SCS-C02 Question 399
Select 2An organization is using AWS to host its applications and wants to ensure that its S3 buckets are protected against accidental or malicious deletion. The security team has mandated that all S3 buckets must have versioning enabled and that MFA should be required to delete objects. Which combination of configurations will meet this requirement?
- A
Enable versioning on the S3 bucket.
- B
Enable S3 Object Lock in Governance mode.
- C
Set up an S3 bucket policy requiring MFA for delete operations.
- D
Enable S3 Access Logs to monitor delete requests.
- E
Use AWS Config to monitor and alert for buckets without versioning enabled.
Show answer and explanation
Correct answers: A, C
Explanation
To protect S3 buckets from accidental or malicious deletions, enabling versioning ensures that previous versions of objects are not immediately deleted, while requiring MFA for delete operations adds an additional layer of security. Together, these configurations meet the security team's requirements.
- A. Correct.
Correct. Enabling versioning ensures that previous versions of objects are retained, protecting against accidental or malicious deletions.
- B. Incorrect.
Incorrect. While enabling S3 Object Lock in Governance mode can provide additional protection, it is not required to meet the specific requirement of using MFA for delete operations.
- C. Correct.
Correct. Setting up a bucket policy requiring MFA for delete operations ensures that object deletions are protected by an additional layer of security.
- D. Incorrect.
Incorrect. While enabling S3 Access Logs helps monitor bucket activity, it does not directly enforce the requirement for versioning or MFA for delete.
- E. Incorrect.
Incorrect. AWS Config can monitor the state of S3 buckets, but it does not enforce versioning or MFA for delete operations. It is used for compliance monitoring and alerting.