Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Use a suitable regional key or supported KMS multi-Region key architecture addresses a separate condition: customers in a secondary region cannot decrypt replicas encrypted with a single-region key. KMS keys have regional scope unless using multi-Region key design. The actual requirement is an S3 object uses SSE-S3 and the team expects KMS key-policy enforcement. Recommended corrective action: Use SSE-KMS with a customer key when KMS policy control is required. SSE-S3 encryption is not controlled by customer KMS key policies.

Configure replica key permissions separately for the regional consumer would help if a replica KMS key is created but its policy allows no application decrypt. Each regional key has independent access policy evaluation. That is not the symptom described here: an S3 object uses SSE-S3 and the team expects KMS key-policy enforcement. The matching response is Use SSE-KMS with a customer key when KMS policy control is required, because sSE-S3 encryption is not controlled by customer KMS key policies.

For the alternative failure s3 replication attempts to use a source key unavailable to its replication role, the control Permit the replication role necessary KMS decrypt and encrypt operations is relevant: replication requires access to both source and destination encryption keys. Here the evidence instead is an S3 object uses SSE-S3 and the team expects KMS key-policy enforcement. The selected technical mechanism is Use SSE-KMS with a customer key when KMS policy control is required: sSE-S3 encryption is not controlled by customer KMS key policies.

Evaluate minimum object size and transition charges before lifecycle movement would help if a dataset has objects smaller than lifecycle tiering thresholds. Small objects can be uneconomical to transition. That is not the symptom described here: logs require immediate access but seldom, with variable future access patterns. The matching response is Use S3 Intelligent-Tiering when access patterns cannot be predicted, because intelligent-Tiering moves eligible objects among access tiers automatically.

For the alternative failure an S3 lifecycle policy deletes files required by an active legal hold, the control Verify Object Lock retention/holds and exempt protected versions from intended deletion is relevant: governance/legal retention takes precedence over ordinary expiration. Here the evidence instead is logs require immediate access but seldom, with variable future access patterns. The selected technical mechanism is Use S3 Intelligent-Tiering when access patterns cannot be predicted: intelligent-Tiering moves eligible objects among access tiers automatically.

The competing option Keep the index in a frequent-access class and place payloads in an archive tier would be useful when an index must remain instantly readable while large records are archived. Retrieval policies can differ between metadata and archived objects. The present issue is logs require immediate access but seldom, with variable future access patterns; it is more directly addressed by Use S3 Intelligent-Tiering when access patterns cannot be predicted. Intelligent-Tiering moves eligible objects among access tiers automatically.

Keep the index in a frequent-access class and place payloads in an archive tier solves a different operational problem where an index must remain instantly readable while large records are archived. Retrieval policies can differ between metadata and archived objects. It does not directly address a yearly audit may restore archives within hours rather than milliseconds. The case calls for Use a suitable S3 Glacier storage class and plan retrieval lead time, since archive tiers have retrieval latency and minimum storage-duration considerations.

The competing option Verify Object Lock retention/holds and exempt protected versions from intended deletion would be useful when an S3 lifecycle policy deletes files required by an active legal hold. Governance/legal retention takes precedence over ordinary expiration. The present issue is a yearly audit may restore archives within hours rather than milliseconds; it is more directly addressed by Use a suitable S3 Glacier storage class and plan retrieval lead time. Archive tiers have retrieval latency and minimum storage-duration considerations.

The option Evaluate minimum object size and transition charges before lifecycle movement addresses a separate condition: a dataset has objects smaller than lifecycle tiering thresholds. Small objects can be uneconomical to transition. The actual requirement is a yearly audit may restore archives within hours rather than milliseconds. Recommended corrective action: Use a suitable S3 Glacier storage class and plan retrieval lead time. Archive tiers have retrieval latency and minimum storage-duration considerations.

Evaluate minimum object size and transition charges before lifecycle movement solves a different operational problem where a dataset has objects smaller than lifecycle tiering thresholds. Small objects can be uneconomical to transition. It does not directly address an index must remain instantly readable while large records are archived. The case calls for Keep the index in a frequent-access class and place payloads in an archive tier, since retrieval policies can differ between metadata and archived objects.

