Q6 — AWS SAA-C03 Ch.16

Question 6 of 100 | ← Chapter 16

Q1206. A company plans to use an Amazon S3 bucket to archive backup data. Regulations require the company to retain the backup data for 7 years.During the retention period,the company must prevent users,including administrators,from deleting the data.The company can delete the data after 7 years.Which solution will meet these requirements?

• A. Create an S3 bucket policy that denies delete operations for 7 years. Create an S3 Lifecycle policy to delete the data after 7 years
• B. Create an S3 Object Lock default retention policy that retains data for 7 years in governance mode.Create an S3 Lifecycle policy to delete the data after 7 years.
• C. Create an S3 Object Lock default retention policy that retains data for 7 years in compliance mode.Create an S3 Lifecycle policy to delete the data after 7 years. ✓
• D. Create an S3 Batch Operations job to set a legal hold on each object for 7 years.Create an S3 Lifecycle policy to delete the data after 7 years.

Correct Answer: C. Create an S3 Object Lock default retention policy that retains data for 7 years in compliance mode.Create an S3 Lifecycle policy to delete the data after 7 years.

Explanation

To meet the requirement of retaining backup data in an Amazon S3 bucket for 7 years while preventing users, including administrators, from deleting the data during the retention period, and allowing deletion after 7 years, the most suitable solution is:C. Create an S3 Object Lock default retention policy that retains data for 7 years in compliance mode. Create an S3 Lifecycle policy to delete the data after 7 years.Analysis:S3 Object Lock in Compliance Mode:Compliance Mode: This mode ensures that objects protected by an Object Lock cannot be overwritten or deleted by any user, including the root user, until the retention period expires. This meets the requirement of preventing users, including administrators, from deleting the data during the 7-year retention period. Default Retention Policy: By setting a default retention policy, you can ensure that all objects uploaded to the bucket are automatically protected by the specified retention period.S3 Lifecycle Policy for Deletion After 7 Years:After the 7-year retention period expires, you can use an S3 Lifecycle policy to automatically delete the objects. This ensures that the data is removed from the bucket after the required retention period, meeting the company's regulatory requirements.Why Other Options Are Not Suitable:A. Create an S3 bucket policy that denies delete operations for 7 years. Create an S3 Lifecycle policy to delete the data after 7 years.Bucket Policy Limitations: While a bucket policy can be used to deny delete operations, it does not provide the same level of protection as S3 Object Lock in compliance mode. Administrators with sufficient permissions could potentially modify or remove the bucket policy, allowing them to delete the data. B. Create an S3 Object Lock default retention policy that retains data for 7 years in governance mode. Create an S3 Lifecycle policy to delete the data after 7 years. Governance Mode Limitations: Governance mode allows users with special permissions (such as those with the s3:BypassGovernanceRetention permission) to override the retention period and delete the objects. This does not meet the requirement of preventing all users, including administrators, from deleting the data during the retention period.D. Create an S3 Batch Operations job to set a legal hold on each object for 7 years. Create an S3 Lifecycle policy to delete the data after 7 years.Legal Hold Limitations: While a legal hold can prevent objects from being deleted, it is typically used for legal or regulatory holds that may have varying durations and are not necessarily tied to a fixed retention period. Additionally, managing legal holds for each object individually can be cumbersome and error-prone, especially for large-scale backups. S3 Object Lock with a default retention policy provides a more automated and reliable solution.