Amazon S3 — Object Storage
Amazon S3 is object storage: you put whole files ("objects") into "buckets" and reach them over the internet, not as a disk attached to a server. The most-tested ideas are picking the cheapest storage class for an access pattern, knowing that all classes share the same 11 nines of durability but differ in availability and retrieval speed, and not confusing S3 with EBS (block) or EFS (file). Security questions hinge on Block Public Access, bucket policies vs ACLs, and the three server-side encryption options.
Q1 A company stores files that are read many times per day for the first month, then almost never again — but when an old file IS needed, it must come back within milliseconds. They want the lowest cost for the old files without sacrificing instant access. Which approach fits best?
- Keep everything in S3 Standard forever to guarantee speed
- Use a lifecycle rule to move objects to S3 Glacier Flexible Retrieval after 30 days
- Move the old files to S3 One Zone-IA and accept slower restores
- Use a lifecycle rule to move objects to S3 Glacier Instant Retrieval after 30 days
- A — Standard stays instant but is the most expensive storage tier, so it wastes money on data that is barely touched.
- B — Glacier Flexible Retrieval restores take minutes to hours, breaking the "within milliseconds" rule.
- C — One Zone-IA gives fast retrieval but is not the cheapest archive option and loses a copy across Availability Zones; the question wants lowest cost with instant access, which Glacier Instant Retrieval delivers.
Q2 An exam item states that S3 Standard offers "eleven nines of durability." A candidate wants to know what that number actually promises. What does 99.999999999% durability mean?
- Your data will be reachable 99.999999999% of the time each year
- Objects are extremely unlikely to be lost or corrupted because S3 stores redundant copies across multiple Availability Zones
- S3 guarantees no downtime for requests to the bucket
- AWS refunds you if the bucket is unreachable for more than a few minutes
- A — Being "reachable X% of the time" describes availability, not durability — two different metrics.
- C — Durability says nothing about request uptime; that is again availability.
- D — Service credits relate to availability SLAs, not the durability figure.
Q3 A team has unpredictable, changing access patterns — some objects suddenly get hot again months later — and they do not want to design lifecycle rules or risk retrieval fees on guessed-wrong tiers. Which storage class is designed for exactly this situation?
- S3 Intelligent-Tiering
- S3 Standard-IA
- S3 Glacier Deep Archive
- S3 One Zone-IA
- B — Standard-IA charges a retrieval fee and assumes data really is infrequently accessed; unexpected hot objects get expensive.
- C — Deep Archive is for data you almost never touch and tolerate hours-long restores — the opposite of unpredictable hot data.
- D — One Zone-IA assumes infrequent access AND accepts single-AZ risk; it does not auto-adapt to changing patterns.
Q4 A developer needs a low-latency disk volume attached to a single EC2 instance to run a database, formatted with a filesystem and persisting when the instance stops. Which AWS storage service fits?
- Amazon S3
- Amazon EFS
- Amazon EBS
- EC2 Instance Store
- A — S3 is object storage reached over HTTP; you cannot mount it as a raw disk for a database engine.
- B — EFS is a shared file system for many instances at once, not a low-latency single-instance block volume for a database.
- D — Instance Store is temporary — its data is lost when the instance stops or terminates, so it is unsafe for a database.
Q5 Several EC2 instances across different Availability Zones must read and write the same set of files simultaneously, like a shared content directory. Which service is purpose-built for this?
- Amazon EBS
- Amazon EFS
- EC2 Instance Store
- Amazon S3 Standard-IA
- A — A standard EBS volume attaches to one instance at a time, so it cannot be the shared store for many instances across AZs.
- C — Instance Store is local, temporary, and tied to a single instance — not shareable or durable.
- D — S3 is object storage accessed via API, not a mountable shared file system that apps read/write like a directory.
Q6 A user accidentally deleted and also overwrote several important objects in a bucket. The company wants the ability to recover previous copies after such mistakes. Which S3 feature should be enabled?
- S3 Transfer Acceleration
- S3 Block Public Access
- S3 Lifecycle policies
- S3 Versioning
- A — Transfer Acceleration only speeds up uploads/downloads over long distances; it does not protect or recover data.
- B — Block Public Access controls who can reach the bucket from the internet, not version recovery.
- C — Lifecycle policies move or expire objects to save cost; they help delete data on schedule, not recover deleted data.
Q7 Logs are written once and may be retrieved only during a rare yearly audit, where waiting up to 12 hours for a restore is perfectly acceptable. The company wants the absolute lowest storage cost. Which storage class is best?
- S3 Glacier Flexible Retrieval
- S3 Standard-IA
- S3 Glacier Deep Archive
- S3 Glacier Instant Retrieval
- A — Glacier Flexible Retrieval costs more than Deep Archive; since 12-hour waits are acceptable, you can go cheaper.
- B — Standard-IA is far more expensive than any Glacier tier and is meant for occasional-but-quick access.
- D — Glacier Instant Retrieval pays extra for millisecond access the audit does not need, so it is not the lowest cost.
