SAP-C02 Question 404
Select 2A financial organization is storing sensitive customer data in Amazon S3. The organization must comply with strict regulatory requirements that mandate data retention for 7 years and encryption at rest. Additionally, they want to prevent accidental deletion of this data while ensuring it cannot be modified once written. Which combination of AWS services and features can best meet these requirements?
- A
Enable S3 Object Lock with Compliance Mode and set a retention period of 7 years.
- B
Enable default encryption on the S3 bucket using an AWS KMS key.
- C
Use AWS Backup to create daily backups of the S3 bucket and store them for 7 years.
- D
Enable S3 Versioning and configure a lifecycle policy to transition non-current versions to Glacier after 7 years.
- E
Use Glacier Vault Lock to enforce a 7-year retention policy for archived objects.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the organization's regulatory requirements, enabling S3 Object Lock in Compliance Mode ensures that data cannot be modified or deleted during the retention period, fulfilling the immutability requirement. Additionally, enabling default encryption with an AWS KMS key ensures the data is encrypted at rest, meeting the encryption requirement. These features together satisfy the data retention, sensitivity, and regulatory needs of the organization.
- A. Correct.
Enabling S3 Object Lock with Compliance Mode ensures the data cannot be modified or deleted during the retention period, meeting the regulatory requirements for immutability and retention.
- B. Correct.
Enabling default encryption on the S3 bucket with an AWS KMS key ensures that data is encrypted at rest, addressing the requirement for encryption.
- C. Incorrect.
AWS Backup is not suitable for meeting the specific immutability and retention requirements for data stored in S3. While it can back up resources, it does not provide the same level of regulatory compliance as S3 Object Lock.
- D. Incorrect.
S3 Versioning and lifecycle policies are useful for managing cost and retaining object versions, but they do not enforce strict immutability or regulatory compliance requirements for sensitive data.
- E. Incorrect.
Glacier Vault Lock is used for long-term archive storage, but it is not suitable for ensuring compliance directly on S3 objects or providing encryption at rest.