DEA-C01 Data Security and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable MFA Delete on the bucket

  Why this is correct

  MFA Delete requires multi-factor authentication for permanently deleting object versions or changing bucket versioning state, so a compromised credential alone cannot purge the critical logs. This directly satisfies the requirement that versioned data must not be permanently deleted.

• ✗

  Enable versioning on the bucket

  Why it's wrong here

  The exhibit already shows versioning enabled, so this changes nothing; the stem's protection gap is that noncurrent versions remain deletable without a retention lock. Versioning alone is the right first step when a bucket is unversioned, but it cannot prevent a principal with delete permissions from removing versions.

• ✗

  Enable cross-region replication

  Why it's wrong here

  Cross-region replication copies objects to another bucket but does not stop deletion in the source, and replicated deletions propagate if configured to do so. Replication is the correct choice for regional durability or latency, not for preventing permanent deletion; an S3 Object Lock retention period is what blocks version removal.

• ✗

  Configure a lifecycle policy to expire noncurrent versions

  Why it's wrong here

  Expiring noncurrent versions actively deletes the previous copies, directly contradicting the requirement that logs never be permanently removed. Lifecycle expiry is intended for cost control on transient or superseded data; here the engineer needs S3 Object Lock in compliance mode to block version deletion entirely.