Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Allow the supported log delivery principal to use the intended KMS encryption key addresses a separate condition: service logs cannot be written to a KMS-encrypted destination because the delivery role lacks key access. Log delivery requires key permissions where SSE-KMS is supported. The actual requirement is a log-delivery bucket must reject writes that lack the expected object ownership behavior. Recommended corrective action: Configure supported ownership settings and log service delivery permissions. Object Ownership and service principal permissions must align.

Restrict PutObject to the approved log-delivery principal and target prefix would help if an S3 bucket's policy grants wildcard access to PutObject but not to read. Narrow log delivery permissions avoid indiscriminate object creation. That is not the symptom described here: a log-delivery bucket must reject writes that lack the expected object ownership behavior. The matching response is Configure supported ownership settings and log service delivery permissions, because object Ownership and service principal permissions must align.

Inspect S3 object encryption metadata and associated CloudTrail/KMS events solves a different operational problem where a customer enables encryption but has no evidence of which key was used. Encryption attributes and KMS audit traces support verification. It does not directly address a log-delivery bucket must reject writes that lack the expected object ownership behavior. The case calls for Configure supported ownership settings and log service delivery permissions, since object Ownership and service principal permissions must align.

Configure delete-marker replication behavior consistent with retention needs would help if accidental deletion markers propagate and policy requires preservation at destination. Delete marker settings influence whether replicated deletions appear remotely. That is not the symptom described here: a bucket needs asynchronous copies in a second region for disaster recovery. The matching response is Enable versioning and configure S3 Cross-Region Replication rules, because cRR replicates eligible object versions across regions.

Opt in to SSE-KMS replication with destination key and role permissions solves a different operational problem where objects encrypted with SSE-KMS are not replicating under the default replication setup. KMS-encrypted replication needs explicit key and rule configuration. It does not directly address a bucket needs asynchronous copies in a second region for disaster recovery. The case calls for Enable versioning and configure S3 Cross-Region Replication rules, since cRR replicates eligible object versions across regions.

The competing option Monitor S3 replication metrics and time-control options where supported would be useful when replication metrics show a backlog that violates RPO targets. Replication visibility helps meet bounded recovery objectives. The present issue is a bucket needs asynchronous copies in a second region for disaster recovery; it is more directly addressed by Enable versioning and configure S3 Cross-Region Replication rules. CRR replicates eligible object versions across regions.

For the alternative failure replication metrics show a backlog that violates RPO targets, the control Monitor S3 replication metrics and time-control options where supported is relevant: replication visibility helps meet bounded recovery objectives. Here the evidence instead is objects encrypted with SSE-KMS are not replicating under the default replication setup. The selected technical mechanism is Opt in to SSE-KMS replication with destination key and role permissions: kMS-encrypted replication needs explicit key and rule configuration.

Use S3 Batch Replication for eligible preexisting objects solves a different operational problem where existing historical objects are missing from a newly enabled replication rule. Standard replication rules do not retroactively copy all prior objects. It does not directly address objects encrypted with SSE-KMS are not replicating under the default replication setup. The case calls for Opt in to SSE-KMS replication with destination key and role permissions, since kMS-encrypted replication needs explicit key and rule configuration.

The option Configure delete-marker replication behavior consistent with retention needs addresses a separate condition: accidental deletion markers propagate and policy requires preservation at destination. Delete marker settings influence whether replicated deletions appear remotely. The actual requirement is objects encrypted with SSE-KMS are not replicating under the default replication setup. Recommended corrective action: Opt in to SSE-KMS replication with destination key and role permissions. KMS-encrypted replication needs explicit key and rule configuration.

Opt in to SSE-KMS replication with destination key and role permissions solves a different operational problem where objects encrypted with SSE-KMS are not replicating under the default replication setup. KMS-encrypted replication needs explicit key and rule configuration. It does not directly address existing historical objects are missing from a newly enabled replication rule. The case calls for Use S3 Batch Replication for eligible preexisting objects, since standard replication rules do not retroactively copy all prior objects.

