SCS-C03 Data Protection Practice Question
A financial institution requires that all data stored in S3 buckets be immutable for five years to comply with regulatory requirements. They also need to ensure that even the root user cannot delete the data or shorten the retention period. Which configuration should the security engineer implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable S3 Object Lock on the bucket and set a Default Retention period of five years using Compliance mode.
S3 Object Lock in Compliance mode provides the strongest immutability guarantee by preventing any user, including the root user, from deleting objects or reducing the retention period. This is essential for meeting strict regulatory requirements like SEC Rule 17a-4. Using Compliance mode ensures that the protection remains absolute throughout the entire specified duration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable S3 Versioning and implement an S3 Lifecycle policy to transition objects to Glacier Deep Archive with a five-year expiration rule.
Why it's wrong here
Lifecycle policies and versioning can manage object versions and transitions, but they do not prevent a user with sufficient permissions from manually deleting those versions. This configuration fails the requirement to block the root user from deleting data, as lifecycle rules are not a substitute for data immutability controls.
- ✗
Enable S3 Object Lock on the bucket and set a Default Retention period of five years using Governance mode.
Why it's wrong here
Governance mode allows users with special permissions, such as the root user or those with the s3:BypassGovernanceRetention permission, to delete objects or change retention settings. This does not meet the requirement of preventing the root user from modifying the retention period or deleting the data during the period.
- ✓
Enable S3 Object Lock on the bucket and set a Default Retention period of five years using Compliance mode.
Why this is correct
Compliance mode ensures that an object cannot be deleted or its retention settings modified by any user, including the AWS account root user. This mode is specifically designed for environments where strict data integrity and non-rewriteable, non-erasable storage are required for a fixed period to satisfy legal mandates.
- ✗
Apply a Bucket Policy with a Deny effect on the s3:DeleteObject action for all principals, including a condition that checks the current date.
Why it's wrong here
Bucket policies can be modified or deleted by the root user or any user with IAM management permissions. Because the policy itself can be removed, it does not provide the same level of guaranteed immutability as S3 Object Lock in Compliance mode, which is enforced at the object level.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.