SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  S3 Versioning with MFA Delete

  Why it's wrong here

  While S3 Versioning keeps history and MFA Delete prevents accidental deletions, an authorized user with an MFA token could still delete the data. This does not provide the absolute 'no modification or deletion' guarantee required for regulatory compliance that persists even against administrative actions.

• ✗

  S3 Object Lock in Governance mode

  Why it's wrong here

  In Governance mode, users with special permissions (like the 's3:BypassGovernanceRetention' permission) can still delete or modify the objects. Since the requirement states that even the root user must be restricted, Governance mode is insufficient as it allows for administrative overrides during the retention period.

• ✓

  S3 Object Lock in Compliance mode

  Why this is correct

  Compliance mode ensures that an object version cannot be overwritten or deleted by any user, including the AWS account root user. The retention period is strictly enforced, and the mode cannot be changed or shortened, making it the correct choice for meeting high-bar regulatory standards.

• ✗

  S3 Lifecycle policy with an expiration of 7 years

  Why it's wrong here

  Lifecycle policies are used to automate the deletion or transition of objects after a certain timeframe. They do not prevent a user from manually deleting the object before the expiration date. Therefore, they cannot be used to guarantee that data will remain available for the full 7-year period.