorization logic; objects that are publicly readable will remain readable regardless of whether logging is enabled. Logs can help you detect exposure after the fact, but they cannot enforce privacy or prevent a misconfiguration from happening.
- ✗
Enable S3 Transfer Acceleration
Why it's wrong here
S3 Transfer Acceleration uses a network of CloudFront edge locations to accelerate uploads over long distances by routing traffic through optimized network paths. It is designed to improve throughput and reduce latency for large files, not to alter access control or privacy. Enabling it has no bearing on whether objects are publicly readable, so it does nothing to satisfy a requirement that claim objects remain private.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SAA-C03 question is part of Courseiva's 935-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.