SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable S3 Block Public Access at the account or bucket level

  Why this is correct

  Enabling S3 Block Public Access at either the account or bucket level is the most robust and recommended control for preventing unintended public exposure of S3 buckets. This feature provides four distinct settings that can be applied to block public access granted through new or existing bucket policies, access control lists (ACLs), or any combination thereof. By enforcing these settings, S3 Block Public Access acts as a comprehensive safeguard, overriding any conflicting permissions that might otherwise inadvertently grant public read or write access to objects.

• ✗

  Enable server access logging on the bucket

  Why it's wrong here

  Enabling server access logging on an S3 bucket records detailed information about requests made to the bucket, such as the requester, the S3 operation performed, and the time and date of the request. While valuable for auditing, security analysis, and understanding access patterns, this feature is purely for monitoring and does not provide any mechanism to prevent or restrict public access to the bucket's contents. It is a reactive tool for observation, not a proactive control for access enforcement.

• ✗

  Create an IAM policy that denies s3:GetObject to anonymous users

  Why it's wrong here

  Creating an IAM policy that denies s3:GetObject to anonymous users, when attached to an IAM user or role, only controls the permissions of that specific identity. It does not prevent public access if the S3 bucket itself has a permissive bucket policy or an Access Control List (ACL) that grants public read access to objects. S3 bucket policies and ACLs operate independently of IAM user policies and can directly grant public permissions, which an IAM user policy cannot override for the bucket itself.

• ✗

  Enable S3 Transfer Acceleration

  Why it's wrong here

  S3 Transfer Acceleration is a feature designed to speed up data transfers to and from S3 buckets over long distances by utilizing Amazon CloudFront's globally distributed edge locations. This service optimizes the network path for uploads and downloads, resulting in faster performance, particularly for users geographically distant from the S3 bucket's region. However, Transfer Acceleration is solely focused on data transfer performance and has no impact whatsoever on the access control, security, or public/private status of the S3 bucket or its objects.