DEA-C01 Question 239
Select 2Your company needs to comply with GDPR requirements by ensuring that customer data stored in Amazon S3 can be permanently deleted upon request. Additionally, the company must ensure that deleted data cannot be recovered. What approach should you take to meet these requirements?
- A
Enable S3 Object Lock in compliance mode and apply a legal hold to the objects.
- B
Use S3 Lifecycle policies to expire objects and enable S3 Versioning with Multi-Factor Authentication (MFA) Delete.
- C
Use the S3 DeleteObject API to delete the objects and then configure a Lifecycle policy to permanently delete expired object versions.
- D
Configure S3 Object Versioning and delete specific object versions using the S3 DeleteObject API.
- E
Enable Default Encryption with AWS KMS and delete the KMS key used for encryption.
Show answer and explanation
Correct answers: C, D
Explanation
To comply with GDPR requirements for permanent data deletion, you must ensure all object versions and metadata are removed. This can be achieved by deleting objects using the S3 DeleteObject API and properly managing S3 Versioning. Configuring Lifecycle policies to remove expired object versions further ensures that deleted data cannot be recovered. The other options either fail to delete data permanently or do not address the core GDPR requirements directly.
- A. Incorrect.
Enabling S3 Object Lock in compliance mode and applying a legal hold ensures objects cannot be deleted for a specified duration but does not directly address the need to delete data permanently to meet GDPR requirements.
- B. Incorrect.
S3 Lifecycle policies can expire objects, and enabling MFA Delete adds an additional layer of protection for deletion operations. However, Lifecycle policies alone do not guarantee that deleted objects and versions are immediately unrecoverable.
- C. Correct.
Using the S3 DeleteObject API to delete objects and configuring Lifecycle policies to remove expired versions ensures that deleted data is removed permanently, satisfying GDPR requirements.
- D. Correct.
Configuring S3 Object Versioning and deleting specific versions ensures that all traces of the deleted object version are removed, which aligns with GDPR requirements for permanent data deletion.
- E. Incorrect.
While deleting the KMS key used for encryption makes encrypted data inaccessible, it does not fully meet GDPR requirements since the data might still exist in S3, albeit in an encrypted form.