DEA-C01 Data Security and Governance Practice Question
A data engineer needs to ensure that data stored in Amazon S3 is protected against accidental deletion and that the data cannot be altered for a period of 7 years to meet compliance requirements. The engineer must also ensure that the data remains encrypted at rest using SSE-KMS. Which two actions should the engineer take? (Choose two.)
⚠ Common exam trap
The trap here is thinking that a bucket policy denying delete operations or versioning alone can provide the same immutability as S3 Object Lock in compliance mode, which is specifically designed for regulatory retention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable S3 Object Lock in compliance mode on the bucket and set a retention period of 7 years for all objects.
To protect data from deletion and alteration for 7 years, S3 Object Lock in compliance mode must be enabled on the bucket with a retention period of 7 years. This ensures objects are immutable. Additionally, default encryption with SSE-KMS ensures data is encrypted at rest. Other options like versioning, lifecycle rules, bucket policies, or AWS Backup do not provide the required immutability for the primary data in S3.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable S3 Object Lock in compliance mode on the bucket and set a retention period of 7 years for all objects.
Why this is correct
S3 Object Lock in compliance mode prevents objects from being overwritten or deleted for the specified retention period, even by the root user. This meets the requirement that data cannot be altered for 7 years. It also provides immutability, which is essential for compliance. Enabling Object Lock requires versioning to be enabled on the bucket.
- ✗
Use AWS Backup to create a vault lock with a 7-year retention policy and schedule daily backups of the S3 bucket.
Why it's wrong here
AWS Backup with vault lock can provide immutable backups, but it does not prevent deletion or alteration of the original S3 objects. The requirement is to protect the data in S3 itself from being altered or deleted. While backups are valuable, they do not enforce immutability on the primary data, so this does not fully satisfy the compliance need.
- ✓
Configure default encryption on the bucket to use SSE-KMS with a customer managed key.
Why this is correct
Default encryption with SSE-KMS ensures that all objects are encrypted at rest using the specified KMS key. This satisfies the encryption requirement. While default encryption does not prevent deletion or alteration, it is a necessary action to meet the encryption part of the compliance requirement. It complements Object Lock for immutability.
- ✗
Enable versioning on the bucket and configure a lifecycle rule to transition objects to S3 Glacier Deep Archive after 30 days.
Why it's wrong here
Versioning and lifecycle transitions to Glacier Deep Archive help with data retention and cost optimization, but they do not prevent deletion or alteration. A user with sufficient permissions could still delete object versions or overwrite objects. Lifecycle rules do not enforce immutability, so this does not meet the compliance requirement for unalterable data.
- ✗
Create an S3 bucket policy that denies s3:DeleteObject and s3:PutObject for all principals except a specific IAM role.
Why it's wrong here
A bucket policy can restrict deletion and overwrite actions, but it does not provide the same level of immutability as Object Lock. A privileged user could still modify the policy or use root credentials to bypass it. For strict compliance requiring that data cannot be altered for 7 years, Object Lock in compliance mode is the appropriate control.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.