The competing option Verify Object Lock retention/holds and exempt protected versions from intended deletion would be useful when an S3 lifecycle policy deletes files required by an active legal hold. Governance/legal retention takes precedence over ordinary expiration. The present issue is an index must remain instantly readable while large records are archived; it is more directly addressed by Keep the index in a frequent-access class and place payloads in an archive tier. Retrieval policies can differ between metadata and archived objects.

Use S3 Intelligent-Tiering when access patterns cannot be predicted would help if logs require immediate access but seldom, with variable future access patterns. Intelligent-Tiering moves eligible objects among access tiers automatically. That is not the symptom described here: an index must remain instantly readable while large records are archived. The matching response is Keep the index in a frequent-access class and place payloads in an archive tier, because retrieval policies can differ between metadata and archived objects.

The competing option Use a suitable S3 Glacier storage class and plan retrieval lead time would be useful when a yearly audit may restore archives within hours rather than milliseconds. Archive tiers have retrieval latency and minimum storage-duration considerations. The present issue is a dataset has objects smaller than lifecycle tiering thresholds; it is more directly addressed by Evaluate minimum object size and transition charges before lifecycle movement. Small objects can be uneconomical to transition.

The option Use S3 Intelligent-Tiering when access patterns cannot be predicted addresses a separate condition: logs require immediate access but seldom, with variable future access patterns. Intelligent-Tiering moves eligible objects among access tiers automatically. The actual requirement is a dataset has objects smaller than lifecycle tiering thresholds. Recommended corrective action: Evaluate minimum object size and transition charges before lifecycle movement. Small objects can be uneconomical to transition.

For the alternative failure an index must remain instantly readable while large records are archived, the control Keep the index in a frequent-access class and place payloads in an archive tier is relevant: retrieval policies can differ between metadata and archived objects. Here the evidence instead is a dataset has objects smaller than lifecycle tiering thresholds. The selected technical mechanism is Evaluate minimum object size and transition charges before lifecycle movement: small objects can be uneconomical to transition.

The option Use a suitable S3 Glacier storage class and plan retrieval lead time addresses a separate condition: a yearly audit may restore archives within hours rather than milliseconds. Archive tiers have retrieval latency and minimum storage-duration considerations. The actual requirement is an S3 lifecycle policy deletes files required by an active legal hold. Recommended corrective action: Verify Object Lock retention/holds and exempt protected versions from intended deletion. Governance/legal retention takes precedence over ordinary expiration.

Use S3 Intelligent-Tiering when access patterns cannot be predicted would help if logs require immediate access but seldom, with variable future access patterns. Intelligent-Tiering moves eligible objects among access tiers automatically. That is not the symptom described here: an S3 lifecycle policy deletes files required by an active legal hold. The matching response is Verify Object Lock retention/holds and exempt protected versions from intended deletion, because governance/legal retention takes precedence over ordinary expiration.

Evaluate minimum object size and transition charges before lifecycle movement solves a different operational problem where a dataset has objects smaller than lifecycle tiering thresholds. Small objects can be uneconomical to transition. It does not directly address an S3 lifecycle policy deletes files required by an active legal hold. The case calls for Verify Object Lock retention/holds and exempt protected versions from intended deletion, since governance/legal retention takes precedence over ordinary expiration.

For the alternative failure a restore drill fails because service-linked IAM permissions are missing, the control Supply only the required restore permissions and test recovery in isolation is relevant: restore authorization is necessary even with usable backup data. Here the evidence instead is rDS automated backups are disabled while retention rules require PITR. The selected technical mechanism is Enable automated backups with retention meeting the application RPO: pITR depends on automated backup mechanisms.

Use Amazon Macie classification results on the target buckets solves a different operational problem where a data analyst needs to identify personally sensitive S3 objects without moving them. Macie examines S3 data for sensitive content patterns. It does not directly address rDS automated backups are disabled while retention rules require PITR. The case calls for Enable automated backups with retention meeting the application RPO, since pITR depends on automated backup mechanisms.

The competing option Enable DynamoDB point-in-time recovery for the table would be useful when a DynamoDB table must be recoverable to a point within the recent history window. PITR continuously protects eligible table state within the recovery window. The present issue is rDS automated backups are disabled while retention rules require PITR; it is more directly addressed by Enable automated backups with retention meeting the application RPO. PITR depends on automated backup mechanisms.

