Amazon AWS Certified Solutions Architect Associate SAA-C03 Data Governance Retention and Recovery Protection Practice Test

 

Topic 06 covers data governance, retention, and recovery protection for the AWS Certified Solutions Architect – Associate certification. These original SAA-C03 questions separate classification and access boundaries, immutable retention, recovery-copy isolation, compliance evidence, and recoverability risks. Select one answer unless a fixed number is requested. Each alternative includes a specific technical reason. For broader preparation, visit the AWS Certified Solutions Architect Associate SAA-C03 Exam Dumps page.

Question 1

A company stores millions of documents in S3 but does not know which objects contain personally identifiable information. The security team wants managed discovery before it writes more restrictive bucket policies. Which service should be used first?

1. Amazon Inspector
2. AWS Certificate Manager
3. AWS Shield Advanced
4. Use Amazon Macie.

Correct Answer: D

 

Correct Answer

Answer D is correct because Macie can discover and classify sensitive data in S3 so the team can identify which data needs stronger handling controls.

Incorrect Answers

Answer A is incorrect because Inspector focuses on software vulnerabilities in workloads, not classification of S3 object contents. It therefore does not satisfy the scenario’s decisive requirement: Managed discovery needed.

Answer B is incorrect because ACM manages TLS certificates and cannot classify data stored in S3. It therefore does not satisfy the scenario’s decisive requirement: Managed discovery needed.

Answer C is incorrect because Shield Advanced addresses DDoS protection rather than discovery of sensitive stored data. It therefore does not satisfy the scenario’s decisive requirement: Managed discovery needed.

 

Question 2

A regulated analytics dataset must be accessible only from a dedicated data account. Analysts in other accounts may assume a tightly scoped role in the data account, but the dataset must not be copied into their accounts. Which design best supports the boundary?

1. Copy the dataset into every analyst account and rely on naming conventions.
2. Email temporary presigned URLs with multi-year expirations to all analysts.
3. Keep the data in the dedicated account and delegate controlled read access.
4. Make the S3 bucket public and use an obscure object prefix.

Correct Answer: C

 

Correct Answer

Answer C is correct because Centralizing the data preserves the account boundary while delegated authorization can provide governed access without creating unmanaged copies.

Incorrect Answers

Answer A is incorrect because Copying multiplies the number of locations that need retention, encryption, and access governance. It therefore does not satisfy the scenario’s decisive requirement: Delegated access permitted.

Answer B is incorrect because Long-lived ad hoc links weaken centralized revocation and do not preserve the stated governed account-access model.

Answer D is incorrect because Public access removes the required account boundary and object names are not an authorization control.

 

Question 3

An S3 bucket containing confidential exports is accidentally configured for public access. The company wants a preventive control that blocks public exposure at the account level even if a future bucket policy is misconfigured. Which control is most appropriate?

1. Use AWS Backup to copy the bucket nightly.
2. Enable S3 Versioning only.
3. Add a longer lifecycle retention period.
4. Enable S3 Block Public Access at the appropriate account or bucket scope.

Correct Answer: D

 

Correct Answer

Answer D is correct because Block Public Access provides a preventive guardrail against public S3 access configurations and directly addresses the stated exposure risk.

Incorrect Answers

Answer A is incorrect because Backups improve recovery but do not prevent public exposure of the live bucket. It therefore does not satisfy the scenario’s decisive requirement: Prevent public access.

Answer B is incorrect because Versioning protects object history but does not prevent anonymous public reads. It therefore does not satisfy the scenario’s decisive requirement: Prevent public access.

Answer C is incorrect because Retention affects object age and storage transitions, not whether the bucket is publicly accessible.

 

Question 4

A research team shares one governed S3 dataset with an external processing account for 30 days. The external account must read only a designated prefix and must not change retention settings or delete source objects. Which design principle is most important?

1. Grant only the required read access and keep retention administration with the owner.
2. Disable object encryption so cross-account access is simpler.
3. Grant s3:* so the processor can troubleshoot without returning to the owner.
4. Transfer bucket ownership to the external account for the duration.

Correct Answer: A

 

Correct Answer

Answer A is correct because The external workload receives the minimum data-plane access while the source account retains lifecycle and deletion authority.

