Get Your CertSAP-C02PlayCompete
‹ All SAP-C02 questions

SAP-C02 Practice Question 85: Presigned URL Direct Mobile Upload

AWS Certified Solutions Architect – Professional (SAP-C02) · Test 9 · question 5 of 10

Design for New Solutionseasy

A mobile app lets users upload photos of up to 20 MB. The company wants the photos to go directly to an Amazon S3 bucket so that no upload traffic passes through its application servers. The bucket must stay private, users have no AWS credentials, and each upload permission must be limited to one object key and to a short period.

Which solution meets these requirements?

Select one answer
Show answer and explanation

Answer:

  • A. Have the backend generate a presigned PUT URL for each upload and return it to the app with a short expiration

AWS explains that presigned URLs *"allow someone to upload an object to your Amazon S3 bucket ... without requiring another party to have AWS security credentials or permissions."* A presigned URL is limited by the permissions of the user who creates it, is scoped to a specific object key, and expires after the time that the creator sets. The backend creates the URL on demand, the app uploads directly to S3, and the bucket stays private (option A).

- B is wrong because a publicly writable bucket lets anyone upload or overwrite objects, and unpredictable names are not an access control. - C is wrong because access keys embedded in an app can be extracted and reused by anyone, and they cannot be limited to one object or a short period. - D is wrong because a proxy sends all upload traffic through servers that the company wants to keep out of the data path, and it must be scaled and operated.

Reference: Uploading objects with presigned URLs

Practice Test 9 ›

Study guides for SAP-C02

Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.
SAP-C02 vs SAP-C03, the Solutions Architect Professional updateWhat changes when AWS replaces SAP-C02 with SAP-C03, the key dates, who should still sit SAP-C02, and how to study through the switch without wasted work.
AWS disaster recovery strategies, RTO and RPOBackup and restore, pilot light, warm standby and active/active on AWS, how RTO and RPO pick between them, and the services each strategy uses.
IAM users, roles and policies on AWSHow IAM users, roles, identity-based and resource-based policies, cross-account access, SCPs and permissions boundaries fit together for AWS exams.
SQS vs SNS vs EventBridge on AWSWhen to use an SQS queue, an SNS topic or an EventBridge bus, plus fan-out, FIFO ordering, visibility timeouts and dead-letter queues for AWS exams.
VPC endpoints vs NAT gateways on AWSWhen to use gateway endpoints, interface endpoints (PrivateLink) or a NAT gateway for private subnets, and the cost and security trade-offs exams test.