A company is storing backups in an Amazon S3 bucket. These backups must not be deleted for at least 3 months after creation. What should the CloudOps engineer do?

Question

Options

• AConfigure an IAM policy that denies the s3:DeleteObject action for all users. Three months after
• BEnable S3 Object Lock on a new S3 bucket in compliance mode. Place all backups in the new S3
• CEnable S3 Versioning on the existing S3 bucket. Configure S3 Lifecycle rules to protect the
• DEnable S3 Object Lock on a new S3 bucket in governance mode. Place all backups in the new S3

• A
  4% (1)
• B
  81% (22)
• C
  11% (3)
• D
  4% (1)

Explanation

Per the AWS Cloud Operations and Data Protection documentation, S3 Object Lock enforces write- once-read-many (WORM) protection on objects for a defined retention period. There are two modes: Compliance mode: Even the root user cannot delete or modify objects during the retention period. Governance mode: Privileged users with special permissions can override lock settings. For regulatory or audit requirements that prohibit deletion, Compliance mode is the correct choice. When configured with a 3-month retention period, all backup objects are protected from deletion until expiration, ensuring compliance with data retention mandates. Versioning (Option C) alone does not prevent deletion. IAM-based restrictions (Option A) lack time-based enforcement and require manual intervention. Governance mode (Option D) is less strict and unsuitable for regulatory retention. Thus, Option B is the correct CloudOps solution for immutable S3 backups.

No community discussion yet for this question.