Amazon Web Services Updated SAA-C03 Exam Questions and Answers by chase

The most cost-effective and low-maintenance solution to aggregate S3 data from multiple accounts within the same AWS Region is to use Amazon S3 Same-Region Replication (SRR).

From AWS S3 Documentation:

" S3 Same-Region Replication (SRR) automatically replicates new objects between buckets in the same AWS Region. SRR is commonly used to aggregate logs into a single bucket, simplify data aggregation, and meet compliance requirements. "

(Source: Amazon S3 User Guide – Replication Overview)

Key benefits of using SRR for this use case:

Zero operational overhead – No Lambda, scripts, or custom code

Fully managed – AWS handles all replication automatically

Secure and efficient – No data leaves the us-west-2 Region

Supports cross-account replication – With proper IAM roles and permissions

Low-cost – Compared to custom ETL pipelines or Lambda solutions

In contrast:

Option A (Lifecycle policies) do not support copying, only expiration, transitions, or deletions.

Option C (scripts) requires custom scheduling and maintenance, increasing operational overhead.

Option D (Lambda) adds complexity and cost and is not as scalable or hands-off as SRR.

The requirement is to restrict actions by Region to prevent accidental cross-Region operations that could violate data residency rules. The most direct and flexible way to enforce Region-based restrictions in AWS is to use IAM condition keys, specifically aws:RequestedRegion, in identity-based policies (and commonly in permission boundaries or SCPs when managing an organization).

Option B is correct because it applies Region constraints at authorization time. By adding conditions that allow actions only when aws:RequestedRegion matches an approved list (or denies when it matches disallowed Regions), the company can prevent users and roles from creating, modifying, or accessing resources in the wrong Region. This approach is broad and can be applied across many services, not just EC2, making it suitable for enforcing data residency boundaries across a multi-Region footprint.

Option A is too narrow because it restricts only ec2:RunInstances. Data residency concerns typically apply to many services (S3, RDS, DynamoDB, KMS, etc.), and limiting only EC2 does not prevent accidental data operations elsewhere. Option C controls where requests come from (source IP), not which Region is targeted. Option D (AWS Config) is detective, not preventative; it can alert after noncompliant actions occur, which does not meet the requirement to prevent accidental operations.

Therefore, B best meets the requirement by enforcing Region-level guardrails through IAM authorization conditions, helping ensure workloads remain within approved geographic boundaries.

Large binary objects are usually more cost-effective inAmazon S3than in a relational database. AWS S3 documentation describes S3 as highly durable object storage, and AWS storage guidance commonly uses a database to holdmetadatawhile S3 stores the objects themselves. Moving the documents out of the Oracle database reduces expensive database storage growth and can improve database performance by shrinking the amount of blob data managed inside the DB engine. The existing database can continue to store metadata and relational records, preserving application structure while improving cost efficiency and resilience. The other options either increase database cost further or shift to a much bigger redesign than needed.

============

Comprehensive and Detailed 250 to 300 words of Explanation (AWS documentation-based, no links):

Amazon Macie is the AWS managed service specifically built to discover, classify, and protect sensitive data in Amazon S3, including many common types of personally identifiable information (PII). Macie uses automated analysis and machine learning to identify sensitive data patterns at scale and produces findings that can be reviewed, prioritized, and integrated into security workflows. Because the environment spans hundreds of buckets, millions of objects, and multiple Regions, the key requirement is to minimize operational overhead while achieving broad coverage.

Option C is therefore the best fit: enabling Macie and configuring it to evaluate the targeted buckets provides a centralized, managed approach without building custom scanners, maintaining parsing logic, or operating distributed processing pipelines. Macie is designed for large-scale S3 estates and reduces ongoing maintenance compared with bespoke solutions.

Option A is incorrect because Amazon Detective is used to investigate and analyze security findings and relationships, not to classify S3 object content for PII. Option B is incorrect because Trusted Advisor provides best-practice checks (cost, security posture items, limits), but it does not inspect S3 object contents to detect PII. Option D would require building and operating custom Lambda scanning across millions of objects, handling pagination, retries, file types, performance tuning, and cost controls—high operational overhead and ongoing maintenance, which the company wants to avoid.

Therefore, C meets the requirement most directly and with the least operational burden by using the AWS service purpose-built for PII discovery in S3.