DVA-C02 Development with AWS Services Practice Question
Network Topology
The above CLI output shows the versioning status of an S3 bucket. A developer wants to enable MFA Delete on the bucket. What should the developer do?
⚠ Common exam trap
Many exam-takers confuse MFA Delete with requiring MFA for access (via bucket policy) or assume Object Lock automatically enables MFA Delete, but MFA Delete is a distinct versioning setting that must be explicitly enabled using the `put-bucket-versioning` API with the `--mfa` parameter.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the aws s3api put-bucket-versioning command with the --mfa parameter.
The `aws s3api put-bucket-versioning` command with the `--mfa` parameter is the correct way to enable MFA Delete on an S3 bucket. The `--mfa` parameter supplies the MFA token (serial number + code) required for this high-security operation, as MFA Delete can only be toggled by the bucket owner using multi-factor authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the aws s3api put-bucket-acl command with MFA token.
Why it's wrong here
put-bucket-acl manages grants on the bucket, not versioning configuration, so it cannot enable MFA Delete. ACLs are the right mechanism for cross-account read or write grants, but MFA Delete must be set through put-bucket-versioning with --mfa specifying the device serial and code.
- ✓
Use the aws s3api put-bucket-versioning command with the --mfa parameter.
Why this is correct
Using `aws s3api put-bucket-versioning` with `--mfa` supplies the required authentication code alongside the versioning configuration, satisfying S3's rule that MFA Delete can only be enabled by the bucket owner via a signed request including both the MFA device serial and a valid code.
- ✗
Enable Object Lock on the bucket, which automatically enables MFA Delete.
Why it's wrong here
Object Lock provides WORM retention and governance, and does not enable MFA Delete; MFA Delete must be turned on by the bucket's root user via the AWS CLI with an MFA token. It is tempting because both features protect objects from deletion, so they appear interchangeable.
- ✗
Use the aws s3api put-bucket-policy command to require MFA.
Why it's wrong here
A bucket policy controls who may call S3 APIs; it cannot toggle MFA Delete, which is a versioning sub-state. Policies are the correct tool for enforcing TLS or denying unencrypted uploads, whereas MFA Delete requires put-bucket-versioning with the MFA header and serial number.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.