DEA-C01 Data Security and Governance Practice Question

A company has a requirement to store audit logs for 7 years for compliance. The logs are stored in S3 and must be immutable. Which S3 feature should be used?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable S3 Object Lock in compliance mode

S3 Object Lock in compliance mode prevents objects from being deleted or overwritten for a specified retention period, ensuring immutability for compliance. Option A is wrong because a bucket policy denying s3:DeleteObject does not prevent overwrites or other actions that could modify the object. Option B is wrong because MFA Delete adds a protection layer but can be bypassed by the root user and does not prevent overwrites. Option C is wrong because versioning and lifecycle policies do not inherently prevent deletion or overwrite of all versions; they only manage object versions and transitions. Option D is correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use a bucket policy that denies s3:DeleteObject
Why it's wrong here
A bucket policy denying s3:DeleteObject can be edited or removed by any principal holding s3:PutBucketPolicy, so it is not immutable against privileged or compromised accounts. It is tempting because it blocks ordinary deletions, and would suffice where the threat is accidental deletion by standard users rather than compliance-grade retention.
✗
Enable MFA Delete on the bucket
Why it's wrong here
MFA Delete only requires additional authentication for version deletion; it does not prevent overwriting objects or removing the bucket policy, and it is unavailable on directory buckets. It is tempting because it genuinely hardens deletion, and would be correct if the requirement were simply extra protection against accidental version removal.
✗
Enable S3 Versioning and set a lifecycle policy
Why it's wrong here
Versioning plus a lifecycle policy retains prior versions but permits deletion of current objects and version expiry, so records are not immutable for the full seven years. It is tempting because lifecycle rules genuinely manage long-term retention cost-effectively, and would be correct for tiering logs to Glacier rather than enforcing write-once storage.
✓
Enable S3 Object Lock in compliance mode
Why this is correct
S3 Object Lock in compliance mode enforces a write-once-read-many (WORM) retention period that no user, including the root account, can shorten or bypass. This directly satisfies the seven-year immutability requirement, unlike governance mode, which privileged users can override.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Security and Governance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question