DEA-C01 Data Store Management Practice Question

A data engineer is configuring an Amazon S3 bucket that will receive raw clickstream files from a mobile application. The engineer must ensure that the objects are protected against accidental overwrites and deletions for a defined retention period, and that the protection cannot be removed or shortened by any user, including the account root user. Which S3 feature should the engineer use?

⚠ Common exam trap

The trap here is assuming that a deny-based bucket policy or versioning provides the same guarantee as Object Lock, when both can be changed or bypassed by privileged identities.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

S3 Object Lock in compliance mode with a retention period matching the required window.

S3 Object Lock provides write-once-read-many protection by binding a retention period to object versions. In compliance mode, no principal, including the account root user, can shorten or remove that retention, which is the only option that satisfies an absolute immutability requirement. Governance mode, by contrast, allows privileged users to bypass retention.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
S3 Object Lock in compliance mode with a retention period matching the required window.
Why this is correct
S3 Object Lock in compliance mode prevents any user, including the account root user, from overwriting or deleting a protected object version until the retention date passes, and the retention cannot be shortened. That exactly matches the requirement for enforceable, tamper-proof retention on the incoming clickstream objects.
✗
S3 Versioning with a lifecycle rule that transitions objects to S3 Standard-IA after 30 days.
Why it's wrong here
Versioning preserves prior object versions so an overwrite or delete can be undone, but any principal with sufficient permissions can permanently delete versions or suspend versioning. A lifecycle transition only changes the storage class and does not enforce an immutable retention window, so it cannot guarantee the required protection.
✗
A bucket policy that denies s3:DeleteObject and s3:PutObject to all principals except the ingestion role.
Why it's wrong here
A bucket policy can restrict most principals, but the account root user retains the ability to modify or remove that policy, so the protection is not absolute. It also does not create a time-based retention window, meaning an authorized role could still delete objects early, which fails the immutability requirement.
✗
S3 default encryption with AWS KMS customer managed keys and a restrictive key policy.
Why it's wrong here
Encryption protects the confidentiality of object contents at rest but says nothing about preventing overwrites or deletions. A key policy governs who can use the key, not who can delete the object, so an authorized delete would still succeed and the retention requirement would remain unmet.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Store Management Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question