Incorrect Answers

Answer B is incorrect because Removing encryption weakens protection and is unnecessary when cross-account authorization can be configured correctly.

Answer C is incorrect because Wildcard permissions would include destructive and administrative capabilities that the requirement explicitly excludes. It therefore does not satisfy the scenario’s decisive requirement: No retention or deletion authority.

Answer D is incorrect because Ownership transfer would broaden control far beyond the temporary read requirement. It therefore does not satisfy the scenario’s decisive requirement: No retention or deletion authority.

 

Question 5

A legal policy requires customer records to remain only in eu-central-1, including backups and replicas. Which TWO design checks are required? Choose TWO.

1. Copy snapshots to us-east-1 because cross-Region storage is always more compliant.
2. Disable encryption because encrypted data is exempt from residency rules.
3. Use a global CloudFront distribution because edge caching does not create any data-location considerations.
4. Keep backups, replicas, and copies in eu-central-1.
5. Keep primary storage in eu-central-1.

Correct Answers: D, E

 

Correct Answers

Answer D is correct because Residency applies to recovery copies as well as the primary dataset. This applies directly to the scenario’s decisive requirement: Replicas included.

Answer E is correct because The live data location must satisfy the stated residency boundary. This applies directly to the scenario’s decisive requirement: Replicas included.

Incorrect Answers

Answer A is incorrect because The explicit policy forbids recovery copies outside eu-central-1. It therefore does not satisfy the scenario’s decisive requirement: Replicas included.

Answer B is incorrect because Encryption does not relocate data or waive the stated geographic requirement. It therefore does not satisfy the scenario’s decisive requirement: Replicas included.

Answer C is incorrect because A blanket statement that edge behavior can never affect data location would not satisfy a strict residency review.

 

Question 6

A company must retain specific S3 object versions until an ongoing investigation ends, but nobody knows the end date in advance. Which Object Lock feature best matches?

1. Transition the objects to S3 Standard-IA.
2. Apply a legal hold.
3. Use only S3 Versioning with no retention control.
4. Set a one-day lifecycle expiration rule.

Correct Answer: B

 

Correct Answer

Answer B is correct because A legal hold protects an object version without a fixed expiration date and remains until an authorized user removes it.

Incorrect Answers

Answer A is incorrect because A storage-class change affects cost and retrieval characteristics, not legal immutability. It therefore does not satisfy the scenario’s decisive requirement: Must prevent deletion.

Answer C is incorrect because Versioning retains versions unless they are explicitly deleted; it does not by itself enforce indefinite legal preservation.

Answer D is incorrect because Expiration would work against the requirement to keep the evidence until an unknown future date.

 

Question 7

A regulatory rule states that retained S3 records must not be deletable by any user, including the account root user, during the fixed retention period. Which Object Lock mode fits?

1. Compliance mode
2. S3 Intelligent-Tiering
3. Governance mode
4. MFA Delete alone

Correct Answer: A

 

Correct Answer

Answer A is correct because Compliance mode prevents deletion or shortening of the protected version during retention, including by root.

Incorrect Answers

Answer B is incorrect because Storage class optimization changes cost and access behavior but does not enforce immutability or legal retention.

Answer C is incorrect because Governance mode allows specially authorized principals to bypass retention, so it does not satisfy the no-user-exception requirement.

Answer D is incorrect because MFA Delete adds deletion friction but is not equivalent to Object Lock compliance-mode WORM retention.

 

Question 8

An application overwrites the same S3 key every hour. Operators want the ability to recover yesterday’s content after an accidental overwrite, but they do not require immutability. Which feature is the primary control?

1. Enable a WAF web ACL.
2. Use CloudFront field-level encryption.
3. Enable S3 Versioning.
4. Use a KMS alias.

Correct Answer: C

 

Correct Answer

Answer C is correct because Versioning preserves multiple object versions so an earlier version can be recovered after an overwrite.

Incorrect Answers

Answer A is incorrect because WAF filters web requests and does not retain prior object content. It therefore does not satisfy the scenario’s decisive requirement: No immutability requirement.

Answer B is incorrect because Transport/content encryption does not create recoverable historical object versions. It therefore does not satisfy the scenario’s decisive requirement: No immutability requirement.