Q8 A startup will store infrequently accessed thumbnails that are easy to regenerate if lost, and they want to save money even further than Standard-IA. They accept that the data lives in only one Availability Zone. Which class matches?
- S3 One Zone-IA
- S3 Standard
- S3 Intelligent-Tiering
- S3 Glacier Deep Archive
- B — Standard is for frequent access and is the most expensive, the opposite of the goal.
- C — Intelligent-Tiering suits unknown patterns and does not specifically give the single-AZ discount this team is willing to accept.
- D — Deep Archive needs hours to restore, which is wrong for thumbnails that may be served on demand.
Q9 A compliance team requires that S3 encrypts data at rest AND that they keep full control over the encryption keys, including the ability to audit and rotate them and control who can use them through AWS. Which option meets this?
- SSE-S3 (Amazon S3-managed keys)
- SSE-C (customer-provided keys)
- SSE-KMS (AWS Key Management Service keys)
- No encryption, rely on bucket policy only
- A — SSE-S3 encrypts data but AWS fully manages the keys behind the scenes, giving the team no key policy control or per-use audit.
- B — SSE-C means the customer supplies and manages keys on their own and sends them with each request; AWS does not store them, putting all key management burden on you rather than giving controlled, audited AWS-managed keys.
- D — A bucket policy controls access, not encryption at rest, so it does not satisfy the encryption requirement.
Q10 Users in Asia and Europe upload large files to a bucket in the United States and complain about slow, inconsistent upload speeds over the public internet. Which S3 feature directly addresses this?
- S3 Versioning
- S3 Transfer Acceleration
- S3 Cross-Region Replication
- S3 Intelligent-Tiering
- A — Versioning preserves object history; it has nothing to do with upload speed.
- C — Cross-Region Replication copies objects between buckets in different Regions after they arrive; it does not speed up the user's initial upload.
- D — Intelligent-Tiering optimizes storage cost by access pattern, not network transfer speed.
Q11 A company wants to host a simple marketing site made only of HTML, CSS, JavaScript, and images — no server-side code or database. They want the lowest-cost, fully managed way to serve it. What is the simplest fit?
- Use S3 static website hosting
- Launch an EC2 instance running a web server
- Deploy the files to an EBS volume
- Store the files in EFS and mount them
- B — An EC2 web server adds management overhead and cost you do not need for purely static content.
- C — EBS is a disk for an EC2 instance; it cannot serve a website by itself.
- D — EFS is a shared file system for instances, not a public website host on its own.
Q12 An administrator wants a single account-level safeguard so that no bucket can ever be made public by accident, even if someone later writes a permissive policy. Which feature provides this guardrail?
- S3 Block Public Access
- A restrictive bucket policy on each bucket
- Object-level ACLs set to private
- SSE-KMS encryption
- B — A bucket policy protects one bucket, and a future careless policy edit could still open it; it is not an account-wide guardrail.
- C — ACLs are per-object/per-bucket grants and can be overridden by other settings; they are not a blanket protection.
- D — Encryption protects data confidentiality at rest, not whether the bucket is publicly reachable.
Q13 A new engineer asks why S3 is called "object storage" and how that differs from the "block storage" of EBS. Which statement best captures the core difference at the Cloud Practitioner level?
- Object storage stores whole files with metadata accessed via API, while block storage splits data into fixed blocks on a volume you mount and format like a disk
- Object storage is always faster than block storage for every workload
- Block storage can be accessed over the public internet by URL, while object storage cannot
- Object storage can only hold text files, while block storage holds everything else
- B — Speed depends on workload; block storage often gives lower latency for databases, so "always faster" is false.
- C — It is S3 objects that can be exposed via URL over the internet, not EBS volumes — this reverses reality.
- D — Both can hold any file type; the claim about text-only object storage is wrong.
Q14 A company wants to grant another AWS account read access to all objects in a specific bucket using a single, centralized, JSON-based permission document attached to the bucket. Which mechanism is the recommended modern approach?
- Object ACLs on every object
- A bucket policy
- Block Public Access
- S3 Versioning
- A — ACLs are an older, per-object grant mechanism that AWS now discourages for most use cases; managing every object individually does not scale.
- C — Block Public Access restricts public exposure; it does not grant access to a specific account.
- D — Versioning is about keeping object history, not about granting permissions.
Q15 Data is uploaded and accessed frequently for 30 days, occasionally for the next 60 days, then must be archived cheaply for 7 years before deletion. The company wants this to happen automatically without manual moves. What should they configure?
- Cross-Region Replication rules
- Transfer Acceleration on the bucket
- Manual storage class changes scheduled by an admin
- An S3 Lifecycle policy with transition and expiration rules
- A — Replication copies objects to another Region; it does not change storage classes over time.
- B — Transfer Acceleration only speeds network transfers, unrelated to aging data through tiers.
- C — Manual changes are not automatic and are error-prone, the opposite of what is asked.
Q16 Two storage classes both have "11 nines" of durability, but one advertises a lower availability percentage. A candidate asks what the lower availability practically implies. Which statement is accurate?