The competing option Enable versioning and configure S3 Cross-Region Replication rules would be useful when a bucket needs asynchronous copies in a second region for disaster recovery. CRR replicates eligible object versions across regions. The present issue is existing historical objects are missing from a newly enabled replication rule; it is more directly addressed by Use S3 Batch Replication for eligible preexisting objects. Standard replication rules do not retroactively copy all prior objects.

Monitor S3 replication metrics and time-control options where supported would help if replication metrics show a backlog that violates RPO targets. Replication visibility helps meet bounded recovery objectives. That is not the symptom described here: existing historical objects are missing from a newly enabled replication rule. The matching response is Use S3 Batch Replication for eligible preexisting objects, because standard replication rules do not retroactively copy all prior objects.

The competing option Opt in to SSE-KMS replication with destination key and role permissions would be useful when objects encrypted with SSE-KMS are not replicating under the default replication setup. KMS-encrypted replication needs explicit key and rule configuration. The present issue is replication metrics show a backlog that violates RPO targets; it is more directly addressed by Monitor S3 replication metrics and time-control options where supported. Replication visibility helps meet bounded recovery objectives.

The option Enable versioning and configure S3 Cross-Region Replication rules addresses a separate condition: a bucket needs asynchronous copies in a second region for disaster recovery. CRR replicates eligible object versions across regions. The actual requirement is replication metrics show a backlog that violates RPO targets. Recommended corrective action: Monitor S3 replication metrics and time-control options where supported. Replication visibility helps meet bounded recovery objectives.

For the alternative failure accidental deletion markers propagate and policy requires preservation at destination, the control Configure delete-marker replication behavior consistent with retention needs is relevant: delete marker settings influence whether replicated deletions appear remotely. Here the evidence instead is replication metrics show a backlog that violates RPO targets. The selected technical mechanism is Monitor S3 replication metrics and time-control options where supported: replication visibility helps meet bounded recovery objectives.

Monitor S3 replication metrics and time-control options where supported would help if replication metrics show a backlog that violates RPO targets. Replication visibility helps meet bounded recovery objectives. That is not the symptom described here: accidental deletion markers propagate and policy requires preservation at destination. The matching response is Configure delete-marker replication behavior consistent with retention needs, because delete marker settings influence whether replicated deletions appear remotely.

For the alternative failure existing historical objects are missing from a newly enabled replication rule, the control Use S3 Batch Replication for eligible preexisting objects is relevant: standard replication rules do not retroactively copy all prior objects. Here the evidence instead is accidental deletion markers propagate and policy requires preservation at destination. The selected technical mechanism is Configure delete-marker replication behavior consistent with retention needs: delete marker settings influence whether replicated deletions appear remotely.

Opt in to SSE-KMS replication with destination key and role permissions solves a different operational problem where objects encrypted with SSE-KMS are not replicating under the default replication setup. KMS-encrypted replication needs explicit key and rule configuration. It does not directly address accidental deletion markers propagate and policy requires preservation at destination. The case calls for Configure delete-marker replication behavior consistent with retention needs, since delete marker settings influence whether replicated deletions appear remotely.

Configure cross-account backup copies into a controlled backup account would help if a backup copy must be isolated from the source account's compromise. Separate account custody limits source account compromise impact. That is not the symptom described here: teams each create inconsistent snapshots and retention schedules. The matching response is Apply AWS Backup policies and plans across supported accounts/resources, because central backup plans standardize retention and scheduling.

Use AWS Backup Vault Lock with approved retention controls solves a different operational problem where a ransomware threat must not allow ordinary administrators to delete recent backups. Vault Lock enforces protected backup retention settings. It does not directly address teams each create inconsistent snapshots and retention schedules. The case calls for Apply AWS Backup policies and plans across supported accounts/resources, since central backup plans standardize retention and scheduling.

The competing option Use AWS Backup restore testing and validate recovery outputs would be useful when a report says backups run but no one knows if restore is functional. Restoration tests provide evidence beyond job success. The present issue is teams each create inconsistent snapshots and retention schedules; it is more directly addressed by Apply AWS Backup policies and plans across supported accounts/resources. Central backup plans standardize retention and scheduling.