For the alternative failure a restore drill fails because service-linked IAM permissions are missing, the control Supply only the required restore permissions and test recovery in isolation is relevant: restore authorization is necessary even with usable backup data. Here the evidence instead is a DynamoDB table must be recoverable to a point within the recent history window. The selected technical mechanism is Enable DynamoDB point-in-time recovery for the table: pITR continuously protects eligible table state within the recovery window.

Create AWS Backup copies to a protected backup vault in a separate account solves a different operational problem where a production table's backups require immutable cross-account custody. Cross-account vaults separate recovery control planes. It does not directly address a DynamoDB table must be recoverable to a point within the recent history window. The case calls for Enable DynamoDB point-in-time recovery for the table, since pITR continuously protects eligible table state within the recovery window.

The option Use Amazon Macie classification results on the target buckets addresses a separate condition: a data analyst needs to identify personally sensitive S3 objects without moving them. Macie examines S3 data for sensitive content patterns. The actual requirement is a DynamoDB table must be recoverable to a point within the recent history window. Recommended corrective action: Enable DynamoDB point-in-time recovery for the table. PITR continuously protects eligible table state within the recovery window.

Use Amazon Macie classification results on the target buckets solves a different operational problem where a data analyst needs to identify personally sensitive S3 objects without moving them. Macie examines S3 data for sensitive content patterns. It does not directly address a production table's backups require immutable cross-account custody. The case calls for Create AWS Backup copies to a protected backup vault in a separate account, since cross-account vaults separate recovery control planes.

The competing option Supply only the required restore permissions and test recovery in isolation would be useful when a restore drill fails because service-linked IAM permissions are missing. Restore authorization is necessary even with usable backup data. The present issue is a production table's backups require immutable cross-account custody; it is more directly addressed by Create AWS Backup copies to a protected backup vault in a separate account. Cross-account vaults separate recovery control planes.

The option Enable automated backups with retention meeting the application RPO addresses a separate condition: rDS automated backups are disabled while retention rules require PITR. PITR depends on automated backup mechanisms. The actual requirement is a production table's backups require immutable cross-account custody. Recommended corrective action: Create AWS Backup copies to a protected backup vault in a separate account. Cross-account vaults separate recovery control planes.

The competing option Use Amazon Macie classification results on the target buckets would be useful when a data analyst needs to identify personally sensitive S3 objects without moving them. Macie examines S3 data for sensitive content patterns. The present issue is a restore drill fails because service-linked IAM permissions are missing; it is more directly addressed by Supply only the required restore permissions and test recovery in isolation. Restore authorization is necessary even with usable backup data.

Create AWS Backup copies to a protected backup vault in a separate account would help if a production table's backups require immutable cross-account custody. Cross-account vaults separate recovery control planes. That is not the symptom described here: a restore drill fails because service-linked IAM permissions are missing. The matching response is Supply only the required restore permissions and test recovery in isolation, because restore authorization is necessary even with usable backup data.

For the alternative failure rDS automated backups are disabled while retention rules require PITR, the control Enable automated backups with retention meeting the application RPO is relevant: pITR depends on automated backup mechanisms. Here the evidence instead is a restore drill fails because service-linked IAM permissions are missing. The selected technical mechanism is Supply only the required restore permissions and test recovery in isolation: restore authorization is necessary even with usable backup data.

Create AWS Backup copies to a protected backup vault in a separate account would help if a production table's backups require immutable cross-account custody. Cross-account vaults separate recovery control planes. That is not the symptom described here: a data analyst needs to identify personally sensitive S3 objects without moving them. The matching response is Use Amazon Macie classification results on the target buckets, because macie examines S3 data for sensitive content patterns.

For the alternative failure a DynamoDB table must be recoverable to a point within the recent history window, the control Enable DynamoDB point-in-time recovery for the table is relevant: pITR continuously protects eligible table state within the recovery window. Here the evidence instead is a data analyst needs to identify personally sensitive S3 objects without moving them. The selected technical mechanism is Use Amazon Macie classification results on the target buckets: macie examines S3 data for sensitive content patterns.

Supply only the required restore permissions and test recovery in isolation solves a different operational problem where a restore drill fails because service-linked IAM permissions are missing. Restore authorization is necessary even with usable backup data. It does not directly address a data analyst needs to identify personally sensitive S3 objects without moving them. The case calls for Use Amazon Macie classification results on the target buckets, since macie examines S3 data for sensitive content patterns.