Q54 — AWS SAA-C03 Ch.13

Question 54 of 100 | ← Chapter 13

Q954. A company needs to save confidential medical results in an Amazon S3 bucket. The repository must allow a few approved users to add new files.The repository must restrict all other users to read-only access by using a write once, ready many (WORM) approach.The company must keep every file in the repository for a minimum of 1 year after its creation date.Which solution will meet these requirements with the LEAST implementation effort?

Correct Answer: B. Use S3 Object Lock in compliance mode with a retention period of 1 year. Use an IAM policy that restricts file access to specified approved users

Explanation

The solution that meets the requirements with the LEAST implementation effort is B. Use S3 Object Lock in compliance mode with a retention period of 1 year. Use an IAM policy that restricts file access to specified approved users.Here's why:Object Lock: S3 Object Lock provides a WORM (Write Once, Read Many) approach, ensuring that files cannot be deleted or modified after they are uploaded.Compliance Mode: Compliance mode enforces the retention period, guaranteeing that files remain in the bucket for at least 1 year.IAM Policy: You can easily create an IAM policy that grants specific users write access (for adding new files) and other users read-only access.Minimal Effort: S3 Object Lock and IAM policies are straightforward to configure, requiring minimal implementation effort.Why other options are less efficient:A. Configure the S3 bucket with multi-factor authentication (MFA) delete. Do not share the MFA secret with users to avoid deletion: While MFA delete can prevent accidental deletions, it doesn't provide a WORM approach and requires users to have access to the MFA secret, which is not ideal for security. C. Use an IAM role to restrict all users from deleting or changing objects in the S3 bucket. Use an S3 bucket policy to only allow the IAM role: This approach requires more complex configuration and doesn't guarantee the 1-year retention period.D. Configure the S3 bucket to invoke an AWS Lambda function every time an object is added. Configure the function to track the hash of the saved object so that modified objects can be marked accordingly: This solution involves building and managing a Lambda function, adding complexity and operational overhead. It also doesn't provide a true WORM approach as it relies on tracking object hashes and marking modifications.In summary:Option B offers the most streamlined and efficient solution for meeting the company's requirements. S3 Object Lock in compliance mode with a 1-year retention period, combined with an IAM policy for access control, provides a secure, compliant, and easy-to-implement solution for storing confidential medical results.