Two Actions to Prevent Accidental S3 Bucket Deletion: MFA Delete and Deny DeleteBucket
Which TWO actions can help protect against accidental deletion of an Amazon S3 bucket? (Select TWO.)
Quick Answer
The answer is to enable MFA Delete and add a bucket policy that explicitly denies the s3:DeleteBucket action. MFA Delete requires a second authentication factor before any object version can be permanently deleted or the bucket itself can be removed, adding a critical layer of protection against accidental or unauthorized deletion. Meanwhile, a bucket policy that denies the s3:DeleteBucket action acts as a direct permission guard, ensuring that even if an IAM user or role has broad rights, the bucket cannot be deleted unless that specific deny statement is removed. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this question tests your understanding of preventive controls versus detective or lifecycle-based features; a common trap is confusing versioning or CloudTrail with deletion prevention, but versioning only protects objects, not the bucket itself. Remember the memory tip: “MFA for objects, Deny for the bucket itself” to quickly recall which tool applies to which risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable MFA Delete on the bucket.
Options C (MFA Delete) and E (bucket policy denying s3:DeleteBucket) are correct. MFA Delete adds an extra layer of protection by requiring multi-factor authentication to permanently delete object versions and change the versioning state, which helps prevent accidental deletions. A bucket policy that explicitly denies the s3:DeleteBucket action directly prevents accidental bucket deletion. Option A is incorrect because versioning alone does not prevent bucket deletion; it protects object versions. Option B is incorrect because CloudTrail provides auditing of delete events but does not prevent them. Option D is incorrect because a lifecycle policy automatically deletes objects, increasing the risk of accidental deletion rather than protecting against it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable versioning on the bucket.
Why it's wrong here
Versioning protects objects, not bucket deletion.
- ✗
Enable AWS CloudTrail to log delete events.
Why it's wrong here
Logging does not prevent deletion.
- ✓
Enable MFA Delete on the bucket.
Why this is correct
Requires MFA to delete objects.
- ✗
Configure a lifecycle policy to expire objects.
Why it's wrong here
Lifecycle removes objects, not protect.
- ✓
Add a bucket policy that explicitly denies the s3:DeleteBucket action.
Why this is correct
Prevents bucket deletion.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to ensure its data in Amazon S3 is protected against accidental deletion. The bucket stores critical documents. Which approach provides the HIGHEST level of resilience?
easy- A.Apply a bucket policy that denies s3:DeleteObject for all users.
- B.Enable S3 lifecycle policies to archive objects to Glacier.
- ✓ C.Enable versioning and MFA delete on the bucket.
- D.Configure cross-region replication (CRR) to another bucket.
Why C: Enabling versioning and MFA delete provides protection against both accidental overwrites and malicious deletions. Versioning allows recovery of deleted or overwritten objects, while MFA delete adds an extra layer of security by requiring multi-factor authentication for permanent deletions. Option A is incorrect because a bucket policy that denies s3:DeleteObject can prevent deletions but does not allow recovery if the policy is bypassed or changed. Option B is incorrect because lifecycle policies archive objects to Glacier, which reduces costs but does not prevent or recover from accidental deletion. Option D is incorrect because cross-region replication protects against regional failures but does not protect against accidental deletion within the source bucket.
Variation 2. A company wants to ensure that its Amazon S3 bucket is resilient to accidental deletion of objects. Which TWO actions should be taken?
easy- ✓ A.Enable MFA Delete on the bucket.
- B.Enable S3 Object Lock.
- ✓ C.Enable S3 Versioning.
- D.Enable S3 Transfer Acceleration.
- E.Configure a lifecycle policy to expire objects after 30 days.
Why A: Enabling MFA Delete on an S3 bucket requires multi-factor authentication for any delete operations, including object version deletion and bucket deletion. This adds a critical layer of protection against accidental or unauthorized deletions, as the user must present both their AWS credentials and a valid MFA code to perform these destructive actions.
Variation 3. A company wants to protect its S3 bucket data from accidental deletion or overwrite. Which feature should be enabled?
easy- A.Enable cross-region replication
- B.Apply a bucket policy that denies DeleteObject
- ✓ C.Enable S3 Versioning
- D.Enable MFA Delete
Why C: S3 Versioning is the primary feature that protects against accidental deletion and overwrite by preserving all versions of objects. When versioning is enabled, deleted objects are replaced with a delete marker and previous versions can be restored. MFA Delete (option D) is an additional security feature that requires multi-factor authentication for versioning operations, but versioning itself is the foundational protection. Option A (cross-region replication) is used for geographic redundancy and compliance, not for protecting against accidental deletions. Option B (bucket policy denying DeleteObject) would prevent deletions but does not protect against overwrites (PutObject) and can be overly restrictive; also, it may not allow legitimate deletions if not carefully scoped. Therefore, enabling S3 Versioning is the correct and most straightforward solution.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.