DEA-C01 Data Security and Governance Practice Question

A company has an S3 bucket that stores logs for compliance. The compliance team requires that objects are retained for 7 years and cannot be deleted or overwritten. Which S3 feature should be used?

⚠ Common exam trap

DEA-C01 often tests the misconception that MFA Delete or bucket policies provide immutability — candidates confuse access control with WORM retention, but only Object Lock in COMPLIANCE mode guarantees non-deletable, non-overwritable objects.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable S3 Object Lock with retention mode COMPLIANCE and a retention period of 7 years

S3 Object Lock in COMPLIANCE mode enforces a WORM (Write Once Read Many) model where no user, including the root account, can delete or overwrite the object version until the retention period expires. Setting a 7-year retention period directly satisfies the compliance requirement that objects cannot be deleted or overwritten for 7 years. COMPLIANCE mode is the strictest retention mode and is specifically designed for regulatory retention scenarios.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Enable S3 Object Lock with retention mode COMPLIANCE and a retention period of 7 years
Why this is correct
S3 Object Lock in COMPLIANCE mode enforces a WORM retention period that no user, including the root account, can shorten or bypass, directly satisfying the requirement that objects cannot be deleted or overwritten for 7 years. GOVERNANCE mode would permit privileged users to alter retention, so it fails this constraint.
✗
Enable MFA Delete on the bucket
Why it's wrong here
MFA Delete only requires extra authentication to permanently delete versions or change versioning state; it enforces no retention period and permits overwrites. It is tempting because it guards against accidental deletion, but the seven-year immutability requirement needs S3 Object Lock in compliance mode, which blocks deletion and overwrite outright.
✗
Configure an S3 bucket policy that denies delete and overwrite actions
Why it's wrong here
A bucket policy denying delete and overwrite is removable by any principal holding s3:PutBucketPolicy, so it cannot guarantee immutability for seven years. It is tempting because policies can block actions, but compliance requires S3 Object Lock in compliance mode, which even the root account cannot bypass before expiry.
✗
Enable S3 Versioning and configure a lifecycle policy to expire objects after 7 years
Why it's wrong here
Versioning plus expiry keeps prior versions but allows deletion and overwrite, and the lifecycle rule removes objects at seven years rather than retaining them. It is tempting because versioning preserves history, yet the requirement is non-deletable, non-overwritable retention, which only S3 Object Lock in compliance mode enforces.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Security and Governance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question