Q63 — AWS SAA-C03 Ch.14

Question 63 of 100 | ← Chapter 14

Q1063. A law firm needs to make hundreds of files readable for the general public. The law firm must prevent members of the public from modifying or deleting the files before a specified future date.Which solution will meet these requirements MOST securely?

Correct Answer: B. Create a new Amazon S3 bucket.Enable S3 Versioning. Use S3 Object Lock and set a retention period based on the specified date. Create an Amazon CloudFront distribution to serve content from the bucket. Use an S3 bucket policy to restrict access to the CloudFront origin access control (OAC).

Explanation

To determine the most secure solution for the law firm's needs, let's analyze each option provided:A. Upload the files to an Amazon S3 bucket configured for static website hosting. Grant read-only IAM permissions to any AWS principals that access the S3 bucket until the specified date.Drawbacks: IAM policies are not time-limited in the manner described; once granted, they remain in effect until explicitly revoked. This method does not securely prevent future modification or deletion once the read-only permissions are set up.B. Create a new Amazon S3 bucket. Enable S3 Versioning. Use S3 Object Lock and set a retention period based on the specified date. Create an Amazon CloudFront distribution to serve content from the bucket. Use an S3 bucket policy to restrict access to the CloudFront origin access control (OAC).Advantages:S3 Versioning ensures that all versions of an object are kept and can be accessed. S3 Object Lock with a defined retention period enforces that objects cannot be deleted or overwritten for the specified duration.CloudFront can serve the content securely and efficiently. OAC ensures that only CloudFront can access the S3 bucket, adding an extra layer of security. C. Create a new Amazon S3 bucket. Enable S3 Versioning. Configure an event trigger to run an AWS Lambda function if a user modifies or deletes an object. Configure the Lambda function to replace the modified or deleted objects with the original versions of the objects from a private S3 bucket.Drawbacks: This solution relies on detecting changes and then reversing them, which is reactive rather than proactive. It could introduce latency and complexity, and there's still a window where objects could be altered or deleted temporarily.D. Upload the files to an Amazon S3 bucket configured for static website hosting. Select the folder that contains the files. Use S3 Object Lock with a retention period based on the specified date. Grant read-only IAM permissions to any AWS principals that access the S3 bucket.Drawbacks: Similar to option A, the use of IAM permissions to enforce time-limited access is not feasible. Additionally, while S3 Object Lock is correctly applied, the read-only access control via IAM does not meet the secure, time-limited access requirement.Conclusion:Option B is the most secure solution. It leverages S3 Versioning to maintain historical versions of objects, S3 Object Lock to enforce an immutable retention period, and CloudFront with OAC to serve content securely. This combination ensures that the files are readable by the public but cannot be modified or deleted until the specified date, fulfilling the law firm's requirements.答案:B