Apply AWS Backup policies and plans across supported accounts/resources solves a different operational problem where teams each create inconsistent snapshots and retention schedules. Central backup plans standardize retention and scheduling. It does not directly address a ransomware threat must not allow ordinary administrators to delete recent backups. The case calls for Use AWS Backup Vault Lock with approved retention controls, since vault Lock enforces protected backup retention settings.

The competing option Configure cross-account backup copies into a controlled backup account would be useful when a backup copy must be isolated from the source account's compromise. Separate account custody limits source account compromise impact. The present issue is a ransomware threat must not allow ordinary administrators to delete recent backups; it is more directly addressed by Use AWS Backup Vault Lock with approved retention controls. Vault Lock enforces protected backup retention settings.

The option Validate service support and use an appropriate native backup mechanism addresses a separate condition: an unsupported resource cannot be protected by the selected AWS Backup plan. Backup selection must match resource support. The actual requirement is a ransomware threat must not allow ordinary administrators to delete recent backups. Recommended corrective action: Use AWS Backup Vault Lock with approved retention controls. Vault Lock enforces protected backup retention settings.

Use AWS Backup Vault Lock with approved retention controls solves a different operational problem where a ransomware threat must not allow ordinary administrators to delete recent backups. Vault Lock enforces protected backup retention settings. It does not directly address a backup copy must be isolated from the source account's compromise. The case calls for Configure cross-account backup copies into a controlled backup account, since separate account custody limits source account compromise impact.

The competing option Apply AWS Backup policies and plans across supported accounts/resources would be useful when teams each create inconsistent snapshots and retention schedules. Central backup plans standardize retention and scheduling. The present issue is a backup copy must be isolated from the source account's compromise; it is more directly addressed by Configure cross-account backup copies into a controlled backup account. Separate account custody limits source account compromise impact.

The option Use AWS Backup restore testing and validate recovery outputs addresses a separate condition: a report says backups run but no one knows if restore is functional. Restoration tests provide evidence beyond job success. The actual requirement is a backup copy must be isolated from the source account's compromise. Recommended corrective action: Configure cross-account backup copies into a controlled backup account. Separate account custody limits source account compromise impact.

The competing option Validate service support and use an appropriate native backup mechanism would be useful when an unsupported resource cannot be protected by the selected AWS Backup plan. Backup selection must match resource support. The present issue is a report says backups run but no one knows if restore is functional; it is more directly addressed by Use AWS Backup restore testing and validate recovery outputs. Restoration tests provide evidence beyond job success.

The option Configure cross-account backup copies into a controlled backup account addresses a separate condition: a backup copy must be isolated from the source account's compromise. Separate account custody limits source account compromise impact. The actual requirement is a report says backups run but no one knows if restore is functional. Recommended corrective action: Use AWS Backup restore testing and validate recovery outputs. Restoration tests provide evidence beyond job success.

For the alternative failure teams each create inconsistent snapshots and retention schedules, the control Apply AWS Backup policies and plans across supported accounts/resources is relevant: central backup plans standardize retention and scheduling. Here the evidence instead is a report says backups run but no one knows if restore is functional. The selected technical mechanism is Use AWS Backup restore testing and validate recovery outputs: restoration tests provide evidence beyond job success.

Use AWS Backup restore testing and validate recovery outputs would help if a report says backups run but no one knows if restore is functional. Restoration tests provide evidence beyond job success. That is not the symptom described here: an unsupported resource cannot be protected by the selected AWS Backup plan. The matching response is Validate service support and use an appropriate native backup mechanism, because backup selection must match resource support.

For the alternative failure a backup copy must be isolated from the source account's compromise, the control Configure cross-account backup copies into a controlled backup account is relevant: separate account custody limits source account compromise impact. Here the evidence instead is an unsupported resource cannot be protected by the selected AWS Backup plan. The selected technical mechanism is Validate service support and use an appropriate native backup mechanism: backup selection must match resource support.

Apply AWS Backup policies and plans across supported accounts/resources solves a different operational problem where teams each create inconsistent snapshots and retention schedules. Central backup plans standardize retention and scheduling. It does not directly address an unsupported resource cannot be protected by the selected AWS Backup plan. The case calls for Validate service support and use an appropriate native backup mechanism, since backup selection must match resource support.