The AWS Certified Solutions Architect – Associate (SAA-C03) exam includes Design Secure Architectures, worth 30% of scored content, and Design Cost-Optimized Architectures, worth 20%. These domains test how to protect data, control access, and match storage spending to business needs. These SAA-C03 storage security questions cover retention, encryption permissions, file access, and cost controls.
This is the ninth set in our AWS Certified Solutions Architect – Associate SAA-C03 series (Questions 81-90). It follows SAA-C03 Questions 71-80 on data services and application resilience. Every question is an original practice scenario mapped to the official exam objectives, not a copy of a real exam item.
Separate permission to access a storage resource from permission to use its encryption key. For retention and cost questions, identify whether the requirement is an enforceable restriction, a reporting feature, or an alert.
Question 81: Retention That Administrators Cannot Shorten
A records team stores finalized reports as object versions in an S3 bucket with Versioning and Object Lock enabled. Each report must remain protected for seven years after upload. No user, including the account root user, may shorten that period or permanently delete the protected version through S3. Which setting meets this requirement?
A) Apply governance-mode retention with a seven-year retain-until date.
B) Apply compliance-mode retention with a seven-year retain-until date.
C) Apply a legal hold that authorized administrators can remove.
D) Apply a bucket policy denying deletion by the records-team role.
👁 Reveal Answer
Correct Answer: B
Explanation: Compliance mode prevents any user, including root, from deleting the protected object version or shortening its retention period. Protection applies to the version, not to all future versions with the same key. A allows authorized governance bypass. C can be removed by a user with legal-hold permissions and does not enforce the fixed duration by itself. D restricts one role and remains an editable access policy rather than the required retention control.
Reference: Locking objects with Object Lock
Question 82: An Encrypted Replication Gap
An S3 replication rule copies newly uploaded SSE-S3 objects but skips newly uploaded SSE-KMS objects under the same prefix. Versioning, the rule filter, and all required S3 and KMS permissions are correct. The rule does not enable replication of KMS-encrypted objects or specify a replica KMS key. What should the architect change while keeping SSE-KMS encryption?
A) Enable S3 Bucket Keys on the source and leave the replication rule unchanged.
B) Change destination default encryption and leave the replication rule unchanged.
C) Extend source object retention and leave the replication rule unchanged.
D) Enable KMS-object replication and specify a valid destination-Region KMS key.
👁 Reveal Answer
Correct Answer: D
Explanation: Replicating SSE-KMS objects requires explicit opt-in in the replication configuration and a suitable KMS key in the destination bucket’s Region. The scenario already establishes the necessary permissions. A changes how S3 uses KMS but does not supply the missing replication settings. B does not replace the explicit opt-in and replica-key configuration. C changes retention rather than selecting encrypted objects for replication. Permissions alone cannot compensate for a rule that omits these settings.
Reference: Replicating encrypted objects
Question 83: One Side of Cross-Account Authorization
An analytics role in account B reads exports encrypted with a customer managed KMS key in account A. S3 access is correctly authorized, but KMS decryption is denied. The key policy allows account B to use the key; the role has no IAM permission for that key. There are no grants or explicit denies. Which change completes authorization with least privilege?
A) Allow the role kms:Decrypt on account A’s specific key ARN.
B) Allow the role kms:Decrypt only on account B’s own key ARNs.
C) Allow the role kms:DescribeKey on account A’s specific key ARN.
D) Allow the role s3:GetObject on the export prefix a second time.
👁 Reveal Answer
Correct Answer: A
Explanation: Cross-account KMS access requires authorization in the owning account’s key policy and an IAM policy in the caller’s account. A supplies the missing decrypt permission for the exact key that protects these exports. B names keys in the wrong account. C permits key inspection, not decryption. D repeats an S3 permission that is already present; storage access does not independently authorize the cryptographic operation against the KMS key.