- The lower-availability class is more likely to permanently lose your data
- Lower availability means the data is stored in more Availability Zones
- The lower-availability class may be momentarily unreachable slightly more often, but your stored data is equally protected from loss
- Availability and durability are the same metric expressed differently
- A — Identical durability means identical loss protection; availability does not change loss risk.
- B — Lower availability is typically associated with fewer AZs (like One Zone-IA), not more.
- D — They measure different things — survival of data vs reachability — so they are not the same metric.
Q17 By default, when you create a new S3 bucket and upload objects without changing anything, who can access those objects?
- Anyone on the internet, because S3 buckets are public by default
- Only the bucket owner / account, because S3 buckets are private by default
- Any AWS account in the same Region
- Anyone with the bucket name, even without permissions
- A — Buckets are not public by default; this is a long-standing security misconception.
- C — Other accounts get no access unless you deliberately grant it via a policy.
- D — Knowing the bucket name grants nothing without proper permissions.
Q18 A workload needs the cheapest, highest-performance temporary scratch space directly attached to an EC2 instance for caching data that can be safely lost if the instance stops. Which option fits, and why is it acceptable here?
- Amazon S3, because it is durable
- Amazon EFS, because it is shared
- Amazon EBS Provisioned IOPS, because it persists
- EC2 Instance Store, because it is fast local storage and the data is disposable
- A — S3 is durable object storage over the network, not high-speed local scratch space attached to the instance.
- B — EFS is a shared network file system, adding cost and latency unnecessary for local temporary cache.
- C — Persistent, provisioned EBS costs more than needed when the data is explicitly disposable.
Q19 A team enabled the simplest possible encryption so that all new objects are automatically encrypted at rest with keys fully managed by S3, requiring zero key management effort on their part. Which option did they choose?
- SSE-C
- Client-side encryption
- SSE-S3
- SSE-KMS
- A — SSE-C requires you to provide and manage your own keys with each request, which is the opposite of zero effort.
- B — Client-side encryption means you encrypt before upload and manage everything yourself — maximum effort.
- D — SSE-KMS adds key control and auditing through KMS, which is more management than "fully managed by S3 with zero effort."
Q20 A media company stores objects accessed a few times a month and needs them back in milliseconds, but Standard's price is too high for this access frequency. Which class gives infrequent-access savings while still retrieving in milliseconds across multiple AZs?
- S3 Standard-IA
- S3 Glacier Flexible Retrieval
- S3 One Zone-IA
- S3 Glacier Deep Archive
- B — Glacier Flexible Retrieval takes minutes to hours to restore, failing the millisecond requirement.
- C — One Zone-IA retrieves fast but stores in a single AZ, dropping the multi-AZ resilience the scenario keeps.
- D — Deep Archive needs hours to restore, far from millisecond access.
Q21 A solution requires that even AWS cannot read the encryption keys, because the company keeps and supplies the keys itself with every upload and download request while still letting S3 perform the encryption. Which option matches?
- SSE-S3
- SSE-KMS
- Block Public Access
- SSE-C
- A — SSE-S3 keys are created and held by AWS, not supplied by the customer per request.
- B — SSE-KMS keys live in AWS KMS under AWS management, not provided by you on every request.
- C — Block Public Access governs public exposure, not encryption keys.
Q22 A backup tool writes about 50 TB of compliance archives that will be read only if regulators demand them, possibly never. Restores within a few hours are fine. Compared with Glacier Instant Retrieval, why might Glacier Flexible Retrieval or Deep Archive be the better choice here?
- They offer higher durability than Instant Retrieval
- They have lower storage cost because the workload tolerates slower retrieval
- They allow public website hosting that Instant Retrieval does not
- They retrieve objects faster than Instant Retrieval
- A — All S3 storage classes share the same 11 nines of durability, so durability is not the differentiator.
- C — Glacier tiers are for archival, not website hosting; this is irrelevant.
- D — Instant Retrieval is the faster one; the trade for the slower tiers is lower cost, not higher speed.
Q23 A developer needs to share one large dataset file with the public over a simple HTTPS URL, with virtually unlimited capacity and no servers to run. Which storage service is designed for serving individual files to the internet this way?
- Amazon EBS
- Amazon EFS
- Amazon S3
- EC2 Instance Store
- A — EBS is a private disk attached to one EC2 instance and cannot serve files to the internet by itself.
- B — EFS is a shared file system for mounted instances, not a public per-file URL service.
- D — Instance Store is temporary local disk, not internet-facing or durable.
Q24 An admin turned off Block Public Access and wrote a bucket policy allowing public reads for a static website. Months later, sensitive files were uploaded to the same bucket and exposed. What does this scenario best illustrate about S3 access controls?
- Bucket policies automatically exclude sensitive files
- Encryption would have prevented the files from being listed publicly
- Versioning would have kept the sensitive files private
- A bucket policy applies broadly to the bucket, so mixing public and private data in one bucket is risky; Block Public Access is the guardrail that was removed
- A — Bucket policies do not magically know which files are sensitive; they apply by the rules written, not by content.
- B — Encryption protects data at rest but does not stop a public policy from exposing objects to authorized readers.
- C — Versioning keeps history; it does nothing to control public access.