SCS-C02 · Question #454
A company stores sensitive data in an Amazon S3 bucket. The company encrypts the data at rest by using server-side encryption with Amazon S3 managed keys (SSE-S3). A security engineer must prevent…
The correct answer is B. Configure S3 Object Lock in compliance mode with S3 bucket versioning enabled. S3 Object Lock in compliance mode prevents any modifications or deletions to objects during a specified retention period, ensuring data immutability. Enabling Object Lock in compliance mode along with bucket versioning effectively meets the requirement to prevent any…
Question
A company stores sensitive data in an Amazon S3 bucket. The company encrypts the data at rest by using server-side encryption with Amazon S3 managed keys (SSE-S3). A security engineer must prevent any modifications to the data in the S3 bucket. Which solution will meet this requirement?
Options
- AConfigure S3 bucket policies to deny DELETE and PUT object permissions.
- BConfigure S3 Object Lock in compliance mode with S3 bucket versioning enabled.
- CChange the encryption on the S3 bucket to use AWS Key Management Service (AWS KMS)
- DConfigure the S3 bucket with multi-factor authentication (MFA) delete protection.
How the community answered
(52 responses)- A12% (6)
- B79% (41)
- C6% (3)
- D4% (2)
Explanation
S3 Object Lock in compliance mode prevents any modifications or deletions to objects during a specified retention period, ensuring data immutability. Enabling Object Lock in compliance mode along with bucket versioning effectively meets the requirement to prevent any modifications to the data in the S3 bucket.
Topics
Community Discussion
No community discussion yet for this question.