SCS-C02 Question 388
Single answerYour organization operates in a highly regulated industry and must comply with strict data retention policies for audit purposes. You need to ensure that sensitive customer data stored in an Amazon S3 bucket adheres to a 7-year retention policy, and any accidental deletion of this data is prevented during this timeframe. Which solution best meets these requirements?
- A
Enable S3 Versioning and configure a Lifecycle policy to permanently delete objects after 7 years.
- B
Enable S3 Object Lock in Compliance mode and apply a Retention period of 7 years to the objects.
- C
Configure S3 Cross-Region Replication and replicate the data to another bucket with a 7-year Lifecycle policy.
- D
Enable S3 Server-Side Encryption (SSE) with AWS KMS and rotate the encryption keys every 7 years.
Show answer and explanation
Correct answer: B
Explanation
To meet strict data retention standards and prevent accidental deletion of sensitive data, enabling S3 Object Lock in Compliance mode with a retention period of 7 years ensures that objects cannot be modified or deleted during the specified timeframe. This approach is specifically designed for compliance with regulatory requirements.
- A. Incorrect.
While S3 Versioning can help maintain object history and a Lifecycle policy can automatically delete objects after 7 years, it does not prevent accidental deletion during the retention period, which is a key requirement.
- B. Correct.
S3 Object Lock in Compliance mode ensures that objects cannot be deleted or overwritten during the retention period, even by administrators, making it the best solution for meeting strict data retention requirements.
- C. Incorrect.
Cross-Region Replication improves availability and disaster recovery but does not enforce a 7-year retention policy or prevent accidental deletions.
- D. Incorrect.
S3 Server-Side Encryption (SSE) with AWS KMS enhances data security but does not address data retention or accidental deletion requirements.