SCS-C02 · Question #434
A company plans to create Amazon S3 buckets to store log data. All the S3 buckets will have versioning enabled and will use the S3 Standard storage class. A security engineer needs to implement a…
The correct answer is C. Enable S3 Object Lock in compliance mode. Set a retention period of 90 days. The key requirement here is that no object can be deleted for 90 days, even by an administrator or the root user. To achieve this level of immutability, S3 Object Lock in compliance mode must be used, along with setting a retention period for 90 days. Compliance mode ensures…
Question
A company plans to create Amazon S3 buckets to store log data. All the S3 buckets will have versioning enabled and will use the S3 Standard storage class. A security engineer needs to implement a solution that protects objects in the S3 buckets from deletion for 90 days. The solution must ensure that no object can be deleted during this time period, even by an administrator or the AWS account root user. Which solution will meet these requirements?
Options
- AEnable S3 Object Lock in governance mode. Set a legal hold of 90 days.
- BEnable S3 Object Lock in governance mode. Set a retention period of 90 days.
- CEnable S3 Object Lock in compliance mode. Set a retention period of 90 days.
- DCreate an S3 Glacier Vault Lock policy that prevents deletion for 90 days.
How the community answered
(28 responses)- A18% (5)
- B7% (2)
- C71% (20)
- D4% (1)
Explanation
The key requirement here is that no object can be deleted for 90 days, even by an administrator or the root user. To achieve this level of immutability, S3 Object Lock in compliance mode must be used, along with setting a retention period for 90 days. Compliance mode ensures that no user, including the root user, can delete the objects during the retention period, providing the highest level of protection against deletions.
Topics
Community Discussion
No community discussion yet for this question.