Answer D is incorrect because A key alias does not preserve old versions of the object. It therefore does not satisfy the scenario’s decisive requirement: No immutability requirement.

 

Question 9

A bucket has Object Lock-protected versions and an S3 lifecycle rule that expires current objects. What happens when lifecycle expiration reaches a version that is still under retention?

1. Lifecycle expiration overrides Object Lock because lifecycle rules run as the S3 service.
2. The KMS key is deleted to make the object unreadable instead.
3. The protected version cannot be permanently deleted while retention applies.
4. The object is immediately copied to a new bucket without retention.

Correct Answer: C

 

Correct Answer

Answer C is correct because Object Lock protection remains effective through lifecycle processing; lifecycle can add delete markers or transition storage but cannot permanently remove a protected version.

Incorrect Answers

Answer A is incorrect because Object Lock retention is specifically designed to prevent deletion even when ordinary lifecycle expiration would otherwise remove data.

Answer B is incorrect because Lifecycle does not delete the encryption key as an alternative to object deletion. It therefore does not satisfy the scenario’s decisive requirement: Need deletion behavior.

Answer D is incorrect because Lifecycle expiration does not automatically create an unprotected copy elsewhere. It therefore does not satisfy the scenario’s decisive requirement: Need deletion behavior.

 

Question 10

Archived records are transitioned to a cold S3 storage class to reduce cost. A compliance officer asks whether the retention requirement disappears after the transition. Which answer is correct?

1. Yes. Archive storage classes cannot preserve Object Lock metadata.
2. No; Object Lock retention remains with the protected object version.
3. Yes, unless the object is publicly readable.
4. No, but only because KMS automatically prevents every delete of archived objects.

Correct Answer: B

 

Correct Answer

Answer B is correct because Retention metadata and WORM protection are tied to the object version, not to a particular S3 storage class.

Incorrect Answers

Answer A is incorrect because Object Lock is maintained through lifecycle transitions; moving to archival storage does not remove retention.

Answer C is incorrect because Public access has no relationship to whether retention metadata survives a storage-class transition.

Answer D is incorrect because KMS protects encryption keys; it is not the mechanism enforcing S3 Object Lock retention.

 

Question 11

Production backups are stored in the same AWS account as the workload. The threat model includes compromise of the production account’s administrators. What improvement most directly increases backup isolation?

1. Copy backups to a dedicated recovery account.
2. Increase the backup frequency but keep all copies in the production account.
3. Disable encryption so copies are easier to restore.
4. Rename the backup vault so attackers are less likely to find it.

Correct Answer: A

 

Correct Answer

Answer A is correct because Cross-account copies place recovery points outside the compromised production-account administrative boundary. This applies directly to the scenario’s decisive requirement: Need recovery isolation.

Incorrect Answers

Answer B is incorrect because More restore points improve RPO but do not remove the shared administrative failure domain.

Answer C is incorrect because Removing encryption weakens data protection and does not isolate the backup from the production account.

Answer D is incorrect because Resource naming is not an isolation control against compromised administrators. It therefore does not satisfy the scenario’s decisive requirement: Need recovery isolation.

 

Question 12

A company requires backup recovery points that cannot be deleted or have retention shortened by any user after a defined grace period. Which AWS Backup control is designed for this?

1. Use AWS Backup Vault Lock in compliance mode.
2. An IAM policy that every current administrator promises not to change.
3. An S3 bucket lifecycle rule.
4. A backup vault name that begins with protected-.

Correct Answer: A

 

Correct Answer

Answer A is correct because After its grace period, compliance-mode Vault Lock makes the lock immutable and prevents users, including root, from deleting protected recovery points before retention ends.

Incorrect Answers

Answer B is incorrect because An administrator who can alter the policy could remove the protection; the requirement asks for immutable enforcement.

Answer C is incorrect because AWS Backup recovery points are governed by backup-vault controls, not an unrelated S3 lifecycle rule.

Answer D is incorrect because A naming convention does not create deletion protection. It therefore does not satisfy the scenario’s decisive requirement: Immutable after grace period.

