CLF-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  S3 Block Public Access

  Why it's wrong here

  S3 Block Public Access provides a set of bucket and account-level controls that prevent objects from being made publicly readable or writable, regardless of individual bucket policies or object ACLs. Its purpose is to eliminate accidental public exposure, not to guard against destructive operations by authorized users. Because it does not intercept or gate DeleteObject or DeleteObjectVersion requests, it cannot prevent an authenticated principal with DeleteVersion permission from permanently removing a version.

• ✗

  S3 Object Lock

  Why it's wrong here

  S3 Object Lock implements a Write-Once-Read-Many (WORM) model by applying a retention date and mode (either Governance or Compliance) to object versions, so they cannot be deleted until the retention period expires unless you have special permissions. This protects against deletion through legal holds or compliance policies, but it operates on a time-based retention schedule, not on an immediate MFA challenge for each delete operation. For the requirement of requiring an MFA code for permanent version deletion, Object Lock does not provide that and would be the wrong choice.

• ✓

  S3 MFA Delete

  Why this is correct

  S3 MFA Delete is a versioning feature that requires a multi-factor authentication code to permanently delete an object version or to suspend versioning on a bucket. Because the bucket has versioning enabled and the customer wants protection against accidental permanent deletions, MFA Delete directly addresses that risk by ensuring that even a root or admin user cannot irreversibly remove data without a second factor. This makes it the correct choice for guarding specific object versions from permanent loss.

• ✗

  S3 Access Points

  Why it's wrong here

  S3 Access Points are named network endpoints that allow you to customize the permissions and network controls for shared datasets without changing the underlying bucket policy. While they help manage access from separate applications or VPCs, they operate at the data-plane access-control layer and do not interact with versioning operations. An Access Point simply cannot require an MFA code when an authorized user calls DeleteObject, so it would not protect a versioned object from permanent deletion.

Go deeper

Related to this question