SCS-C02 Question 150
Single answerYour organization is using an Amazon S3 bucket to store critical application logs. The logs need to be immutable for a minimum of 7 years to meet compliance requirements, and you must ensure that any accidental or intentional modifications or deletions are prevented during this time. Which AWS feature or service would you use to meet this requirement?
- A
Amazon S3 Object Lock with Compliance Mode enabled
- B
AWS CloudTrail with log file validation
- C
Amazon S3 Lifecycle Policies
- D
Amazon Macie
Show answer and explanation
Correct answer: A
Explanation
To meet compliance requirements for log immutability, Amazon S3 Object Lock with Compliance Mode is the most appropriate solution. It ensures that objects cannot be deleted or altered during the retention period, making it suitable for scenarios requiring a write-once-read-many (WORM) model. Other options, such as AWS CloudTrail or S3 Lifecycle Policies, address different aspects of data management but do not enforce immutability.
- A. Correct.
Amazon S3 Object Lock with Compliance Mode enabled allows you to enforce a write-once-read-many (WORM) model, preventing any modifications or deletions of the objects during the defined retention period. This feature directly fulfills the immutability requirement for compliance.
- B. Incorrect.
AWS CloudTrail with log file validation ensures that log files are not tampered with after delivery to the S3 bucket, but it does not prevent accidental or intentional deletions. It is more suitable for validating log integrity rather than enforcing immutability.
- C. Incorrect.
Amazon S3 Lifecycle Policies are used to transition or expire objects based on predefined rules. While they help in managing storage costs, they do not enforce immutability or prevent deletions.
- D. Incorrect.
Amazon Macie is a service for discovering and protecting sensitive data in AWS. It does not provide immutability or compliance-related features for log storage.