Reference: Allowing users in other accounts to use a KMS key
Question 84: Sharing a Recovery Image Privately
A platform team privately shares an EBS snapshot encrypted with its customer managed KMS key with a recovery account in the same Region. The recovery role has the necessary EC2 permissions, but no access to the source KMS key. The team must keep the snapshot encrypted. What additional setup is required for the recovery role to use it?
A) Make the encrypted snapshot public and keep the KMS key private.
B) Grant the role access only to an unrelated key in the recovery account.
C) Authorize the role’s required use of the source key through cross-account policies.
D) Grant the role broader EC2 permissions without changing its KMS access.
👁 Reveal Answer
Correct Answer: C
Explanation: Sharing an encrypted EBS snapshot requires sharing access to the customer managed key that encrypts it. Configure the key policy and the recovery role’s IAM permissions for the required EBS-related KMS operations. A is invalid because encrypted snapshots cannot be shared publicly. B does not authorize use of the key protecting the source snapshot. D expands permissions in the wrong service and leaves the cryptographic access failure unresolved.
Reference: Share an Amazon EBS snapshot with other AWS accounts
Question 85: A Separate View for Each Application
Two applications share one EFS file system. Each must see only its own directory tree and use an assigned POSIX identity regardless of its container’s local user ID. The team can enforce IAM-authenticated mounts and wants to keep one file system. Which design meets these requirements?
A) Assign separate mount-target security groups to select each application’s directory.
B) Assign separate mount targets so each application automatically gets a different root.
C) Assign access points with root directories and POSIX identities, enforced through IAM.
D) Assign client-side mount paths while allowing both applications unrestricted direct mounts.
👁 Reveal Answer
Correct Answer: C
Explanation: EFS access points can enforce both an application-specific root directory and a POSIX user identity. IAM policies can require each application to use its designated access point rather than bypass it with a direct mount. A controls network traffic, not directory visibility or POSIX identity. B provides network connectivity but does not create separate directory roots. D relies on client configuration and leaves an unrestricted path to the shared file system.
Reference: Working with access points
Question 86: Keeping a File Interface While Using S3
An on-premises application writes documents through SMB and cannot be changed to call S3 APIs. The company wants the documents stored as S3 objects, with low-latency local access to frequently used files. It can deploy a gateway appliance but does not want to maintain a custom file-to-object transfer service. Which approach best fits?
A) Run a scheduled DataSync task from an existing SMB server to S3.
B) Mount an EFS file system over private connectivity from the data center.
C) Write a local SMB service that uploads objects and maintains a file cache.
D) Deploy S3 File Gateway with an SMB share and local cache storage.
👁 Reveal Answer
Correct Answer: D
Explanation: S3 File Gateway exposes an SMB file interface backed by S3 objects and provides transparent local caching. It handles the transfer between the gateway and AWS without a custom file-to-object service. A copies data from an existing server but does not provide the requested S3-backed file interface and cache. B provides a different file storage service, not SMB access backed by S3 objects. C recreates functionality that the managed gateway already supplies.
Reference: What is Amazon S3 File Gateway
Question 87: Reading Less Data for Analytics
An analytics team runs Athena SQL queries over wide CSV datasets in S3. Most queries select a few columns and filter on their values. The team wants a query-friendly storage representation that supports column compression and skipping irrelevant data blocks, while retaining every field for future analysis. Which change best meets those goals?
A) Rewrite the datasets as compressed Parquet and query the converted data.
B) Rewrite the datasets as uncompressed CSV with the columns in a new order.
C) Rewrite the datasets as JSON text while retaining the same row structure.
D) Keep the CSV files unchanged and move them under a shorter S3 prefix.
👁 Reveal Answer
Correct Answer: A
Explanation: Parquet is a columnar format that supports compression and predicate pushdown, allowing Athena to avoid reading irrelevant blocks when data statistics support it. Converting the dataset preserves fields while improving its suitability for selective analytics. B rearranges a row-oriented text format without adding those features. C remains a text representation rather than the requested columnar layout. D changes the object location but not the storage format or its block-skipping capabilities.