 

Question 13

A security team wants backups stored with compliance-mode immutability and also wants the option to share the recovery vault with another account for incident recovery. Which AWS Backup vault type is designed for this pattern?

1. Use a logically air-gapped vault.
2. An EBS volume in the production account.
3. A standard S3 bucket with public read disabled.
4. A CloudFront distribution with origin failover.

Correct Answer: A

 

Correct Answer

Answer A is correct because A logically air-gapped vault includes compliance-mode Vault Lock and can be shared for recovery through supported cross-account mechanisms.

Incorrect Answers

Answer B is incorrect because A live volume shares the production account boundary and is not an immutable backup vault.

Answer C is incorrect because An S3 bucket is not an AWS Backup vault and does not provide the integrated recovery-point sharing model requested.

Answer D is incorrect because CloudFront origin failover addresses content delivery availability, not immutable backup storage. It therefore does not satisfy the scenario’s decisive requirement: Cross-account recovery option.

 

Question 14

A backup copy exists in Account B, and the team wants to restore the protected resource into Account B after Account A is compromised. Which sequence reflects the AWS Backup cross-account recovery model for standard vault copies?

1. Export the recovery point as a public S3 object and import it manually.
2. Start a restore in Account A and specify Account B as the output account without copying the recovery point.
3. Make Account B the root user of Account A and restore in place.
4. Copy the recovery point into Account B, then restore from Account B.

Correct Answer: D

 

Correct Answer

Answer D is correct because AWS Backup restores from a recovery point in the destination account; cross-account recovery is achieved through copy followed by restore.

Incorrect Answers

Answer A is incorrect because Public exposure is unnecessary and would bypass the native protected backup workflow. It therefore does not satisfy the scenario’s decisive requirement: Standard cross-account backup.

Answer B is incorrect because AWS Backup does not directly restore a standard recovery point from one account into another without the copy step.

Answer C is incorrect because Root credential sharing is neither required nor an acceptable recovery pattern. It therefore does not satisfy the scenario’s decisive requirement: Standard cross-account backup.

 

Question 15

A company runs successful backup jobs every night but has never attempted a restore. The recovery objective requires confidence that applications can actually be rebuilt. Which TWO actions provide stronger recovery evidence? Choose TWO.

1. Validate the restored data and application against recovery checks.
2. Increase the backup retention period without testing restores.
3. Perform periodic restores into an isolated environment.
4. Rename the vault after each backup job.
5. Disable encryption during tests so failures are less likely.

Correct Answers: A, C

 

Correct Answers

Answer A is correct because Recovery confidence requires checking that restored resources are usable, not merely that the restore API returned success.

Answer C is correct because A completed backup job does not prove the data and dependencies can be restored into a usable resource.

Incorrect Answers

Answer B is incorrect because Longer retention provides more historical points but does not demonstrate recoverability. It therefore does not satisfy the scenario’s decisive requirement: Need confidence in recovery.

Answer D is incorrect because Vault naming has no relationship to restore integrity. It therefore does not satisfy the scenario’s decisive requirement: Need confidence in recovery.

Answer E is incorrect because Testing should validate the real protected recovery path, including encryption dependencies. It therefore does not satisfy the scenario’s decisive requirement: Need confidence in recovery.

 

Question 16

An auditor asks for AWS’s SOC report and other provider-level compliance documents about the AWS infrastructure. Which service is the most direct source?

1. AWS Backup
2. AWS Config
3. AWS Artifact
4. Amazon GuardDuty

Correct Answer: C

 

Correct Answer

Answer C is correct because Artifact provides on-demand access to AWS compliance reports, certifications, and agreements about the AWS infrastructure.

Incorrect Answers

Answer A is incorrect because Backup protects customer recovery points and does not publish AWS provider audit reports. It therefore does not satisfy the scenario’s decisive requirement: Not customer resource evidence.

Answer B is incorrect because Config records the customer’s AWS resource configurations and compliance evaluations, not AWS provider audit reports.

Answer D is incorrect because GuardDuty provides threat-detection findings rather than provider compliance documentation. It therefore does not satisfy the scenario’s decisive requirement: Not customer resource evidence.

 

Question 17

A compliance analyst needs to determine how a security group was configured last week and whether an AWS Config rule marked it noncompliant at that time. Which service provides the most direct resource-configuration timeline?

