SAA-C03 Q124 · Storage

Question

A law firm needs to make hundreds of files readable for the general public. The law firm must prevent members of the public from modifying or deleting the files before a specified future date. Which solution will meet these requirements MOST securely?

Accepted Answer

Option B satisfies every requirement securely:

1. **Public readability**: CloudFront distribution serves files to the general public via HTTPS — no AWS credentials needed for end users.

2. **Prevent modification/deletion before a date**: S3 Object Lock in **Compliance mode** (or Governance mode) with a retention period set to the specified future date makes objects immutable. Even the root account cannot delete objects in Compliance mode before the retention date expires.

3. **S3 Versioning enabled**: This is a **prerequisite** for S3 Object Lock — you cannot enable Object Lock without Versioning.

4. **Most secure access pattern**: The S3 bucket policy restricts direct access to only the CloudFront **Origin Access Control (OAC)**. The public never accesses S3 directly. This prevents:

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips