SAA-C03 Design Resilient Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable S3 versioning on the bucket and configure cross-Region replication so previous versions are available after regional loss and accidental deletion.

  Why this is correct

  Enabling S3 versioning preserves every PUT as a new version, so an accidental DELETE only adds a delete marker and the original object can be restored instantly. Cross-Region replication (CRR) asynchronously copies every version — including previous ones — to a secondary Region, providing recoverability if the entire source Region becomes unavailable. Together, versioning addresses user error and CRR addresses regional loss, satisfying the full recovery requirement.

• ✗

  Move all objects to S3 Glacier Instant Retrieval and apply a lifecycle policy to keep only the latest object copy.

  Why it's wrong here

  S3 Glacier Instant Retrieval is an archive storage class designed for long-lived data with millisecond access, but it has no inherent versioning, deletion protection, or cross-Region redundancy. Applying a lifecycle rule to keep only the latest object copy would actually purge all older versions (if any existed) and the single remaining copy is still vulnerable to deletion or a Regional outage. This option intentionally discards historical versions, contradicting the requirement to retain previous versions for recovery.

  When this WOULD be correct

  This option would be correct if the requirements were to reduce storage costs for infrequently accessed data while maintaining millisecond retrieval times, and there was no need to recover from accidental deletion or regional disasters.

• ✗

  Use S3 server-side encryption with KMS keys and rely on access logs to manually recover the deleted objects.

  Why it's wrong here

  Server-side encryption with AWS KMS (SSE-KMS) protects object confidentiality by encrypting data at rest, but it does not increase durability and has no mechanism to protect against deletion or to store history. S3 access logs can confirm that a DELETE request was made and by whom, yet logs record request metadata, not object contents, so they cannot rebuild the deleted file's bytes. Without versioning or replication, the original uploads are gone forever, making this a security-monitoring aid rather than a data recovery solution.

  When this WOULD be correct

  If the requirement was to audit who deleted objects and when, without needing to restore them, enabling S3 server access logs and using AWS CloudTrail would be correct. This scenario focuses on detective controls, not recovery.

• ✗

  Enable S3 bucket policies that deny DeleteObject, but do not enable versioning or replication.

  Why it's wrong here

  A bucket policy that denies s3:DeleteObject can block ordinary IAM users from issuing deletes, but it cannot prevent deletes from the AWS account root user, lifecycle expirations, or a compromised administrative role, so it only narrows some future mistakes. Because versioning is not enabled, the currently deleted objects were permanently removed and no prior copy exists to restore. Without replication, there is also no second Region copy, so the policy provides neither recovery for existing deletions nor resilience against a regional failure.

  When this WOULD be correct

  A question requiring prevention of accidental deletion by unauthorized users (e.g., preventing a junior admin from deleting objects) where versioning is already enabled and disaster recovery is not a concern. The policy would block delete API calls while versioning retains previous versions.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question