1. AWS Certificate Manager
2. AWS Config
3. Amazon Macie
4. Amazon SQS

Correct Answer: B

 

Correct Answer

Answer B is correct because Config records supported resource configuration items and can show configuration and compliance history over time.

Incorrect Answers

Answer A is incorrect because ACM manages certificates and their lifecycle rather than historical resource-configuration or compliance timelines.

Answer C is incorrect because Macie classifies sensitive data in S3 and does not maintain security-group configuration history.

Answer D is incorrect because SQS delivers messages and does not record historical AWS resource configuration. It therefore does not satisfy the scenario’s decisive requirement: Need point-in-time configuration.

 

Question 18

An investigator needs to know which identity changed an S3 bucket policy, when the API call occurred, and the request parameters. Which evidence source should be queried?

1. Amazon Macie only
2. Use AWS CloudTrail.
3. S3 Object Lock metadata
4. AWS Config only

Correct Answer: B

 

Correct Answer

Answer B is correct because CloudTrail records AWS API activity and provides caller and request context for control-plane changes such as bucket-policy updates.

Incorrect Answers

Answer A is incorrect because Macie can identify sensitive data risks but does not attribute the bucket-policy API call.

Answer C is incorrect because Object Lock metadata describes retention on object versions, not who changed a bucket policy.

Answer D is incorrect because Config can show the configuration state change, but CloudTrail is the more direct source for the caller and API request details.

 

Question 19

A company wants to collect evidence mapped to a compliance assessment using AWS Config checks, Security Hub controls, CloudTrail user activity, and manual evidence. Which service is designed to organize this assessment evidence?

1. AWS Lambda
2. AWS Artifact
3. Use AWS Audit Manager.
4. Amazon CloudFront

Correct Answer: C

 

Correct Answer

Answer C is correct because Audit Manager collects and organizes automated and manual evidence against assessment controls using sources such as Config, Security Hub, and CloudTrail.

Incorrect Answers

Answer A is incorrect because Lambda can automate tasks, but it is not the managed audit-evidence assessment service requested.

Answer B is incorrect because Artifact provides AWS provider reports but does not organize the customer’s ongoing control evidence in this assessment model.

Answer D is incorrect because CloudFront delivers content and does not manage audit assessments. It therefore does not satisfy the scenario’s decisive requirement: Automated and manual evidence.

 

Question 20

A policy exception allows one S3 bucket to remain without a specific Config rule for 14 days while a migration finishes. The compliance team needs the exception documented rather than silently treated as compliant. What is the best governance approach?

1. Delete CloudTrail history for the migration period.
2. Make the bucket public so reviewers can verify it more easily.
3. Record a scoped, time-bounded exception and preserve the noncompliant evidence.
4. Change the Config rule so every bucket always evaluates compliant.

Correct Answer: C

 

Correct Answer

Answer C is correct because A documented time-bounded exception keeps the evidence truthful and separates risk acceptance from a false compliant state.

Incorrect Answers

Answer A is incorrect because Removing evidence weakens auditability and does not create a legitimate exception process. It therefore does not satisfy the scenario’s decisive requirement: Need truthful evidence.

Answer B is incorrect because Public exposure would add risk and is unrelated to documenting a control exception. It therefore does not satisfy the scenario’s decisive requirement: Need truthful evidence.

Answer D is incorrect because Changing the rule to hide the exception destroys the usefulness of the control for all resources.

 

Question 21

A user accidentally overwrites a critical S3 object. Versioning was enabled before the overwrite. Which recovery action is appropriate?

1. Retrieve or restore the prior object version and make it current again.
2. Schedule deletion of the current version’s KMS key.
3. Rotate the bucket’s KMS key because rotation automatically restores previous content.
4. Enable AWS WAF on the bucket endpoint.

Correct Answer: A

 

Correct Answer

Answer A is correct because Versioning preserves the previous object version so it can be recovered after an accidental overwrite.

Incorrect Answers

Answer B is incorrect because Deleting the key risks making data unreadable and does not restore the earlier object version.

Answer C is incorrect because Key rotation changes encryption material and does not revert object data. It therefore does not satisfy the scenario’s decisive requirement: Need previous content.

