A company stores sensitive data in an Amazon S3 bucket. The company encrypts the data at rest by using server-side encryption with Amazon S3 managed keys (SSE-S3). A security engineer must prevent…

Question

Options

• AConfigure S3 bucket policies to deny DELETE and PUT object permissions.
• BConfigure S3 Object Lock in compliance mode with S3 bucket versioning enabled.
• CChange the encryption on the S3 bucket to use AWS Key Management Service (AWS KMS)
• DConfigure the S3 bucket with multi-factor authentication (MFA) delete protection.

• A
  7% (3)
• B
  78% (32)
• C
  12% (5)
• D
  2% (1)

Explanation

Amazon S3 Object Lock in compliance mode provides write-once-read-many (WORM) protection, which prevents objects from being modified or deleted for a specified retention period. According to the AWS Certified Security - Specialty Study Guide, compliance mode enforces immutability even for the root user and cannot be overridden. Enabling S3 Object Lock requires S3 bucket versioning and ensures that once an object is written, it cannot be changed or removed until the retention period expires. This is the strongest protection against data modification and is commonly used for regulatory and legal retention Option A can be bypassed by administrators. Option D only protects against deletions, not overwrites. Option C changes encryption but does not prevent modification. AWS documentation explicitly identifies S3 Object Lock in compliance mode as the correct solution for immutable data storage.

No community discussion yet for this question.