DEA-C01 Question 506
Single answerYour organization needs to prepare application logs for an upcoming audit. The logs are stored in Amazon S3, and the audit requirements specify that logs must be immutable and stored for at least 7 years. As a Data Engineer, how can you ensure the logs meet the audit requirements while minimizing the risk of accidental deletion or modification?
- A
Enable S3 Object Lock in Compliance mode and set a retention period of 7 years.
- B
Configure an S3 Lifecycle policy to transition logs to Amazon Glacier after 7 years.
- C
Use an AWS Lambda function to duplicate the logs to another S3 bucket every 7 years.
- D
Enable versioning on the S3 bucket and manually delete outdated versions of the logs after 7 years.
Show answer and explanation
Correct answer: A
Explanation
To meet audit requirements for immutability and retention, S3 Object Lock in Compliance mode is the best choice. Compliance mode ensures that no one, not even administrators, can modify or delete objects during the specified retention period. This guarantees that the logs remain intact and meet the 7-year retention requirement.
- A. Correct.
This is the correct option. Enabling S3 Object Lock in Compliance mode ensures that logs cannot be deleted or modified during the retention period, which satisfies the audit requirements for immutability and retention.
- B. Incorrect.
While S3 Lifecycle policies can transition logs to lower-cost storage classes, they do not ensure immutability. This option does not meet the audit requirements for protecting logs from modification or deletion.
- C. Incorrect.
Duplicating logs using AWS Lambda does not provide immutability or protection against deletion or modification. This approach is also operationally burdensome and error-prone.
- D. Incorrect.
Versioning allows you to preserve older versions of objects, but it does not prevent deletion or modification of the latest version. Manual deletion of versions is also not compliant with audit requirements.