DEA-C01 Question 238
Single answerYour company processes sensitive customer data stored in an Amazon S3 bucket. Due to new legal regulations, you are required to delete specific customer records upon their request. The deletion process must ensure that the data is permanently removed and cannot be recovered. Which approach should you use to meet this requirement?
- A
Enable S3 Versioning and use the DeleteObject API to remove the objects.
- B
Use the S3 Lifecycle policy to transition the objects to Glacier and then delete them.
- C
Enable S3 Object Lock in Compliance mode and delete the objects.
- D
Enable S3 Versioning and use the DeleteObject API, then use the DeleteMarkers and ExpiredObjectDeleteMarkers to permanently remove all object versions.
Show answer and explanation
Correct answer: D
Explanation
To meet the legal requirement of permanently deleting customer data, you must ensure all versions of the object are removed. Enabling S3 Versioning allows object version management, and using the DeleteObject API removes specific object versions. Additionally, cleaning up DeleteMarkers and ExpiredObjectDeleteMarkers ensures no recoverable data remains, satisfying the business and legal requirements.
- A. Incorrect.
This approach does not guarantee permanent deletion because versioned objects create delete markers that need additional cleanup to fully remove all versions.
- B. Incorrect.
Transitioning objects to Glacier does not delete the data but instead moves it to a different storage class, which does not meet the requirement of permanent deletion.
- C. Incorrect.
S3 Object Lock in Compliance mode prevents deletion of data for a specified retention period, which conflicts with the requirement to delete data on request.
- D. Correct.
This is the correct approach as enabling S3 Versioning and using the DeleteObject API deletes the latest object version, and removing DeleteMarkers and ExpiredObjectDeleteMarkers ensures permanent deletion of all object versions.