CLF-C02 Cloud Technology and Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  S3 Versioning

  Why it's wrong here

  Amazon S3 Versioning preserves every version of an object, so accidental overwrites or deletions can be recovered by restoring a previous version. However, a caller with s3:DeleteObject permission can still permanently remove a specific version, and even with MFA Delete enabled, a user who possesses the MFA token can delete versions. Versioning does not lock data or enforce a retention period, so it does not provide the write-once-read-many (WORM) guarantee required by compliance regulations; Object Lock is the feature that adds genuine immutability.

• ✗

  S3 Lifecycle policies

  Why it's wrong here

  S3 Lifecycle policies automate storage-class transitions and object expiration based on age or other rules, helping to optimize cost and manage data freshness. Yet these policies cannot prevent deletion—in fact, the expiration action permanently deletes objects after the configured number of days. Because WORM compliance requires data to remain intact and unalterable for a specified duration, lifecycle rules actively undermine that goal by enabling automated destructive actions.

• ✓

  S3 Object Lock

  Why this is correct

  S3 Object Lock delivers WORM protection by allowing you to set a retention period on objects, during which they cannot be overwritten or deleted. In Governance mode, a principal with s3:BypassGovernanceRetention can remove the lock, but in Compliance mode the object is immutable even for the root user until the retention expires. This mandatory retention directly satisfies regulatory requirements such as SEC 17a-4(f), making Object Lock the only option here that guarantees data cannot be tampered with.

• ✗

  S3 Block Public Access

  Why it's wrong here

  S3 Block Public Access is a bucket- and account-level control that blocks all public access to S3 objects, closing off unauthenticated reads and writes. It does not, however, restrict the actions that authenticated IAM users, roles, or the account root user can perform—so an authorized user with s3:DeleteObject can still delete data. Since WORM compliance requires protection against tampering by users who already have write/delete permissions, Block Public Access offers no defensive value for this use case.