Answer D is incorrect because WAF filters supported web requests and does not preserve or restore earlier S3 object versions.

 

Question 22

An attacker compromises an administrator in the production account and deletes every recovery point the administrator can reach. Which design would have most reduced this blast radius?

1. Use shorter retention so fewer backups are exposed.
2. Keep immutable protected copies in a separate recovery account.
3. Disable CloudTrail to prevent the attacker from learning vault names.
4. Create more backups in the same deletable production vault.

Correct Answer: B

 

Correct Answer

Answer B is correct because Account separation removes copies from the compromised administrator’s normal boundary, and immutable retention further resists destructive actions.

Incorrect Answers

Answer A is incorrect because Shorter retention reduces recovery history and does not protect against administrative deletion. It therefore does not satisfy the scenario’s decisive requirement: Need smaller blast radius.

Answer C is incorrect because Attackers with administrative access do not depend on CloudTrail to discover resources, and disabling logs removes evidence.

Answer D is incorrect because Additional copies with the same compromised administrative boundary can still be deleted together. It therefore does not satisfy the scenario’s decisive requirement: Need smaller blast radius.

 

Question 23

A workload has daily backups in the same Region. The business requires the ability to recover after a complete regional outage. What additional control is needed?

1. Disable backup encryption so another Region can read the files.
2. Move the backups to a different Availability Zone in the same Region and declare regional independence.
3. Increase the number of same-Region snapshots only.
4. Maintain a supported cross-Region recovery copy or replication strategy.

Correct Answer: D

 

Correct Answer

Answer D is correct because A recovery point in another Region avoids sharing the same regional failure domain as the primary workload and local backups.

Incorrect Answers

Answer A is incorrect because Encryption is compatible with cross-Region recovery when keys and permissions are designed correctly.

Answer B is incorrect because Availability Zone separation does not satisfy a requirement to survive loss of the entire Region.

Answer C is incorrect because More snapshots improve recovery points but still share the regional outage boundary. It therefore does not satisfy the scenario’s decisive requirement: Need regional recovery.

 

Question 24

A backup is intact, but the only customer managed KMS key that can decrypt it was permanently deleted months ago. What is the recovery implication?

1. AWS Backup automatically recreates the same deleted KMS key material.
2. The backup can always be restored by disabling encryption during the restore job.
3. S3 Versioning reconstructs the deleted KMS key from object metadata.
4. The backup may be unrecoverable because the decrypt key no longer exists.

Correct Answer: D

 

Correct Answer

Answer D is correct because Permanent deletion of the KMS key destroys the cryptographic dependency needed to decrypt data protected by that key.

Incorrect Answers

Answer A is incorrect because AWS cannot recreate permanently deleted customer key material merely because a backup still exists.

Answer B is incorrect because Encryption cannot be bypassed when the ciphertext requires the missing key for decryption. It therefore does not satisfy the scenario’s decisive requirement: Need restore.

Answer C is incorrect because Versioning preserves object versions, not external KMS cryptographic key material. It therefore does not satisfy the scenario’s decisive requirement: Need restore.

 

Question 25

A lifecycle policy is configured to delete backups after 30 days, but a new legal requirement says selected records must remain immutable for seven years. Which principle should govern the redesign?

1. Delete the oldest backups now so the seven-year period can restart from today.
2. Enforce the seven-year retention requirement ahead of ordinary lifecycle deletion.
3. Keep the 30-day lifecycle because automated deletion is more reliable than compliance retention.
4. Turn off all backups and rely on the live application database for seven years.

Correct Answer: B

 

Correct Answer

Answer B is correct because Retention requirements must override ordinary cleanup schedules for the protected records; lifecycle can still operate within the boundaries of the retention control.

Incorrect Answers

Answer A is incorrect because Destroying existing required records would worsen the retention violation. It therefore does not satisfy the scenario’s decisive requirement: Selected records.

Answer C is incorrect because The current cleanup schedule directly conflicts with the new legal retention requirement. It therefore does not satisfy the scenario’s decisive requirement: Selected records.

Answer D is incorrect because A live database alone does not provide the required immutable retention or recovery protection.