AWS Certified Solutions Architect S3 Storage Classes and Policies 3 — Questions and Answers
Question 1: S3 Intelligent-Tiering automatically moves objects to which tier after 90 consecutive days without access?
- S3 Glacier Instant Retrieval tier
- Archive Instant Access tier (Correct answer)
- Deep Archive Access tier
- Infrequent Access tier
Correct answer: Archive Instant Access tier
After 90 days without access, Intelligent-Tiering automatically moves objects to the Archive Instant Access tier, which offers the same millisecond retrieval as Glacier Instant Retrieval.
Question 2: Which S3 bucket policy element explicitly denies all actions on objects unless they are uploaded with server-side encryption?
- Condition with s3:x-amz-server-side-encryption and a Deny effect (Correct answer)
- Principal: * with Allow effect
- Resource ARN with /encrypted/* prefix
- s3:PutObject with RequireSSL condition
Correct answer: Condition with s3:x-amz-server-side-encryption and a Deny effect
A bucket policy with a Deny effect and the condition s3:x-amz-server-side-encryption ensures unencrypted PutObject requests are rejected.
Question 3: A company wants archived S3 objects to be permanently undeletable for 7 years for regulatory compliance. Which feature should be configured?
- S3 Versioning with MFA Delete
- S3 Object Lock in Compliance mode (Correct answer)
- S3 Object Lock in Governance mode
- S3 Replication with delete marker replication disabled
Correct answer: S3 Object Lock in Compliance mode
S3 Object Lock in Compliance mode prevents any user, including the root account, from deleting or overwriting objects until the retention period expires.
Question 4: When using S3 Cross-Region Replication (CRR), what is replicated by default?
- Objects, delete markers, and lifecycle rules
- Only new objects uploaded after replication is enabled (Correct answer)
- All existing and future objects
- Objects and their ACLs but not metadata
Correct answer: Only new objects uploaded after replication is enabled
CRR only replicates new objects added after replication is configured; existing objects must be replicated separately using S3 Batch Replication.
Question 5: Which S3 Glacier retrieval option provides access to archived data within 1-5 minutes?
- Bulk
- Standard
- Expedited (Correct answer)
- Instant
Correct answer: Expedited
Expedited retrieval for S3 Glacier Flexible Retrieval provides access within 1-5 minutes, though it costs more than Standard or Bulk options.
Question 6: A bucket policy must allow cross-account access to objects for a specific AWS account. Which Principal format is correct?
- Principal: {AWS: 'arn:aws:iam::123456789012:root'} (Correct answer)
- Principal: {Service: 'account-123456789012.amazonaws.com'}
- Principal: {Federated: '123456789012'}
- Principal: '*' with Condition AccountId
Correct answer: Principal: {AWS: 'arn:aws:iam::123456789012:root'}
Cross-account access is granted by specifying the external account's root ARN (arn:aws:iam::ACCOUNT_ID:root) in the bucket policy Principal.
Question 7: What happens to S3 Intelligent-Tiering monitoring and automation fees for objects smaller than 128 KB?
- They are billed at a reduced rate
- They are not charged (Correct answer)
- They are charged at Standard rate plus automation fee
- They are rounded up to 128 KB for billing
Correct answer: They are not charged
Objects smaller than 128 KB in Intelligent-Tiering are not charged the monthly monitoring and automation fee, but they remain stored in the Frequent Access tier.
AWS Certified Solutions Architect S3 Storage Classes and Policies 3
S3 Intelligent-Tiering automatically moves objects to which tier after 90 consecutive days without access?