Reference: Use columnar storage formats
Question 88: A Tag Missing From Cost Reports
A company applies a user-defined CostCenter tag consistently to supported resources. The tag key now appears on the Billing and Cost Management cost allocation tags page with an inactive status. Finance needs to allocate future tagged resource charges by this key. What should the billing administrator do next?
A) Reapply the same tag values and leave the billing activation status unchanged.
B) Activate the CostCenter tag key and allow time for billing processing.
C) Activate each resource’s tag value separately without activating the tag key.
D) Add the tag key to IAM policy conditions without changing billing configuration.
👁 Reveal Answer
Correct Answer: B
Explanation: User-defined tags must be activated for cost allocation before they appear in billing reports. Activation operates on the tag key and affects the values that share that key; it is not instantaneous. A repeats resource tagging but leaves the stated blocker unchanged. C uses the wrong activation unit because administrators activate keys, not individual values. D concerns authorization and does not turn the resource tag into an active billing dimension.
Reference: Activating user-defined cost allocation tags
Question 89: Warning Before the Monthly Target Is Exceeded
A team has enough spending history for AWS Budgets to calculate a forecast. It wants an email when forecasted month-end cost exceeds its monthly target, even if actual spending is still below that target. The team wants an alert only, not automatic resource changes. Which configuration is appropriate?
A) A monthly cost budget with an actual-cost notification at 100%.
B) A monthly usage budget with an actual-usage notification at 100%.
C) A daily RI utilization budget with a notification below its target.
D) A monthly cost budget with a forecasted-cost notification at 100%.
👁 Reveal Answer
Correct Answer: D
Explanation: A forecasted-cost notification compares projected spending with the monthly cost target and can send email without a budget action. Budget data has update delays, so the notification is not a real-time spending cap. A waits for actual cost to cross the threshold. B measures usage rather than the required forecasted cost. C tracks reservation utilization, which does not answer whether total month-end spending is expected to exceed the budget.
Reference: Managing your costs with AWS Budgets
Question 90: A Short-Lived Backup in a Locked Vault
An AWS Backup vault has Vault Lock configured with a minimum retention of 30 days and a maximum of 365 days. A new backup job specifies a lifecycle retention of seven days. No other configuration is incorrect. What should the architect expect when the job targets this vault?
A) The job fails because its retention is below the vault’s permitted minimum.
B) The job succeeds and its retention is automatically increased to 30 days.
C) The job succeeds and its retention is automatically increased to 365 days.
D) The job succeeds because vault limits apply only to existing recovery points.
👁 Reveal Answer
Correct Answer: A
Explanation: Vault Lock retention limits validate new backup and copy jobs. A job whose lifecycle is shorter than the minimum fails instead of having its retention silently rewritten. B and C incorrectly treat the minimum or maximum as an automatic replacement lifecycle. D reverses the behavior: recovery points already present before the lock retain their earlier lifecycle settings, while new jobs must conform. Set the backup plan’s lifecycle within the allowed range before retrying.
Reference: AWS Backup Vault Lock
Study Tips for Storage Security and Cost Controls
- Separate access from retention. IAM permissions, Object Lock, and Vault Lock address different parts of data protection.
- Check both accounts. Cross-account encrypted access needs the right storage permissions and authorization to use the protecting KMS key.
- Match the interface. EFS access points control application views of a file system; S3 File Gateway presents S3-backed files to existing applications.
- Distinguish reports from enforcement. Cost allocation tags support reporting, budget notifications warn about spending, and retention limits can reject backup jobs.
Keep Practicing for AWS Solutions Architect Associate
Review SAA-C03 Questions 71-80 for data services and recovery choices, then revisit these SAA-C03 storage security questions to compare access, retention, and cost controls. The final set will provide a mixed architecture review across all four domains.