Crucial Exams

AWS Certified Solutions Architect Associate SAA-C03 Practice Question

A security engineer is designing permissions for a mission-critical Amazon S3 bucket that resides in the production AWS account (111111111111). The engineer must guarantee that no IAM principals-users or roles-from any other AWS account, including the company's dev account (222222222222), can delete objects from this bucket. The solution must continue to allow valid delete operations that originate from principals in the production account. Which approach meets these requirements MOST effectively?

  • Enable S3 Block Public Access on the bucket.

  • Use an S3 access control list (ACL) that grants FULL_CONTROL permission to the bucket owner.

  • Attach a bucket policy to the S3 bucket that includes an explicit Deny for the actions s3:DeleteObject and s3:DeleteObjectVersion with Principal "*" and a Condition that aws:PrincipalAccount is not equal to "111111111111".

  • Apply an IAM identity-based policy in the dev account that denies s3:DeleteObject against the production bucket.

AWS Certified Solutions Architect Associate SAA-C03
Design Secure Architectures
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot