Question 600 of 1,040
Design Secure ArchitectureshardMultiple ChoiceObjective-mapped

Quick Answer

The answer is S3 Object Lock in Compliance mode with a 7-year retention period. This configuration is mandatory because Compliance mode prevents any user, including the AWS account root user, from deleting or overwriting objects or shortening the retention period before it expires, making it the only choice for immutable audit logs that must survive even administrative tampering. On the SAA-C03 exam, this scenario tests your understanding of the critical difference between Governance and Compliance modes: Governance mode allows users with the s3:BypassGovernanceRetention permission to override locks, while Compliance mode offers a true write-once-read-many (WORM) guarantee. The common trap is choosing Governance mode because it sounds sufficient, but remember that root access can bypass it. For audit logs requiring absolute immutability, Compliance mode is non-negotiable. Memory tip: think “Compliance = Complete lockdown, no one can override.”

SAA-C03 Practice Question: S3 Object Lock Compliance mode prevents deletion…

This SAA-C03 practice question tests your understanding of design secure architectures. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. A key principle to apply: s3 Object Lock Compliance mode prevents deletion by ALL users including root. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A financial services company must store audit logs in S3 for 7 years and ensure that no one — including the AWS account root user — can delete or overwrite the logs during the retention period. Which S3 Object Lock configuration should a solutions architect use?

Question 1hardmultiple choice
Full question →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Object Lock in Compliance mode with a 7-year retention period

S3 Object Lock in Compliance mode prevents ALL users — including the root account — from deleting or overwriting objects before the retention period expires. The retention period itself cannot be shortened once set in Compliance mode. Governance mode also prevents most deletions, but users with s3:BypassGovernanceRetention permission (and the root account) can delete objects or shorten the retention period. For regulatory requirements where not even root can override, Compliance mode is mandatory.

Key principle: S3 Object Lock Compliance mode prevents deletion by ALL users including root

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Object Lock in Compliance mode with a 7-year retention period

    Why this is correct

    Compliance mode prevents ALL users including root from deleting or overwriting objects before retention expires. The period cannot be shortened, satisfying strict financial regulatory requirements.

    Related concept

    S3 Object Lock Compliance mode prevents deletion by ALL users including root

  • Object Lock in Governance mode with a 7-year retention period

    Why it's wrong here

    Governance mode can be bypassed by the root account and users with s3:BypassGovernanceRetention. This fails the requirement that no one including root can delete the logs.

  • S3 Versioning with a lifecycle rule to transition objects to Glacier after 7 years

    Why it's wrong here

    Versioning keeps prior versions but a privileged user can permanently delete all versions. Lifecycle rules change storage class — they do not provide immutability.

  • A bucket policy with Deny for s3:DeleteObject applied to all principals including root

    Why it's wrong here

    Bucket policies (IAM resource policies) cannot restrict the root account. Root is exempt from IAM policies. Only Object Lock Compliance mode can prevent root from deleting S3 objects.

Common exam traps

Common exam trap: answer the scenario, not the keyword

Candidates choose Governance mode because 'governance' sounds strict. In AWS terminology, Governance is the LESS strict option — it can be bypassed by privileged users. Compliance mode is immutable: no one can remove the retention until the period expires. This distinction is critical for financial regulations like SEC Rule 17a-4 and FINRA requirements.

Detailed technical explanation

How to think about this question

S3 Object Lock mode comparison: - Compliance mode: Not even root can delete/overwrite before retention expires. Retention cannot be shortened. Required for strict regulatory WORM. - Governance mode: Users with s3:BypassGovernanceRetention permission and root can override. Retention can be shortened. Use when admin escape hatch is needed. - Legal Hold: Indefinite lock on individual objects, overrides retention date. Independent of mode. Important: Object Lock must be enabled at bucket creation time. It cannot be enabled retroactively. Versioning is required and is enabled automatically when Object Lock is enabled.

KKey Concepts to Remember

  • S3 Object Lock Compliance mode prevents deletion by ALL users including root
  • S3 Object Lock Governance mode can be overridden by users with s3:BypassGovernanceRetention and root
  • Object Lock must be enabled at bucket creation — cannot be added retroactively
  • Compliance mode is required for SEC Rule 17a-4, FINRA, and similar financial regulations
  • Legal Holds provide indefinite object-level protection independent of retention period

TExam Day Tips

  • Watch for words such as best, first, most likely and least administrative effort.
  • Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

S3 Object Lock Compliance mode prevents deletion by ALL users including root

Real-world example

How this comes up in practice

A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.

What to study next

Got this wrong? Here's your next step.

Review s3 Object Lock Compliance mode prevents deletion by ALL users including root, then practise related SAA-C03 questions on the same topic to reinforce the concept.

Related practice questions

Related SAA-C03 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Practice this exam

Start a free SAA-C03 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

FAQ

Questions learners often ask

What does this SAA-C03 question test?

Design Secure Architectures — This question tests Design Secure Architectures — S3 Object Lock Compliance mode prevents deletion by ALL users including root.

What is the correct answer to this question?

The correct answer is: Object Lock in Compliance mode with a 7-year retention period — S3 Object Lock in Compliance mode prevents ALL users — including the root account — from deleting or overwriting objects before the retention period expires. The retention period itself cannot be shortened once set in Compliance mode. Governance mode also prevents most deletions, but users with s3:BypassGovernanceRetention permission (and the root account) can delete objects or shorten the retention period. For regulatory requirements where not even root can override, Compliance mode is mandatory.

What should I do if I get this SAA-C03 question wrong?

Review s3 Object Lock Compliance mode prevents deletion by ALL users including root, then practise related SAA-C03 questions on the same topic to reinforce the concept.

What is the key concept behind this question?

S3 Object Lock Compliance mode prevents deletion by ALL users including root

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

5 more ways this is tested on SAA-C03

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A claims portal stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured?

medium
  • A.S3 server access logging
  • B.S3 versioning only
  • C.S3 Object Lock in compliance mode with an appropriate retention period
  • D.S3 lifecycle expiration after seven years

Why C: C is correct because S3 Object Lock in compliance mode enforces a write-once-read-many (WORM) model that prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This meets the compliance team's requirement that logs cannot be altered or removed for seven years, as compliance mode provides the highest level of protection and cannot be bypassed or shortened.

Variation 2. A healthcare document service stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured?

medium
  • A.S3 Object Lock in compliance mode with an appropriate retention period
  • B.S3 server access logging
  • C.S3 lifecycle expiration after seven years
  • D.S3 versioning only

Why A: S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This meets the compliance requirement of immutable audit logs for seven years, as compliance mode enforces a strict write-once-read-many (WORM) model that cannot be bypassed.

Variation 3. A IoT ingestion API stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured?

medium
  • A.S3 lifecycle expiration after seven years
  • B.S3 versioning only
  • C.S3 server access logging
  • D.S3 Object Lock in compliance mode with an appropriate retention period

Why D: Option D is correct because S3 Object Lock with compliance mode provides a write-once-read-many (WORM) model that prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This meets the compliance requirement of a seven-year immutable audit log, as compliance mode enforces a legal hold that cannot be removed by any entity, including AWS support.

Variation 4. A order processing API stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured?

medium
  • A.S3 server access logging
  • B.S3 lifecycle expiration after seven years
  • C.S3 versioning only
  • D.S3 Object Lock in compliance mode with an appropriate retention period

Why D: S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This meets the compliance requirement of immutable audit logs for seven years, as compliance mode enforces a legal hold that cannot be removed by any party.

Variation 5. A order processing API stores audit logs in S3. The compliance team requires that logs cannot be overwritten or deleted for seven years. What should be configured? The design must avoid adding custom operational scripts.

medium
  • A.S3 server access logging
  • B.S3 lifecycle expiration after seven years
  • C.S3 versioning only
  • D.S3 Object Lock in compliance mode with an appropriate retention period

Why D: S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This meets the compliance requirement of a seven-year immutable audit log without custom scripts. Compliance mode enforces a legal hold that cannot be removed by any user, ensuring logs remain intact.

Keep practising

More SAA-C03 practice questions

Last reviewed: May 17, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

Sign in to join the discussion.

This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.